Merging upstream version 126.0.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

17 files changed, 118 insertions, 99 deletions

diff --git a/dom/html/CustomStateSet.cpp b/dom/html/CustomStateSet.cpp
index 4e24551f5e..bb3621b195 100644
--- a/dom/html/CustomStateSet.cpp
+++ b/dom/html/CustomStateSet.cpp
@@ -38,32 +38,39 @@ void CustomStateSet::Clear(ErrorResult& aRv) {
     return;
   }
 
-  mTarget->EnsureCustomStates().Clear();
-  InvalidateStyleFromCustomStateSetChange();
-}
-
-void CustomStateSet::InvalidateStyleFromCustomStateSetChange() const {
-  Document* doc = mTarget->OwnerDoc();
-
-  PresShell* presShell = doc->GetPresShell();
-  if (!presShell) {
+  nsTArray<RefPtr<nsAtom>>& states = mTarget->EnsureCustomStates();
+  Document* doc = mTarget->GetComposedDoc();
+  PresShell* presShell = doc ? doc->GetPresShell() : nullptr;
+  if (presShell) {
+    presShell->CustomStatesWillChange(*mTarget);
+    // Iterate over each state to ensure each one is invalidated.
+    while (!states.IsEmpty()) {
+      RefPtr<nsAtom> atom = states.PopLastElement();
+      presShell->CustomStateChanged(*mTarget, atom);
+    }
     return;
   }
 
-  // TODO: make this more efficient?
-  presShell->DestroyFramesForAndRestyle(mTarget);
+  states.Clear();
 }
 
 bool CustomStateSet::Delete(const nsAString& aState, ErrorResult& aRv) {
-  if (!CustomStateSet_Binding::SetlikeHelpers::Delete(this, aState, aRv) ||
-      aRv.Failed()) {
+  CustomStateSet_Binding::SetlikeHelpers::Delete(this, aState, aRv);
+  if (aRv.Failed()) {
     return false;
   }
 
   RefPtr<nsAtom> atom = NS_AtomizeMainThread(aState);
+  Document* doc = mTarget->GetComposedDoc();
+  PresShell* presShell = doc ? doc->GetPresShell() : nullptr;
+  if (presShell) {
+    presShell->CustomStatesWillChange(*mTarget);
+  }
+
   bool deleted = mTarget->EnsureCustomStates().RemoveElement(atom);
-  if (deleted) {
-    InvalidateStyleFromCustomStateSetChange();
+
+  if (presShell) {
+    presShell->CustomStateChanged(*mTarget, atom);
   }
   return deleted;
 }
@@ -74,9 +81,23 @@ void CustomStateSet::Add(const nsAString& aState, ErrorResult& aRv) {
     return;
   }
 
+  nsTArray<RefPtr<nsAtom>>& states = mTarget->EnsureCustomStates();
   RefPtr<nsAtom> atom = NS_AtomizeMainThread(aState);
-  mTarget->EnsureCustomStates().AppendElement(atom);
-  InvalidateStyleFromCustomStateSetChange();
+  if (states.Contains(atom)) {
+    return;
+  }
+
+  Document* doc = mTarget->GetComposedDoc();
+  PresShell* presShell = doc ? doc->GetPresShell() : nullptr;
+  if (presShell) {
+    presShell->CustomStatesWillChange(*mTarget);
+  }
+
+  states.AppendElement(atom);
+
+  if (presShell) {
+    presShell->CustomStateChanged(*mTarget, atom);
+  }
 }
 
 }  // namespace mozilla::dom
diff --git a/dom/html/CustomStateSet.h b/dom/html/CustomStateSet.h
index 095974b5f4..a28a22011e 100644
--- a/dom/html/CustomStateSet.h
+++ b/dom/html/CustomStateSet.h
@@ -35,8 +35,6 @@ class CustomStateSet final : public nsISupports, public nsWrapperCache {
   static MOZ_CAN_RUN_SCRIPT_BOUNDARY already_AddRefed<CustomStateSet>
   Constructor(const GlobalObject& aGlobal, ErrorResult& aRv);
 
