www/waterfox: apply more FF57 fixes

23 files changed, 2202 insertions, 1 deletions

diff --git a/www/waterfox/Makefile b/www/waterfox/Makefile
index fee9271eaca6..1bcd898d0a24 100644
--- a/www/waterfox/Makefile
+++ b/www/waterfox/Makefile
@@ -2,7 +2,7 @@
 
 PORTNAME=	waterfox
 DISTVERSION=	56.0.4
-PORTREVISION=	2
+PORTREVISION=	3
 CATEGORIES=	www ipv6
 
 MAINTAINER=	jbeich@FreeBSD.org
diff --git a/www/waterfox/files/patch-bug1338764 b/www/waterfox/files/patch-bug1338764
new file mode 100644
index 000000000000..fcedb824ff69
--- /dev/null
+++ b/www/waterfox/files/patch-bug1338764
@@ -0,0 +1,120 @@
+commit 0e98738d78b9
+Author: Xidorn Quan <me@upsuper.org>
+Date:   Mon Jul 17 15:10:50 2017 +1000
+
+    Bug 1338764 part 1 - Use const rather than enum for context flags of nsStyleSVG. r=manishearth
+    
+    MozReview-Commit-ID: KzORnfVXgLJ
+    
+    --HG--
+    extra : rebase_source : 365842d6e6fda4b35a5932272773a3d88bfc04c6
+---
+ layout/style/nsStyleStruct.h | 22 +++++++++++++---------
+ 1 file changed, 13 insertions(+), 9 deletions(-)
+
+diff --git layout/style/nsStyleStruct.h layout/style/nsStyleStruct.h
+index 59833e37f3bb..eccc02380f7e 100644
+--- layout/style/nsStyleStruct.h
++++ layout/style/nsStyleStruct.h
+@@ -3603,15 +3603,19 @@ private:
+   // Flags to represent the use of context-fill and context-stroke
+   // for fill-opacity or stroke-opacity, and context-value for stroke-dasharray,
+   // stroke-dashoffset and stroke-width.
+-  enum {
+-    FILL_OPACITY_SOURCE_MASK   = 0x03,  // fill-opacity: context-{fill,stroke}
+-    STROKE_OPACITY_SOURCE_MASK = 0x0C,  // stroke-opacity: context-{fill,stroke}
+-    STROKE_DASHARRAY_CONTEXT   = 0x10,  // stroke-dasharray: context-value
+-    STROKE_DASHOFFSET_CONTEXT  = 0x20,  // stroke-dashoffset: context-value
+-    STROKE_WIDTH_CONTEXT       = 0x40,  // stroke-width: context-value
+-    FILL_OPACITY_SOURCE_SHIFT   = 0,
+-    STROKE_OPACITY_SOURCE_SHIFT = 2,
+-  };
++
++  // fill-opacity: context-{fill,stroke}
++  static const uint8_t FILL_OPACITY_SOURCE_MASK   = 0x03;
++  // stroke-opacity: context-{fill,stroke}
++  static const uint8_t STROKE_OPACITY_SOURCE_MASK = 0x0C;
++  // stroke-dasharray: context-value
++  static const uint8_t STROKE_DASHARRAY_CONTEXT   = 0x10;
++  // stroke-dashoffset: context-value
++  static const uint8_t STROKE_DASHOFFSET_CONTEXT  = 0x20;
++  // stroke-width: context-value
++  static const uint8_t STROKE_WIDTH_CONTEXT       = 0x40;
++  static const uint8_t FILL_OPACITY_SOURCE_SHIFT   = 0;
++  static const uint8_t STROKE_OPACITY_SOURCE_SHIFT = 2;
+ 
+   uint8_t          mContextFlags;     // [inherited]
+ };
+
+commit 63d6f06939ee
+Author: Xidorn Quan <me@upsuper.org>
+Date:   Tue Aug 1 16:05:04 2017 +1000
+
+    Bug 1338764 part 2 - Add context-{fill,stroke}-opacity support to {fill,stroke}-opacity. r=manishearth
+    
+    MozReview-Commit-ID: HzUHmZb8ICl
+    
+    --HG--
+    extra : rebase_source : b8746c4d9d4cfc3abe6645f583dc08d0f7c75341
+---
+ layout/style/ServoBindings.toml | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git layout/style/ServoBindings.toml layout/style/ServoBindings.toml
+index 5e09c24eb0e3..6d8e979fdc1f 100644
+--- layout/style/ServoBindings.toml
++++ layout/style/ServoBindings.toml
+@@ -232,6 +232,7 @@ whitelist-types = [
+     "nsStylePadding",
+     "nsStylePosition",
+     "nsStyleSVG",
++    "nsStyleSVGOpacitySource",
+     "nsStyleSVGPaint",
+     "nsStyleSVGReset",
+     "nsStyleTable",
+@@ -458,6 +459,7 @@ structs-types = [
+     "nsStylePosition",
+     "nsStyleQuoteValues",
+     "nsStyleSVG",
++    "nsStyleSVGOpacitySource",
+     "nsStyleSVGPaint",
+     "nsStyleSVGReset",
+     "nsStyleTable",
+
+commit 03e036aff26d
+Author: Xidorn Quan <me@upsuper.org>
+Date:   Tue Aug 1 16:38:27 2017 +1000
+
+    Bug 1338764 part 3 - Update test expectations. r=manishearth
+    
+    MozReview-Commit-ID: HzN5WP210G7
+    
+    --HG--
+    extra : rebase_source : c3585958cb5159a242515a80f226e43f506319d8
+---
+ layout/style/test/stylo-failures.md | 8 --------
+ 1 file changed, 8 deletions(-)
+
+diff --git layout/style/test/stylo-failures.md layout/style/test/stylo-failures.md
+index 0509269b1334..d69fa898d9be 100644
+--- layout/style/test/stylo-failures.md
++++ layout/style/test/stylo-failures.md
+@@ -34,10 +34,6 @@ to mochitest command.
+ * Animation support:
+   * SMIL Animation
+     * test_restyles_in_smil_animation.html [2]
+-* Unsupported values
+-  * SVG-in-OpenType values not supported servo/servo#15211 bug 1338764
+-    * test_value_storage.html `context-` [7]
+-    * test_bug798843_pref.html [3]
+ * Incorrect serialization
+   * place-{content,items,self} shorthands bug 1363971
+     * test_align_shorthand_serialization.html [6]
+@@ -58,7 +54,3 @@ to mochitest command.
+ ## Unknown / Unsure
+ 
+ ## Ignore
+-
+-* Ignore for now since should be mostly identical to test_value_storage.html
+-  * test_value_cloning.html [*]
+-  * test_value_computation.html [*]
diff --git a/www/waterfox/files/patch-bug1352453 b/www/waterfox/files/patch-bug1352453
new file mode 100644
index 000000000000..87630d5510d2
--- /dev/null
+++ b/www/waterfox/files/patch-bug1352453
@@ -0,0 +1,27 @@
+commit 96ac0874dc2e
+Author: Ethan Lin <ethlin@mozilla.com>
+Date:   Sat Sep 23 15:06:07 2017 +0800
+
+    Bug 1352453 - Check image dimension when computing border space size. r=heycam, a=sledru
+    
+    MozReview-Commit-ID: LQcf9UGyUUq
+    
+    --HG--
+    extra : source : 6974ff079df11b3e7dc46e2df754149321e3f3aa
+---
+ layout/painting/nsCSSRendering.cpp | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git layout/painting/nsCSSRendering.cpp layout/painting/nsCSSRendering.cpp
+index 89760f33229b..55051c9ac376 100644
+--- layout/painting/nsCSSRendering.cpp
++++ layout/painting/nsCSSRendering.cpp
+@@ -3068,7 +3068,7 @@ nsCSSRendering::ComputeBorderSpacedRepeatSize(nscoord aImageDimension,
+                                               nscoord aAvailableSpace,
+                                               nscoord& aSpace)
+ {
+-  int32_t count = aAvailableSpace / aImageDimension;
++  int32_t count = aImageDimension ? (aAvailableSpace / aImageDimension) : 0;
+   aSpace = (aAvailableSpace - aImageDimension * count) / (count + 1);
+   return aSpace + aImageDimension;
+ }
diff --git a/www/waterfox/files/patch-bug1360603 b/www/waterfox/files/patch-bug1360603
new file mode 100644
index 000000000000..b7e5e247a43a
--- /dev/null
+++ b/www/waterfox/files/patch-bug1360603
@@ -0,0 +1,101 @@
+commit b5d0a61cd5df
+Author: Amy Chung <amchung@mozilla.com>
+Date:   Sun Sep 24 00:38:32 2017 +0800
+
+    Bug 1360603 - Mark the save channel as throttleable. r=baku, a=sledru
+    
+    --HG--
+    extra : source : d409c2ac7d88b7193e8369aa3359a9368e1135b3
+---
+ dom/webbrowserpersist/nsWebBrowserPersist.cpp | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git dom/webbrowserpersist/nsWebBrowserPersist.cpp dom/webbrowserpersist/nsWebBrowserPersist.cpp
+index a9b37ed281ca..a5971216d8b4 100644
+--- dom/webbrowserpersist/nsWebBrowserPersist.cpp
++++ dom/webbrowserpersist/nsWebBrowserPersist.cpp
+@@ -13,6 +13,7 @@
+ #include "nsAutoPtr.h"
+ #include "nsNetCID.h"
+ #include "nsNetUtil.h"
++#include "nsIClassOfService.h"
+ #include "nsIInterfaceRequestorUtils.h"
+ #include "nsILoadContext.h"
+ #include "nsIPrivateBrowsingChannel.h"
+@@ -1497,6 +1498,12 @@ nsresult nsWebBrowserPersist::SaveChannelInternal(
+         return StartUpload(bufferedInputStream, aFile, contentType);
+     }
+ 
++    // Mark save channel as throttleable.
++    nsCOMPtr<nsIClassOfService> cos(do_QueryInterface(aChannel));
++    if (cos) {
++      cos->AddClassFlags(nsIClassOfService::Throttleable);
++    }
++
+     // Read from the input channel
+     nsresult rv = NS_MaybeOpenChannelUsingAsyncOpen2(aChannel, this);
+     if (rv == NS_ERROR_NO_CONTENT)
+commit 1e11071bc4f9
+Author: Amy Chung <amchung@mozilla.com>
+Date:   Sun Sep 24 00:56:04 2017 +0800
+
+    Bug 1360603 - Confirm the Throttleable flag on browser_saveImageURL.js. r=baku, a=sledru
+    
+    --HG--
+    extra : source : 6d7610f4d26d76878b83b1f2489a96116c2bdf15
+---
+ toolkit/content/contentAreaUtils.js                   |  4 ++++
+ toolkit/content/tests/browser/browser_saveImageURL.js | 18 ++++++++++++++++++
+ 2 files changed, 22 insertions(+)
+
+diff --git toolkit/content/contentAreaUtils.js toolkit/content/contentAreaUtils.js
+index fba70c91c8a3..1492b4c1654c 100644
+--- toolkit/content/contentAreaUtils.js
++++ toolkit/content/contentAreaUtils.js
+@@ -1264,6 +1264,10 @@ function openURL(aURL) {
+       loadUsingSystemPrincipal: true
+     });
+ 
++    if (channel) {
++      channel.channelIsForDownload = true;
++    }
++
+     var uriLoader = Components.classes["@mozilla.org/uriloader;1"]
+                               .getService(Components.interfaces.nsIURILoader);
+     uriLoader.openURI(channel,
+diff --git toolkit/content/tests/browser/browser_saveImageURL.js toolkit/content/tests/browser/browser_saveImageURL.js
+index fe10482f35dc..0d9c872921c2 100644
+--- toolkit/content/tests/browser/browser_saveImageURL.js
++++ toolkit/content/tests/browser/browser_saveImageURL.js
+@@ -37,6 +37,15 @@ add_task(async function preferred_API() {
+     });
+ 
+     saveImageURL(url, "image.jpg", null, true, false, null, null, null, null, false);
++    let channel = content.document.docShell.currentDocumentChannel;
++    if (channel) {
++      ok(true, channel.QueryInterface(Ci.nsIHttpChannelInternal)
++                      .channelIsForDownload);
++
++      // Throttleable is the only class flag assigned to downloads.
++      ok(channel.QueryInterface(Ci.nsIClassOfService).classFlags,
++         Ci.nsIClassOfService.Throttleable);
++    }
+     await waitForFilePicker();
+   });
+ });
+@@ -64,6 +73,15 @@ add_task(async function deprecated_API() {
+     // pass the XUL document instead to test this interface.
+     let doc = document;
+ 
++    let channel = content.document.docShell.currentDocumentChannel;
++    if (channel) {
++      ok(true, channel.QueryInterface(Ci.nsIHttpChannelInternal)
++                      .channelIsForDownload);
++
++      // Throttleable is the only class flag assigned to downloads.
++      ok(channel.QueryInterface(Ci.nsIClassOfService).classFlags,
++         Ci.nsIClassOfService.Throttleable);
++    }
+     saveImageURL(url, "image.jpg", null, true, false, null, doc, null, null);
+     await waitForFilePicker();
+   });
diff --git a/www/waterfox/files/patch-bug1370508 b/www/waterfox/files/patch-bug1370508
new file mode 100644
index 000000000000..3f5ffc992a6c
--- /dev/null
+++ b/www/waterfox/files/patch-bug1370508
@@ -0,0 +1,79 @@
+commit c40f44ef9b35
+Author: Xidorn Quan <me@upsuper.org>
+Date:   Wed Aug 9 19:57:33 2017 +1000
+
+    Bug 1370508 - Enable stylo on generic XML documents. r=heycam
+    
+    MozReview-Commit-ID: 4XQ9RPQ7oa1
+    
+    --HG--
+    extra : rebase_source : 74e411e2280e818fc1fbd2efda677565cfa2f8b6
+---
+ dom/base/nsDocument.cpp                                           | 3 +--
+ layout/reftests/w3c-css/failures.list                             | 4 ++++
+ layout/reftests/w3c-css/received/reftest.list                     | 2 +-
+ layout/xul/crashtests/crashtests.list                             | 2 +-
+ testing/web-platform/meta/css/css-namespaces-3/syntax-013.xml.ini | 4 ++++
+ 5 files changed, 11 insertions(+), 4 deletions(-)
+
+diff --git dom/base/nsDocument.cpp dom/base/nsDocument.cpp
+index 2a01e6ec3a67..66a860ff3257 100644
+--- dom/base/nsDocument.cpp
++++ dom/base/nsDocument.cpp
+@@ -13293,8 +13293,7 @@ nsIDocument::UpdateStyleBackendType()
+       mStyleBackendType = StyleBackendType::Servo;
+     } else if (!mDocumentContainer) {
+       NS_WARNING("stylo: No docshell yet, assuming Gecko style system");
+-    } else if ((IsHTMLOrXHTML() || IsSVGDocument()) &&
+-               IsContentDocument()) {
++    } else if (!IsXULDocument() && IsContentDocument()) {
+       // Disable stylo for about: pages other than about:blank, since
+       // they tend to use unsupported selectors like XUL tree pseudos.
