sync with release

frg/work-js/mozilla-release/patches/mozilla-central-push_422645.patch → frg/work-js/mozilla-release/patches/1343620-62a1.patch

@@ -3,13 +3,13 @@
 # Date 1528327718 25200
 #      Wed Jun 06 16:28:38 2018 -0700
 # Node ID b15524c982e924e0732f56c4b9ca170ffcd10a30
-# Parent  9496b052a5d18a752ad186fa3c28dd182342f1b7
+# Parent  a1f6a81a4cfaf534f32aec1ecd54f3b0501a506e
 Bug 1343620 - Use JS_HAZ_ROOTED everywhere instead of programmatic annotations, r=pbone
 
 diff --git a/dom/bindings/ErrorResult.h b/dom/bindings/ErrorResult.h
 --- a/dom/bindings/ErrorResult.h
 +++ b/dom/bindings/ErrorResult.h
-@@ -561,17 +561,17 @@ private:
+@@ -556,17 +556,17 @@ private:
    // The thread that created this TErrorResult
    NS_DECL_OWNINGTHREAD;
  #endif
@@ -24,20 +24,20 @@ diff --git a/dom/bindings/ErrorResult.h b/dom/bindings/ErrorResult.h
  struct JustAssertCleanupPolicy {
    static const bool assertHandled = true;
    static const bool suppress = false;
-   static const bool assertSameThread = true;
  };
  
  struct AssertAndSuppressCleanupPolicy {
-@@ -833,17 +833,17 @@ class MOZ_TEMPORARY_CLASS IgnoreErrors {
- public:
-   operator ErrorResult&() && { return mInner; }
-   operator OOMReporter&() && { return mInner; }
- private:
-   // We don't use an ErrorResult member here so we don't make two separate calls
-   // to SuppressException (one from us, one from the ErrorResult destructor
-   // after asserting).
-   binding_danger::TErrorResult<binding_danger::JustSuppressCleanupPolicy> mInner;
--};
+   static const bool assertHandled = true;
+@@ -717,17 +717,17 @@ public:
+ };
+ } // namespace binding_danger
+ 
+ template<typename CleanupPolicy>
+ binding_danger::TErrorResult<CleanupPolicy>::operator OOMReporter&()
+ {
+   return *static_cast<OOMReporter*>(
+      reinterpret_cast<TErrorResult<JustAssertCleanupPolicy>*>(this));
+-}
 +} JS_HAZ_ROOTED;
  
  /******************************************************************************
@@ -50,14 +50,14 @@ diff --git a/dom/bindings/ErrorResult.h b/dom/bindings/ErrorResult.h
 diff --git a/js/src/devtools/rootAnalysis/annotations.js b/js/src/devtools/rootAnalysis/annotations.js
 --- a/js/src/devtools/rootAnalysis/annotations.js
 +++ b/js/src/devtools/rootAnalysis/annotations.js
-@@ -317,29 +317,20 @@ function stripUCSAndNamespace(name)
- function extraRootedGCThings()
+@@ -327,29 +327,20 @@ function extraRootedGCThings()
  {
      return [ 'JSAddonId' ];
  }
  
  function extraRootedPointers()
  {
+     return (name == "JSAddonId");
      return [
 -        'ModuleValidator',
 -        'JSErrorResult',
@@ -105,14 +105,14 @@ diff --git a/js/src/wasm/AsmJS.cpp b/js/src/wasm/AsmJS.cpp
 diff --git a/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp b/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
 --- a/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
 +++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp
-@@ -74,16 +74,17 @@
- #include "nsContentUtils.h"
+@@ -75,16 +75,17 @@
  #include "nsDOMJSUtils.h"
  #include "nsIScriptError.h"
  #include "nsPrintfCString.h"
  #include "nsURLHelper.h"
  #include "nsNetUtil.h"
  #include "nsIURLParser.h"
+ #include "nsIDOMDataChannel.h"
  #include "NullPrincipal.h"
 +#include "js/GCAnnotations.h"
  #include "mozilla/PeerIdentity.h"
@@ -123,7 +123,7 @@ diff --git a/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp b/
  #include "mozilla/dom/RTCRtpReceiverBinding.h"
  #include "mozilla/dom/RTCRtpSenderBinding.h"
  #include "mozilla/dom/RTCStatsReportBinding.h"
-@@ -150,17 +151,17 @@ namespace {
+@@ -152,17 +153,17 @@ namespace {
  class JSErrorResult :
      public binding_danger::TErrorResult<binding_danger::JustAssertCleanupPolicy>
  {
@@ -142,7 +142,7 @@ diff --git a/media/webrtc/signaling/src/peerconnection/PeerConnectionImpl.cpp b/
  // This WrappableJSErrorResult hack solves this by not actually copying the
  // ErrorResult, but creating a new one instead, which works because we don't
  // care about the result.
-@@ -179,17 +180,17 @@ public:
+@@ -181,17 +182,17 @@ public:
      if (isCopy) {
        MOZ_ASSERT(NS_IsMainThread());
      }