-  void InvalidateStyleFromCustomStateSetChange() const;
-
   MOZ_CAN_RUN_SCRIPT void Clear(ErrorResult& aRv);
 
   /**
diff --git a/dom/html/HTMLAnchorElement.h b/dom/html/HTMLAnchorElement.h
index 4d89c6a75b..88669549e3 100644
--- a/dom/html/HTMLAnchorElement.h
+++ b/dom/html/HTMLAnchorElement.h
@@ -68,11 +68,11 @@ class HTMLAnchorElement final : public nsGenericHTMLElement,
 
   // WebIDL API
 
-  void GetHref(nsAString& aValue) const {
+  void GetHref(nsACString& aValue) const {
     GetURIAttr(nsGkAtoms::href, nullptr, aValue);
   }
-  void SetHref(const nsAString& aValue, mozilla::ErrorResult& rv) {
-    SetHTMLAttr(nsGkAtoms::href, aValue, rv);
+  void SetHref(const nsACString& aValue, ErrorResult& aRv) {
+    SetHTMLAttr(nsGkAtoms::href, NS_ConvertUTF8toUTF16(aValue), aRv);
   }
   void GetTarget(nsAString& aValue) const;
   void SetTarget(const nsAString& aValue, mozilla::ErrorResult& rv) {
@@ -180,8 +180,6 @@ class HTMLAnchorElement final : public nsGenericHTMLElement,
   void SetShape(const nsAString& aValue, mozilla::ErrorResult& rv) {
     SetHTMLAttr(nsGkAtoms::shape, aValue, rv);
   }
-  void Stringify(nsAString& aResult) const { GetHref(aResult); }
-  void ToString(nsAString& aSource) const { GetHref(aSource); }
 
   void NodeInfoChanged(Document* aOldDoc) final {
     ClearHasPendingLinkUpdate();
diff --git a/dom/html/HTMLAreaElement.cpp b/dom/html/HTMLAreaElement.cpp
index e07150cc06..fc47069ead 100644
--- a/dom/html/HTMLAreaElement.cpp
+++ b/dom/html/HTMLAreaElement.cpp
@@ -92,8 +92,6 @@ void HTMLAreaElement::AfterSetAttr(int32_t aNamespaceID, nsAtom* aName,
       aNamespaceID, aName, aValue, aOldValue, aSubjectPrincipal, aNotify);
 }
 
-void HTMLAreaElement::ToString(nsAString& aSource) { GetHref(aSource); }
-
 already_AddRefed<nsIURI> HTMLAreaElement::GetHrefURI() const {
   if (nsCOMPtr<nsIURI> uri = GetCachedURI()) {
     return uri.forget();
diff --git a/dom/html/HTMLAreaElement.h b/dom/html/HTMLAreaElement.h
index 3effb1a87e..6e9744ae62 100644
--- a/dom/html/HTMLAreaElement.h
+++ b/dom/html/HTMLAreaElement.h
@@ -64,12 +64,11 @@ class HTMLAreaElement final : public nsGenericHTMLElement, public Link {
     SetHTMLAttr(nsGkAtoms::shape, aShape, aError);
   }
 
-  // argument type nsAString for nsContextMenuInfo
-  void GetHref(nsAString& aValue) {
+  void GetHref(nsACString& aValue) {
     GetURIAttr(nsGkAtoms::href, nullptr, aValue);
   }
-  void SetHref(const nsAString& aHref, ErrorResult& aError) {
-    SetHTMLAttr(nsGkAtoms::href, aHref, aError);
+  void SetHref(const nsACString& aHref, ErrorResult& aError) {
+    SetHTMLAttr(nsGkAtoms::href, NS_ConvertUTF8toUTF16(aHref), aError);
   }
 
   void GetTarget(DOMString& aValue);
@@ -85,13 +84,11 @@ class HTMLAreaElement final : public nsGenericHTMLElement, public Link {
   }
 
