Merging upstream version 126.0.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

9 files changed, 556 insertions, 141 deletions

diff --git a/modules/libjar/nsIZipReader.idl b/modules/libjar/nsIZipReader.idl
index b6a1f70abd..abead2841a 100644
--- a/modules/libjar/nsIZipReader.idl
+++ b/modules/libjar/nsIZipReader.idl
@@ -225,7 +225,7 @@ interface nsIZipReaderCache : nsISupports
     /**
      * returns true if this zipreader already has this file cached
      */
-    bool isCached(in nsIFile zipFile);
+    boolean isCached(in nsIFile zipFile);
 
     /**
      * Returns a (possibly shared) nsIZipReader for a zip inside another zip
diff --git a/modules/libjar/zipwriter/nsDeflateConverter.cpp b/modules/libjar/zipwriter/nsDeflateConverter.cpp
index b3f4301234..26aabc3ad5 100644
--- a/modules/libjar/zipwriter/nsDeflateConverter.cpp
+++ b/modules/libjar/zipwriter/nsDeflateConverter.cpp
@@ -133,6 +133,11 @@ NS_IMETHODIMP nsDeflateConverter::OnDataAvailable(nsIRequest* aRequest,
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsDeflateConverter::MaybeRetarget(nsIRequest* request) {
+  return NS_ERROR_NOT_IMPLEMENTED;
+}
+
 NS_IMETHODIMP nsDeflateConverter::OnStartRequest(nsIRequest* aRequest) {
   if (!mListener) return NS_ERROR_NOT_INITIALIZED;
 
diff --git a/modules/libpref/Preferences.cpp b/modules/libpref/Preferences.cpp
index 47759ffadc..5b7df133cd 100644
--- a/modules/libpref/Preferences.cpp
+++ b/modules/libpref/Preferences.cpp
@@ -21,6 +21,7 @@
 #include "mozilla/Attributes.h"
 #include "mozilla/Components.h"
 #include "mozilla/dom/PContent.h"
+#include "mozilla/dom/Promise.h"
 #include "mozilla/dom/RemoteType.h"
 #include "mozilla/HashFunctions.h"
 #include "mozilla/HashTable.h"
@@ -74,6 +75,7 @@
 #include "nsIZipReader.h"
 #include "nsNetUtil.h"
 #include "nsPrintfCString.h"
+#include "nsProxyRelease.h"
 #include "nsReadableUtils.h"
 #include "nsRefPtrHashtable.h"
 #include "nsRelativeFilePref.h"
@@ -112,8 +114,13 @@
 #  include "mozilla/WidgetUtilsGtk.h"
 #endif  // defined(MOZ_WIDGET_GTK)
 
+#ifdef MOZ_WIDGET_COCOA
+#  include "ChannelPrefsUtil.h"
+#endif
+
 using namespace mozilla;
 
+using dom::Promise;
 using ipc::FileDescriptor;
 
 #ifdef DEBUG
@@ -3280,7 +3287,13 @@ StaticMutex PreferencesWriter::sWritingToFile;
 
 class PWRunnable : public Runnable {
  public:
-  explicit PWRunnable(nsIFile* aFile) : Runnable("PWRunnable"), mFile(aFile) {}
+  explicit PWRunnable(
+      nsIFile* aFile,
+      UniquePtr<MozPromiseHolder<Preferences::WritePrefFilePromise>>
+          aPromiseHolder)
+      : Runnable("PWRunnable"),
+        mFile(aFile),
+        mPromiseHolder(std::move(aPromiseHolder)) {}
 
   NS_IMETHOD Run() override {
     // Preference writes are handled a bit strangely, in that a "newer"
@@ -3332,11 +3345,15 @@ class PWRunnable : public Runnable {
         nsresult rvCopy = rv;
         nsCOMPtr<nsIFile> fileCopy(mFile);
         SchedulerGroup::Dispatch(NS_NewRunnableFunction(
-            "Preferences::WriterRunnable", [fileCopy, rvCopy] {
+            "Preferences::WriterRunnable",
+            [fileCopy, rvCopy, promiseHolder = std::move(mPromiseHolder)] {
               MOZ_RELEASE_ASSERT(NS_IsMainThread());
               if (NS_FAILED(rvCopy)) {
                 Preferences::HandleDirty();
               }
+              if (promiseHolder) {
+                promiseHolder->ResolveIfExists(true, __func__);
+              }
             }));
       }
     }
@@ -3349,8 +3366,16 @@ class PWRunnable : public Runnable {
     return rv;
   }
 
+ private:
+  ~PWRunnable() {
+    if (mPromiseHolder) {
+      mPromiseHolder->RejectIfExists(NS_ERROR_ABORT, __func__);
+    }
+  }
+
  protected:
   nsCOMPtr<nsIFile> mFile;
+  UniquePtr<MozPromiseHolder<Preferences::WritePrefFilePromise>> mPromiseHolder;
 };
 
 // Although this is a member of Preferences, it measures sPreferences and
@@ -4059,6 +4084,67 @@ Preferences::SavePrefFile(nsIFile* aFile) {
   return SavePrefFileInternal(aFile, SaveMethod::Asynchronous);
 }
 