frg/work-js/mozilla-release/patches/1345433-1-59a1.patch

@@ -0,0 +1,59 @@
+# HG changeset patch
+# User Thomas Nguyen <tnguyen@mozilla.com>
+# Date 1508753668 -28800
+# Node ID 1294e490afc2d16596baa7497dd4c758864f9afc
+# Parent  f57e0b8c5b994f8ef62b81af5ab0b29f5c6ca0c9
+Bug 1345433 - Bring back assertion that history entries need a valid triggeringPrincipal r=JanH,smaug
+
+MozReview-Commit-ID: 9GfGIxkqfhM
+
+diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
+--- a/docshell/base/nsDocShell.cpp
++++ b/docshell/base/nsDocShell.cpp
+@@ -12917,18 +12917,20 @@ nsDocShell::LoadHistoryEntry(nsISHEntry*
+   if (isSrcdoc) {
+     aEntry->GetSrcdocData(srcdoc);
+     aEntry->GetBaseURI(getter_AddRefs(baseURI));
+     flags |= INTERNAL_LOAD_FLAGS_IS_SRCDOC;
+   } else {
+     srcdoc = VoidString();
+   }
+ 
++  // If there is no valid triggeringPrincipal, we deny the load
++  MOZ_ASSERT(triggeringPrincipal, "need a valid triggeringPrincipal to load from history");
+   if (!triggeringPrincipal) {
+-    triggeringPrincipal = nsContentUtils::GetSystemPrincipal();
++    return NS_ERROR_FAILURE;
+   }
+ 
+   // Passing nullptr as aSourceDocShell gives the same behaviour as before
+   // aSourceDocShell was introduced. According to spec we should be passing
+   // the source browsing context that was used when the history entry was
+   // first created. bug 947716 has been created to address this issue.
+   Maybe<nsCOMPtr<nsIURI>> emplacedResultPrincipalURI;
+   emplacedResultPrincipalURI.emplace(Move(resultPrincipalURI));
+diff --git a/docshell/shistory/nsSHEntry.cpp b/docshell/shistory/nsSHEntry.cpp
+--- a/docshell/shistory/nsSHEntry.cpp
++++ b/docshell/shistory/nsSHEntry.cpp
+@@ -545,16 +545,21 @@ nsSHEntry::GetTriggeringPrincipal(nsIPri
+ {
+   NS_IF_ADDREF(*aTriggeringPrincipal = mShared->mTriggeringPrincipal);
+   return NS_OK;
+ }
+ 
+ NS_IMETHODIMP
+ nsSHEntry::SetTriggeringPrincipal(nsIPrincipal* aTriggeringPrincipal)
+ {
++  MOZ_ASSERT(aTriggeringPrincipal, "need a valid triggeringPrincipal");
++  if (!aTriggeringPrincipal) {
++    return NS_ERROR_FAILURE;
++  }
++
+   mShared->mTriggeringPrincipal = aTriggeringPrincipal;
+   return NS_OK;
+ }
+ 
+ NS_IMETHODIMP
+ nsSHEntry::GetPrincipalToInherit(nsIPrincipal** aPrincipalToInherit)
+ {
+   NS_IF_ADDREF(*aPrincipalToInherit = mShared->mPrincipalToInherit);