   void GetPing(DOMString& aValue) { GetHTMLAttr(nsGkAtoms::ping, aValue); }
-
   void SetPing(const nsAString& aPing, ErrorResult& aError) {
     SetHTMLAttr(nsGkAtoms::ping, aPing, aError);
   }
 
   void GetRel(DOMString& aValue) { GetHTMLAttr(nsGkAtoms::rel, aValue); }
-
   void SetRel(const nsAString& aRel, ErrorResult& aError) {
     SetHTMLAttr(nsGkAtoms::rel, aRel, aError);
   }
@@ -141,9 +138,6 @@ class HTMLAreaElement final : public nsGenericHTMLElement, public Link {
     SetHTMLBoolAttr(nsGkAtoms::nohref, aValue, aError);
   }
 
-  void ToString(nsAString& aSource);
-  void Stringify(nsAString& aResult) { GetHref(aResult); }
-
   void NodeInfoChanged(Document* aOldDoc) final {
     ClearHasPendingLinkUpdate();
     nsGenericHTMLElement::NodeInfoChanged(aOldDoc);
diff --git a/dom/html/HTMLInputElement.cpp b/dom/html/HTMLInputElement.cpp
index d5a65a1755..958601616b 100644
--- a/dom/html/HTMLInputElement.cpp
+++ b/dom/html/HTMLInputElement.cpp
@@ -5921,7 +5921,7 @@ nsresult HTMLInputElement::SetDefaultValueAsValue() {
 void HTMLInputElement::SetAutoDirectionality(bool aNotify,
                                              const nsAString* aKnownValue) {
   if (!IsAutoDirectionalityAssociated()) {
-    return SetDirectionality(GetParentDirectionality(this), aNotify);
+    return SetDirectionality(Directionality::Ltr, aNotify);
   }
   nsAutoString value;
   if (!aKnownValue) {
diff --git a/dom/html/HTMLMarqueeElement.cpp b/dom/html/HTMLMarqueeElement.cpp
index 9719f83ea3..8721086064 100644
--- a/dom/html/HTMLMarqueeElement.cpp
+++ b/dom/html/HTMLMarqueeElement.cpp
@@ -34,11 +34,6 @@ static const nsAttrValue::EnumTable kDirectionTable[] = {
 // Default direction value is "left".
 static const nsAttrValue::EnumTable* kDefaultDirection = &kDirectionTable[0];
 
-bool HTMLMarqueeElement::IsEventAttributeNameInternal(nsAtom* aName) {
-  return nsContentUtils::IsEventAttributeName(
-      aName, EventNameType_HTML | EventNameType_HTMLMarqueeOnly);
-}
-
 JSObject* HTMLMarqueeElement::WrapNode(JSContext* aCx,
                                        JS::Handle<JSObject*> aGivenProto) {
   return dom::HTMLMarqueeElement_Binding::Wrap(aCx, this, aGivenProto);
@@ -112,19 +107,6 @@ bool HTMLMarqueeElement::ParseAttribute(int32_t aNamespaceID,
                                               aMaybeScriptedPrincipal, aResult);
 }
 
-void HTMLMarqueeElement::AfterSetAttr(int32_t aNameSpaceID, nsAtom* aName,
-                                      const nsAttrValue* aValue,
-                                      const nsAttrValue* aOldValue,
-                                      nsIPrincipal* aMaybeScriptedPrincipal,
-                                      bool aNotify) {
-  if (IsInComposedDoc() && aNameSpaceID == kNameSpaceID_None &&
-      aName == nsGkAtoms::direction) {
-    NotifyUAWidgetSetupOrChange();
-  }
-  return nsGenericHTMLElement::AfterSetAttr(
-      aNameSpaceID, aName, aValue, aOldValue, aMaybeScriptedPrincipal, aNotify);
-}
-
 void HTMLMarqueeElement::MapAttributesIntoRule(
     MappedDeclarationsBuilder& aBuilder) {
   nsGenericHTMLElement::MapImageMarginAttributeInto(aBuilder);
diff --git a/dom/html/HTMLMarqueeElement.h b/dom/html/HTMLMarqueeElement.h
index f93f6b4944..2abebdcd9d 100644
--- a/dom/html/HTMLMarqueeElement.h
+++ b/dom/html/HTMLMarqueeElement.h
@@ -25,8 +25,6 @@ class HTMLMarqueeElement final : public nsGenericHTMLElement {
   static const int kDefaultScrollAmount = 6;
   static const int kDefaultScrollDelayMS = 85;
 