+       bool isAbout = false;
+diff --git layout/reftests/w3c-css/failures.list layout/reftests/w3c-css/failures.list
+index 966f69ff9ae0..1560f4ad673d 100644
+--- layout/reftests/w3c-css/failures.list
++++ layout/reftests/w3c-css/failures.list
+@@ -314,3 +314,7 @@ fuzzy(255,2808) css-multicol-1/multicol-rule-large-001.xht
+ fails-if(!styloVsGecko) css-multicol-1/multicol-fill-auto-block-children-001.xht
+ fails-if(!styloVsGecko) css-multicol-1/multicol-fill-auto-block-children-002.xht
+ fails-if(!styloVsGecko) css-multicol-1/multicol-span-all-block-sibling-003.xht
++
++#### CSS Namespaces 3 ##############################################
++
++fails-if(stylo||styloVsGecko) css-namespaces-3/syntax-013.xml
+diff --git layout/reftests/w3c-css/received/reftest.list layout/reftests/w3c-css/received/reftest.list
+index eb6151266acd..128d1fcf8121 100644
+--- layout/reftests/w3c-css/received/reftest.list
++++ layout/reftests/w3c-css/received/reftest.list
+@@ -205,7 +205,7 @@ fails-if(!styloVsGecko) == css-multicol-1/multicol-zero-height-001.xht css-multi
+ == css-namespaces-3/syntax-010.xml css-namespaces-3/reftest/ref-lime-3.xml
+ == css-namespaces-3/syntax-011.xml css-namespaces-3/reftest/ref-lime-6.xml
+ == css-namespaces-3/syntax-012.xml css-namespaces-3/reftest/ref-lime-3.xml
+-== css-namespaces-3/syntax-013.xml css-namespaces-3/reftest/ref-lime-5.xml
++fails-if(stylo||styloVsGecko) == css-namespaces-3/syntax-013.xml css-namespaces-3/reftest/ref-lime-5.xml # bug 1388911
+ == css-namespaces-3/syntax-014.xml css-namespaces-3/reftest/ref-lime-3.xml
+ == css-namespaces-3/syntax-015.xml css-namespaces-3/reftest/ref-lime-1.xml
+ fails-if(!styloVsGecko) == css-values-3/attr-color-invalid-cast.html css-values-3/reference/200-200-green.html
+diff --git layout/xul/crashtests/crashtests.list layout/xul/crashtests/crashtests.list
+index c1445cb5ec7a..e60af3526383 100644
+--- layout/xul/crashtests/crashtests.list
++++ layout/xul/crashtests/crashtests.list
+@@ -1,6 +1,6 @@
+ load 131008-1.xul
+ load 137216-1.xul
+-load 140218-1.xml
++asserts-if(stylo,3) load 140218-1.xml
+ load 151826-1.xul
+ load 168724-1.xul
+ load 189814-1.xul
+diff --git testing/web-platform/meta/css/css-namespaces-3/syntax-013.xml.ini testing/web-platform/meta/css/css-namespaces-3/syntax-013.xml.ini
+new file mode 100644
+index 000000000000..b034ccf978f5
+--- /dev/null
++++ testing/web-platform/meta/css/css-namespaces-3/syntax-013.xml.ini
+@@ -0,0 +1,4 @@
++[syntax-013.xml]
++  type: reftest
++  expected:
++    if stylo: FAIL
diff --git a/www/waterfox/files/patch-bug1377158 b/www/waterfox/files/patch-bug1377158
new file mode 100644
index 000000000000..dc4385635715
--- /dev/null
+++ b/www/waterfox/files/patch-bug1377158
@@ -0,0 +1,285 @@
+commit 9e809e01c262
+Author: Xidorn Quan <me@upsuper.org>
+Date:   Thu Aug 3 11:24:55 2017 +1000
+
+    Bug 1377158 - (Part 1) Set style backend to stylo when SVG is used as an image. r=heycam
+    
+    MozReview-Commit-ID: 9FnA8X84h87
+    
+    --HG--
+    extra : rebase_source : 49a6140c4c78c35f755710934c798ce46dafa213
+---
+ dom/base/nsDocument.cpp | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git dom/base/nsDocument.cpp dom/base/nsDocument.cpp
+index 3585a7e222df..b4773160af92 100644
+--- dom/base/nsDocument.cpp
++++ dom/base/nsDocument.cpp
+@@ -13219,7 +13219,10 @@ nsIDocument::UpdateStyleBackendType()
+ 
+ #ifdef MOZ_STYLO
+   if (nsLayoutUtils::StyloEnabled()) {
+-    if (!mDocumentContainer) {
++    if (IsBeingUsedAsImage()) {
++      // Enable stylo for SVG-as-image.
++      mStyleBackendType = StyleBackendType::Servo;
++    } else if (!mDocumentContainer) {
+       NS_WARNING("stylo: No docshell yet, assuming Gecko style system");
+     } else if ((IsHTMLOrXHTML() || IsSVGDocument()) &&
+                IsContentDocument()) {
+
+commit e418f1ccf520
+Author: KuoE0 <kuoe0.tw@gmail.com>
+Date:   Mon Jul 24 11:51:20 2017 +0800
+
+    Bug 1377158 - (Part 2) Add the info of StyloEnabled() to hash function to make reftests of styloVsGecko get the correct caches. r=heycam
+    
+    MozReview-Commit-ID: 7cyXheHQ7Ot
+    
+    --HG--
+    extra : rebase_source : 4a92de63228cb2a138d95d8f366b39122dbdc05e
+---
+ image/ImageCacheKey.cpp | 20 ++++++++++++++++----
+ image/ImageCacheKey.h   |  7 ++++++-
+ 2 files changed, 22 insertions(+), 5 deletions(-)
+
+diff --git image/ImageCacheKey.cpp image/ImageCacheKey.cpp
+index c3327155c1cd..2dfdc7c763cc 100644
+--- image/ImageCacheKey.cpp
++++ image/ImageCacheKey.cpp
+@@ -8,6 +8,7 @@
+ #include "mozilla/Move.h"
+ #include "ImageURL.h"
+ #include "nsHostObjectProtocolHandler.h"
++#include "nsLayoutUtils.h"
+ #include "nsString.h"
+ #include "mozilla/dom/File.h"
+ #include "mozilla/dom/workers/ServiceWorkerManager.h"
+@@ -53,6 +54,7 @@ ImageCacheKey::ImageCacheKey(nsIURI* aURI,
+   , mOriginAttributes(aAttrs)
+   , mControlledDocument(GetControlledDocumentToken(aDocument))
+   , mIsChrome(URISchemeIs(mURI, "chrome"))
++  , mIsStyloEnabled(nsLayoutUtils::StyloEnabled())
+ {
+   NS_ENSURE_SUCCESS_VOID(aRv);
+ 
+@@ -62,7 +64,8 @@ ImageCacheKey::ImageCacheKey(nsIURI* aURI,
+     mBlobSerial = BlobSerial(mURI);
+   }
+ 
+-  mHash = ComputeHash(mURI, mBlobSerial, mOriginAttributes, mControlledDocument);
++  mHash = ComputeHash(mURI, mBlobSerial, mOriginAttributes, mControlledDocument,
++                      mIsStyloEnabled);
+ }
+ 
+ ImageCacheKey::ImageCacheKey(ImageURL* aURI,
+@@ -72,6 +75,7 @@ ImageCacheKey::ImageCacheKey(ImageURL* aURI,
+   , mOriginAttributes(aAttrs)
+   , mControlledDocument(GetControlledDocumentToken(aDocument))
+   , mIsChrome(URISchemeIs(mURI, "chrome"))
++  , mIsStyloEnabled(nsLayoutUtils::StyloEnabled())
+ {
+   MOZ_ASSERT(aURI);
+ 
+@@ -79,7 +83,8 @@ ImageCacheKey::ImageCacheKey(ImageURL* aURI,
+     mBlobSerial = BlobSerial(mURI);
+   }
+ 
+-  mHash = ComputeHash(mURI, mBlobSerial, mOriginAttributes, mControlledDocument);
++  mHash = ComputeHash(mURI, mBlobSerial, mOriginAttributes, mControlledDocument,
++                      mIsStyloEnabled);
+ }
+ 
+ ImageCacheKey::ImageCacheKey(const ImageCacheKey& aOther)
+@@ -89,6 +94,7 @@ ImageCacheKey::ImageCacheKey(const ImageCacheKey& aOther)
+   , mControlledDocument(aOther.mControlledDocument)
+   , mHash(aOther.mHash)
+   , mIsChrome(aOther.mIsChrome)
++  , mIsStyloEnabled(aOther.mIsStyloEnabled)
+ { }
+ 
+ ImageCacheKey::ImageCacheKey(ImageCacheKey&& aOther)
+@@ -98,11 +104,15 @@ ImageCacheKey::ImageCacheKey(ImageCacheKey&& aOther)
+   , mControlledDocument(aOther.mControlledDocument)
+   , mHash(aOther.mHash)
+   , mIsChrome(aOther.mIsChrome)
++  , mIsStyloEnabled(aOther.mIsStyloEnabled)
+ { }
+ 
+ bool
+ ImageCacheKey::operator==(const ImageCacheKey& aOther) const
+ {
++  if (mIsStyloEnabled != aOther.mIsStyloEnabled) {
++    return false;
++  }
+   // Don't share the image cache between a controlled document and anything else.
+   if (mControlledDocument != aOther.mControlledDocument) {
+     return false;
+@@ -132,7 +142,8 @@ ImageCacheKey::Spec() const
+ ImageCacheKey::ComputeHash(ImageURL* aURI,
+                            const Maybe<uint64_t>& aBlobSerial,
+                            const OriginAttributes& aAttrs,
+-                           void* aControlledDocument)
++                           void* aControlledDocument,
++                           bool aIsStyloEnabled)
+ {
+   // Since we frequently call Hash() several times in a row on the same
+   // ImageCacheKey, as an optimization we compute our hash once and store it.
+@@ -142,7 +153,8 @@ ImageCacheKey::ComputeHash(ImageURL* aURI,
+   aAttrs.CreateSuffix(suffix);
+ 
+   return AddToHash(0, aURI->ComputeHash(aBlobSerial),
+-                   HashString(suffix), HashString(ptr));
++                   HashString(suffix), HashString(ptr),
++                   aIsStyloEnabled);
+ }
+ 
+ /* static */ void*
+diff --git image/ImageCacheKey.h image/ImageCacheKey.h
+index c5acd0ea495e..6d676ccb6338 100644
+--- image/ImageCacheKey.h
++++ image/ImageCacheKey.h
+@@ -58,7 +58,8 @@ private:
+   static PLDHashNumber ComputeHash(ImageURL* aURI,
+                                    const Maybe<uint64_t>& aBlobSerial,
+                                    const OriginAttributes& aAttrs,
+-                                   void* aControlledDocument);
++                                   void* aControlledDocument,
++                                   bool aIsStyloEnabled);
+   static void* GetControlledDocumentToken(nsIDocument* aDocument);
+ 
+   RefPtr<ImageURL> mURI;
+@@ -67,6 +68,10 @@ private:
+   void* mControlledDocument;
+   PLDHashNumber mHash;
+   bool mIsChrome;
++  // To prevent the reftests of styloVsGecko taking the same image cache after
++  // refreshing, we need to store different caches of stylo and gecko. So, we
++  // also consider the info of StyloEnabled() in ImageCacheKey.