frg/work-js/mozilla-release/patches/1345433-2-59a1.patch

@@ -0,0 +1,156 @@
+# HG changeset patch
+# User Thomas Nguyen <tnguyen@mozilla.com>
+# Date 1508753740 -28800
+# Node ID 166fb0b613592e18893c0d825dd5332c6185b2ce
+# Parent  e33e08f4af4595cd4bc35a74954414b836fc6a03
+Bug 1345433 - Ensure tests load pass valid triggeringPrincipal. r=ckerschb,JanH
+
+MozReview-Commit-ID: LWcP7drDPwL
+
+diff --git a/browser/components/extensions/test/browser/browser_ext_tabs_discarded.js b/browser/components/extensions/test/browser/browser_ext_tabs_discarded.js
+--- a/browser/components/extensions/test/browser/browser_ext_tabs_discarded.js
++++ b/browser/components/extensions/test/browser/browser_ext_tabs_discarded.js
+@@ -1,14 +1,17 @@
+ /* -*- Mode: indent-tabs-mode: nil; js-indent-level: 2 -*- */
+ /* vim: set sts=2 sw=2 et tw=80: */
+ /* global gBrowser SessionStore */
+ "use strict";
+ 
+-let lazyTabState = {entries: [{url: "http://example.com/", title: "Example Domain"}]};
++const {Utils} = Cu.import("resource://gre/modules/sessionstore/Utils.jsm", {});
++const triggeringPrincipal_base64 = Utils.SERIALIZED_SYSTEMPRINCIPAL;
++
++let lazyTabState = {entries: [{url: "http://example.com/", triggeringPrincipal_base64, title: "Example Domain"}]};
+ 
+ add_task(async function test_discarded() {
+   let extension = ExtensionTestUtils.loadExtension({
+     manifest: {
+       "permissions": ["tabs"],
+     },
+ 
+     background: async function() {
+diff --git a/browser/components/extensions/test/browser/browser_ext_tabs_lazy.js b/browser/components/extensions/test/browser/browser_ext_tabs_lazy.js
+--- a/browser/components/extensions/test/browser/browser_ext_tabs_lazy.js
++++ b/browser/components/extensions/test/browser/browser_ext_tabs_lazy.js
+@@ -1,15 +1,18 @@
+ "use strict";
+ 
++const {Utils} = Cu.import("resource://gre/modules/sessionstore/Utils.jsm", {});
++const triggeringPrincipal_base64 = Utils.SERIALIZED_SYSTEMPRINCIPAL;
++
+ const SESSION = {
+   windows: [{
+     tabs: [
+-      {entries: [{url: "about:blank"}]},
+-      {entries: [{url: "https://example.com/"}]},
++      {entries: [{url: "about:blank", triggeringPrincipal_base64}]},
++      {entries: [{url: "https://example.com/", triggeringPrincipal_base64}]},
+     ],
+   }],
+ };
+ 
+ add_task(async function() {
+   SessionStore.setBrowserState(JSON.stringify(SESSION));
+   const tab = gBrowser.tabs[1];
+ 
+diff --git a/browser/components/sessionstore/test/browser_906076_lazy_tabs.js b/browser/components/sessionstore/test/browser_906076_lazy_tabs.js
+--- a/browser/components/sessionstore/test/browser_906076_lazy_tabs.js
++++ b/browser/components/sessionstore/test/browser_906076_lazy_tabs.js
+@@ -1,32 +1,32 @@
+ /* Any copyright is dedicated to the Public Domain.
+    http://creativecommons.org/publicdomain/zero/1.0/ */
+ 
+ const TEST_STATE = {
+   windows: [{
+     tabs: [
+-      { entries: [{ url: "http://example.com" }] },
+-      { entries: [{ url: "http://example.com" }] },
+-      { entries: [{ url: "http://example.com" }] },
+-      { entries: [{ url: "http://example.com" }] },
+-      { entries: [{ url: "http://example.com" }] },
+-      { entries: [{ url: "http://example.com" }] },
+-      { entries: [{ url: "http://example.com" }] },
+-      { entries: [{ url: "http://example.com" }] },
+-      { entries: [{ url: "http://example.com" }] },
+-      { entries: [{ url: "http://example.com" }] },
++      { entries: [{ url: "http://example.com", triggeringPrincipal_base64 }] },
++      { entries: [{ url: "http://example.com", triggeringPrincipal_base64 }] },
++      { entries: [{ url: "http://example.com", triggeringPrincipal_base64 }] },
++      { entries: [{ url: "http://example.com", triggeringPrincipal_base64 }] },
++      { entries: [{ url: "http://example.com", triggeringPrincipal_base64 }] },
++      { entries: [{ url: "http://example.com", triggeringPrincipal_base64 }] },
++      { entries: [{ url: "http://example.com", triggeringPrincipal_base64 }] },
++      { entries: [{ url: "http://example.com", triggeringPrincipal_base64 }] },
++      { entries: [{ url: "http://example.com", triggeringPrincipal_base64 }] },
++      { entries: [{ url: "http://example.com", triggeringPrincipal_base64 }] },
+     ]
+   }]
+ };
+ 
+ const TEST_STATE_2 = {
+   windows: [{
+     tabs: [
+-      { entries: [{ url: "about:robots" }]
++      { entries: [{ url: "about:robots", triggeringPrincipal_base64 }]
+       },
+       { entries: [],
+         userTypedValue: "http://example.com",
+         userTypedClear: 1
+       }
+     ]
+   }]
+ };
+diff --git a/browser/components/sessionstore/test/browser_tab_label_during_restore.js b/browser/components/sessionstore/test/browser_tab_label_during_restore.js
+--- a/browser/components/sessionstore/test/browser_tab_label_during_restore.js
++++ b/browser/components/sessionstore/test/browser_tab_label_during_restore.js
+@@ -35,20 +35,20 @@ add_task(async function() {
+     };
+   }
+ 
+   info("setting test browser state");
+   let browserLoadedPromise = BrowserTestUtils.firstBrowserLoaded(window, false);
+   await promiseBrowserState({
+     windows: [{
+       tabs: [
+-        { entries: [{ url: REMOTE_URL }] },
+-        { entries: [{ url: ABOUT_ROBOTS_URI }] },
+-        { entries: [{ url: REMOTE_URL }] },
+-        { entries: [{ url: NO_TITLE_URL }] },
++        { entries: [{ url: REMOTE_URL, triggeringPrincipal_base64 }] },
++        { entries: [{ url: ABOUT_ROBOTS_URI, triggeringPrincipal_base64 }] },
++        { entries: [{ url: REMOTE_URL, triggeringPrincipal_base64 }] },
++        { entries: [{ url: NO_TITLE_URL, triggeringPrincipal_base64 }] },
+       ]
+     }]
+   });
+   let [tab1, tab2, tab3, tab4] = gBrowser.tabs;
+   is(gBrowser.selectedTab, tab1, "first tab is selected");
+ 
+   await browserLoadedPromise;
+   const REMOTE_TITLE = tab1.linkedBrowser.contentTitle;
+diff --git a/devtools/client/scratchpad/test/browser_scratchpad_sessions.js b/devtools/client/scratchpad/test/browser_scratchpad_sessions.js
+--- a/devtools/client/scratchpad/test/browser_scratchpad_sessions.js
++++ b/devtools/client/scratchpad/test/browser_scratchpad_sessions.js
+@@ -1,20 +1,20 @@
+  /* Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/ */
+ "use strict";
+ 
+ const {Utils} = ChromeUtils.import("resource://gre/modules/sessionstore/Utils.jsm", {});
+-const triggeringPrincipalBase64 = Utils.SERIALIZED_SYSTEMPRINCIPAL;
++const triggeringPrincipal_base64 = Utils.SERIALIZED_SYSTEMPRINCIPAL;
+ const ss = Cc["@mozilla.org/browser/sessionstore;1"].getService(Ci.nsISessionStore);
+ 
+ const testState = {
+   windows: [{
+     tabs: [
+-      { entries: [{ url: "about:blank", triggeringPrincipalBase64 }] },
++      { entries: [{ url: "about:blank", triggeringPrincipal_base64 }] },
+     ]
+   }],
+   scratchpads: [
+     { text: "text1", executionContext: 1 },
+     { text: "", executionContext: 2, filename: "test.js" }
+   ]
+ };
+ 