+NS_IMETHODIMP
+Preferences::BackupPrefFile(nsIFile* aFile, JSContext* aCx,
+                            Promise** aPromise) {
+  MOZ_ASSERT(NS_IsMainThread());
+
+  if (!aFile) {
+    return NS_ERROR_INVALID_ARG;
+  }
+
+  if (mCurrentFile) {
+    bool equalsCurrent = false;
+    nsresult rv = aFile->Equals(mCurrentFile, &equalsCurrent);
+
+    if (NS_FAILED(rv)) {
+      return rv;
+    }
+
+    if (equalsCurrent) {
+      return NS_ERROR_INVALID_ARG;
+    }
+  }
+
+  ErrorResult result;
+  RefPtr<Promise> promise =
+      Promise::Create(xpc::CurrentNativeGlobal(aCx), result);
+
+  if (MOZ_UNLIKELY(result.Failed())) {
+    return result.StealNSResult();
+  }
+
+  nsMainThreadPtrHandle<Promise> domPromiseHolder(
+      new nsMainThreadPtrHolder<Promise>("Preferences::BackupPrefFile promise",
+                                         promise));
+
+  auto mozPromiseHolder = MakeUnique<MozPromiseHolder<WritePrefFilePromise>>();
+  RefPtr<WritePrefFilePromise> writePrefPromise =
+      mozPromiseHolder->Ensure(__func__);
+
+  nsresult rv = WritePrefFile(aFile, SaveMethod::Asynchronous,
+                              std::move(mozPromiseHolder));
+  if (NS_FAILED(rv)) {
+    // WritePrefFile is responsible for rejecting the underlying MozPromise in
+    // the event that it the method failed somewhere.
+    return rv;
+  }
+
+  writePrefPromise->Then(
+      GetMainThreadSerialEventTarget(), __func__,
+      [domPromiseHolder](bool) {
+        MOZ_ASSERT(NS_IsMainThread());
+        domPromiseHolder.get()->MaybeResolveWithUndefined();
+      },
+      [domPromiseHolder](nsresult rv) {
+        MOZ_ASSERT(NS_IsMainThread());
+        domPromiseHolder.get()->MaybeReject(rv);
+      });
+
+  promise.forget(aPromise);
+  return NS_OK;
+}
+
 /* static */
 void Preferences::SetPreference(const dom::Pref& aDomPref) {
   MOZ_ASSERT(!XRE_IsParentProcess());
@@ -4389,31 +4475,53 @@ nsresult Preferences::SavePrefFileInternal(nsIFile* aFile,
     return rv;
 
   } else {
-    // We only allow off main thread writes on mCurrentFile.
+    // We only allow off main thread writes on mCurrentFile using this method.
+    // If you want to write asynchronously, use BackupPrefFile instead.
     return WritePrefFile(aFile, SaveMethod::Blocking);
   }
 }
 
-nsresult Preferences::WritePrefFile(nsIFile* aFile, SaveMethod aSaveMethod) {
+nsresult Preferences::WritePrefFile(
+    nsIFile* aFile, SaveMethod aSaveMethod,
+    UniquePtr<MozPromiseHolder<WritePrefFilePromise>>
+        aPromiseHolder /* = nullptr */) {
   MOZ_ASSERT(XRE_IsParentProcess());
 
+#define REJECT_IF_PROMISE_HOLDER_EXISTS(rv)       \
+  if (aPromiseHolder) {                           \
+    aPromiseHolder->RejectIfExists(rv, __func__); \
+  }                                               \
+  return rv;
+
   if (!HashTable()) {
-    return NS_ERROR_NOT_INITIALIZED;
+    REJECT_IF_PROMISE_HOLDER_EXISTS(NS_ERROR_NOT_INITIALIZED);
   }
 
   AUTO_PROFILER_LABEL("Preferences::WritePrefFile", OTHER);
 
   if (AllowOffMainThreadSave()) {
-    nsresult rv = NS_OK;
     UniquePtr<PrefSaveData> prefs = MakeUnique<PrefSaveData>(pref_savePrefs());
 
+    nsresult rv = NS_OK;
+    bool writingToCurrent = false;
+
+    if (mCurrentFile) {
+      rv = mCurrentFile->Equals(aFile, &writingToCurrent);
+      if (NS_FAILED(rv)) {
+        REJECT_IF_PROMISE_HOLDER_EXISTS(rv);
+      }
+    }
+
     // Put the newly constructed preference data into sPendingWriteData
     // for the next request to pick up
     prefs.reset(PreferencesWriter::sPendingWriteData.exchange(prefs.release()));
-    if (prefs) {
-      // There was a previous request that hasn't been processed,
-      // and this is the data it had.
-      return rv;
+    if (prefs && !writingToCurrent) {
+      MOZ_ASSERT(!aPromiseHolder,
+                 "Shouldn't be able to enter here if aPromiseHolder is set");
+      // There was a previous request writing to the default location that
+      // hasn't been processed. It will do the work of eventually writing this
+      // latest batch of data to disk.
+      return NS_OK;
     }
 
     // There were no previous requests. Dispatch one since sPendingWriteData has
@@ -4432,20 +4540,27 @@ nsresult Preferences::WritePrefFile(nsIFile* aFile, SaveMethod aSaveMethod) {
       // PreferencesWriter::Flush. Better that in future code we miss an
       // increment of sPendingWriteCount and cause a simple crash due to it
       // ending up negative.
+      //
+      // If aPromiseHolder is not null, ownership is transferred to PWRunnable.
+      // The PWRunnable will automatically reject the MozPromise if it is
+      // destroyed before being resolved or rejected by the Run method.
       PreferencesWriter::sPendingWriteCount++;
       if (async) {
-        rv = target->Dispatch(new PWRunnable(aFile),
+        rv = target->Dispatch(new PWRunnable(aFile, std::move(aPromiseHolder)),
                               nsIEventTarget::DISPATCH_NORMAL);
       } else {
-        rv =
-            SyncRunnable::DispatchToThread(target, new PWRunnable(aFile), true);
+        rv = SyncRunnable::DispatchToThread(
+            target, new PWRunnable(aFile, std::move(aPromiseHolder)), true);
       }
       if (NS_FAILED(rv)) {
         // If our dispatch failed, we should correct our bookkeeping to
         // avoid shutdown hangs.
         PreferencesWriter::sPendingWriteCount--;
+        // No need to reject the aPromiseHolder here, as the PWRunnable will
+        // have already done so.
+        return rv;
       }
-      return rv;
+      return NS_OK;
     }
 
     // If we can't get the thread for writing, for whatever reason, do the main
@@ -4457,7 +4572,26 @@ nsresult Preferences::WritePrefFile(nsIFile* aFile, SaveMethod aSaveMethod) {
   // AllowOffMainThreadSave() returns a consistent value for the lifetime of
   // the parent process.
   PrefSaveData prefsData = pref_savePrefs();
-  return PreferencesWriter::Write(aFile, prefsData);
+
+  // If we were given a MozPromiseHolder, this means the caller is attempting
+  // to write prefs asynchronously to the disk - but if we get here, it means
+  // that AllowOffMainThreadSave() return false, and that we will be forced
+  // to write on the main thread instead. We still have to resolve or reject
+  // that MozPromise regardless.
+  nsresult rv = PreferencesWriter::Write(aFile, prefsData);
+  if (aPromiseHolder) {
+    NS_WARNING(
+        "Cannot write to prefs asynchronously, as AllowOffMainThreadSave() "
+        "returned false.");
+    if (NS_SUCCEEDED(rv)) {
+      aPromiseHolder->ResolveIfExists(true, __func__);
+    } else {
+      aPromiseHolder->RejectIfExists(rv, __func__);
+    }
+  }
+  return rv;
+
+#undef REJECT_IF_PROMISE_HOLDER_EXISTS
 }
 
 static nsresult openPrefFile(nsIFile* aFile, PrefValueKind aKind) {
@@ -4844,6 +4978,27 @@ nsresult Preferences::InitInitialObjects(bool aIsStartup) {
     NS_WARNING("Error parsing application default preferences.");
   }
 