++  bool mIsStyloEnabled;
+ };
+ 
+ } // namespace image
+
+commit c95ed14053c7
+Author: KuoE0 <kuoe0.tw@gmail.com>
+Date:   Thu Jul 27 14:06:54 2017 +0800
+
+    Bug 1377158 - (Part 3) Update the expectation of test cases. r=bholley,heycam
+    
+    MozReview-Commit-ID: K3gmTudkzol
+    
+    --HG--
+    extra : rebase_source : 32ba6ceb37fa2f29cde8d2534d73108e87dfa406
+---
+ layout/reftests/css-break/reftest.list        | 2 +-
+ layout/reftests/svg/as-image/reftest.list     | 2 +-
+ layout/reftests/table-background/reftest.list | 8 ++++----
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git layout/reftests/css-break/reftest.list layout/reftests/css-break/reftest.list
+index 4364cf7d93fc..54cfbcbbeefc 100644
+--- layout/reftests/css-break/reftest.list
++++ layout/reftests/css-break/reftest.list
+@@ -2,7 +2,7 @@ default-preferences pref(layout.css.box-decoration-break.enabled,true)
+ 
+ == box-decoration-break-1.html box-decoration-break-1-ref.html
+ fuzzy(1,20) fuzzy-if(skiaContent,1,700) fuzzy-if(webrender,4-4,3273-3273) == box-decoration-break-with-inset-box-shadow-1.html box-decoration-break-with-inset-box-shadow-1-ref.html
+-fuzzy(16,460) fuzzy-if(Android,10,3673) fuzzy-if(skiaContent,57,374) == box-decoration-break-with-outset-box-shadow-1.html box-decoration-break-with-outset-box-shadow-1-ref.html
++fuzzy(16,460) fuzzy-if(Android,10,3673) fuzzy-if(skiaContent,57,374) fuzzy-if(styloVsGecko,1,420) == box-decoration-break-with-outset-box-shadow-1.html box-decoration-break-with-outset-box-shadow-1-ref.html # Bug 1386543
+ random-if(!gtkWidget) HTTP(..) == box-decoration-break-border-image.html box-decoration-break-border-image-ref.html
+ == box-decoration-break-block-border-padding.html box-decoration-break-block-border-padding-ref.html
+ == box-decoration-break-block-margin.html box-decoration-break-block-margin-ref.html
+diff --git layout/reftests/svg/as-image/reftest.list layout/reftests/svg/as-image/reftest.list
+index d5feb66693ad..acff18d18b50 100644
+--- layout/reftests/svg/as-image/reftest.list
++++ layout/reftests/svg/as-image/reftest.list
+@@ -58,7 +58,7 @@ fuzzy(1,2) fuzzy-if(azureSkia,1,40000) == canvas-drawImage-alpha-2.html canvas-d
+ # context-fill:
+ == context-fill-01.html blue100x100-ref.html
+ test-pref(svg.context-properties.content.enabled,true) == context-fill-01.html lime100x100-ref.html
+-== context-fill-02.html transparent100x100-w-border-ref.html
++fails-if(styloVsGecko||stylo) == context-fill-02.html transparent100x100-w-border-ref.html # Bug 1380590
+ test-pref(svg.context-properties.content.enabled,true) == context-fill-02.html lime100x100-w-border-ref.html
+ test-pref(svg.context-properties.content.enabled,true) == context-fill-03.html lime100x100-50pct-ref.html
+ # fuzz because on win8 the r & b components are off by one
+diff --git layout/reftests/table-background/reftest.list layout/reftests/table-background/reftest.list
+index d8a138112527..df2f629d0d7f 100644
+--- layout/reftests/table-background/reftest.list
++++ layout/reftests/table-background/reftest.list
+@@ -1,11 +1,11 @@
+ # these could be moved to crashtests
+ != backgr_border-table-cell.html empty.html
+-!= backgr_border-table-column-group.html empty.html
++fuzzy-if(styloVsGecko,5,330) != backgr_border-table-column-group.html empty.html # Bug 1386543
+ # This seems to be caused by bug 527825
+-asserts-if(gtkWidget,0-12) != backgr_border-table-column.html empty.html
++fuzzy-if(styloVsGecko,5,561) asserts-if(gtkWidget,0-12) != backgr_border-table-column.html empty.html # Bug 1386543
+ asserts-if(gtkWidget,0-6) != backgr_border-table-quirks.html empty.html
+-!= backgr_border-table-row-group.html empty.html
+-!= backgr_border-table-row.html empty.html
++fuzzy-if(styloVsGecko,1,168) != backgr_border-table-row-group.html empty.html # Bug 1386543
++fuzzy-if(styloVsGecko,1,168) != backgr_border-table-row.html empty.html # Bug 1386543
+ != backgr_border-table.html empty.html
+ != backgr_fixed-bg.html empty.html
+ != backgr_index.html empty.html
+
+commit dd7cb82fb7b5
+Author: KuoE0 <kuoe0.tw@gmail.com>
+Date:   Fri Jul 28 00:23:05 2017 +0800
+
+    Bug 1377158 - (Part 4) Reduce the assertion cost to check reconstruction frame hint. r=bholley,heycam
+    
+    The original assertion took too long time to check nsStyleChangeList. It
+    caused the test case with many elements timed-out and failed.
+    
+    MozReview-Commit-ID: FpNZvdQFTtR
+    
+    --HG--
+    extra : rebase_source : c68072448061c4dcc8399131924cf718a5e53700
+---
+ layout/base/nsStyleChangeList.cpp | 30 +++++++++++++++++++-----------
+ 1 file changed, 19 insertions(+), 11 deletions(-)
+
+diff --git layout/base/nsStyleChangeList.cpp layout/base/nsStyleChangeList.cpp
+index 6f68cded3814..af6256f46c22 100644
+--- layout/base/nsStyleChangeList.cpp
++++ layout/base/nsStyleChangeList.cpp
+@@ -41,17 +41,25 @@ nsStyleChangeList::AppendChange(nsIFrame* aFrame, nsIContent* aContent, nsChange
+              (aHint & nsChangeHint_NeedReflow),
+              "Reflow hint bits set without actually asking for a reflow");
+ 
+-  // If Servo fires reconstruct at a node, it is the only change hint fired at
+-  // that node.
+-  if (IsServo()) {
+-    for (size_t i = 0; i < Length(); ++i) {
+-      MOZ_ASSERT(!aContent || !((aHint | (*this)[i].mHint) & nsChangeHint_ReconstructFrame) ||
+-                 (*this)[i].mContent != aContent);
+-    }
+-  } else {
+-    // Filter out all other changes for same content for Gecko (Servo asserts against this
+-    // case above).
+-    if (aContent && (aHint & nsChangeHint_ReconstructFrame)) {
++  if (aContent && (aHint & nsChangeHint_ReconstructFrame)) {
++    // If Servo fires reconstruct at a node, it is the only change hint fired at
++    // that node.
++    if (IsServo()) {
++      // Note: Because we check whether |aHint| is a reconstruct above (which is
++      // necessary to avoid debug test timeouts on certain crashtests), this check
++      // will not find bugs where we add a non-reconstruct hint for an element after
++      // adding a reconstruct. This is ok though, since ProcessRestyledFrames will
++      // handle that case via mDestroyedFrames.
++      for (size_t i = 0; i < Length(); ++i) {
++        MOZ_ASSERT(aContent != (*this)[i].mContent ||
++                   !((*this)[i].mHint & nsChangeHint_ReconstructFrame),
++                   "Should not append a non-ReconstructFrame hint after \
++                   appending a ReconstructFrame hint for the same \
++                   content.");
++      }
++    } else {
++      // Filter out all other changes for same content for Gecko (Servo asserts against this
++      // case above).
+       // NOTE: This is captured by reference to please static analysis.
+       // Capturing it by value as a pointer should be fine in this case.
+       RemoveElementsBy([&](const nsStyleChangeData& aData) {
diff --git a/www/waterfox/files/patch-bug1388319 b/www/waterfox/files/patch-bug1388319
new file mode 100644
index 000000000000..8b26989437d1
--- /dev/null
+++ b/www/waterfox/files/patch-bug1388319
@@ -0,0 +1,30 @@
+commit e572d7e6e7cf
+Author: Xidorn Quan <me@upsuper.org>
+Date:   Tue Aug 8 22:41:32 2017 +1000
+
+    Bug 1388319 - Mark ServoStyleSet dirty in its Init. r=emilio
+    
+    MozReview-Commit-ID: 804KasIiS6E
+    
+    --HG--
+    extra : rebase_source : 36eb21c5ffc4321aef652947455e73970419803a
+---
+ layout/style/ServoStyleSet.cpp | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git layout/style/ServoStyleSet.cpp layout/style/ServoStyleSet.cpp
+index adb3cba922d2..a1cd15903ade 100644
+--- layout/style/ServoStyleSet.cpp
++++ layout/style/ServoStyleSet.cpp
+@@ -81,8 +81,9 @@ ServoStyleSet::Init(nsPresContext* aPresContext, nsBindingManager* aBindingManag
+     }
+   }
+ 
+-  // No need to Servo_StyleSet_FlushStyleSheets because we just created the
+-  // mRawSet, so there was nothing to flush.
++  // We added prefilled stylesheets into mRawSet, so the stylist is dirty.
++  // The Stylist should be updated later when necessary.
++  SetStylistStyleSheetsDirty();
+ }
+ 
+ void
diff --git a/www/waterfox/files/patch-bug1394146 b/www/waterfox/files/patch-bug1394146
new file mode 100644
index 000000000000..d3cba27a5a88
--- /dev/null
+++ b/www/waterfox/files/patch-bug1394146
@@ -0,0 +1,119 @@
+commit f8221b58e542
+Author: Sean Stangl <sstangl@mozilla.com>
+Date:   Thu Sep 21 15:37:00 2017 -0400
+
+    Bug 1394146 - Avoid overflow on backwards iteration of IC entries. r=jandem, a=sledru
+    
+    --HG--
+    extra : source : 9f05ef54c84d9b63fb3ad2dd2916df34cb35df8d
+    extra : histedit_source : 753ccc8652983bb35d3a1f9f89638902d3b0a2a5
+---
+ js/src/jit/BaselineJIT.cpp    | 11 +++++++++--
+ js/src/jit/IonControlFlow.cpp | 16 ++++++++++++----
+ 2 files changed, 21 insertions(+), 6 deletions(-)
+
+diff --git js/src/jit/BaselineJIT.cpp js/src/jit/BaselineJIT.cpp
+index 3e25fd7b7120..baec7b63b8f0 100644
+--- js/src/jit/BaselineJIT.cpp
++++ js/src/jit/BaselineJIT.cpp
+@@ -669,12 +669,16 @@ BaselineScript::maybeICEntryFromPCOffset(uint32_t pcOffset)
+     if (!ComputeBinarySearchMid(this, pcOffset, &mid))
+         return nullptr;
+ 
++    MOZ_ASSERT(mid < numICEntries());
++
+     // Found an IC entry with a matching PC offset.  Search backward, and then
+     // forward from this IC entry, looking for one with the same PC offset which
+     // has isForOp() set.
+-    for (size_t i = mid; i < numICEntries() && icEntry(i).pcOffset() == pcOffset; i--) {
++    for (size_t i = mid; icEntry(i).pcOffset() == pcOffset; i--) {
+         if (icEntry(i).isForOp())
+             return &icEntry(i);
++        if (i == 0)
++            break;
+     }
+     for (size_t i = mid+1; i < numICEntries() && icEntry(i).pcOffset() == pcOffset; i++) {
+         if (icEntry(i).isForOp())
+@@ -728,10 +732,13 @@ BaselineScript::callVMEntryFromPCOffset(uint32_t pcOffset)
+     // inserted by VM calls.
+     size_t mid;
+     MOZ_ALWAYS_TRUE(ComputeBinarySearchMid(this, pcOffset, &mid));
++    MOZ_ASSERT(mid < numICEntries());
+ 
+-    for (size_t i = mid; i < numICEntries() && icEntry(i).pcOffset() == pcOffset; i--) {
++    for (size_t i = mid; icEntry(i).pcOffset() == pcOffset; i--) {
+         if (icEntry(i).kind() == ICEntry::Kind_CallVM)
+             return icEntry(i);
++        if (i == 0)
++            break;
+     }
+     for (size_t i = mid+1; i < numICEntries() && icEntry(i).pcOffset() == pcOffset; i++) {
+         if (icEntry(i).kind() == ICEntry::Kind_CallVM)
+diff --git js/src/jit/IonControlFlow.cpp js/src/jit/IonControlFlow.cpp
+index 4f27cd53dcaa..8d8a796d3f3b 100644
+--- js/src/jit/IonControlFlow.cpp
++++ js/src/jit/IonControlFlow.cpp
+@@ -1619,7 +1619,7 @@ ControlFlowGenerator::processBreak(JSOp op, jssrcnote* sn)
+     DebugOnly<bool> found = false;
+ 
+     if (SN_TYPE(sn) == SRC_BREAK2LABEL) {
+-        for (size_t i = labels_.length() - 1; i < labels_.length(); i--) {
++        for (size_t i = labels_.length() - 1; ; i--) {
+             CFGState& cfg = cfgStack_[labels_[i].cfgEntry];
+             MOZ_ASSERT(cfg.state == CFGState::LABEL);
+             if (cfg.stopAt == target) {
+@@ -1627,9 +1627,11 @@ ControlFlowGenerator::processBreak(JSOp op, jssrcnote* sn)
+                 found = true;
+                 break;
+             }
++            if (i == 0)
++                break;
+         }
+     } else {
+-        for (size_t i = loops_.length() - 1; i < loops_.length(); i--) {
++        for (size_t i = loops_.length() - 1; ; i--) {
+             CFGState& cfg = cfgStack_[loops_[i].cfgEntry];
+             MOZ_ASSERT(cfg.isLoop());
+             if (cfg.loop.exitpc == target) {
+@@ -1637,6 +1639,8 @@ ControlFlowGenerator::processBreak(JSOp op, jssrcnote* sn)
+                 found = true;
+                 break;
+             }
++            if (i == 0)
++                break;
+         }
+     }
+ 
+@@ -1665,7 +1669,7 @@ ControlFlowGenerator::processContinue(JSOp op)
+     // Find the target loop.
+     CFGState* found = nullptr;
+     jsbytecode* target = pc + GetJumpOffset(pc);
+-    for (size_t i = loops_.length() - 1; i < loops_.length(); i--) {
++    for (size_t i = loops_.length() - 1; ; i--) {
+         // +1 to skip JSOP_JUMPTARGET.
+         if (loops_[i].continuepc == target + 1 ||
+             EffectiveContinue(loops_[i].continuepc) == target)
+@@ -1673,6 +1677,8 @@ ControlFlowGenerator::processContinue(JSOp op)
+             found = &cfgStack_[loops_[i].cfgEntry];
+             break;
+         }
++        if (i == 0)
++            break;
+     }
+ 
+     // There must always be a valid target loop structure. If not, there's
+@@ -1698,11 +1704,13 @@ ControlFlowGenerator::processSwitchBreak(JSOp op)
+     // Find the target switch.