-  bool IsEventAttributeNameInternal(nsAtom* aName) override;
-
   void GetBehavior(nsAString& aValue);
   void SetBehavior(const nsAString& aValue, ErrorResult& aError) {
     SetHTMLAttr(nsGkAtoms::behavior, aValue, aError);
@@ -104,10 +102,6 @@ class HTMLMarqueeElement final : public nsGenericHTMLElement {
                       const nsAString& aValue,
                       nsIPrincipal* aMaybeScriptedPrincipal,
                       nsAttrValue& aResult) override;
-  void AfterSetAttr(int32_t aNameSpaceID, nsAtom* aName,
-                    const nsAttrValue* aValue, const nsAttrValue* aOldValue,
-                    nsIPrincipal* aMaybeScriptedPrincipal,
-                    bool aNotify) override;
   NS_IMETHOD_(bool) IsAttributeMapped(const nsAtom* aAttribute) const override;
   nsMapRuleToAttributesFunc GetAttributeMappingFunction() const override;
 
diff --git a/dom/html/HTMLMediaElement.cpp b/dom/html/HTMLMediaElement.cpp
index 4ea52ccdf6..877f3ec3ba 100644
--- a/dom/html/HTMLMediaElement.cpp
+++ b/dom/html/HTMLMediaElement.cpp
@@ -454,7 +454,7 @@ class HTMLMediaElement::MediaControlKeyListener final
   void HandleMediaKey(MediaControlKey aKey) override {
     MOZ_ASSERT(NS_IsMainThread());
     MOZ_ASSERT(IsStarted());
-    MEDIACONTROL_LOG("HandleEvent '%s'", ToMediaControlKeyStr(aKey));
+    MEDIACONTROL_LOG("HandleEvent '%s'", GetEnumString(aKey).get());
     if (aKey == MediaControlKey::Play) {
       Owner()->Play();
     } else if (aKey == MediaControlKey::Pause) {
@@ -565,6 +565,10 @@ class HTMLMediaElement::MediaStreamTrackListener
   explicit MediaStreamTrackListener(HTMLMediaElement* aElement)
       : mElement(aElement) {}
 
+  NS_DECL_ISUPPORTS_INHERITED
+  NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(MediaStreamTrackListener,
+                                           DOMMediaStream::TrackListener)
+
   void NotifyTrackAdded(const RefPtr<MediaStreamTrack>& aTrack) override {
     if (!mElement) {
       return;
@@ -678,16 +682,26 @@ class HTMLMediaElement::MediaStreamTrackListener
   }
 
  protected:
-  const WeakPtr<HTMLMediaElement> mElement;
+  virtual ~MediaStreamTrackListener() = default;
+  RefPtr<HTMLMediaElement> mElement;
 };
 
+NS_IMPL_CYCLE_COLLECTION_INHERITED(HTMLMediaElement::MediaStreamTrackListener,
+                                   DOMMediaStream::TrackListener, mElement)
+NS_IMPL_ADDREF_INHERITED(HTMLMediaElement::MediaStreamTrackListener,
+                         DOMMediaStream::TrackListener)
+NS_IMPL_RELEASE_INHERITED(HTMLMediaElement::MediaStreamTrackListener,
+                          DOMMediaStream::TrackListener)
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
+    HTMLMediaElement::MediaStreamTrackListener)
+NS_INTERFACE_MAP_END_INHERITING(DOMMediaStream::TrackListener)
+
 /**
  * Helper class that manages audio and video outputs for all enabled tracks in a
  * media element. It also manages calculating the current time when playing a
  * MediaStream.
  */
-class HTMLMediaElement::MediaStreamRenderer
-    : public DOMMediaStream::TrackListener {
+class HTMLMediaElement::MediaStreamRenderer {
  public:
   NS_INLINE_DECL_REFCOUNTING(MediaStreamRenderer)
 
