Bacvkport and crash fix

mozilla-release/patches/1506798-65a1.patch

@@ -0,0 +1,33 @@
+# HG changeset patch
+# User Jon Coppeard <jcoppeard@mozilla.com>
+# Date 1542462498 0
+# Node ID 764c5b94a3950791427e782e59e3e826921cffac
+# Parent  6266a98f3d3d0d409800f37125a70410ae7fe937
+Bug 1506798 - Fix possible data race updating scope object during compacting GC r=pbone
+
+diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
+--- a/js/src/jsgc.cpp
++++ b/js/src/jsgc.cpp
+@@ -2812,21 +2812,21 @@ static const AllocKinds UpdatePhaseMisc 
+     AllocKind::SCRIPT,
+     AllocKind::LAZY_SCRIPT,
+     AllocKind::BASE_SHAPE,
+     AllocKind::SHAPE,
+     AllocKind::ACCESSOR_SHAPE,
+     AllocKind::OBJECT_GROUP,
+     AllocKind::STRING,
+     AllocKind::JITCODE,
+-    AllocKind::SCOPE,
+     AllocKind::REGEXP_SHARED
+ };
+ 
+ static const AllocKinds UpdatePhaseObjects {
++    AllocKind::SCOPE,
+     AllocKind::FUNCTION,
+     AllocKind::FUNCTION_EXTENDED,
+     AllocKind::OBJECT0,
+     AllocKind::OBJECT0_BACKGROUND,
+     AllocKind::OBJECT2,
+     AllocKind::OBJECT2_BACKGROUND,
+     AllocKind::OBJECT4,
+     AllocKind::OBJECT4_BACKGROUND,

mozilla-release/patches/1854076-11505.patch

@@ -1,55 +0,0 @@
-# HG changeset patch
-# User Andrew Sutherland <asutherland@asutherland.org>
-# Date 1698176456 0
-# Node ID d04b0067e2ec64e290fc887c316e0b5ee6eb2b34
-# Parent  ee0e86a44f87ac70fb1372d06a89bf3ef32dc4b3
-Bug 1854076 - ESR115 Improve MessagePort state machine. r=dom-worker-reviewers,edenchuang, a=dsmith
-
-Differential Revision: https://phabricator.services.mozilla.com/D191773
-
-diff --git a/dom/messagechannel/MessagePort.cpp b/dom/messagechannel/MessagePort.cpp
---- a/dom/messagechannel/MessagePort.cpp
-+++ b/dom/messagechannel/MessagePort.cpp
-@@ -248,16 +248,21 @@ MessagePort::MessagePort(nsIGlobalObject
-   mIdentifier = new MessagePortIdentifier();
-   mIdentifier->neutered() = true;
-   mIdentifier->sequenceId() = 0;
- }
- 
- MessagePort::~MessagePort()
- {
-   CloseForced();
-+  MOZ_ASSERT(!mActor);
-+  if (mActor) {
-+    mActor->SetPort(nullptr);
-+    mActor = nullptr;
-+  }
-   MOZ_ASSERT(!mWorkerHolder);
- }
- 
- /* static */ already_AddRefed<MessagePort>
- MessagePort::Create(nsIGlobalObject* aGlobal, const nsID& aUUID,
-                     const nsID& aDestinationUUID, ErrorResult& aRv)
- {
-   MOZ_ASSERT(aGlobal);
-@@ -325,16 +330,20 @@ MessagePort::Initialize(const nsID& aUUI
- 
-   if (!NS_IsMainThread()) {
-     WorkerPrivate* workerPrivate = GetCurrentThreadWorkerPrivate();
-     MOZ_ASSERT(workerPrivate);
-     MOZ_ASSERT(!mWorkerHolder);
- 
-     nsAutoPtr<WorkerHolder> workerHolder(new MessagePortWorkerHolder(this));
-     if (NS_WARN_IF(!workerHolder->HoldWorker(workerPrivate, Closing))) {
-+      // The worker is shutting down.
-+// -      mState = eStateDisentangled;
-+// -      UpdateMustKeepAlive();
-+      CloseForced();
-       aRv.Throw(NS_ERROR_FAILURE);
-       return;
-     }
- 
-     mWorkerHolder = Move(workerHolder);
-   } else if (GetOwner()) {
-     MOZ_ASSERT(NS_IsMainThread());
-     MOZ_ASSERT(GetOwner()->IsInnerWindow());

mozilla-release/patches/series

@@ -5556,7 +5556,6 @@ NOBUG-removemobilethemes-25318.patch
 1835524-bugsplat-mr-v1_6-25318.patch
 1858551-crashreporter-vendor-v1_2-25318.patch
 1858570-11505.patch
-1854076-11505.patch
 1721612-11506.patch
 1837261-2-version-beta-mr-25318.patch
 1861842-version-release-mr-25318.patch
@@ -5897,3 +5896,4 @@ TOP-NOBUG-killtelemetry-debugger-25319.patch
 1432112-60a1.patch
 1432520-60a1.patch
 1431050-61a1.patch
+1506798-65a1.patch