+     CFGState* found = nullptr;
+     jsbytecode* target = pc + GetJumpOffset(pc);
+-    for (size_t i = switches_.length() - 1; i < switches_.length(); i--) {
++    for (size_t i = switches_.length() - 1; ; i--) {
+         if (switches_[i].continuepc == target) {
+             found = &cfgStack_[switches_[i].cfgEntry];
+             break;
+         }
++        if (i == 0)
++            break;
+     }
+ 
+     // There must always be a valid target loop structure. If not, there's
diff --git a/www/waterfox/files/patch-bug1397671 b/www/waterfox/files/patch-bug1397671
new file mode 100644
index 000000000000..567fd3f34817
--- /dev/null
+++ b/www/waterfox/files/patch-bug1397671
@@ -0,0 +1,105 @@
+commit 553df1231272
+Author: Matt Woodrow <mwoodrow@mozilla.com>
+Date:   Tue Sep 26 15:57:56 2017 +1300
+
+    Bug 1397671 - Don't treat SVG transformed frames as being transformed for the purposes of computing Combines3DTransformWithAncestors. r=dbaron, a=sledru
+    
+    --HG--
+    extra : source : 70b150570407df427bed31965fe29cf8736beab6
+---
+ layout/generic/nsFrame.cpp                         | 11 +++++++++--
+ layout/generic/nsIFrame.h                          |  6 ++++++
+ layout/reftests/transform-3d/preserve3d-8-ref.html | 11 +++++++++++
+ layout/reftests/transform-3d/preserve3d-8.html     | 17 +++++++++++++++++
+ 4 files changed, 43 insertions(+), 2 deletions(-)
+
+diff --git layout/generic/nsFrame.cpp layout/generic/nsFrame.cpp
+index 6e6f2bfa5379..02d1dafec21e 100644
+--- layout/generic/nsFrame.cpp
++++ layout/generic/nsFrame.cpp
+@@ -1326,11 +1326,18 @@ nsIFrame::GetMarginRectRelativeToSelf() const
+ bool
+ nsIFrame::IsTransformed(const nsStyleDisplay* aStyleDisplay,
+                         EffectSet* aEffectSet) const
++{
++  return IsCSSTransformed(aStyleDisplay, aEffectSet) ||
++         IsSVGTransformed();
++}
++
++bool
++nsIFrame::IsCSSTransformed(const nsStyleDisplay* aStyleDisplay,
++                           EffectSet* aEffectSet) const
+ {
+   MOZ_ASSERT(aStyleDisplay == StyleDisplay());
+   return ((mState & NS_FRAME_MAY_BE_TRANSFORMED) &&
+           (aStyleDisplay->HasTransform(this) ||
+-           IsSVGTransformed() ||
+            HasAnimationOfTransform(aEffectSet)));
+ }
+ 
+@@ -1402,7 +1409,7 @@ nsIFrame::Combines3DTransformWithAncestors(const nsStyleDisplay* aStyleDisplay,
+   if (!parent || !parent->Extend3DContext()) {
+     return false;
+   }
+-  return IsTransformed(aStyleDisplay,aEffectSet) ||
++  return IsCSSTransformed(aStyleDisplay, aEffectSet) ||
+          BackfaceIsHidden(aStyleDisplay);
+ }
+ 
+diff --git layout/generic/nsIFrame.h layout/generic/nsIFrame.h
+index e8fb4c71a16f..b3ca08370d34 100644
+--- layout/generic/nsIFrame.h
++++ layout/generic/nsIFrame.h
+@@ -1724,6 +1724,12 @@ public:
+     return IsTransformed(StyleDisplay(), aEffectSet);
+   }
+ 
++  /**
++   * Same as IsTransformed, except that it doesn't take SVG transforms
++   * into account.
++   */
++  bool IsCSSTransformed(const nsStyleDisplay* aStyleDisplay, mozilla::EffectSet* aEffectSet = nullptr) const;
++
+   /**
+    * True if this frame has any animation of transform in effect.
+    *
+diff --git layout/reftests/transform-3d/preserve3d-8-ref.html layout/reftests/transform-3d/preserve3d-8-ref.html
+new file mode 100644
+index 000000000000..afddf05d4d81
+--- /dev/null
++++ layout/reftests/transform-3d/preserve3d-8-ref.html
+@@ -0,0 +1,11 @@
++<html>
++<head>
++</head>
++<body style="width:100px">
++  <svg xmlns="http://www.w3.org/2000/svg" version="1.1" id="js" viewBox="0 0 200 200" style="transform: rotateX(180deg)">
++    <g>
++      <rect width="100" height="100" style="fill:rgb(0,0,255)"></rect>
++    </g>
++  </svg>
++</body>
++</html>
+diff --git layout/reftests/transform-3d/preserve3d-8.html layout/reftests/transform-3d/preserve3d-8.html
+new file mode 100644
+index 000000000000..76e9c10c33bc
+--- /dev/null
++++ layout/reftests/transform-3d/preserve3d-8.html
+@@ -0,0 +1,17 @@
++<html>
++<head>
++</head>
++<body>
++  <div style="transform: rotatex(45deg); transform-style: preserve-3d; width: 100px;">
++    <div style="transform: rotatex(45deg); transform-style: preserve-3d; width: 100px;">
++      <div style="transform: rotatex(45deg); transform-style: preserve-3d; width: 100px;">
++        <svg xmlns="http://www.w3.org/2000/svg" version="1.1" id="js" viewBox="0 0 200 200" style="transform: rotateX(45deg)">
++          <g>
++            <rect width="100" height="100" style="fill:rgb(0,0,255)"></rect>
++          </g>
++        </svg>
++      </div>
++    </div>
++  </div>
++</body>
++</html>
diff --git a/www/waterfox/files/patch-bug1398983 b/www/waterfox/files/patch-bug1398983
new file mode 100644
index 000000000000..b273a11cd518
--- /dev/null
+++ b/www/waterfox/files/patch-bug1398983
@@ -0,0 +1,25 @@
+commit 6b2dbc2b8216
+Author: Bobby Holley <bobbyholley@gmail.com>
+Date:   Fri Sep 15 12:25:46 2017 -0700
+
+    Bug 1398983 - Remove warning about assuming gecko style system. r=me
+    
+    MozReview-Commit-ID: BCeG81uxLvS
+---
+ dom/base/nsDocument.cpp | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git dom/base/nsDocument.cpp dom/base/nsDocument.cpp
+index 9d9af08ba04b..076fe1a5d444 100644
+--- dom/base/nsDocument.cpp
++++ dom/base/nsDocument.cpp
+@@ -13490,7 +13490,8 @@ nsIDocument::UpdateStyleBackendType()
+       // Enable stylo for SVG-as-image.
+       mStyleBackendType = StyleBackendType::Servo;
+     } else if (!mDocumentContainer) {
+-      NS_WARNING("stylo: No docshell yet, assuming Gecko style system");
++      // Not docshell, assume Gecko. Various callers can end up setting this
++      // explicitly afterwards to inherit it in various situations.
+     } else if (!IsXULDocument() && IsContentDocument()) {
+       // Disable stylo for about: pages other than about:blank, since
+       // they tend to use unsupported selectors like XUL tree pseudos.
diff --git a/www/waterfox/files/patch-bug1400540 b/www/waterfox/files/patch-bug1400540
new file mode 100644
index 000000000000..6cbe87dc3d61
--- /dev/null
+++ b/www/waterfox/files/patch-bug1400540
@@ -0,0 +1,47 @@
+commit 6905267b2878
+Author: Xidorn Quan <me@upsuper.org>
+Date:   Wed Sep 20 08:26:53 2017 +1000
+
+    Bug 1400540 - Decide style backend type based on principal. r=bholley
+    
+    MozReview-Commit-ID: A4y9Shdbr7g
+    
+    --HG--
+    extra : source : cdfe5e5e059273a1c7fc6506d6e0fecb2bb7affb
+---
+ dom/base/nsDocument.cpp | 21 ++++++++-------------
+ 1 file changed, 8 insertions(+), 13 deletions(-)
+
+diff --git dom/base/nsDocument.cpp dom/base/nsDocument.cpp
+index 642960e6a155..265af0df07b9 100644
+--- dom/base/nsDocument.cpp
++++ dom/base/nsDocument.cpp
+@@ -13465,20 +13465,15 @@ nsIDocument::UpdateStyleBackendType()
+ 
+ #ifdef MOZ_STYLO
+   if (nsLayoutUtils::StyloEnabled()) {
+-    if (IsBeingUsedAsImage()) {
+-      // Enable stylo for SVG-as-image.
++    // Disable stylo only for system principal. Other principals aren't
++    // able to use XUL by default, and the back door to enable XUL is
++    // mostly just for testing, which means they don't matter, and we
++    // shouldn't respect them at the same time.
++    // Note that, since tests can have XUL support, we still need to
++    // explicitly exclude XUL documents here.
++    if (!nsContentUtils::IsSystemPrincipal(NodePrincipal()) &&
++        !IsXULDocument()) {
+       mStyleBackendType = StyleBackendType::Servo;
+-    } else if (!mDocumentContainer) {
+-      // Not docshell, assume Gecko. Various callers can end up setting this
+-      // explicitly afterwards to inherit it in various situations.
+-    } else if (!IsXULDocument() && IsContentDocument()) {
+-      // Disable stylo for about: pages other than about:blank, since
+-      // they tend to use unsupported selectors like XUL tree pseudos.
+-      bool isAbout = false;
+-      mDocumentURI->SchemeIs("about", &isAbout);
+-      if (!isAbout || NS_IsAboutBlank(mDocumentURI)) {
+-        mStyleBackendType = StyleBackendType::Servo;
+-      }
+     }
+   }
+ #endif
diff --git a/www/waterfox/files/patch-bug1401416 b/www/waterfox/files/patch-bug1401416
new file mode 100644
index 000000000000..63f0f8e8e713
--- /dev/null
+++ b/www/waterfox/files/patch-bug1401416
@@ -0,0 +1,29 @@
+commit c5123938eb1e
+Author: Tobias Schneider <schneider@jancona.com>
+Date:   Thu Sep 21 12:43:35 2017 -0700
+
+    Bug 1401416 - [intersection-observer] Let intersection rect be empty if do_QueryFrame(rootFrame) returns null. r=dholbert, a=sledru
+    
+    --HG--
+    extra : source : 90be30b5206c2b2724d61f4f6782197bfa768428
+---
+ dom/base/DOMIntersectionObserver.cpp | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git dom/base/DOMIntersectionObserver.cpp dom/base/DOMIntersectionObserver.cpp
+index 606a1de5ed8c..1ca909e3cfbf 100644
+--- dom/base/DOMIntersectionObserver.cpp
++++ dom/base/DOMIntersectionObserver.cpp
+@@ -308,7 +308,11 @@ DOMIntersectionObserver::Update(nsIDocument* aDocument, DOMHighResTimeStamp time
+         }
+         root = rootFrame->GetContent()->AsElement();
+         nsIScrollableFrame* scrollFrame = do_QueryFrame(rootFrame);
+-        rootRect = scrollFrame->GetScrollPortRect();
++        // If we end up with a null root frame for some reason, we'll proceed
++        // with an empty root intersection rect.
++        if (scrollFrame) {
++          rootRect = scrollFrame->GetScrollPortRect();
++        }
+       }
+     }
+   }
diff --git a/www/waterfox/files/patch-bug1401909 b/www/waterfox/files/patch-bug1401909
new file mode 100644
index 000000000000..f376a52b2732
--- /dev/null
+++ b/www/waterfox/files/patch-bug1401909
@@ -0,0 +1,30 @@
+commit ec17ee7e24b2
+Author: Kaku Kuo <kaku@mozilla.com>
+Date:   Thu Sep 21 17:47:45 2017 +0800
+
+    Bug 1401909 - Turn on preference of ShutdownDecoder feature on desktop version release and beta channel. r=bwu, a=sledru
+    
+    MozReview-Commit-ID: JB3RmyjhvK9
+    
+    --HG--
+    extra : source : 27953b6cbc9b9bff5fb14cb0e69b492f08e62da8
+---
+ modules/libpref/init/all.js | 4 ----
+ 1 file changed, 4 deletions(-)
+
+diff --git modules/libpref/init/all.js modules/libpref/init/all.js
+index 6d66d27d987c..c74659f8d4a5 100644
+--- modules/libpref/init/all.js
++++ modules/libpref/init/all.js
+@@ -432,11 +432,7 @@ pref("media.decoder-doctor.wmf-disabled-is-failure", false);
+ pref("media.decoder-doctor.new-issue-endpoint", "https://webcompat.com/issues/new");
+ 
+ // Whether to suspend decoding of videos in background tabs.
+-#ifdef RELEASE_OR_BETA
+-pref("media.suspend-bkgnd-video.enabled", false);
+-#else
+ pref("media.suspend-bkgnd-video.enabled", true);
+-#endif
+ // Delay, in ms, from time window goes to background to suspending
+ // video decoders. Defaults to 10 seconds.
+ pref("media.suspend-bkgnd-video.delay-ms", 10000);
diff --git a/www/waterfox/files/patch-bug1401992 b/www/waterfox/files/patch-bug1401992
new file mode 100644
index 000000000000..cc3a94b30f9d
--- /dev/null
+++ b/www/waterfox/files/patch-bug1401992
@@ -0,0 +1,239 @@
+commit b00a6f8952ad
+Author: Bobby Holley <bobbyholley@gmail.com>
+Date:   Fri Sep 22 12:34:00 2017 -0700
+
+    Bug 1401992 - Don't cross anonymous boundaries when finding the fieldset. r=bz, a=sledru
+    
+    MozReview-Commit-ID: DiywRognpqx
+    
+    --HG--
+    extra : source : 581b6ab2826a3a90f3d47713b3940f176aa4d39f
+---
+ dom/html/nsGenericHTMLElement.cpp | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git dom/html/nsGenericHTMLElement.cpp dom/html/nsGenericHTMLElement.cpp
+index 61953dab88ce..eda85c9eebaf 100644
+--- dom/html/nsGenericHTMLElement.cpp
++++ dom/html/nsGenericHTMLElement.cpp
+@@ -545,7 +545,7 @@ nsGenericHTMLElement::FindAncestorForm(HTMLFormElement* aCurrentForm)
+                "FindAncestorForm should not be called if @form is set!");
+ 
+   // Make sure we don't end up finding a form that's anonymous from
+-  // our point of view.
++  // our point of view. See also nsGenericHTMLFormElement::UpdateFieldSet.
+   nsIContent* bindingParent = GetBindingParent();
+ 
+   nsIContent* content = this;
+@@ -2365,7 +2365,11 @@ nsGenericHTMLFormElement::UpdateFieldSet(bool aNotify)
+   nsIContent* parent = nullptr;
+   nsIContent* prev = nullptr;
+ 
+-  for (parent = GetParent(); parent;
++  // Don't walk out of anonymous subtrees. Note the similar code in
++  // nsGenericHTMLElement::FindAncestorForm.