@@ -1973,6 +1987,7 @@ NS_IMPL_CYCLE_COLLECTION_CLASS(HTMLMediaElement)
 
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(HTMLMediaElement,
                                                   nsGenericHTMLElement)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mStreamWindowCapturer)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mMediaSource)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mSrcMediaSource)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mSrcStream)
@@ -1988,6 +2003,7 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(HTMLMediaElement,
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mTextTrackManager)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mAudioTrackList)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mVideoTrackList)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mMediaStreamTrackListener)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mMediaKeys)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mIncomingMediaKeys)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mSelectedVideoStreamTrack)
@@ -2022,6 +2038,7 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(HTMLMediaElement,
           tmp->mMediaStreamTrackListener.get());
     }
   }
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mStreamWindowCapturer)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mSrcStream)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mSrcAttrStream)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mMediaSource)
@@ -2040,6 +2057,7 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(HTMLMediaElement,
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mTextTrackManager)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mAudioTrackList)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mVideoTrackList)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mMediaStreamTrackListener)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mMediaKeys)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mIncomingMediaKeys)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mSelectedVideoStreamTrack)
@@ -5270,7 +5288,7 @@ void HTMLMediaElement::SetupSrcMediaStreamPlayback(DOMMediaStream* aStream) {
     NotifyMediaStreamTrackAdded(track);
   }
 
-  mMediaStreamTrackListener = MakeUnique<MediaStreamTrackListener>(this);
+  mMediaStreamTrackListener = new MediaStreamTrackListener(this);
   mSrcStream->RegisterTrackListener(mMediaStreamTrackListener.get());
 
   ChangeNetworkState(NETWORK_IDLE);
@@ -7347,7 +7365,9 @@ void HTMLMediaElement::AudioCaptureTrackChange(bool aCapture) {
         CaptureStreamInternal(StreamCaptureBehavior::CONTINUE_WHEN_ENDED,
                               StreamCaptureType::CAPTURE_AUDIO, mtg);
     mStreamWindowCapturer =
-        MakeUnique<MediaStreamWindowCapturer>(stream, window->WindowID());
+        new MediaStreamWindowCapturer(stream, window->WindowID());
+    mStreamWindowCapturer->mStream->RegisterTrackListener(
+        mStreamWindowCapturer);
   } else if (!aCapture && mStreamWindowCapturer) {
     for (size_t i = 0; i < mOutputStreams.Length(); i++) {
       if (mOutputStreams[i].mStream == mStreamWindowCapturer->mStream) {
@@ -7361,6 +7381,9 @@ void HTMLMediaElement::AudioCaptureTrackChange(bool aCapture) {
         break;
       }
     }
+
+    mStreamWindowCapturer->mStream->UnregisterTrackListener(
+        mStreamWindowCapturer);
     mStreamWindowCapturer = nullptr;
     if (mOutputStreams.IsEmpty()) {
       mTracksCaptured = nullptr;
diff --git a/dom/html/HTMLMediaElement.h b/dom/html/HTMLMediaElement.h
index eef276b43d..6c159a7971 100644
--- a/dom/html/HTMLMediaElement.h
+++ b/dom/html/HTMLMediaElement.h
@@ -1455,7 +1455,7 @@ class HTMLMediaElement : public nsGenericHTMLElement,
 
   // Holds a reference to the stream connecting this stream to the window
   // capture sink.
-  UniquePtr<MediaStreamWindowCapturer> mStreamWindowCapturer;
+  RefPtr<MediaStreamWindowCapturer> mStreamWindowCapturer;
 
   // Holds references to the DOM wrappers for the MediaStreams that we're
   // writing to.
@@ -1770,7 +1770,7 @@ class HTMLMediaElement : public nsGenericHTMLElement,
 
   RefPtr<VideoTrackList> mVideoTrackList;
 