+#ifdef MOZ_WIDGET_COCOA
+  // On macOS, channel-prefs.js is no longer bundled with the application and
+  // the "app.update.channel" pref is now read from a Framework instead.
+  // Previously, channel-prefs.js was read as one of the files in
+  // NS_APP_PREF_DEFAULTS_50_DIR (see just above). See bug 1799332 for more
+  // info.
+  nsAutoCString appUpdatePrefKey;
+  appUpdatePrefKey.Assign(kChannelPref);
+  nsAutoCString appUpdatePrefValue;
+  PrefValue channelPrefValue;
+  channelPrefValue.mStringVal = MOZ_STRINGIFY(MOZ_UPDATE_CHANNEL);
+  if (ChannelPrefsUtil::GetChannelPrefValue(appUpdatePrefValue)) {
+    channelPrefValue.mStringVal = appUpdatePrefValue.get();
+  }
+  pref_SetPref(appUpdatePrefKey, PrefType::String, PrefValueKind::Default,
+               channelPrefValue,
+               /* isSticky */ false,
+               /* isLocked */ true,
+               /* fromInit */ true);
+#endif
+
   // Load jar:$app/omni.jar!/defaults/preferences/*.js
   // or jar:$gre/omni.jar!/defaults/preferences/*.js.
   RefPtr<nsZipArchive> appJarReader = Omnijar::GetReader(Omnijar::APP);
diff --git a/modules/libpref/Preferences.h b/modules/libpref/Preferences.h
index 81c99590da..c675195d57 100644
--- a/modules/libpref/Preferences.h
+++ b/modules/libpref/Preferences.h
@@ -15,6 +15,7 @@
 
 #include "mozilla/Atomics.h"
 #include "mozilla/MemoryReporting.h"
+#include "mozilla/MozPromise.h"
 #include "mozilla/StaticPtr.h"
 #include "nsCOMPtr.h"
 #include "nsIObserver.h"
@@ -97,6 +98,8 @@ class Preferences final : public nsIPrefService,
   friend class ::nsPrefBranch;
 
  public:
+  using WritePrefFilePromise = MozPromise<bool, nsresult, false>;
+
   NS_DECL_THREADSAFE_ISUPPORTS
   NS_DECL_NSIPREFSERVICE
   NS_FORWARD_NSIPREFBRANCH(mRootBranch->)
@@ -454,7 +457,9 @@ class Preferences final : public nsIPrefService,
 
   // Off main thread is only respected for the default aFile value (nullptr).
   nsresult SavePrefFileInternal(nsIFile* aFile, SaveMethod aSaveMethod);
-  nsresult WritePrefFile(nsIFile* aFile, SaveMethod aSaveMethod);
+  nsresult WritePrefFile(
+      nsIFile* aFile, SaveMethod aSaveMethod,
+      UniquePtr<MozPromiseHolder<WritePrefFilePromise>> aPromise = nullptr);
 
   nsresult ResetUserPrefs();
 
diff --git a/modules/libpref/init/StaticPrefList.yaml b/modules/libpref/init/StaticPrefList.yaml
index 835450712a..f32e8a9e8f 100644
--- a/modules/libpref/init/StaticPrefList.yaml
+++ b/modules/libpref/init/StaticPrefList.yaml
@@ -478,11 +478,6 @@
   value: true
   mirror: always
 
-- name: apz.drag.initial.enabled
-  type: RelaxedAtomicBool
-  value: true
-  mirror: always
-
 - name: apz.drag.touch.enabled
   type: RelaxedAtomicBool
   value: true
@@ -591,12 +586,6 @@
   value: 1.0f
   mirror: always
 
-# new scrollbar code for desktop zooming
-- name: apz.force_disable_desktop_zooming_scrollbars
-  type: RelaxedAtomicBool
-  value: false
-  mirror: always
-
 #ifdef MOZ_WIDGET_GTK
 -   name: apz.gtk.kinetic_scroll.enabled
     type: RelaxedAtomicBool
@@ -680,11 +669,6 @@
   value: false
   mirror: always
 
-- name: apz.mvm.force-enabled
-  type: RelaxedAtomicBool
-  value: true
-  mirror: always
-
 - name: apz.one_touch_pinch.enabled
   type: RelaxedAtomicBool
   value: @IS_ANDROID@
@@ -2255,17 +2239,6 @@
   value: 20
   mirror: always
 
-# Whether window.location.reload() and window.history.go(0) should be blocked
-# when called directly from a window resize event handler.
-#
-# This used to be necessary long ago to prevent terrible UX when using stuff
-# like TypeAheadFind (bug 258917), but it also causes compat issues on mobile
-# (bug 1570566).
-- name: dom.block_reload_from_resize_event_handler
-  type: bool
-  value: false
-  mirror: always
-
   # Enable CacheAPI in private browsing mode with encryption
 - name: dom.cache.privateBrowsing.enabled
   type: RelaxedAtomicBool
@@ -2405,7 +2378,7 @@
 # Whether CustomStateSet is enabled
 - name: dom.element.customstateset.enabled
   type: RelaxedAtomicBool
-  value: false
+  value: true
   mirror: always
   rust: true
 
@@ -2637,12 +2610,24 @@
   value: true
   mirror: always
 
+# Expose Window.TextEvent and make the builtin editors dispatch `textInput`
+# event as a default action of `beforeinput`.
+- name: dom.events.textevent.enabled
+  type: bool
+  value: false
+  mirror: always
+
 # Whether to expose test interfaces of various sorts
 - name: dom.expose_test_interfaces
   type: bool
   value: false
   mirror: always
 