++  nsIContent* bindingParent = GetBindingParent();
++
++  for (parent = GetParent(); parent && parent != bindingParent;
+        prev = parent, parent = parent->GetParent()) {
+     HTMLFieldSetElement* fieldset =
+       HTMLFieldSetElement::FromContent(parent);
+
+commit 637fd3497d25
+Author: Bobby Holley <bobbyholley@gmail.com>
+Date:   Fri Sep 22 17:06:00 2017 -0700
+
+    Bug 1401992 - Reftest. r=me, a=sledru
+    
+    MozReview-Commit-ID: C7UQEQOkE7q
+    
+    --HG--
+    extra : source : 5bfa23832767e42835f4c144fcbd4a351b7feca2
+    extra : histedit_source : 31c6d70fac5308f511033692eeb3d8907a88ccab%2Ce5b28d61e7e6cffa0aee00cc2d563be5052830f0
+---
+ layout/reftests/bugs/1401992-ref.html | 21 +++++++++++++++++++++
+ layout/reftests/bugs/1401992.html     | 32 ++++++++++++++++++++++++++++++++
+ layout/reftests/bugs/reftest.list     |  1 +
+ 3 files changed, 54 insertions(+)
+
+diff --git layout/reftests/bugs/1401992-ref.html layout/reftests/bugs/1401992-ref.html
+new file mode 100644
+index 000000000000..8fb36196cf39
+--- /dev/null
++++ layout/reftests/bugs/1401992-ref.html
+@@ -0,0 +1,21 @@
++<!doctype html>
++<html>
++<head>
++<style>
++video {
++  width: 100px;
++  height: 100px;
++  border: 10px solid purple;
++}
++fieldset {
++  border: 10px solid blue;
++  border-color: green;
++}
++</style>
++<script>
++</script>
++</head>
++<body>
++<fieldset><video id="x" style="visibility:hidden"></video></fieldset>
++</body>
++</html>
+diff --git layout/reftests/bugs/1401992.html layout/reftests/bugs/1401992.html
+new file mode 100644
+index 000000000000..f48f563a01a8
+--- /dev/null
++++ layout/reftests/bugs/1401992.html
+@@ -0,0 +1,32 @@
++<!doctype html>
++<html>
++<head>
++<style>
++video {
++  width: 100px;
++  height: 100px;
++  border: 10px solid purple;
++}
++fieldset {
++  border: 10px solid blue;
++}
++fieldset:valid {
++  border-color: green;
++}
++fieldset:invalid {
++  border-color: red;
++}
++</style>
++<script>
++window.onload = function() {
++  let v = document.getElementById("x");
++  v.currentTime = -128;
++  v.controls = !v.controls;
++}
++</script>
++</head>
++<body>
++<!-- Native anonymous content shouldn't affect fieldset validity -->
++<fieldset><video id="x" style="visibility:hidden"></video></fieldset>
++</body>
++</html>
+diff --git layout/reftests/bugs/reftest.list layout/reftests/bugs/reftest.list
+index e95eb8318a5a..55eb7da5611f 100644
+--- layout/reftests/bugs/reftest.list
++++ layout/reftests/bugs/reftest.list
+@@ -2037,3 +2037,4 @@ needs-focus != 1377447-1.html 1377447-2.html
+ == 1380224-1.html 1380224-1-ref.html
+ == 1384065.html 1384065-ref.html
+ == 1384275-1.html 1384275-1-ref.html
++== 1401992.html 1401992-ref.html
+
+commit 67ad215f14ae
+Author: Bobby Holley <bobbyholley@gmail.com>
+Date:   Fri Sep 22 17:20:31 2017 -0700
+
+    Bug 1401992 - Mark some tests as passing on android. r=me, a=sledru
+    
+    MozReview-Commit-ID: HJuIX5VXBm5
+    
+    --HG--
+    extra : source : 4c191b4e631f2f6f672598d70359438d18d05884
+    extra : histedit_source : ad3d624a38b1f0134cd286ea592586f23c52d21b
+---
+ layout/reftests/bugs/reftest.list                  |  2 +-
+ layout/reftests/css-disabled/select/reftest.list   | 10 +++++-----
+ layout/reftests/css-invalid/select/reftest.list    |  4 ++--
+ layout/reftests/css-ui-invalid/select/reftest.list |  4 ++--
+ layout/reftests/css-ui-valid/select/reftest.list   |  4 ++--
+ layout/reftests/css-valid/select/reftest.list      |  4 ++--
+ 6 files changed, 14 insertions(+), 14 deletions(-)
+
+diff --git layout/reftests/bugs/reftest.list layout/reftests/bugs/reftest.list
+index 55eb7da5611f..7815eaf2b69d 100644
+--- layout/reftests/bugs/reftest.list
++++ layout/reftests/bugs/reftest.list
+@@ -1502,7 +1502,7 @@ random != 553571-1.html 553571-1-notref.html # expect dotted circle in test, not
+ fuzzy-if(!contentSameGfxBackendAsCanvas,128,91) random-if(d2d) skip-if(azureSkiaGL) fuzzy-if(skiaContent,32,150) == 555388-1.html 555388-1-ref.html
+ == 556661-1.html 556661-1-ref.html
+ fuzzy-if(skiaContent,4,5) == 557087-1.html 557087-ref.html
+-fails-if(Android) fuzzy-if(skiaContent&&!Android,2,5) == 557087-2.html 557087-ref.html
++fuzzy-if(skiaContent&&!Android,2,5) == 557087-2.html 557087-ref.html
+ == 557736-1.html 557736-1-ref.html
+ != 558011-1.xul 558011-1-ref.xul
+ == 559284-1.html 559284-1-ref.html
+diff --git layout/reftests/css-disabled/select/reftest.list layout/reftests/css-disabled/select/reftest.list
+index 700f06471cda..d6abbd6bd903 100644
+--- layout/reftests/css-disabled/select/reftest.list
++++ layout/reftests/css-disabled/select/reftest.list
+@@ -1,9 +1,9 @@
+ fuzzy-if(Android,12,1) == select-fieldset-1.html select-fieldset-ref.html
+-fails-if(Android) fuzzy-if(skiaContent&&!Android,2,17) == select-fieldset-2.html select-fieldset-ref-disabled.html
+-fails-if(Android) fuzzy-if(skiaContent&&!Android,2,17) == select-fieldset-3.html select-fieldset-ref-disabled.html
+-fails-if(Android) fuzzy-if(skiaContent&&!Android,2,13) == select-fieldset-4.html select-fieldset-ref.html
++fuzzy-if(skiaContent&&!Android,2,17) == select-fieldset-2.html select-fieldset-ref-disabled.html
++fuzzy-if(skiaContent&&!Android,2,17) == select-fieldset-3.html select-fieldset-ref-disabled.html
++fuzzy-if(skiaContent&&!Android,2,13) == select-fieldset-4.html select-fieldset-ref.html
+ == select-fieldset-legend-1.html select-fieldset-legend-ref-1.html
+-fails-if(Android) fuzzy-if(skiaContent&&!Android,2,6) == select-fieldset-legend-2.html select-fieldset-legend-ref-2.html
+-fails-if(Android) fuzzy-if(skiaContent&&!Android,2,8) == select-fieldset-legend-3.html select-fieldset-legend-ref-3.html
++fuzzy-if(skiaContent&&!Android,2,6) == select-fieldset-legend-2.html select-fieldset-legend-ref-2.html
++fuzzy-if(skiaContent&&!Android,2,8) == select-fieldset-legend-3.html select-fieldset-legend-ref-3.html
+ fuzzy-if(skiaContent,2,12) == select-fieldset-legend-4.html select-fieldset-legend-ref-4.html
+ fuzzy-if(skiaContent,2,5) == select-fieldset-legend-5.html select-fieldset-legend-ref-5.html
+diff --git layout/reftests/css-invalid/select/reftest.list layout/reftests/css-invalid/select/reftest.list
+index 2d16e1603b0c..44bd631b6215 100644
+--- layout/reftests/css-invalid/select/reftest.list
++++ layout/reftests/css-invalid/select/reftest.list
+@@ -7,6 +7,6 @@ needs-focus == select-required-invalid.html select-required-ref.html
+ needs-focus == select-required-valid.html select-required-ref.html
+ needs-focus == select-required-multiple-still-valid.html select-required-multiple-ref.html
+ fuzzy-if(skiaContent,1,250) needs-focus == select-required-multiple-valid.html select-required-multiple-ref.html
+-fails-if(Android) fuzzy-if(skiaContent&&!Android,1,3) needs-focus == select-disabled-fieldset-1.html select-fieldset-ref.html
+-fails-if(Android) fuzzy-if(skiaContent&&!Android,2,3) needs-focus == select-disabled-fieldset-2.html select-fieldset-ref.html
++fuzzy-if(skiaContent&&!Android,1,3) needs-focus == select-disabled-fieldset-1.html select-fieldset-ref.html
++fuzzy-if(skiaContent&&!Android,2,3) needs-focus == select-disabled-fieldset-2.html select-fieldset-ref.html
+ fuzzy-if(skiaContent,2,5) needs-focus == select-fieldset-legend.html select-fieldset-legend-ref.html
+diff --git layout/reftests/css-ui-invalid/select/reftest.list layout/reftests/css-ui-invalid/select/reftest.list
+index 1fd197793914..f0b298401ced 100644
+--- layout/reftests/css-ui-invalid/select/reftest.list
++++ layout/reftests/css-ui-invalid/select/reftest.list
+@@ -12,7 +12,7 @@ fuzzy-if(skiaContent,2,5) needs-focus == select-required-valid.html select-requi
+ needs-focus == select-required-multiple-invalid.html select-required-multiple-ref.html
+ fuzzy-if(asyncPan&&!layersGPUAccelerated,84,77) fuzzy-if(skiaContent,1,1000) needs-focus == select-required-multiple-invalid-changed.html select-required-multiple-ref.html
+ needs-focus == select-required-multiple-valid.html select-required-multiple-ref.html
+-fails-if(Android) fuzzy-if(skiaContent&&!Android,2,10) needs-focus == select-disabled-fieldset-1.html select-fieldset-ref.html
+-fails-if(Android) fuzzy-if(skiaContent&&!Android,2,10) needs-focus == select-disabled-fieldset-2.html select-fieldset-ref.html
++fuzzy-if(skiaContent&&!Android,2,10) needs-focus == select-disabled-fieldset-1.html select-fieldset-ref.html
++fuzzy-if(skiaContent&&!Android,2,10) needs-focus == select-disabled-fieldset-2.html select-fieldset-ref.html
+ fuzzy-if(skiaContent,2,10) needs-focus == select-fieldset-legend.html select-fieldset-legend-ref.html
+ fuzzy-if(skiaContent,1,5) needs-focus == select-novalidate.html select-required-ref.html
+diff --git layout/reftests/css-ui-valid/select/reftest.list layout/reftests/css-ui-valid/select/reftest.list
+index 082a6fc0ce40..815cb4635ddb 100644
+--- layout/reftests/css-ui-valid/select/reftest.list
++++ layout/reftests/css-ui-valid/select/reftest.list
+@@ -12,7 +12,7 @@ fuzzy-if(skiaContent,2,5) needs-focus == select-required-valid-changed-2.html se
+ needs-focus == select-required-multiple-invalid.html select-required-multiple-ref.html
+ needs-focus == select-required-multiple-valid.html select-required-multiple-ref.html
+ fuzzy(64,4) fuzzy-if(asyncPan&&layersGPUAccelerated,84,77) fuzzy-if(skiaContent,1,1000) needs-focus == select-required-multiple-valid-changed.html select-required-multiple-ref.html
+-fails-if(Android) needs-focus == select-disabled-fieldset-1.html select-fieldset-ref.html
+-fails-if(Android) fuzzy-if(skiaContent&&!Android,2,10) needs-focus == select-disabled-fieldset-2.html select-fieldset-ref.html
++needs-focus == select-disabled-fieldset-1.html select-fieldset-ref.html
++fuzzy-if(skiaContent&&!Android,2,10) needs-focus == select-disabled-fieldset-2.html select-fieldset-ref.html
+ fuzzy-if(skiaContent,2,10) needs-focus == select-fieldset-legend.html select-fieldset-legend-ref.html
+ fuzzy-if(skiaContent,2,5) needs-focus == select-novalidate.html select-required-ref.html
+diff --git layout/reftests/css-valid/select/reftest.list layout/reftests/css-valid/select/reftest.list
+index ac77e60d68a7..fc84eb8541c5 100644
+--- layout/reftests/css-valid/select/reftest.list
++++ layout/reftests/css-valid/select/reftest.list
+@@ -7,6 +7,6 @@ needs-focus == select-required-invalid.html select-required-ref.html
+ needs-focus == select-required-valid.html select-required-ref.html
+ needs-focus == select-required-multiple-still-valid.html select-required-multiple-ref.html
+ fuzzy-if(skiaContent,1,250) needs-focus == select-required-multiple-valid.html select-required-multiple-ref.html
+-fails-if(Android) needs-focus == select-disabled-fieldset-1.html select-fieldset-ref.html
+-fails-if(Android) fuzzy-if(skiaContent&&!Android,1,3) needs-focus == select-disabled-fieldset-2.html select-fieldset-ref.html
++needs-focus == select-disabled-fieldset-1.html select-fieldset-ref.html
++fuzzy-if(skiaContent&&!Android,1,3) needs-focus == select-disabled-fieldset-2.html select-fieldset-ref.html
+ needs-focus == select-fieldset-legend.html select-fieldset-legend-ref.html
diff --git a/www/waterfox/files/patch-bug1402094 b/www/waterfox/files/patch-bug1402094
new file mode 100644
index 000000000000..b901b43f5f13
--- /dev/null
+++ b/www/waterfox/files/patch-bug1402094
@@ -0,0 +1,57 @@
+commit 447413f00860
+Author: Xidorn Quan <me@upsuper.org>
+Date:   Thu Sep 28 16:19:45 2017 +1000
+
+    Bug 1402094 - Blacklist about:reader from using stylo. r=bholley, a=sledru
+    
+    MozReview-Commit-ID: 6cG1x1tcOwn
+    
+    --HG--
+    extra : source : 813556d9e389f580d8e6efa9c24825edec952259
+---
+ dom/base/nsDocument.cpp | 25 ++++++++++++++++++++++++-
+ 1 file changed, 24 insertions(+), 1 deletion(-)
+
+diff --git dom/base/nsDocument.cpp dom/base/nsDocument.cpp
+index 07ef9ef817b7..7f8ebecffa97 100644
+--- dom/base/nsDocument.cpp
++++ dom/base/nsDocument.cpp
+@@ -13575,6 +13575,29 @@ nsIDocument::ReportHasScrollLinkedEffect()
+                                   "ScrollLinkedEffectFound2");
+ }
+ 
++#ifdef MOZ_STYLO
++// URL-based blacklist for stylo.