frg/work-js/mozilla-release/patches/1346211-6-63a1.patch

@@ -2,7 +2,7 @@
 # User Andre Bargull <andre.bargull@gmail.com>
 # Date 1534500279 25200
 # Node ID 7b1a3a49547dc9564aaa6ecf90b919b66b7ada8d
-# Parent  773d5e54e37da645834cd70a76b67593a7f95061
+# Parent  18dbc987f837f547838c2b012aeba86c1169384c
 Bug 1346211 - Part 6: Use ICU for all time zone computations when available. r=Waldo
 
 diff --git a/browser/components/resistfingerprinting/test/browser/browser_timezone.js b/browser/components/resistfingerprinting/test/browser/browser_timezone.js
@@ -191,15 +191,15 @@ diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctio
  
      uint32_t max_cnt;
      if (!ToUint32(cx, args.get(0), &max_cnt))
-@@ -5908,16 +5989,20 @@ gc::ZealModeHelpText),
-     JS_FN_HELP("scriptedCallerGlobal", ScriptedCallerGlobal, 0, 0,
- "scriptedCallerGlobal()",
- "  Get the caller's global (or null). See JS::GetScriptedCallerGlobal.\n"),
- 
+@@ -5921,16 +6002,20 @@ gc::ZealModeHelpText),
      JS_FN_HELP("objectGlobal", ObjectGlobal, 1, 0,
  "objectGlobal(obj)",
  "  Returns the object's global object or null if the object is a wrapper.\n"),
  
+     JS_FN_HELP("assertCorrectRealm", AssertCorrectRealm, 0, 0,
+ "assertCorrectRealm()",
+ "  Asserts cx->realm matches callee->raelm.\n"),
+ 
 +    JS_FN_HELP("getDefaultLocale", GetDefaultLocale, 0, 0,
 +"getDefaultLocale()",
 +"  Get the current default locale.\n"),
@@ -212,7 +212,7 @@ diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctio
  "  running the jitcode rather than staying in the interpreter:\n"
  "    baselineCompile();  for (var i=0; i<1; i++) {} ...\n"
  "  The interpreter will enter the new jitcode at the loop header.\n"),
-@@ -5941,16 +6026,22 @@ static const JSFunctionSpecWithHelp Fuzz
+@@ -5954,16 +6039,22 @@ static const JSFunctionSpecWithHelp Fuzz
  "  Returns an array of error notes."),
  