-  UniquePtr<MediaStreamTrackListener> mMediaStreamTrackListener;
+  RefPtr<MediaStreamTrackListener> mMediaStreamTrackListener;
 
   // The principal guarding mVideoFrameContainer access when playing a
   // MediaStream.
diff --git a/dom/html/TextControlState.cpp b/dom/html/TextControlState.cpp
index 11f7619699..cbc10452ca 100644
--- a/dom/html/TextControlState.cpp
+++ b/dom/html/TextControlState.cpp
@@ -2877,8 +2877,7 @@ bool TextControlState::SetValueWithoutTextEditor(
 
   // We can't just early-return here, because OnValueChanged below still need to
   // be called.
-  if (!mValue.Equals(aHandlingSetValue.GetSettingValue()) ||
-      !StaticPrefs::dom_input_skip_cursor_move_for_same_value_set()) {
+  if (!mValue.Equals(aHandlingSetValue.GetSettingValue())) {
     bool handleSettingValue = true;
     // If `SetValue()` call is nested, `GetSettingValue()` result will be
     // modified.  So, we need to store input event data value before
diff --git a/dom/html/nsGenericHTMLElement.cpp b/dom/html/nsGenericHTMLElement.cpp
index 1014ba2a25..1deaf719d3 100644
--- a/dom/html/nsGenericHTMLElement.cpp
+++ b/dom/html/nsGenericHTMLElement.cpp
@@ -646,7 +646,6 @@ already_AddRefed<nsIURI> nsGenericHTMLElement::GetHrefURIForAnchors() const {
   // We use the nsAttrValue's copy of the URI string to avoid copying.
   nsCOMPtr<nsIURI> uri;
   GetURIAttr(nsGkAtoms::href, nullptr, getter_AddRefs(uri));
-
   return uri.forget();
 }
 
@@ -1661,34 +1660,50 @@ uint32_t nsGenericHTMLElement::GetDimensionAttrAsUnsignedInt(
 void nsGenericHTMLElement::GetURIAttr(nsAtom* aAttr, nsAtom* aBaseAttr,
                                       nsAString& aResult) const {
   nsCOMPtr<nsIURI> uri;
-  bool hadAttr = GetURIAttr(aAttr, aBaseAttr, getter_AddRefs(uri));
-  if (!hadAttr) {
+  const nsAttrValue* attr = GetURIAttr(aAttr, aBaseAttr, getter_AddRefs(uri));
+  if (!attr) {
     aResult.Truncate();
     return;
   }
-
   if (!uri) {
     // Just return the attr value
-    GetAttr(aAttr, aResult);
+    attr->ToString(aResult);
     return;
   }
-
   nsAutoCString spec;
   uri->GetSpec(spec);
   CopyUTF8toUTF16(spec, aResult);
 }
 
-bool nsGenericHTMLElement::GetURIAttr(nsAtom* aAttr, nsAtom* aBaseAttr,
-                                      nsIURI** aURI) const {
+void nsGenericHTMLElement::GetURIAttr(nsAtom* aAttr, nsAtom* aBaseAttr,
+                                      nsACString& aResult) const {
+  nsCOMPtr<nsIURI> uri;
+  const nsAttrValue* attr = GetURIAttr(aAttr, aBaseAttr, getter_AddRefs(uri));
+  if (!attr) {
+    aResult.Truncate();
+    return;
+  }
+  if (!uri) {
+    // Just return the attr value
+    nsAutoString value;
+    attr->ToString(value);
+    CopyUTF16toUTF8(value, aResult);
+    return;
+  }
+  uri->GetSpec(aResult);
+}
+
+const nsAttrValue* nsGenericHTMLElement::GetURIAttr(nsAtom* aAttr,
+                                                    nsAtom* aBaseAttr,
+                                                    nsIURI** aURI) const {
   *aURI = nullptr;
 
   const nsAttrValue* attr = mAttrs.GetAttr(aAttr);
   if (!attr) {
-    return false;
+    return nullptr;
   }
 