++static bool
++ShouldUseGeckoBackend(nsIURI* aDocumentURI)
++{
++  if (!aDocumentURI) {
++    return false;
++  }
++  bool isScheme = false;
++  if (NS_SUCCEEDED(aDocumentURI->SchemeIs("about", &isScheme))) {
++    nsAutoCString path;
++    aDocumentURI->GetFilePath(path);
++    // about:reader requires support of :scope pseudo-class so we have
++    // to use Gecko backend for now. See bug 1402094.
++    // This should be fixed by bug 1204818.
++    if (path.EqualsLiteral("reader")) {
++      return true;
++    }
++  }
++  return false;
++}
++#endif // MOZ_STYLO
++
+ void
+ nsIDocument::UpdateStyleBackendType()
+ {
+@@ -13593,7 +13616,7 @@ nsIDocument::UpdateStyleBackendType()
+     // Note that, since tests can have XUL support, we still need to
+     // explicitly exclude XUL documents here.
+     if (!nsContentUtils::IsSystemPrincipal(NodePrincipal()) &&
+-        !IsXULDocument()) {
++        !IsXULDocument() && !ShouldUseGeckoBackend(mDocumentURI)) {
+       mStyleBackendType = StyleBackendType::Servo;
+     }
+   }
diff --git a/www/waterfox/files/patch-bug1402205 b/www/waterfox/files/patch-bug1402205
new file mode 100644
index 000000000000..a91f52251035
--- /dev/null
+++ b/www/waterfox/files/patch-bug1402205
@@ -0,0 +1,77 @@
+commit 86b6592ab804
+Author: Haik Aftandilian <haftandilian@mozilla.com>
+Date:   Mon Sep 25 15:48:40 2017 -0700
+
+    Bug 1402205 - Non-existent background page blocks extension startup. r=kmag, a=sledru
+    
+    Add calls to OnStartRequest() and OnStopRequest() to properly handle async
+    read failures for remote JAR's and remote unpacked extension resources.
+    
+    MozReview-Commit-ID: Dcg0LDht9B9
+    
+    --HG--
+    extra : source : 611582e42451dd26fcaa38f251e2203a6e8b0bf9
+---
+ netwerk/protocol/res/ExtensionProtocolHandler.cpp | 23 +++++++++++++++++------
+ 1 file changed, 17 insertions(+), 6 deletions(-)
+
+diff --git netwerk/protocol/res/ExtensionProtocolHandler.cpp netwerk/protocol/res/ExtensionProtocolHandler.cpp
+index 326c21d13057..a2d900f95b96 100644
+--- netwerk/protocol/res/ExtensionProtocolHandler.cpp
++++ netwerk/protocol/res/ExtensionProtocolHandler.cpp
+@@ -253,6 +253,19 @@ ExtensionStreamGetter::GetAsync(nsIStreamListener* aListener,
+   return Ok();
+ }
+ 
++static void
++CancelRequest(nsIStreamListener* aListener,
++              nsIChannel* aChannel,
++              nsresult aResult)
++{
++  MOZ_ASSERT(aListener);
++  MOZ_ASSERT(aChannel);
++
++  aListener->OnStartRequest(aChannel, nullptr);
++  aListener->OnStopRequest(aChannel, nullptr, aResult);
++  aChannel->Cancel(NS_BINDING_ABORTED);
++}
++
+ // Handle an input stream sent from the parent.
+ void
+ ExtensionStreamGetter::OnStream(nsIInputStream* aStream)
+@@ -269,9 +282,7 @@ ExtensionStreamGetter::OnStream(nsIInputStream* aStream)
+ 
+   if (!aStream) {
+     // The parent didn't send us back a stream.
+-    listener->OnStartRequest(mChannel, nullptr);
+-    listener->OnStopRequest(mChannel, nullptr, NS_ERROR_FILE_ACCESS_DENIED);
+-    mChannel->Cancel(NS_BINDING_ABORTED);
++    CancelRequest(listener, mChannel, NS_ERROR_FILE_ACCESS_DENIED);
+     return;
+   }
+ 
+@@ -279,13 +290,13 @@ ExtensionStreamGetter::OnStream(nsIInputStream* aStream)
+   nsresult rv = NS_NewInputStreamPump(getter_AddRefs(pump), aStream, -1, -1, 0,
+                                       0, false, mMainThreadEventTarget);
+   if (NS_FAILED(rv)) {
+-    mChannel->Cancel(NS_BINDING_ABORTED);
++    CancelRequest(listener, mChannel, rv);
+     return;
+   }
+ 
+   rv = pump->AsyncRead(listener, nullptr);
+   if (NS_FAILED(rv)) {
+-    mChannel->Cancel(NS_BINDING_ABORTED);
++    CancelRequest(listener, mChannel, rv);
+   }
+ }
+ 
+@@ -310,7 +321,7 @@ ExtensionStreamGetter::OnFD(const FileDescriptor& aFD)
+   mJarChannel->SetJarFile(fdFile);
+   nsresult rv = mJarChannel->AsyncOpen2(listener);
+   if (NS_FAILED(rv)) {
+-    mChannel->Cancel(NS_BINDING_ABORTED);
++    CancelRequest(listener, mChannel, rv);
+   }
+ }
+ 
diff --git a/www/waterfox/files/patch-bug1402366 b/www/waterfox/files/patch-bug1402366
new file mode 100644
index 000000000000..393c36e27ef0
--- /dev/null
+++ b/www/waterfox/files/patch-bug1402366
@@ -0,0 +1,87 @@
+commit 0211305e7012
+Author: Emilio Cobos Álvarez <emilio@crisal.io>
+Date:   Fri Sep 22 21:23:11 2017 +0200
+
+    Bug 1402366 - Mark datetimebox as not needing xul.css. r=bholley, r=jessica, a=sledru
+    
+    We create a datetimebox in content documents that gets an XBL binding on
+    nsDateTimeControlFrame::CreateAnonymousContent.
+    
+    This is done during frame construction, and loading a datetimebox insert xul.css
+    in the document, which causes invalidation to run.
+    
+    datetimebox styles are in html.css, and there's no rule in xul.css that styles
+    it, so we don't need to load the stylesheet at all.
+    
+    MozReview-Commit-ID: 2SbIOoER2uB
+    
+    --HG--
+    extra : source : 5b642e09aacd450f7ea2b667d2d453a701a30e15
+---
+ dom/xul/nsXULElement.cpp | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git dom/xul/nsXULElement.cpp dom/xul/nsXULElement.cpp
+index f1a87e917182..2c3574cd6580 100644
+--- dom/xul/nsXULElement.cpp
++++ dom/xul/nsXULElement.cpp
+@@ -696,6 +696,7 @@ static inline bool XULElementsRulesInMinimalXULSheet(nsIAtom* aTag)
+          aTag == nsGkAtoms::thumb ||
+          aTag == nsGkAtoms::scale ||
+          // other
++         aTag == nsGkAtoms::datetimebox ||
+          aTag == nsGkAtoms::resizer ||
+          aTag == nsGkAtoms::label ||
+          aTag == nsGkAtoms::videocontrols;
+@@ -810,9 +811,7 @@ nsXULElement::BindToTree(nsIDocument* aDocument,
+       // pulling in xul.css.
+       // Note that add-ons may introduce bindings that cause this assertion to
+       // fire.
+-      NS_ASSERTION(IsInVideoControls(this) ||
+-                   IsInFeedSubscribeLine(this) ||
+-                   IsXULElement(nsGkAtoms::datetimebox),
++      NS_ASSERTION(IsInVideoControls(this) || IsInFeedSubscribeLine(this),
+                    "Unexpected XUL element in non-XUL doc");
+     }
+   }
+
+commit 07adf4398955
+Author: Emilio Cobos Álvarez <emilio@crisal.io>
+Date:   Mon Sep 25 10:16:36 2017 +0200
+
+    Bug 1402366 - Crashtest. r=me, a=sledru
+    
+    MozReview-Commit-ID: 8ZcVBHKNntj
+    
+    --HG--
+    extra : source : 7fde3082d44b416af788f2ba09834fb3403eb8ff
+---
+ layout/style/crashtests/1402366.html    | 10 ++++++++++
+ layout/style/crashtests/crashtests.list |  1 +
+ 2 files changed, 11 insertions(+)
+
+diff --git layout/style/crashtests/1402366.html layout/style/crashtests/1402366.html
+new file mode 100644
+index 000000000000..9cffd08f0415
+--- /dev/null
++++ layout/style/crashtests/1402366.html
+@@ -0,0 +1,10 @@
++<script>
++document.documentElement.appendChild(document.createElement('x'))
++a = document.createElement('x')
++document.documentElement.appendChild(a)
++new Range().getClientRects()
++document.documentElement.appendChild(document.createElement('tr'))
++b = document.createElement('input')
++b.type = 'date'
++document.documentElement.insertBefore(b, a)
++</script>
+diff --git layout/style/crashtests/crashtests.list layout/style/crashtests/crashtests.list
+index 9cd557a44187..be05f417d6aa 100644
+--- layout/style/crashtests/crashtests.list
++++ layout/style/crashtests/crashtests.list
+@@ -203,3 +203,4 @@ load 1387499.html
+ load 1391577.html
+ load 1398581.html
+ load 1402218-1.html
++load 1402366.html
diff --git a/www/waterfox/files/patch-bug1402469 b/www/waterfox/files/patch-bug1402469
new file mode 100644
index 000000000000..4dae69a93f04
--- /dev/null
+++ b/www/waterfox/files/patch-bug1402469
@@ -0,0 +1,182 @@
+commit 6b4f644b9a4e
+Author: Makoto Kato <m_kato@ga2.so-net.ne.jp>
+Date:   Mon Sep 25 14:15:50 2017 +0900
+
+    Bug 1402469 - Part 1. Return value of ConvertListType should use Element instead of nsresult. r=masayuki, a=sledru
+    
+    This is a typo bug of Bug 1053779 Part 2.  ConvertListType might return NS_OK
+    even if ReplaceContainer doesn't return valid value.
+    
+    So, to clean up code, we should return Element instead of nsresult since out
+    parameter of this function is Element only.
+    
+    MozReview-Commit-ID: 44UHETzcdGy
+    
+    --HG--
+    extra : source : 5efdecc086858b4b4e5b0fcf9b7f27ef63d91738
+---
+ editor/libeditor/HTMLEditRules.cpp | 47 +++++++++++++++++---------------------
+ editor/libeditor/HTMLEditRules.h   |  4 ++--
+ 2 files changed, 23 insertions(+), 28 deletions(-)
+
+diff --git editor/libeditor/HTMLEditRules.cpp editor/libeditor/HTMLEditRules.cpp
+index ad613517269d..fdb15fec7b2f 100644
+--- editor/libeditor/HTMLEditRules.cpp
++++ editor/libeditor/HTMLEditRules.cpp
+@@ -2960,9 +2960,8 @@ HTMLEditRules::TryToJoinBlocks(nsIContent& aLeftNode,
+     // Nodes are same type.  merge them.
+     EditorDOMPoint pt = JoinNodesSmart(*leftBlock, *rightBlock);
+     if (pt.node && mergeLists) {
+-      nsCOMPtr<Element> newBlock;
+-      ConvertListType(rightBlock, getter_AddRefs(newBlock),
+-                      existingList, nsGkAtoms::li);
++      RefPtr<Element> newBlock =
++        ConvertListType(rightBlock, existingList, nsGkAtoms::li);
+     }
+     ret.MarkAsHandled();
+   } else {
+@@ -3320,18 +3319,19 @@ HTMLEditRules::WillMakeList(Selection* aSelection,
+         NS_ENSURE_STATE(mHTMLEditor);
+         rv = mHTMLEditor->MoveNode(curNode, curList, -1);
+         NS_ENSURE_SUCCESS(rv, rv);
+-        rv = ConvertListType(curNode->AsElement(), getter_AddRefs(newBlock),
+-                             listType, itemType);
+-        NS_ENSURE_SUCCESS(rv, rv);
++        newBlock = ConvertListType(curNode->AsElement(), listType, itemType);
++        if (NS_WARN_IF(!newBlock)) {
++          return NS_ERROR_FAILURE;
++        }
+         NS_ENSURE_STATE(mHTMLEditor);
+         rv = mHTMLEditor->RemoveBlockContainer(*newBlock);
+         NS_ENSURE_SUCCESS(rv, rv);
+       } else {
+         // replace list with new list type
+-        rv = ConvertListType(curNode->AsElement(), getter_AddRefs(newBlock),
+-                             listType, itemType);
+-        NS_ENSURE_SUCCESS(rv, rv);
+-        curList = newBlock;
++        curList = ConvertListType(curNode->AsElement(), listType, itemType);
++        if (NS_WARN_IF(!curList)) {
++          return NS_ERROR_FAILURE;
++        }
+       }
+       prevListItem = nullptr;
+       continue;
+@@ -4495,14 +4495,12 @@ HTMLEditRules::OutdentPartOfBlock(Element& aBlock,
+ /**
+  * ConvertListType() converts list type and list item type.