      JS_FN_HELP("setTimeZone", SetTimeZone, 1, 0,

frg/work-js/mozilla-release/patches/1406161-1-59a1.patch

@@ -0,0 +1,657 @@
+# HG changeset patch
+# User Samael Wang <freesamael@gmail.com>
+# Date 1513368846 21600
+# Node ID 3165c7f9db20917c367ee15fb0c17776087714d2
+# Parent  3ac010bc76c8ae203f88a2d8111708efdb4a95a8
+Bug 1406161 - Part 1: Reorder #include, #define, forward declarations, global & static variables. r=smaug
+
+MozReview-Commit-ID: 9DKL1zuLboL
+
+diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
+--- a/docshell/base/nsDocShell.cpp
++++ b/docshell/base/nsDocShell.cpp
+@@ -3,299 +3,277 @@
+ /* This Source Code Form is subject to the terms of the Mozilla Public
+  * License, v. 2.0. If a copy of the MPL was not distributed with this
+  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+ 
+ #include "nsDocShell.h"
+ 
+ #include <algorithm>
+ 
++#ifdef XP_WIN
++#include <process.h>
++#define getpid _getpid
++#else
++#include <unistd.h> // for getpid()
++#endif
++
+ #include "mozilla/ArrayUtils.h"
+ #include "mozilla/Attributes.h"
+ #include "mozilla/AutoRestore.h"
+ #include "mozilla/BasePrincipal.h"
+ #include "mozilla/Casting.h"
+-#include "mozilla/dom/ClientChannelHelper.h"
+-#include "mozilla/dom/ClientHandle.h"
+-#include "mozilla/dom/ClientInfo.h"
+-#include "mozilla/dom/ClientManager.h"
+-#include "mozilla/dom/ClientSource.h"
+-#include "mozilla/dom/ContentChild.h"
+-#include "mozilla/dom/Element.h"
+-#include "mozilla/dom/HTMLAnchorElement.h"
+-#include "mozilla/dom/TabChild.h"
+-#include "mozilla/dom/ProfileTimelineMarkerBinding.h"
+-#include "mozilla/dom/ScreenOrientation.h"
+-#include "mozilla/dom/ToJSValue.h"
+-#include "mozilla/dom/PermissionMessageUtils.h"
+-#include "mozilla/dom/workers/ServiceWorkerManager.h"
++#include "mozilla/Encoding.h"
+ #include "mozilla/EventStateManager.h"
++#include "mozilla/HTMLEditor.h"
+ #include "mozilla/LoadInfo.h"
+-#include "mozilla/HTMLEditor.h"
++#include "mozilla/Logging.h"
+ #include "mozilla/Preferences.h"
+ #include "mozilla/ResultExtensions.h"
+ #include "mozilla/Services.h"
+ #include "mozilla/StartupTimeline.h"
+ #include "mozilla/Telemetry.h"
+ #include "mozilla/Unused.h"
+-#include "Navigator.h"
+-#include "URIUtils.h"
++
++#include "mozilla/dom/ClientChannelHelper.h"
++#include "mozilla/dom/ClientHandle.h"
++#include "mozilla/dom/ClientInfo.h"
++#include "mozilla/dom/ClientManager.h"
++#include "mozilla/dom/ClientSource.h"
++#include "mozilla/dom/ContentChild.h"
+ #include "mozilla/dom/DocGroup.h"
++#include "mozilla/dom/Element.h"
++#include "mozilla/dom/HTMLAnchorElement.h"
++#include "mozilla/dom/PerformanceNavigation.h"
++#include "mozilla/dom/PermissionMessageUtils.h"
++#include "mozilla/dom/ProfileTimelineMarkerBinding.h"
++#include "mozilla/dom/ScreenOrientation.h"
++#include "mozilla/dom/ScriptSettings.h"
++#include "mozilla/dom/TabChild.h"
+ #include "mozilla/dom/TabGroup.h"
+-
++#include "mozilla/dom/ToJSValue.h"
++
++#include "mozilla/dom/workers/ServiceWorkerManager.h"
++
++#include "mozilla/net/ReferrerPolicy.h"
++
++#include "nsIApplicationCacheChannel.h"
++#include "nsIApplicationCacheContainer.h"
++#include "nsIAppShell.h"
++#include "nsIAsyncVerifyRedirectCallback.h"
++#include "nsIAuthPrompt.h"
++#include "nsIAuthPrompt2.h"
++#include "nsICachingChannel.h"
++#include "nsICaptivePortalService.h"
++#include "nsIChannel.h"
++#include "nsIChannelEventSink.h"
++#include "nsIClassOfService.h"
++#include "nsICommandManager.h"
++#include "nsIConsoleReportCollector.h"
+ #include "nsIContent.h"
+ #include "nsIContentInlines.h"
++#include "nsIContentSecurityPolicy.h"
++#include "nsIContentViewer.h"
++#include "nsIController.h"
++#include "nsICookieService.h"
++#include "nsIDocShellTreeItem.h"
++#include "nsIDocShellTreeOwner.h"
+ #include "nsIDocument.h"
++#include "nsIDocumentLoaderFactory.h"
+ #include "nsIDOMDocument.h"
+ #include "nsIDOMElement.h"
++#include "nsIDOMNode.h"
++#include "nsIDOMStorage.h"
++#include "nsIDOMWindow.h"
++#include "nsIEditingSession.h"
++#include "nsIExternalProtocolService.h"
++#include "nsIFormPOSTActionChannel.h"
++#include "nsIFrame.h"
++#include "nsIGlobalHistory2.h"
++#include "nsIGlobalObject.h"
++#include "nsIHttpChannel.h"
++#include "nsIHttpChannelInternal.h"