+- name: dom.fetchKeepalive.enabled
+  type: RelaxedAtomicBool
+  value: false
+  mirror: always
+
 - name: dom.fetchObserver.enabled
   type: RelaxedAtomicBool
   value: false
@@ -2801,7 +2786,11 @@
   value: false
   mirror: always
 
-# Whether innerWidth / innerHeight return rounded or fractional sizes.
+# How innerWidth / innerHeight return rounded or fractional sizes.
+#
+#   0 or others: Do not round at all.
+#   1: Round.
+#   2: Truncate.
 #
 # NOTE(emilio): Fractional sizes are not web-compatible, see the regressions
 # from bug 1676843, but we want to expose the fractional sizes (probably in
@@ -2809,9 +2798,9 @@
 # time being.
 #
 # [1]: https://github.com/w3c/csswg-drafts/issues/5260
-- name: dom.innerSize.rounded
-  type: bool
-  value: true
+- name: dom.innerSize.rounding
+  type: uint32_t
+  value: 2
   mirror: always
 
 # Whether we conform to Input Events Level 1 or Input Events Level 2.
@@ -2856,13 +2845,6 @@
   value: 8
   mirror: always
 
-# Enable not moving the cursor to end when a text input or textarea has .value
-# set to the value it already has.  By default, enabled.
-- name: dom.input.skip_cursor_move_for_same_value_set
-  type: bool
-  value: true
-  mirror: always
-
 # How often to check for CPOW timeouts (ms). CPOWs are only timed
 # out by the hang monitor.
 - name: dom.ipc.cpow.timeout
@@ -3520,7 +3502,7 @@
 # Enable Screen Wake Lock API
 - name: dom.screenwakelock.enabled
   type: bool
-  value: @IS_EARLY_BETA_OR_EARLIER@
+  value: true
   mirror: always
 
 # Whether to enable the JavaScript start-up cache. This causes one of the first
@@ -3848,10 +3830,10 @@
   value: 120000
   mirror: always
 
-# SetDocumentURI security option, enforces origin check
+# Enforce origin check whenever a content process tries to set a document URI
 - name: dom.security.setdocumenturi
   type: bool
-  value: @IS_EARLY_BETA_OR_EARLIER@
+  value: true
   mirror: always
 
 # Whether or not selection events on text controls are enabled.
@@ -4153,6 +4135,12 @@
   value: false
   mirror: always
 
+- name: dom.text_fragments.enabled
+  type: RelaxedAtomicBool
+  value: false
+  mirror: always
+  rust: true
+
 - name: dom.textMetrics.actualBoundingBox.enabled
   type: RelaxedAtomicBool
   value: true
@@ -4583,6 +4571,14 @@
   value: @IS_NOT_ANDROID@
   mirror: always
 
+# Whether allowing selection across the boundary
+# between shadow DOM and light DOM.
+# This is based on https://github.com/mfreed7/shadow-dom-selection
+- name: dom.shadowdom.selection_across_boundary.enabled
+  type: bool
+  value: @IS_NIGHTLY_BUILD@
+  mirror: always
+
 # NOTE: This preference is used in unit tests. If it is removed or its default
 # value changes, please update test_sharedMap_static_prefs.js accordingly.
 - name: dom.webcomponents.shadowdom.report_usage
@@ -4632,11 +4628,14 @@
   mirror: always
   rust: true
 
-- name: dom.webgpu.swap-chain.external-texture-dx12
+- name: dom.webgpu.allow-present-without-readback
   type: RelaxedAtomicBool
+#if defined(XP_WIN)
+  value: true
+#else
   value: false
+#endif
   mirror: always
-  rust: true
 
 # For testing purposes, crash if we don't get a hardware adapter.
 - name: dom.webgpu.testing.assert-hardware-adapter
@@ -4715,6 +4714,13 @@
 #endif
   mirror: always
 
+# Setting log level for notification modules.
+# The value follows the enum ConsoleLogLevel in ConsoleInstance.webidl.
+- name: dom.webnotifications.loglevel
+  type: String
+  value: Error
+  mirror: never
+
 # Is support for Window.event enabled?
 - name: dom.window.event.enabled
   type: bool
@@ -4850,7 +4856,7 @@
 # Whether allowing using <tab> to move focus to root elements
 - name: dom.disable_tab_focus_to_root_element
   type: bool
-  value: @IS_NIGHTLY_BUILD@
+  value: true
   mirror: always
 
 #---------------------------------------------------------------------------
@@ -5083,14 +5089,6 @@
   value: @IS_NOT_ANDROID@
   mirror: never
 
-# This pref has no effect within fission windows, it only controls the
-# behaviour within non-fission windows. If true, preserve browsing contexts
-# between process swaps.
-- name: fission.preserve_browsing_contexts
-  type: bool
-  value: true
-  mirror: always
-
 # Disable storing the session history in the parent process, and accessing it
 # over IPC from the child processes.
 - name: fission.disableSessionHistoryInParent
@@ -5132,15 +5130,6 @@
   value: false
   mirror: always
 
-# If true, allow process-switching documents loaded by <object> and <embed>
-# elements into a remote process.
-# NOTE: This pref has no impact outside of windows with the
-# `useRemoteSubframes` flag set.
-- name: fission.remoteObjectEmbed
-  type: bool
-  value: true
-  mirror: always
-
 # The strategy used to control how sites are isolated into separate processes
 # when Fisison is enabled. This pref has no effect if Fission is disabled.
 # See the `WebContentIsolationStrategy` enum in `ProcessIsolation.cpp`.
@@ -5829,6 +5818,11 @@
   value: 10000
   mirror: always
 
+- name: gfx.canvas.remote.use-draw-image-fast-path
+  type: RelaxedAtomicBool
+  value: true
+  mirror: always
+
 - name: gfx.canvas.willreadfrequently.enabled
   type: bool
 #if defined(XP_WIN)
@@ -6056,6 +6050,13 @@
   value: 0
   mirror: always
 