+  */
+-nsresult
++already_AddRefed<Element>
+ HTMLEditRules::ConvertListType(Element* aList,
+-                               Element** aOutList,
+                                nsIAtom* aListType,
+                                nsIAtom* aItemType)
+ {
+   MOZ_ASSERT(aList);
+-  MOZ_ASSERT(aOutList);
+   MOZ_ASSERT(aListType);
+   MOZ_ASSERT(aItemType);
+ 
+@@ -4513,29 +4511,26 @@ HTMLEditRules::ConvertListType(Element* aList,
+       if (HTMLEditUtils::IsListItem(element) &&
+           !element->IsHTMLElement(aItemType)) {
+         child = mHTMLEditor->ReplaceContainer(element, aItemType);
+-        NS_ENSURE_STATE(child);
++        if (NS_WARN_IF(!child)) {
++          return nullptr;
++        }
+       } else if (HTMLEditUtils::IsList(element) &&
+                  !element->IsHTMLElement(aListType)) {
+-        nsCOMPtr<dom::Element> temp;
+-        nsresult rv = ConvertListType(child->AsElement(), getter_AddRefs(temp),
+-                                      aListType, aItemType);
+-        NS_ENSURE_SUCCESS(rv, rv);
+-        child = temp.forget();
++        child = ConvertListType(child->AsElement(), aListType, aItemType);
++        if (NS_WARN_IF(!child)) {
++          return nullptr;
++        }
+       }
+     }
+     child = child->GetNextSibling();
+   }
+ 
+   if (aList->IsHTMLElement(aListType)) {
+-    nsCOMPtr<dom::Element> list = aList->AsElement();
+-    list.forget(aOutList);
+-    return NS_OK;
++    RefPtr<dom::Element> list = aList->AsElement();
++    return list.forget();
+   }
+ 
+-  *aOutList = mHTMLEditor->ReplaceContainer(aList, aListType).take();
+-  NS_ENSURE_STATE(aOutList);
+-
+-  return NS_OK;
++  return mHTMLEditor->ReplaceContainer(aList, aListType);
+ }
+ 
+ 
+diff --git editor/libeditor/HTMLEditRules.h editor/libeditor/HTMLEditRules.h
+index d1bb1fa7e3b2..0dde7f01e408 100644
+--- editor/libeditor/HTMLEditRules.h
++++ editor/libeditor/HTMLEditRules.h
+@@ -316,8 +316,8 @@ protected:
+                               nsIContent** aOutLeftNode,
+                               nsIContent** aOutRightNode);
+ 
+-  nsresult ConvertListType(Element* aList, Element** aOutList,
+-                           nsIAtom* aListType, nsIAtom* aItemType);
++  already_AddRefed<Element> ConvertListType(Element* aList, nsIAtom* aListType,
++                                            nsIAtom* aItemType);
+ 
+   nsresult CreateStyleForInsertText(Selection& aSelection, nsIDocument& aDoc);
+   enum class MozBRCounts { yes, no };
+
+commit 5e5f298b8e42
+Author: Makoto Kato <m_kato@ga2.so-net.ne.jp>
+Date:   Mon Sep 25 14:11:29 2017 +0900
+
+    Bug 1402469 - Part 2. Add crash test. r=masayuki, a=sledru
+    
+    MozReview-Commit-ID: HogVH2OTyd6
+    
+    --HG--
+    extra : source : 5e311cd7074e6b649187f5a79371f0681c2d7504
+---
+ editor/libeditor/crashtests/1402469.html    | 16 ++++++++++++++++
+ editor/libeditor/crashtests/crashtests.list |  1 +
+ 2 files changed, 17 insertions(+)
+
+diff --git editor/libeditor/crashtests/1402469.html editor/libeditor/crashtests/1402469.html
+new file mode 100644
+index 000000000000..04b1adc96f25
+--- /dev/null
++++ editor/libeditor/crashtests/1402469.html
+@@ -0,0 +1,16 @@
++<html>
++<head>
++<script type="application/javascript">
++function do_test() {
++  document.execCommand("insertUnorderedList", false);
++}
++</script>
++</head>
++<body onload="do_test()">
++<table>
++  <th contenteditable="true">
++    <ol contenteditable="false">
++  </th>
++</table>
++</body>
++</html>
+diff --git editor/libeditor/crashtests/crashtests.list editor/libeditor/crashtests/crashtests.list
+index 11672c41d102..840e26f2fe62 100644
+--- editor/libeditor/crashtests/crashtests.list
++++ editor/libeditor/crashtests/crashtests.list
+@@ -80,3 +80,4 @@ load 1366176.html
+ load 1375131.html
+ load 1381541.html
+ load 1383755.html
++load 1402469.html
diff --git a/www/waterfox/files/patch-bug1402681 b/www/waterfox/files/patch-bug1402681
new file mode 100644
index 000000000000..6fddbdf9937d
--- /dev/null
+++ b/www/waterfox/files/patch-bug1402681
@@ -0,0 +1,138 @@
+commit ffcf40b7a0e9
+Author: Alastor Wu <alwu@mozilla.com>
+Date:   Tue Sep 26 17:48:19 2017 +0800
+
+    Bug 1402681 - Part 1: Do not queue the task without task queue. r=jya, a=sledru
+    
+    Since the source buffer is a wrapped native, it would be unlinked twice and then the
+    TrackBuffersManager::Detach() would also be called twice.
+    
+    The first detach task would clear the task queue of TrackBuffersManager, and then we
+    won't accept any new task without task queue. The second detach task should not be
+    executed.
+    
+    MozReview-Commit-ID: AWTzVbRH5B1
+    
+    --HG--
+    extra : source : 145eac8ba70636cdb1a235d6d7094b87bbfd8022
+---
+ dom/media/mediasource/TrackBuffersManager.cpp | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git dom/media/mediasource/TrackBuffersManager.cpp dom/media/mediasource/TrackBuffersManager.cpp
+index 50293810064b..cda89faaff51 100644
+--- dom/media/mediasource/TrackBuffersManager.cpp
++++ dom/media/mediasource/TrackBuffersManager.cpp
+@@ -145,6 +145,15 @@ TrackBuffersManager::DoAppendData(already_AddRefed<MediaByteBuffer> aData,
+ void
+ TrackBuffersManager::QueueTask(SourceBufferTask* aTask)
+ {
++  // The source buffer is a wrapped native, it would be unlinked twice and so
++  // the TrackBuffersManager::Detach() would also be called twice. Since the
++  // detach task has been done before, we could ignore this task.
++  if (!GetTaskQueue()) {
++    MOZ_ASSERT(aTask->GetType() == SourceBufferTask::Type::Detach,
++               "only detach task could happen here!");
++    return;
++  }
++
+   if (!OnTaskQueue()) {
+     GetTaskQueue()->Dispatch(NewRunnableMethod<RefPtr<SourceBufferTask>>(
+       "TrackBuffersManager::QueueTask",
+
+commit 99e2204da6a1
+Author: Alastor Wu <alwu@mozilla.com>
+Date:   Tue Sep 26 17:48:39 2017 +0800
+
+    Bug 1402681 - Part 2: Add log. r=jya, a=sledru
+    
+    MozReview-Commit-ID: 8qINxSCKrvg
+    
+    --HG--
+    extra : source : 0cac2e15b4ca7cf03e75ee208da624495215382f
+---
+ dom/media/mediasource/SourceBufferTask.h      | 7 +++++++
+ dom/media/mediasource/TrackBuffersManager.cpp | 4 ++++
+ 2 files changed, 11 insertions(+)
+
+diff --git dom/media/mediasource/SourceBufferTask.h dom/media/mediasource/SourceBufferTask.h
+index 183e7b4b2a0b..b73094fbd282 100644
+--- dom/media/mediasource/SourceBufferTask.h
++++ dom/media/mediasource/SourceBufferTask.h
+@@ -32,6 +32,7 @@ public:
+   typedef MozPromise<bool, nsresult, /* IsExclusive = */ true> RangeRemovalPromise;
+ 
+   virtual Type GetType() const = 0;
++  virtual const char* GetTypeName() const = 0;
+ 
+   template<typename ReturnType>
+   ReturnType* As()
+@@ -54,6 +55,7 @@ public:
+ 
+   static const Type sType = Type::AppendBuffer;
+   Type GetType() const override { return Type::AppendBuffer; }
++  const char* GetTypeName() const override { return "AppendBuffer"; }
+ 
+   RefPtr<MediaByteBuffer> mBuffer;
+   SourceBufferAttributes mAttributes;
+@@ -64,12 +66,14 @@ class AbortTask : public SourceBufferTask {
+ public:
+   static const Type sType = Type::Abort;
+   Type GetType() const override { return Type::Abort; }
++  const char* GetTypeName() const override { return "Abort"; }
+ };
+ 
+ class ResetTask : public SourceBufferTask {
+ public:
+   static const Type sType = Type::Reset;
+   Type GetType() const override { return Type::Reset; }
++  const char* GetTypeName() const override { return "Reset"; }
+ };
+ 
+ class RangeRemovalTask : public SourceBufferTask {
+@@ -80,6 +84,7 @@ public:
+ 
+   static const Type sType = Type::RangeRemoval;
+   Type GetType() const override { return Type::RangeRemoval; }
++  const char* GetTypeName() const override { return "RangeRemoval"; }
+ 
+   media::TimeInterval mRange;
+   MozPromiseHolder<RangeRemovalPromise> mPromise;
+@@ -94,6 +99,7 @@ public:
+ 
+   static const Type sType = Type::EvictData;
+   Type GetType() const override { return Type::EvictData; }
++  const char* GetTypeName() const override { return "EvictData"; }
+ 
+   media::TimeUnit mPlaybackTime;
+   int64_t mSizeToEvict;
+@@ -103,6 +109,7 @@ class DetachTask : public SourceBufferTask {
+ public:
+   static const Type sType = Type::Detach;
+   Type GetType() const override { return Type::Detach; }
++  const char* GetTypeName() const override { return "Detach"; }
+ };
+ 
+ } // end mozilla namespace
+diff --git dom/media/mediasource/TrackBuffersManager.cpp dom/media/mediasource/TrackBuffersManager.cpp
+index cda89faaff51..b9b768b726a2 100644
+--- dom/media/mediasource/TrackBuffersManager.cpp
++++ dom/media/mediasource/TrackBuffersManager.cpp
+@@ -151,6 +151,8 @@ TrackBuffersManager::QueueTask(SourceBufferTask* aTask)
+   if (!GetTaskQueue()) {
+     MOZ_ASSERT(aTask->GetType() == SourceBufferTask::Type::Detach,
+                "only detach task could happen here!");
++    MSE_DEBUG("Could not queue the task '%s' without task queue",
++              aTask->GetTypeName());
+     return;
+   }
+ 
+@@ -183,6 +185,8 @@ TrackBuffersManager::ProcessTasks()
+     // nothing to do.
+     return;
+   }
++
++  MSE_DEBUG("Process task '%s'", task->GetTypeName());
+   switch (task->GetType()) {
+     case Type::AppendBuffer:
+       mCurrentTask = task;
diff --git a/www/waterfox/files/patch-bug1403282 b/www/waterfox/files/patch-bug1403282
new file mode 100644
index 000000000000..baab3804b1bb
--- /dev/null
+++ b/www/waterfox/files/patch-bug1403282
@@ -0,0 +1,180 @@
+commit fc20d87173c4
+Author: Manish Goregaokar <manishearth@gmail.com>
+Date:   Tue Sep 26 23:56:15 2017 -0500
+
+    Bug 1403282 - stylo: Don't error out on trailing whitespace in attr(). r=bz, a=sledru
+    
+    Source-Repo: https://github.com/servo/servo
+    Source-Revision: 97227aaca3613e22afc832554d29f7f7fdfb7220
+    
+    --HG--
+    extra : source : 4263e1c081c940b4eae7bcd388274ec8c5b5dd8b
+---
+ servo/components/style/values/specified/mod.rs | 44 ++++++++++++++------------
+ 1 file changed, 24 insertions(+), 20 deletions(-)
+
+diff --git servo/components/style/values/specified/mod.rs servo/components/style/values/specified/mod.rs
+index 856aecca90ac..72ed1b1de83a 100644
+--- servo/components/style/values/specified/mod.rs
++++ servo/components/style/values/specified/mod.rs
+@@ -739,28 +739,32 @@ impl Attr {
+         let first = input.try(|i| i.expect_ident_cloned()).ok();
+         if let Ok(token) = input.try(|i| i.next_including_whitespace().map(|t| t.clone())) {
+             match token {
+-                Token::Delim('|') => {}
++                Token::Delim('|') => {
++                    // must be followed by an ident
++                    let second_token = match *input.next_including_whitespace()? {
++                        Token::Ident(ref second) => second,
++                        ref t => return Err(BasicParseError::UnexpectedToken(t.clone()).into()),
++                    };
++
++                    let ns_with_id = if let Some(ns) = first {
++                        let ns = Namespace::from(ns.as_ref());
++                        let id: Result<_, ParseError> =
++                            get_id_for_namespace(&ns, context)
++                            .map_err(|()| StyleParseError::UnspecifiedError.into());
++                        Some((ns, id?))
++                    } else {
++                        None
++                    };
++                    return Ok(Attr {
++                        namespace: ns_with_id,
++                        attribute: second_token.as_ref().to_owned(),
++                    })
++                }
++                // In the case of attr(foobar    ) we don't want to error out
++                // because of the trailing whitespace
++                Token::WhiteSpace(_) => (),
+                 ref t => return Err(BasicParseError::UnexpectedToken(t.clone()).into()),
+             }
+-            // must be followed by an ident
+-            let second_token = match *input.next_including_whitespace()? {
+-                Token::Ident(ref second) => second,
+-                ref t => return Err(BasicParseError::UnexpectedToken(t.clone()).into()),
+-            };
+-
+-            let ns_with_id = if let Some(ns) = first {
+-                let ns = Namespace::from(ns.as_ref());
+-                let id: Result<_, ParseError> =
+-                    get_id_for_namespace(&ns, context)
+-                    .map_err(|()| StyleParseError::UnspecifiedError.into());
+-                Some((ns, id?))