   nsCOMPtr<nsIURI> baseURI = GetBaseURI();
-
   if (aBaseAttr) {
     nsAutoString baseAttrValue;
     if (GetAttr(aBaseAttr, baseAttrValue)) {
@@ -1696,7 +1711,7 @@ bool nsGenericHTMLElement::GetURIAttr(nsAtom* aAttr, nsAtom* aBaseAttr,
       nsresult rv = nsContentUtils::NewURIWithDocumentCharset(
           getter_AddRefs(baseAttrURI), baseAttrValue, OwnerDoc(), baseURI);
       if (NS_FAILED(rv)) {
-        return true;
+        return attr;
       }
       baseURI.swap(baseAttrURI);
     }
@@ -1706,7 +1721,7 @@ bool nsGenericHTMLElement::GetURIAttr(nsAtom* aAttr, nsAtom* aBaseAttr,
   // return true, and *aURI will be null.
   nsContentUtils::NewURIWithDocumentCharset(aURI, attr->GetStringValue(),
                                             OwnerDoc(), baseURI);
-  return true;
+  return attr;
 }
 
 bool nsGenericHTMLElement::IsLabelable() const {
diff --git a/dom/html/nsGenericHTMLElement.h b/dom/html/nsGenericHTMLElement.h
index 227e052fdf..86f87e8795 100644
--- a/dom/html/nsGenericHTMLElement.h
+++ b/dom/html/nsGenericHTMLElement.h
@@ -60,7 +60,6 @@ class nsGenericHTMLElement : public nsGenericHTMLElementBase {
       : nsGenericHTMLElementBase(std::move(aNodeInfo)) {
     NS_ASSERTION(mNodeInfo->NamespaceID() == kNameSpaceID_XHTML,
                  "Unexpected namespace");
-    AddStatesSilently(mozilla::dom::ElementState::LTR);
   }
 
   NS_INLINE_DECL_REFCOUNTING_INHERITED(nsGenericHTMLElement,
@@ -641,6 +640,7 @@ class nsGenericHTMLElement : public nsGenericHTMLElementBase {
    * @param aResult    result value [out]
    */
   void GetURIAttr(nsAtom* aAttr, nsAtom* aBaseAttr, nsAString& aResult) const;
+  void GetURIAttr(nsAtom* aAttr, nsAtom* aBaseAttr, nsACString& aResult) const;
 
   /**
    * Gets the absolute URI values of an attribute, by resolving any relative
@@ -648,7 +648,8 @@ class nsGenericHTMLElement : public nsGenericHTMLElementBase {
    * isn't a relative URI, the substring is returned as is. Only works for
    * attributes in null namespace.
    */
-  bool GetURIAttr(nsAtom* aAttr, nsAtom* aBaseAttr, nsIURI** aURI) const;
+  const nsAttrValue* GetURIAttr(nsAtom* aAttr, nsAtom* aBaseAttr,
+                                nsIURI** aURI) const;
 
   bool IsHidden() const { return HasAttr(nsGkAtoms::hidden); }
 
@@ -767,6 +768,9 @@ class nsGenericHTMLElement : public nsGenericHTMLElementBase {
   void GetHTMLURIAttr(nsAtom* aName, nsAString& aResult) const {
     GetURIAttr(aName, nullptr, aResult);
   }
+  void GetHTMLURIAttr(nsAtom* aName, nsACString& aResult) const {
+    GetURIAttr(aName, nullptr, aResult);
+  }
 
   void SetHTMLAttr(nsAtom* aName, const nsAString& aValue) {
     SetAttr(kNameSpaceID_None, aName, aValue, true);
diff --git a/dom/html/test/browser_ImageDocument_svg_zoom.js b/dom/html/test/browser_ImageDocument_svg_zoom.js
index f0df2282a3..0bf0b98065 100644
--- a/dom/html/test/browser_ImageDocument_svg_zoom.js
+++ b/dom/html/test/browser_ImageDocument_svg_zoom.js
@@ -13,7 +13,7 @@ function test_once() {
         `${rect.width}x${rect.height}, ${content.innerWidth}x${content.innerHeight}`
       );
       is(
-        Math.round(rect.height),
+        Math.trunc(rect.height),
         content.innerHeight,
         "Should fill the viewport and not overflow"
       );
diff --git a/dom/html/test/browser_bug436200.js b/dom/html/test/browser_bug436200.js
index 7e739c02ad..ca11a3e994 100644
--- a/dom/html/test/browser_bug436200.js
+++ b/dom/html/test/browser_bug436200.js
@@ -8,12 +8,6 @@ const kTestPage = "https://example.org/browser/dom/html/test/bug436200.html";
 async function run_test(shouldShowPrompt, msg) {
   let promptShown = false;
 