+# Whether to disable downloadable font cache so that behavior is consistently
+# the uncached load behavior across pages (useful for testing reflow problems)
+- name: gfx.downloadable_fonts.disable_cache
+  type: RelaxedAtomicBool
+  value: false
+  mirror: always
+
 # Whether to preserve color bitmap tables in fonts (bypassing OTS).
 # Currently these are supported only on platforms where we use Freetype
 # to render fonts (Linux/Gtk and Android).
@@ -6811,7 +6812,7 @@
 # for devices with weak GPUs, or when running SWGL.
 - name: gfx.webrender.low-quality-pinch-zoom
   type: bool
-#if defined(MOZ_WIDGET_ANDROID)
+#if defined(MOZ_WIDGET_ANDROID) && defined(NIGHTLY_BUILD)
   value: true
 #else
   value: false
@@ -6831,13 +6832,21 @@
 # Enable VideoProcessor Super Resolution for video overlay
 - name: gfx.webrender.overlay-vp-super-resolution
   type: bool
+#if defined(XP_WIN)
+  value: true
+#else
   value: false
+#endif
   mirror: once
 
 # Enable VideoProcessor-HDR on SDR content for video overlay
 - name: gfx.webrender.overlay-vp-auto-hdr
   type: bool
+#if defined(XP_WIN)
+  value: true
+#else
   value: false
+#endif
   mirror: once
 
 # Use vsync events generated by hardware
@@ -6851,6 +6860,11 @@
   value: false
   mirror: always
 
+- name: gfx.remote-texture.recycle.disabled
+  type: RelaxedAtomicBool
+  value: false
+  mirror: always
+
 #---------------------------------------------------------------------------
 # Prefs starting with "gl." (OpenGL)
 #---------------------------------------------------------------------------
@@ -7622,6 +7636,13 @@
     value: false
     mirror: always
     set_spidermonkey_pref: startup
+
+  # Experimental support for Uint8Array base64/hex in JavaScript.
+-   name: javascript.options.experimental.uint8array_base64
+    type: bool
+    value: false
+    mirror: always
+    set_spidermonkey_pref: startup
 #endif  // NIGHTLY_BUILD
 
 # Experimental support for ArrayBuffer.prototype.transfer{,ToFixedLength}() in JavaScript.
@@ -7646,6 +7667,14 @@
     mirror: always
 #endif  // NIGHTLY_BUILD
 
+#ifdef ENABLE_JSON_PARSE_WITH_SOURCE
+-   name: javascript.options.experimental.json_parse_with_source
+    type: bool
+    value: false
+    mirror: always
+    set_spidermonkey_pref: startup
+#endif  // ENABLE_JSON_PARSE_WITH_SOURCE
+
 - name: javascript.options.wasm_caching
   type: bool
   value: true
@@ -7932,6 +7961,16 @@
   value: false
   mirror: always
 
+# Whether to disable the jit within the main process
+- name: javascript.options.main_process_disable_jit
+  type: bool
+#ifdef XP_IOS
+  value: true
+#else
+  value: false
+#endif
+  mirror: always
+
 #---------------------------------------------------------------------------
 # Prefs starting with "layers."
 #---------------------------------------------------------------------------
@@ -8339,6 +8378,13 @@
   mirror: always
   rust: true
 
+# Whether @starting-style is enabled?
+- name: layout.css.starting-style-at-rules.enabled
+  type: RelaxedAtomicBool
+  value: false
+  mirror: always
+  rust: true
+
 # Should we look for counter ancestor scopes first?
 - name: layout.css.counter-ancestor-scope.enabled
   type: bool
@@ -8477,6 +8523,13 @@
   mirror: always
   rust: true
 
+# Is support for shape() enabled?
+- name: layout.css.basic-shape-shape.enabled
+  type: RelaxedAtomicBool
+  value: @IS_NIGHTLY_BUILD@
+  mirror: always
+  rust: true
+
 # Is support for xywh() enabled?
 - name: layout.css.basic-shape-xywh.enabled
   type: RelaxedAtomicBool
@@ -8637,35 +8690,14 @@
   value: false
   mirror: always
 
-# Is support for motion-path <basic-shape> other than path() enabled?
-# https://drafts.fxtf.org/motion-1/#valdef-offset-path-basic-shape
-- name: layout.css.motion-path-basic-shapes.enabled
-  type: RelaxedAtomicBool
-  value: true
-  mirror: always
-  rust: true
-
-# Is support for motion-path <coord-box> enabled?
-# https://drafts.fxtf.org/motion-1/#valdef-offset-path-coord-box
-- name: layout.css.motion-path-coord-box.enabled
-  type: RelaxedAtomicBool
-  value: true
-  mirror: always
-  rust: true
-
-# Is support for motion-path ray() enabled?
-- name: layout.css.motion-path-ray.enabled
-  type: RelaxedAtomicBool
-  value: true
-  mirror: always
-  rust: true
-
-# Is support for motion-path offset-position enabled?
-- name: layout.css.motion-path-offset-position.enabled
-  type: RelaxedAtomicBool
-  value: true
+# Which model to use for CSS letter-spacing:
+#   0 - Gecko legacy model, spacing added to trailing side of letter
+#   1 - WebKit/Blink-compatible, spacing always added to right-hand side
+#   2 - Symmetrical spacing, half added to each side
+- name: layout.css.letter-spacing.model
+  type: int32_t
+  value: 0
   mirror: always
-  rust: true
 
 # Is support for motion-path url enabled?
 - name: layout.css.motion-path-url.enabled
@@ -8740,6 +8772,13 @@
   mirror: always
   rust: true
 
+# Whether @scope rule is enabled
+- name: layout.css.at-scope.enabled
+  type: RelaxedAtomicBool
+  value: false
+  mirror: always
+  rust: true
+
 # Dictates whether or not the prefers contrast media query will be
 # usable.
 #   true: prefers-contrast will toggle based on OS and browser settings.
@@ -8815,15 +8854,22 @@
 # Is support for -moz-prefixed transform properties enabled?
 - name: layout.css.prefixes.transforms
   type: bool
-  value: @IS_NOT_NIGHTLY_BUILD@
+  value: false
   mirror: always
 
 # Is support for -moz-prefixed transition properties enabled?
 - name: layout.css.prefixes.transitions
   type: bool
-  value: @IS_NOT_NIGHTLY_BUILD@
+  value: false
   mirror: always
 
+# Enable relative color syntax: https://drafts.csswg.org/css-color-5/#relative-colors
+- name: layout.css.relative-color-syntax.enabled
+  type: RelaxedAtomicBool
+  value: false
+  mirror: always
+  rust: true
+
 # Is CSS error reporting enabled?
 - name: layout.css.report_errors
   type: bool
@@ -8850,7 +8896,7 @@
   mirror: always
 