+-            } else {
+-                None
+-            };
+-            return Ok(Attr {
+-                namespace: ns_with_id,
+-                attribute: second_token.as_ref().to_owned(),
+-            })
+         }
+ 
+         if let Some(first) = first {
+
+commit 20bbda2d12de
+Author: Manish Goregaokar <manishearth@gmail.com>
+Date:   Tue Sep 26 13:54:22 2017 -0700
+
+    Bug 1403282 - stylo: Add reftests for whitespace in attr(). r=bz, a=sledru
+    
+    MozReview-Commit-ID: IMXFY7bpKGf
+    
+    --HG--
+    extra : source : cfcb518088438415e5c6f7776dc268abd0b86119
+---
+ .../generated-content/attr-whitespace-ref.html     | 10 ++++
+ .../generated-content/attr-whitespace.xhtml        | 60 ++++++++++++++++++++++
+ layout/reftests/generated-content/reftest.list     |  1 +
+ 3 files changed, 71 insertions(+)
+
+diff --git layout/reftests/generated-content/attr-whitespace-ref.html layout/reftests/generated-content/attr-whitespace-ref.html
+new file mode 100644
+index 000000000000..54a74fe4d81f
+--- /dev/null
++++ layout/reftests/generated-content/attr-whitespace-ref.html
+@@ -0,0 +1,10 @@
++<!DOCTYPE HTML>
++<html>
++<body>
++<div>HelloWorld</div>
++<div>HelloWorld</div>
++<div>HelloWorld</div>
++<div>Hello</div>
++<div>Hello</div>
++</body>
++</html>
+diff --git layout/reftests/generated-content/attr-whitespace.xhtml layout/reftests/generated-content/attr-whitespace.xhtml
+new file mode 100644
+index 000000000000..e9b6554849b0
+--- /dev/null
++++ layout/reftests/generated-content/attr-whitespace.xhtml
+@@ -0,0 +1,60 @@
++<?xml version="1.0" encoding="UTF-8"?>
++<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
++  "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
++<html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml">
++<head>
++    <title>Whitespace in attributes</title>
++    <link rel="author" title="Manish Goregaokar" href="mailto:manishearth@gmail.com" />
++    <link rel="author" title="Mozilla Corporation" href="http://mozilla.com/" />
++    <link rel="help" href="https://drafts.csswg.org/css-values-3/#attr-notation"/>
++<style>
++@namespace ns url(http://www.example.com/ns);
++/* Spaces within attr() are fine*/
++#a::after {
++
++  content: attr(          
++      data-text  
++
++
++          );
++}
++#b::after {
++
++  content: attr(ns|data-text);
++}
++#c::after {
++
++  content: attr(          
++      ns|data-text  
++
++
++          );
++}
++
++/* No whitespace around the | */
++#d::after {
++
++  content: attr(          
++      ns      |data-text
++
++
++          );
++}
++#e::after {
++
++  content: attr(          
++      ns|       data-text
++
++
++          );
++}
++</style>
++</head>
++<body xmlns:ns="http://www.example.com/ns">
++<div id="a" data-text="World">Hello</div>
++<div id="b" ns:data-text="World">Hello</div>
++<div id="b" ns:data-text="World">Hello</div>
++<div id="d" ns:data-text="World">Hello</div>
++<div id="e" ns:data-text="World">Hello</div>
++</body>
++</html>
+diff --git layout/reftests/generated-content/reftest.list layout/reftests/generated-content/reftest.list
+index e07a0dd565a5..c789f1845421 100644
+--- layout/reftests/generated-content/reftest.list
++++ layout/reftests/generated-content/reftest.list
+@@ -19,3 +19,4 @@ fuzzy-if(OSX==1010,1,10) == table-parts-01.html table-parts-01-ref.html
+ == before-style-sharing.html before-style-sharing-ref.html
+ == transitive-style-invalidation.html transitive-style-invalidation-ref.html
+ == dynamic-content.html dynamic-content-ref.html
++== attr-whitespace.xhtml attr-whitespace-ref.html
diff --git a/www/waterfox/files/patch-bug1403465 b/www/waterfox/files/patch-bug1403465
new file mode 100644
index 000000000000..23ed5a79d30d
--- /dev/null
+++ b/www/waterfox/files/patch-bug1403465
@@ -0,0 +1,60 @@
+commit f2c88f86dc5b
+Author: Emilio Cobos Álvarez <emilio@crisal.io>
+Date:   Thu Sep 28 10:40:02 2017 +0200
+
+    Bug 1403465 - style: Avoid creating element data in Servo_ResolvePseudoStyle. r=bholley, a=sledru
+    
+    The reason the patch in bug 1402285 doesn't work is that we call this function
+    multiple times with the same element. This fixes it.
+    
+    MozReview-Commit-ID: Ko9zirCOzTR
+    
+    --HG--
+    extra : transplant_source : qegB%06%15r/%F2%BDm%86%9C%C7%91%06%FA-%1E%A8
+---
+ servo/ports/geckolib/glue.rs | 27 +++++++++++++++++----------
+ 1 file changed, 17 insertions(+), 10 deletions(-)
+
+diff --git servo/ports/geckolib/glue.rs servo/ports/geckolib/glue.rs
+index 714947fc1812..2f2938f4890b 100644
+--- servo/ports/geckolib/glue.rs
++++ servo/ports/geckolib/glue.rs
+@@ -1767,21 +1767,28 @@ pub extern "C" fn Servo_ResolvePseudoStyle(element: RawGeckoElementBorrowed,
+      -> ServoStyleContextStrong
+ {
+     let element = GeckoElement(element);
+-    let data = unsafe { element.ensure_data() };
+     let doc_data = PerDocumentStyleData::from_ffi(raw_data).borrow();
+ 
+     debug!("Servo_ResolvePseudoStyle: {:?} {:?}, is_probe: {}",
+            element, PseudoElement::from_pseudo_type(pseudo_type), is_probe);
+ 
+-    // FIXME(bholley): Assert against this.
+-    if !data.has_styles() {
+-        warn!("Calling Servo_ResolvePseudoStyle on unstyled element");
+-        return if is_probe {
+-            Strong::null()
+-        } else {
+-            doc_data.default_computed_values().clone().into()
+-        };
+-    }
++    let data = element.borrow_data();
++
++    let data = match data.as_ref() {
++        Some(data) if data.has_styles() => data,
++        _ => {
++            // FIXME(bholley, emilio): Assert against this.
++            //
++            // Known offender is nsMathMLmoFrame::MarkIntrinsicISizesDirty,
++            // which goes and does a bunch of work involving style resolution.
++            warn!("Calling Servo_ResolvePseudoStyle on unstyled element");
++            return if is_probe {
++                Strong::null()
++            } else {
++                doc_data.default_computed_values().clone().into()
++            };
++        }
++    };
+ 
+     let pseudo = PseudoElement::from_pseudo_type(pseudo_type)
+                     .expect("ResolvePseudoStyle with a non-pseudo?");
diff --git a/www/waterfox/files/patch-bug1403473 b/www/waterfox/files/patch-bug1403473
new file mode 100644
index 000000000000..87196f41522a
--- /dev/null
+++ b/www/waterfox/files/patch-bug1403473
@@ -0,0 +1,27 @@
+commit 3da3e74521d4 (HEAD)
+Author: Thomas Nguyen <tnguyen@mozilla.com>
+Date:   Fri Sep 29 01:46:00 2017 -0400
+
+    Bug 1403473 - Init loggingEnable for hashcompleter. r=dimi, a=sledru
+    
+    MozReview-Commit-ID: 1BpErwmbgCM
+    
+    --HG--
+    extra : amend_source : 5993fe27195003ac1fa77f89b4d14187cbff591e
+---
+ toolkit/components/url-classifier/nsUrlClassifierHashCompleter.js | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git toolkit/components/url-classifier/nsUrlClassifierHashCompleter.js toolkit/components/url-classifier/nsUrlClassifierHashCompleter.js
+index eac72dadabd3..16b1b7dc7c52 100644
+--- toolkit/components/url-classifier/nsUrlClassifierHashCompleter.js
++++ toolkit/components/url-classifier/nsUrlClassifierHashCompleter.js
+@@ -184,6 +184,8 @@ function HashCompleter() {
+ 
+   Services.obs.addObserver(this, "quit-application");
+   Services.prefs.addObserver(PREF_DEBUG_ENABLED, this);
++
++  loggingEnabled = Services.prefs.getBoolPref(PREF_DEBUG_ENABLED);
+ }
+ 
+ HashCompleter.prototype = {
diff --git a/www/waterfox/files/patch-bug1403592 b/www/waterfox/files/patch-bug1403592
new file mode 100644
index 000000000000..a716a4fd183e
--- /dev/null
+++ b/www/waterfox/files/patch-bug1403592
@@ -0,0 +1,157 @@
+commit 79c72166bf05
+Author: Emilio Cobos Álvarez <emilio@crisal.io>
+Date:   Wed Sep 27 18:09:31 2017 +0200
+
+    Bug 1403592 - Never flush the user font set when getting font metrics from style resolution. r=Manishearth, a=sledru
+    
+    In this case, the caller doesn't go through all the PreTraverseSync stuff (we
+    don't really want it to do so), via GetComputedStyleNoFlush.
+    
+    It makes sense to not flush the user font set that case, we'll schedule a
+    restyle properly if / when needed.
+    
+    Since the set should be flushed otherwise, let's just not flush it from the
+    styling code.
+    
+    MozReview-Commit-ID: LLHfxemJ8QQ
+    
+    --HG--
+    extra : source : 0a0cc4bb885a2487b643e94fc244620751616d03
+---
+ layout/style/ServoBindings.cpp |  7 ++++---
+ layout/style/nsRuleNode.cpp    | 13 ++++++++-----
+ layout/style/nsRuleNode.h      |  8 +++++++-
+ 3 files changed, 19 insertions(+), 9 deletions(-)
+
+diff --git layout/style/ServoBindings.cpp layout/style/ServoBindings.cpp
+index ac2a6cc2ec01..d248e6ad1401 100644
+--- layout/style/ServoBindings.cpp
++++ layout/style/ServoBindings.cpp
+@@ -2482,9 +2482,10 @@ Gecko_GetFontMetrics(RawGeckoPresContextBorrowed aPresContext,
+ 
+   nsPresContext* presContext = const_cast<nsPresContext*>(aPresContext);
+   presContext->SetUsesExChUnits(true);
+-  RefPtr<nsFontMetrics> fm = nsRuleNode::GetMetricsFor(presContext, aIsVertical,
+-                                                       aFont, aFontSize,
+-                                                       aUseUserFontSet);
++  RefPtr<nsFontMetrics> fm = nsRuleNode::GetMetricsFor(
++      presContext, aIsVertical, aFont, aFontSize, aUseUserFontSet,
++      nsRuleNode::FlushUserFontSet::No);
++
+   ret.mXSize = fm->XHeight();
+   gfxFloat zeroWidth = fm->GetThebesFontGroup()->GetFirstValidFont()->
+                            GetMetrics(fm->Orientation()).zeroOrAveCharWidth;
+diff --git layout/style/nsRuleNode.cpp layout/style/nsRuleNode.cpp
+index ccccce98009e..fbb5e3824e2f 100644
+--- layout/style/nsRuleNode.cpp
++++ layout/style/nsRuleNode.cpp
+@@ -377,7 +377,8 @@ nsRuleNode::GetMetricsFor(nsPresContext* aPresContext,
+                           bool aIsVertical,
+                           const nsStyleFont* aStyleFont,
+                           nscoord aFontSize,
+-                          bool aUseUserFontSet)
++                          bool aUseUserFontSet,
++                          FlushUserFontSet aFlushUserFontSet)
+ {
+   nsFont font = aStyleFont->mFont;
+   font.size = aFontSize;
+@@ -387,8 +388,9 @@ nsRuleNode::GetMetricsFor(nsPresContext* aPresContext,
+   params.language = aStyleFont->mLanguage;
+   params.explicitLanguage = aStyleFont->mExplicitLanguage;
+   params.orientation = orientation;
+-  params.userFontSet =
+-    aUseUserFontSet ? aPresContext->GetUserFontSet() : nullptr;
++  params.userFontSet = aUseUserFontSet
++    ? aPresContext->GetUserFontSet(aFlushUserFontSet == FlushUserFontSet::Yes)
++    : nullptr;
+   params.textPerf = aPresContext->GetTextPerfMetrics();
+   return aPresContext->DeviceContext()->GetMetricsFor(font, params);
+ }
+@@ -408,8 +410,9 @@ nsRuleNode::GetMetricsFor(nsPresContext* aPresContext,
+       isVertical = true;
+     }
+   }
+-  return nsRuleNode::GetMetricsFor(aPresContext, isVertical, aStyleFont,
+-                                   aFontSize, aUseUserFontSet);
++  return nsRuleNode::GetMetricsFor(
++      aPresContext, isVertical, aStyleFont, aFontSize, aUseUserFontSet,
++      FlushUserFontSet::Yes);
+ }
+ 
+ /* static */
+diff --git layout/style/nsRuleNode.h layout/style/nsRuleNode.h
+index 423545ffd198..719eb0c51eb0 100644
+--- layout/style/nsRuleNode.h
++++ layout/style/nsRuleNode.h
+@@ -807,11 +807,17 @@ public:
+                                  bool aConvertListItem = false);
+   static void EnsureInlineDisplay(mozilla::StyleDisplay& display);
+ 
++  enum class FlushUserFontSet {
++    Yes,
++    No,
++  };
++
+   static already_AddRefed<nsFontMetrics> GetMetricsFor(nsPresContext* aPresContext,
+                                                        bool aIsVertical,
+                                                        const nsStyleFont* aStyleFont,
+                                                        nscoord aFontSize,
+-                                                       bool aUseUserFontSet);
++                                                       bool aUseUserFontSet,
++                                                       FlushUserFontSet aFlushUserFontSet);
+ 
+   static already_AddRefed<nsFontMetrics> GetMetricsFor(nsPresContext* aPresContext,
+                                                        nsStyleContext* aStyleContext,
+commit f01f1d6ac516
+Author: Emilio Cobos Álvarez <emilio@crisal.io>
+Date:   Wed Sep 27 18:16:25 2017 +0200
+
+    Bug 1403592 - Crashtest. r=Manishearth, a=sledru
+    
+    I've made it crash at least once, though it's intermittent-y. I guess it's
+    better than no crashtest.
+    
+    MozReview-Commit-ID: 5m2VCrEs8lM
+    
+    --HG--
+    extra : source : c050d8574203c0344a9570fef73df51a1a489091
+    extra : amend_source : 45265a4fbe7d484fc784c3389f912d45eebf15de
+---
+ layout/style/crashtests/1403592.html    | 19 +++++++++++++++++++
+ layout/style/crashtests/crashtests.list |  1 +
+ 2 files changed, 20 insertions(+)
+
+diff --git layout/style/crashtests/1403592.html layout/style/crashtests/1403592.html
+new file mode 100644
+index 000000000000..fdd810b88603
+--- /dev/null
++++ layout/style/crashtests/1403592.html
+@@ -0,0 +1,19 @@
++<!DOCTYPE html>
++<html class="reftest-wait">
++<head>
++<style></style>
++<script>
++function boom() {
++  a = document.createElement("x")
++  a.style.overflow = "o"
++  document.styleSheets[0].insertRule("i {}", 0)
++  requestIdleCallback(function() {
++    document.documentElement.className = "";
++  });
++}
++requestIdleCallback(boom)
++</script>
++</head>
++<i id=id0 style="margin: 15ch">
++<svg><animate xlink:href=#id0 attributeName=width to></svg>
++</html>
+diff --git layout/style/crashtests/crashtests.list layout/style/crashtests/crashtests.list
+index 565abf6c1f83..e811e54554b3 100644
+--- layout/style/crashtests/crashtests.list
++++ layout/style/crashtests/crashtests.list
+@@ -204,3 +204,4 @@ load 1391577.html
+ load 1398581.html
+ load 1402218-1.html
+ load 1402366.html
++load 1403592.html