++#include "nsIIDNService.h"
++#include "nsIInputStreamChannel.h"
++#include "nsIInterfaceRequestorUtils.h"
++#include "nsIJARChannel.h"
++#include "nsILayoutHistoryState.h"
++#include "nsILoadInfo.h"
++#include "nsIMultiPartChannel.h"
++#include "nsINestedURI.h"
++#include "nsINetworkPredictor.h"
++#include "nsINode.h"
++#include "nsINSSErrorsService.h"
++#include "nsIObserverService.h"
++#include "nsIOService.h"
++#include "nsIPrincipal.h"
++#include "nsIPrivacyTransitionObserver.h"
++#include "nsIPrompt.h"
++#include "nsIPromptFactory.h"
++#include "nsIReflowObserver.h"
++#include "nsIScriptChannel.h"
++#include "nsIScriptError.h"
++#include "nsIScriptObjectPrincipal.h"
++#include "nsIScriptSecurityManager.h"
++#include "nsIScrollableFrame.h"
++#include "nsIScrollObserver.h"
++#include "nsISecureBrowserUI.h"
++#include "nsISecurityUITelemetry.h"
++#include "nsISeekableStream.h"
++#include "nsISelectionDisplay.h"
++#include "nsISHContainer.h"
++#include "nsISHEntry.h"
++#include "nsISHistory.h"
++#include "nsISHistoryInternal.h"
++#include "nsISiteSecurityService.h"
++#include "nsISocketProvider.h"
++#include "nsIStringBundle.h"
++#include "nsIStructuredCloneContainer.h"
++#include "nsISupportsPrimitives.h"
++#include "nsITabChild.h"
++#include "nsITextToSubURI.h"
++#include "nsITimedChannel.h"
++#include "nsITimer.h"
++#include "nsITransportSecurityInfo.h"
++#include "nsIUploadChannel.h"
++#include "nsIUploadChannel2.h"
++#include "nsIURIFixup.h"
++#include "nsIURILoader.h"
++#include "nsIURL.h"
++#include "nsIViewSourceChannel.h"
++#include "nsIWebBrowserChrome.h"
++#include "nsIWebBrowserChrome3.h"
++#include "nsIWebBrowserChromeFocus.h"
++#include "nsIWebBrowserFind.h"
++#include "nsIWebProgress.h"
++#include "nsIWidget.h"
++#include "nsIWindowWatcher.h"
++#include "nsIWritablePropertyBag2.h"
++#include "nsIWyciwygChannel.h"
++
++#include "nsPICommandUpdater.h"
++#include "nsPIDOMWindow.h"
++#include "nsPILoadGroupInternal.h"
++#include "nsPIWindowRoot.h"
++
++#include "IHistory.h"
++
++#include "mozIThirdPartyUtil.h"
+ 
+ #include "nsArray.h"
+ #include "nsArrayUtils.h"
++#include "nsAutoPtr.h"
++#include "nsCDefaultURIFixup.h"
++#include "nsCExternalHandlerService.h"
++#include "nsContentDLF.h"
++#include "nsContentPolicyUtils.h" // NS_CheckContentLoadPolicy(...)
+ #include "nsContentSecurityManager.h"
+-#include "nsICaptivePortalService.h"
+-#include "nsIDOMStorage.h"
+-#include "nsIContentViewer.h"
+-#include "nsIDocumentLoaderFactory.h"
++#include "nsContentUtils.h"
+ #include "nsCURILoader.h"
+-#include "nsContentDLF.h"
+ #include "nsDocShellCID.h"
++#include "nsDocShellEditorData.h"
++#include "nsDocShellEnumerator.h"
++#include "nsDocShellLoadInfo.h"
++#include "nsDocShellLoadTypes.h"
++#include "nsDocShellTransferableHooks.h"
+ #include "nsDOMCID.h"
++#include "nsDOMNavigationTiming.h"
++#include "nsDSURIContentListener.h"
++#include "nsError.h"
++#include "nsEscape.h"
++#include "nsFocusManager.h"
++#include "nsGlobalWindow.h"
++#include "nsJSEnvironment.h"
+ #include "nsNetCID.h"
+ #include "nsNetUtil.h"
+-#include "mozilla/net/ReferrerPolicy.h"
+-#include "nsRect.h"
+-#include "prenv.h"
+-#include "nsIDOMWindow.h"
+-#include "nsIGlobalObject.h"
+-#include "nsIViewSourceChannel.h"
+-#include "nsIWebBrowserChrome.h"
++#include "nsObjectLoadingContent.h"
+ #include "nsPoint.h"
+-#include "nsIObserverService.h"
+-#include "nsIPrompt.h"
+-#include "nsIAuthPrompt.h"
+-#include "nsIAuthPrompt2.h"
+-#include "nsIChannelEventSink.h"
+-#include "nsIAsyncVerifyRedirectCallback.h"
+-#include "nsIScriptSecurityManager.h"
+-#include "nsIScriptObjectPrincipal.h"
+-#include "nsIScrollableFrame.h"
+-#include "nsContentPolicyUtils.h" // NS_CheckContentLoadPolicy(...)
+-#include "nsISeekableStream.h"
+-#include "nsAutoPtr.h"
+ #include "nsQueryObject.h"
+-#include "nsIWritablePropertyBag2.h"
+-#include "nsIAppShell.h"
+-#include "nsWidgetsCID.h"
+-#include "nsIInterfaceRequestorUtils.h"
++#include "nsRect.h"
++#include "nsSandboxFlags.h"
++#include "nsSHistory.h"
++#include "nsStreamUtils.h"
++#include "nsStringStream.h"
++#include "nsStructuredCloneContainer.h"
++#include "nsSubDocumentFrame.h"
+ #include "nsView.h"
+ #include "nsViewManager.h"
+-#include "nsIScriptChannel.h"