 # Whether the scroll-driven animations generated by CSS is enabled. This
-# also include animation-timelime property.
+# also include animation-timeline property.
 - name: layout.css.scroll-driven-animations.enabled
   type: RelaxedAtomicBool
   value: false
@@ -8981,7 +9027,7 @@
 # Support for the css Zoom property.
 - name: layout.css.zoom.enabled
   type: RelaxedAtomicBool
-  value: @IS_NIGHTLY_BUILD@
+  value: true
   mirror: always
   rust: true
 
@@ -9357,6 +9403,16 @@
   mirror: always
   rust: true
 
+# Is matching video-dynamic-range: high allowed?
+- name: layout.css.video-dynamic-range.allows-high
+  type: RelaxedAtomicBool
+#if defined(XP_MACOSX) || defined(NIGHTLY_BUILD)
+  value: true
+#else
+  value: false
+#endif
+  mirror: always
+
 # Whether frame visibility tracking is enabled globally.
 - name: layout.framevisibility.enabled
   type: bool
@@ -9509,6 +9565,20 @@
   mirror: always
   rust: true
 
+# Whether to disable forced centering of binary operators (+, =, ...).
+- name: mathml.centered_operators.disabled
+  type: bool
+  value: true
+  mirror: always
+  rust: true
+
+# Whether to disable extra top/bottom spacing for stretchy operators.
+- name: mathml.top_bottom_spacing_for_stretchy_operators.disabled
+  type: bool
+  value: true
+  mirror: always
+  rust: true
+
 #---------------------------------------------------------------------------
 # Prefs starting with "media."
 #---------------------------------------------------------------------------
@@ -9553,6 +9623,20 @@
   value: 32768   # Measured in KiB
   mirror: always
 
+# Multiplier to change the sample rate at which input-only streams run, so as
+# to similate clock drift.
+- name: media.cubeb.input_drift_factor
+  type: AtomicFloat
+  mirror: always
+  value: 1.f
+
+# Multiplier to change the sample rate at which output-only streams run, so as
+# to similate clock drift.
+- name: media.cubeb.output_drift_factor
+  type: AtomicFloat
+  mirror: always
+  value: 1.f
+
 # Whether cubeb is sandboxed (AudioIPC)
 - name: media.cubeb.sandbox
   type: bool
@@ -11172,6 +11256,19 @@
     mirror: always
 #endif
 
+# Bug 1860492 - Deprecate and remove theora
+-  name: media.theora.enabled
+   type: RelaxedAtomicBool
+   value: @IS_NOT_NIGHTLY_BUILD@
+   mirror: always
+
+# When this is true, the protection mask that Firefox replies to Widevine API
+# QueryOutputProtectionStatus is `kProtectionHDCP` when no potential capturing.
+- name: media.widevine.hdcp-protection-mask
+  type: RelaxedAtomicBool
+  value: true
+  mirror: always
+
 #---------------------------------------------------------------------------
 # Prefs starting with "memory."
 #---------------------------------------------------------------------------
@@ -11569,6 +11666,13 @@
   value: true
   mirror: always
 
+# If true, when browser code itself makes network requests, default to
+# omitting credentials.
+- name: network.fetch.systemDefaultsToOmittingCredentials
+  type: RelaxedAtomicBool
+  value: true
+  mirror: always
+
 # Whether to strip auth headers for redirected http channels
 # https://fetch.spec.whatwg.org/#http-redirect-fetch
 - name: network.http.redirect.stripAuthHeader
@@ -11584,6 +11688,12 @@
   mirror: always
   do_not_use_directly: true
 
+# Whether to add urgency and incremental to request headers
+- name: network.http.priority_header.enabled
+  type: bool
+  value: true
+  mirror: always
+
 # The maximum allowed length for a referrer header - 4096 default.
 # 0 means no limit.
 - name: network.http.referer.referrerLengthLimit
@@ -11882,7 +11992,7 @@
 # (e.g. `<script>`) is enabled.
 - name: network.fetchpriority.enabled
   type: RelaxedAtomicBool
-  value: false
+  value: @IS_NIGHTLY_BUILD@
   mirror: always
 
 # Adjustments to apply to the internal priority of <link rel=preload as=script
@@ -12734,6 +12844,19 @@
   value: false
   mirror: always
 
+# Allows use of a protocol exception list that will bypass defaultURI parser
+- name: network.url.some_schemes_bypass_defaultURI_fallback
+  type: RelaxedAtomicBool
+  value: true
+  mirror: always
+
+# A list of schemes to allow for bypassing defaultURI as default
+# This is only used when network.url.some_schemes_bypass_defaultURI_fallback is true
+- name: network.url.simple_uri_schemes
+  type: String
+  value: ""
+  mirror: never
+
 # The maximum allowed length for a URL - 32MB default.
 # If 0 that means no limit.
 - name: network.url.max-length
@@ -12804,6 +12927,16 @@
   value: true
   mirror: always
 
+# When true, origin A and origin B will be coalesced if they have an overlap
+# in IP addresses as advertized by DNS, regardless if the existing connection
+# to origin A is not to an IP present in B's DNS response.
+# When false, an existing connection will only be reused if the
+# connection's remote IP is also present in B's DNS response.
+- name: network.http.http2.aggressive_coalescing
+  type: RelaxedAtomicBool
+  value: false
+  mirror: always
+
 - name: network.http.http2.ping-threshold
   type: RelaxedAtomicInt32
   value: 58
@@ -13052,6 +13185,12 @@
   value: false
   mirror: always
 
+# Whether to prefer IPv6 name lookups.
+- name: network.dns.preferIPv6
+  type: RelaxedAtomicBool
+  value: false
+  mirror: always
+
 # Whether to add additional record IPs to the cache
 - name: network.trr.add_additional_records
   type: RelaxedAtomicBool
@@ -13186,6 +13325,12 @@
   value: true
   mirror: always
 
+  # The length of cnonce string used in HTTP digest auth.
+- name: network.http.digest_auth_cnonce_length
+  type: uint32_t
+  value: 16
+  mirror: always
+
   # If true, HTTP response content-type headers will be parsed using the standards-compliant MimeType parser
 - name: network.standard_content_type_parsing.response_headers
   type: RelaxedAtomicBool
@@ -13259,6 +13404,17 @@
   value: "file,moz-gio"
   mirror: never
 