-  function tabModalObserver(subject) {
-    promptShown = true;
-    subject.querySelector(".tabmodalprompt-button0").click();
-  }
-  Services.obs.addObserver(tabModalObserver, "tabmodal-dialog-loaded");
-
   function commonDialogObserver(subject) {
     let dialog = subject.Dialog;
     promptShown = true;
@@ -27,7 +21,6 @@ async function run_test(shouldShowPrompt, msg) {
     let form = content.document.getElementById("test_form");
     form.submit();
   });
-  Services.obs.removeObserver(tabModalObserver, "tabmodal-dialog-loaded");
   Services.obs.removeObserver(commonDialogObserver, "common-dialog-loaded");
 
   is(promptShown, shouldShowPrompt, msg);
diff --git a/dom/html/test/forms/test_input_password_click_show_password_button.html b/dom/html/test/forms/test_input_password_click_show_password_button.html
index 76f4e066f5..5a6b24e82c 100644
--- a/dom/html/test/forms/test_input_password_click_show_password_button.html
+++ b/dom/html/test/forms/test_input_password_click_show_password_button.html
@@ -37,16 +37,16 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=502258
     element.type = "text";
     await new Promise(resolve => requestAnimationFrame(resolve));
     var typeTextSnapshot = await snapshotWindow(window);
-    results = compareSnapshots(baseSnapshot, typeTextSnapshot, true);
-    ok(results[0], aId + ": type=text should render the same as type=password that is showing the password");
+    info(aId + ": type=text should render the same as type=password that is showing the password");
+    assertSnapshots(baseSnapshot, typeTextSnapshot, true, null, aId + ": base", aId + ": type=text");
 
     // Re-setting value shouldn't change anything.
     // eslint-disable-next-line no-self-assign
     element.value = element.value;
     var tmpSnapshot = await snapshotWindow(window);
 
-    results = compareSnapshots(baseSnapshot, tmpSnapshot, true);
-    ok(results[0], aId + ": re-setting the value should change nothing");
+    info(aId + ": re-setting the value should change nothing");
+    assertSnapshots(baseSnapshot, tmpSnapshot, true, null, aId + ": base", aId + ": tmp");
   }
 
   async function reset_show_password(aId, concealedSnapshot) {
@@ -54,8 +54,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=502258
     element.type = "password";
     await new Promise(resolve => requestAnimationFrame(resolve));
     var typePasswordSnapshot = await snapshotWindow(window);
-    results = compareSnapshots(concealedSnapshot, typePasswordSnapshot, true);
-    ok(results[0], aId + ": changing the type attribute should conceal the password again");
+    info(aId + ": changing the type attribute should conceal the password again");
+    assertSnapshots(concealedSnapshot, typePasswordSnapshot, true, null, aId + ": concealed", aId + ": type=password");
   }
 
   async function runTest() {
diff --git a/dom/html/test/test_document-element-inserted.html b/dom/html/test/test_document-element-inserted.html
index 6d7e8695ce..59228b393e 100644
--- a/dom/html/test/test_document-element-inserted.html
+++ b/dom/html/test/test_document-element-inserted.html
@@ -28,7 +28,7 @@ var observe = function(doc){
 
 var media = document.getElementById('media');
 var tests = [
-    "../../../media/test/short-video.ogv",
+    "../../../media/test/vp9.webm",
     "../../../media/test/sound.ogg",
     "../../content/test/image.png"
 ]