+-#include "nsITimedChannel.h"
+-#include "nsIPrivacyTransitionObserver.h"
+-#include "nsIReflowObserver.h"
+-#include "nsIScrollObserver.h"
+-#include "nsIDocShellTreeItem.h"
+-#include "nsIChannel.h"
+-#include "IHistory.h"
+ #include "nsViewSourceHandler.h"
+ #include "nsWhitespaceTokenizer.h"
+-#include "nsICookieService.h"
+-#include "nsIConsoleReportCollector.h"
+-#include "nsObjectLoadingContent.h"
+-#include "nsStringStream.h"
+-
+-// we want to explore making the document own the load group
+-// so we can associate the document URI with the load group.
+-// until this point, we have an evil hack:
+-#include "nsIHttpChannelInternal.h"
+-#include "nsPILoadGroupInternal.h"
+-
+-// Local Includes
+-#include "nsDocShellLoadInfo.h"
+-#include "nsCDefaultURIFixup.h"
+-#include "nsDocShellEnumerator.h"
+-#include "nsSHistory.h"
+-#include "nsDocShellEditorData.h"
++#include "nsWidgetsCID.h"
++#include "nsXULAppAPI.h"
++
+ #include "GeckoProfiler.h"
++#include "Navigator.h"
++#include "NullPrincipal.h"
++#include "prenv.h"
++#include "URIUtils.h"
++
+ #include "timeline/JavascriptTimelineMarker.h"
+ 
+-// Helper Classes
+-#include "nsError.h"
+-#include "nsEscape.h"
+-
+-// Interfaces Needed
+-#include "nsIFormPOSTActionChannel.h"
+-#include "nsIUploadChannel.h"
+-#include "nsIUploadChannel2.h"
+-#include "nsIWebProgress.h"
+-#include "nsILayoutHistoryState.h"
+-#include "nsITimer.h"
+-#include "nsISHistoryInternal.h"
+-#include "nsIPrincipal.h"
+-#include "NullPrincipal.h"
+-#include "nsISHEntry.h"
+-#include "nsIWindowWatcher.h"
+-#include "nsIPromptFactory.h"
+-#include "nsITransportSecurityInfo.h"
+-#include "nsINode.h"
+-#include "nsINSSErrorsService.h"
+-#include "nsIApplicationCacheChannel.h"
+-#include "nsIApplicationCacheContainer.h"
+-#include "nsStreamUtils.h"
+-#include "nsIController.h"
+-#include "nsPICommandUpdater.h"
+-#include "nsIWebBrowserChrome3.h"
+-#include "nsITabChild.h"
+-#include "nsISiteSecurityService.h"
+-#include "nsStructuredCloneContainer.h"
+-#include "nsIStructuredCloneContainer.h"
+-#include "nsISupportsPrimitives.h"
+ #ifdef MOZ_PLACES
+ #include "nsIFaviconService.h"
+ #include "mozIPlacesPendingOperation.h"
+ #include "mozIAsyncFavicons.h"
+ #endif
+-#include "nsINetworkPredictor.h"
+-
+-// Editor-related
+-#include "nsIEditingSession.h"
+-
+-#include "nsPIDOMWindow.h"
+-#include "nsGlobalWindow.h"
+-#include "nsPIWindowRoot.h"
+-#include "nsICachingChannel.h"
+-#include "nsIMultiPartChannel.h"
+-#include "nsIWyciwygChannel.h"
+-
+-// For reporting errors with the console service.
+-// These can go away if error reporting is propagated up past nsDocShell.
+-#include "nsIScriptError.h"
+-
+-// used to dispatch urls to default protocol handlers
+-#include "nsCExternalHandlerService.h"
+-#include "nsIExternalProtocolService.h"
+-
+-#include "nsFocusManager.h"
+-
+-#include "nsITextToSubURI.h"
+-
+-#include "nsIJARChannel.h"
+-
+-#include "mozilla/Logging.h"
+-
+-#include "nsISelectionDisplay.h"
+-
+-#include "nsIGlobalHistory2.h"
+-
+-#include "nsIFrame.h"
+-#include "nsSubDocumentFrame.h"
+-
+-// for embedding
+-#include "nsIWebBrowserChromeFocus.h"
+ 
+ #if NS_PRINT_PREVIEW
+ #include "nsIDocumentViewerPrint.h"
+ #include "nsIWebBrowserPrint.h"
+ #endif
+ 
+-#include "nsContentUtils.h"
+-#include "nsIContentSecurityPolicy.h"
+-#include "nsILoadInfo.h"
+-#include "nsSandboxFlags.h"
+-#include "nsXULAppAPI.h"
+-#include "nsDOMNavigationTiming.h"
+-#include "nsISecurityUITelemetry.h"
+-#include "nsDSURIContentListener.h"
+-#include "nsDocShellLoadTypes.h"
+-#include "nsDocShellTransferableHooks.h"
+-#include "nsICommandManager.h"
+-#include "nsIDOMNode.h"
+-#include "nsIClassOfService.h"
+-#include "nsIDocShellTreeOwner.h"
+-#include "nsIHttpChannel.h"
+-#include "nsIIDNService.h"
+-#include "nsIInputStreamChannel.h"
+-#include "nsINestedURI.h"
+-#include "nsIOService.h"
+-#include "nsISHContainer.h"
+-#include "nsISHistory.h"
+-#include "nsISecureBrowserUI.h"
+-#include "nsISocketProvider.h"
+-#include "nsIStringBundle.h"
+-#include "nsIURIFixup.h"
+-#include "nsIURILoader.h"
+-#include "nsIURL.h"
+-#include "nsIWebBrowserFind.h"
+-#include "nsIWidget.h"
+-#include "mozilla/dom/PerformanceNavigation.h"
+-#include "mozilla/dom/ScriptSettings.h"