+# Enable off-main-thread decompression of network streams
+- name: network.decompression_off_mainthread
+  type: bool
+  value: true
+  mirror: always
+
+# Minimum content-lengthe to use off-main-thread decompression of network streams
+- name: network.decompression_off_mainthread_min_size
+  type: int32_t
+  value: 512
+  mirror: always
 
 #---------------------------------------------------------------------------
 # Prefs starting with "nglayout."
@@ -13477,6 +13633,16 @@
   value: true
   mirror: always
 
+# Determines if and when to center pages on a sheet horiontally when printing.
+# With a setting of 2, it's guaranteed that A4 on US Letter will be centered.
+#  0: never,
+#  1: always,
+#  2: when the ratio of sheet to page size after content scaling is near 1.0
+- name: print.center_page_on_sheet
+  type: RelaxedAtomicUint32
+  value: 2
+  mirror: always
+
 #---------------------------------------------------------------------------
 # Prefs starting with "privacy."
 #---------------------------------------------------------------------------
@@ -13779,7 +13945,7 @@
 # Enable the heuristic to allow storage access for windows opened using window.open()
 - name: privacy.restrict3rdpartystorage.heuristic.redirect
   type: bool
-  value: true
+  value: @IS_NOT_NIGHTLY_BUILD@
   mirror: always
 
 # Anti-tracking permission expiration.
@@ -15948,6 +16114,11 @@
   type: RelaxedAtomicBool
   value: true
   mirror: always
+
+- name: widget.macos.titlebar-blend-mode.behind-window
+  type: RelaxedAtomicBool
+  value: false
+  mirror: always
 #endif
 
 # Whether native GTK global menubar support is enabled.
diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js
index 7157f197e8..9707432c6e 100644
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -188,11 +188,12 @@ pref("pdfjs.enableXfa", true);
 // Enable adding an image in a pdf.
 pref("pdfjs.enableStampEditor", true);
 
-// Enable adding an image in a pdf.
+// Enable highlighting in a pdf.
+pref("pdfjs.enableHighlightEditor", true);
 #if defined(EARLY_BETA_OR_EARLIER)
-  pref("pdfjs.enableHighlightEditor", true);
+  pref("pdfjs.enableHighlightFloatingButton", true);
 #else
-  pref("pdfjs.enableHighlightEditor", false);
+  pref("pdfjs.enableHighlightFloatingButton", false);
 #endif
 
 // Disable support for MathML
@@ -413,10 +414,6 @@ pref("gfx.downloadable_fonts.enabled", true);
 pref("gfx.downloadable_fonts.fallback_delay", 3000);
 pref("gfx.downloadable_fonts.fallback_delay_short", 100);
 
-// disable downloadable font cache so that behavior is consistently
-// the uncached load behavior across pages (useful for testing reflow problems)
-pref("gfx.downloadable_fonts.disable_cache", false);
-
 #ifdef XP_WIN
   pref("gfx.font_rendering.directwrite.use_gdi_table_loading", true);
 #endif
@@ -516,19 +513,6 @@ pref("ui.textHighlightBackground", "#ef0fff");
 // The foreground color for the matched text in findbar highlighting
 // Used with nsISelectionController::SELECTION_FIND
 pref("ui.textHighlightForeground", "#ffffff");
-// The background color for :autofill-ed inputs.
-//
-// In the past, we used the following `filter` to paint autofill backgrounds:
-//
-//   grayscale(21%) brightness(88%) contrast(161%) invert(10%) sepia(40%) saturate(206%);
-//
-// but there are some pages where using `filter` caused issues because it
-// changes the z-order (see bug 1687682, bug 1727950).
-//
-// The color is chosen so that you get the same final color on a white
-// background as the filter above (#fffcc8), but with some alpha so as to
-// prevent fully illegible text.
-pref("ui.-moz-autofill-background", "rgba(255, 249, 145, .5)");
 
 // We want the ability to forcibly disable platform a11y, because
 // some non-a11y-related components attempt to bring it up.  See bug
@@ -639,6 +623,7 @@ pref("toolkit.telemetry.user_characteristics_ping.last_version_sent", 0);
 // the telemetry client id (which is not sent in this ping), it is cleared when a
 // user opts-out of telemetry, it is set upon first telemetry submission
 pref("toolkit.telemetry.user_characteristics_ping.uuid", "");
+pref("toolkit.telemetry.user_characteristics_ping.logLevel", "Warn");
 
 // AsyncShutdown delay before crashing in case of shutdown freeze
 // ASan, TSan and code coverage builds can be considerably slower. Extend the
@@ -959,6 +944,11 @@ pref("javascript.options.mem.gc_incremental_slice_ms", 5);
 // JSGC_COMPACTING_ENABLED
 pref("javascript.options.mem.gc_compacting", true);
 
+#ifdef NIGHTLY_BUILD
+// JSGC_SEMISPACE_NURSERY_ENABLED
+pref("javascript.options.mem.gc_experimental_semispace_nursery", false);
+#endif
+
 // JSGC_PARALLEL_MARKING_ENABLED
 // This only applies to the main runtime and does not affect workers.
 #ifndef ANDROID
@@ -1195,7 +1185,7 @@ pref("network.http.redirection-limit", 20);
 // NOTE: support for "compress" has been disabled per bug 196406.
 // NOTE: separate values with comma+space (", "): see bug 576033
 pref("network.http.accept-encoding", "gzip, deflate");
-pref("network.http.accept-encoding.secure", "gzip, deflate, br");
+pref("network.http.accept-encoding.secure", "gzip, deflate, br, zstd");
 
 // Prompt for redirects resulting in unsafe HTTP requests
 pref("network.http.prompt-temp-redirect", false);
@@ -1241,7 +1231,11 @@ pref("network.http.network-changed.timeout", 5);
 
 // The maximum number of current global half open sockets allowable
 // when starting a new speculative connection.
-pref("network.http.speculative-parallel-limit", 6);
+#ifdef ANDROID
+  pref("network.http.speculative-parallel-limit", 6);
+#else
+  pref("network.http.speculative-parallel-limit", 20);
+#endif
 
 // Whether or not to block requests for non head js/css items (e.g. media)
 // while those elements load.
@@ -3476,13 +3470,24 @@ pref("browser.search.removeEngineInfobar.enabled", true);
 // Enables a new search configuration style with no functional changes for the
 // user. This is solely intended as a rollout button - it will go away once the
 // new configuration has been rolled out.
+// Whether search-config-v2 is enabled.
+#ifdef NIGHTLY_BUILD
+pref("browser.search.newSearchConfig.enabled", true);
+#else
 pref("browser.search.newSearchConfig.enabled", false);
+#endif
 
 // GMPInstallManager prefs
 
 // User-settable override to media.gmp-manager.url for testing purposes.
 //pref("media.gmp-manager.url.override", "");
 
+// When |media.gmp-manager.allowLocalSources| is true, we will allow falling
+// back to using the plugin configurations distributed with Firefox to update
+// or install plugins. This fallback is only used when we fail to get an
+// acceptable configuration via |media.gmp-manager.url|.
+pref("media.gmp-manager.allowLocalSources", true);
+
 // Update service URL for GMP install/updates:
 pref("media.gmp-manager.url", "https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VERSION%/%DISTRIBUTION%/%DISTRIBUTION_VERSION%/update.xml");
 
@@ -3556,7 +3561,19 @@ pref("reader.line_height", 4);
 pref("reader.color_scheme", "auto");
 
 // Color scheme values available in reader mode UI.
-pref("reader.color_scheme.values", "[\"light\",\"dark\",\"sepia\",\"auto\"]");
+pref("reader.color_scheme.values", "[\"auto\",\"light\",\"dark\",\"sepia\",\"contrast\",\"gray\"]");
+
+// Determines if updated color theme menu is enabled in reader mode.
+pref("reader.colors_menu.enabled", false);
+
+// The custom color scheme options in reader colors menu.
+pref("reader.custom_colors.foreground", "");
+pref("reader.custom_colors.background", "");
+
+pref("reader.custom_colors.unvisited-links", "");
+pref("reader.custom_colors.visited-links", "");
+
+pref("reader.custom_colors.selection-highlight", "");
 
 // The font type in reader (sans-serif, serif)
 pref("reader.font_type", "sans-serif");
@@ -3663,10 +3680,6 @@ pref("browser.ml.logLevel", "Error");
 // To disable blocking of auth prompts, set the limit to -1.
 pref("prompts.authentication_dialog_abuse_limit", 2);
 
-// The prompt type to use for http auth prompts
-// content: 1, tab: 2, window: 3
-pref("prompts.modalType.httpAuth", 2);
-
 pref("dom.payments.request.supportedRegions", "US,CA");
 
 #ifdef MOZ_ASAN_REPORTER
diff --git a/modules/libpref/nsIPrefService.idl b/modules/libpref/nsIPrefService.idl
index 5984fa30b7..dba67455bf 100644
--- a/modules/libpref/nsIPrefService.idl
+++ b/modules/libpref/nsIPrefService.idl
@@ -79,6 +79,24 @@ interface nsIPrefService : nsISupports
   void savePrefFile(in nsIFile aFile);
 
   /**
+   * Called to write current preferences state to a file off of the main thread.
+   * This differs from savePrefFile in that null is not accepted for the aFile
+   * parameter, and aFile cannot be pointing at the current preferences file.
+   *
+   * The backup will be written to disk off of the main thread, unless the
+   * preferences service is not configured to write to disk off of the main
+   * thread.
+   *
+   * @param aFile The file to be written.
+   * @returns A DOM promise that resolves when the backup is complete.
+   *
+   * @see readUserPrefsFromFile
+   * @see nsIFile
+   */
+  [implicit_jscontext]
+  Promise backupPrefFile(in nsIFile aFile);
+
+  /**
    * Call to get a Preferences "Branch" which accesses user preference data.
    * Using a Set method on this object will always create or set a user
    * preference value. When using a Get method a user set value will be
diff --git a/modules/libpref/test/unit/test_backupPrefFile.js b/modules/libpref/test/unit/test_backupPrefFile.js
new file mode 100644
index 0000000000..6624443e7c
--- /dev/null
+++ b/modules/libpref/test/unit/test_backupPrefFile.js
@@ -0,0 +1,46 @@
+/* Any copyright is dedicated to the Public Domain.
+http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+/**
+ * Tests that we can create a backup of the preferences state to
+ * a file asynchronously.
+ */
+add_task(async function test_backupPrefFile() {
+  // Create a backup of the preferences state to a file.
+  Services.prefs.setBoolPref("test.backup", true);
+
+  let backupFilePath = PathUtils.join(PathUtils.tempDir, "prefs-backup.js");
+  let backupFile = await IOUtils.getFile(backupFilePath);
+  await Services.prefs.backupPrefFile(backupFile);
+
+  // Verify that the backup file was created and contains the expected content.
+  let backupContent = await IOUtils.read(backupFilePath, { encoding: "utf-8" });
+
+  let sawTestValue = false;
+
+  // Now parse the backup file and verify that it contains the expected
+  // preference value. We'll not worry about any of the other preferences.
+  let observer = {
+    onStringPref() {},
+    onIntPref() {},
+    onBoolPref(kind, name, value, _isSticky, _isLocked) {
+      if (name == "test.backup" && value) {
+        sawTestValue = true;
+      }
+    },
+    onError(message) {
+      Assert.ok(false, "Error while parsing backup file: " + message);
+    },
+  };
+  Services.prefs.parsePrefsFromBuffer(backupContent, observer);
+
+  Assert.ok(
+    sawTestValue,
+    "The backup file contains the expected preference value."
+  );
+
+  // Clean up the backup file.
+  await IOUtils.remove(backupFilePath);
+});
diff --git a/modules/libpref/test/unit/xpcshell.toml b/modules/libpref/test/unit/xpcshell.toml
index 6f9440d609..03cf56d21a 100644
--- a/modules/libpref/test/unit/xpcshell.toml
+++ b/modules/libpref/test/unit/xpcshell.toml
@@ -5,6 +5,8 @@ support-files = [
   "extdata/testExt.js",
 ]
 
+["test_backupPrefFile.js"]
+
 ["test_bug345529.js"]
 
 ["test_bug506224.js"]