+-#include "mozilla/Encoding.h"
+-#include "nsJSEnvironment.h"
+-
+ #ifdef MOZ_TOOLKIT_SEARCH
+ #include "nsIBrowserSearchService.h"
+ #endif
+ 
+-#include "mozIThirdPartyUtil.h"
+-
+-static NS_DEFINE_CID(kAppShellCID, NS_APPSHELL_CID);
+-
+-#if defined(DEBUG_bryner) || defined(DEBUG_chb)
+-//#define DEBUG_DOCSHELL_FOCUS
+-#define DEBUG_PAGE_CACHE
+-#endif
+-
+-#ifdef XP_WIN
+-#include <process.h>
+-#define getpid _getpid
+-#else
+-#include <unistd.h> // for getpid()
+-#endif
+-
+ using namespace mozilla;
+ using namespace mozilla::dom;
+ using mozilla::dom::workers::ServiceWorkerManager;
+ 
++// Threshold value in ms for META refresh based redirects
++#define REFRESH_REDIRECT_TIMER 15000
++
++// Hint for native dispatch of events on how long to delay after
++// all documents have loaded in milliseconds before favoring normal
++// native event dispatch priorites over performance
++// Can be overridden with docshell.event_starvation_delay_hint pref.
++#define NS_EVENT_STARVATION_DELAY_HINT 2000
++
++static NS_DEFINE_CID(kAppShellCID, NS_APPSHELL_CID);
++
+ // True means sUseErrorPages has been added to
+ // preferences var cache.
+ static bool gAddedPreferencesVarCache = false;
+ 
+-bool nsDocShell::sUseErrorPages = false;
+-
+ // Number of documents currently loading
+ static int32_t gNumberOfDocumentsLoading = 0;
+ 
+ // Global count of existing docshells.
+ static int32_t gDocShellCount = 0;
+ 
+ // Global count of docshells with the private attribute set
+ static uint32_t gNumberOfPrivateDocShells = 0;
+ 
+-// Global reference to the URI fixup service.
+-nsIURIFixup* nsDocShell::sURIFixup = 0;
+-
+ // True means we validate window targets to prevent frameset
+ // spoofing. Initialize this to a non-bolean value so we know to check
+ // the pref on the creation of the first docshell.
+ static uint32_t gValidateOrigin = 0xffffffff;
+ 
+-// Hint for native dispatch of events on how long to delay after
+-// all documents have loaded in milliseconds before favoring normal
+-// native event dispatch priorites over performance
+-// Can be overridden with docshell.event_starvation_delay_hint pref.
+-#define NS_EVENT_STARVATION_DELAY_HINT 2000
+-
+ #ifdef DEBUG
+ static mozilla::LazyLogModule gDocShellLog("nsDocShell");
+ #endif
+ static mozilla::LazyLogModule gDocShellLeakLog("nsDocShellLeak");;
+ 
+ const char kBrandBundleURL[]      = "chrome://branding/locale/brand.properties";
+ const char kAppstringsBundleURL[] = "chrome://global/locale/appstrings.properties";
+ 
++bool nsDocShell::sUseErrorPages = false;
++
++// Global reference to the URI fixup service.
++nsIURIFixup* nsDocShell::sURIFixup = nullptr;
++
+ static void
+ FavorPerformanceHint(bool aPerfOverStarvation)
+ {
+   nsCOMPtr<nsIAppShell> appShell = do_GetService(kAppShellCID);
+   if (appShell) {
+     appShell->FavorPerformanceHint(
+       aPerfOverStarvation,
+       Preferences::GetUint("docshell.event_starvation_delay_hint",
+diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
+--- a/docshell/base/nsDocShell.h
++++ b/docshell/base/nsDocShell.h
+@@ -2,111 +2,113 @@
+ /* vim: set ts=8 sts=2 et sw=2 tw=80: */
+ /* This Source Code Form is subject to the terms of the Mozilla Public
+  * License, v. 2.0. If a copy of the MPL was not distributed with this
+  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+ 
+ #ifndef nsDocShell_h__
+ #define nsDocShell_h__
+ 
+-#include "nsITimer.h"
+-#include "nsContentPolicyUtils.h"
+-#include "nsIDocShell.h"
+-#include "nsIDocShellTreeItem.h"
+-#include "nsIBaseWindow.h"
+-#include "nsINetworkInterceptController.h"
+-#include "nsIScrollable.h"
+-#include "nsITextScroll.h"
+-#include "nsIContentViewerContainer.h"
+-#include "nsIDOMStorageManager.h"
+-#include "nsDocLoader.h"
+ #include "mozilla/BasePrincipal.h"
++#include "mozilla/LinkedList.h"
+ #include "mozilla/Maybe.h"
+ #include "mozilla/Move.h"
++#include "mozilla/TimeStamp.h"
+ #include "mozilla/UniquePtr.h"
+ #include "mozilla/WeakPtr.h"
+-#include "mozilla/TimeStamp.h"
+-#include "GeckoProfiler.h"
++
+ #include "mozilla/dom/ProfileTimelineMarkerBinding.h"
+-#include "mozilla/LinkedList.h"
+-#include "jsapi.h"
+ 
+-// Helper Classes
++#include "nsIAuthPromptProvider.h"
++#include "nsIBaseWindow.h"
++#include "nsIClipboardCommands.h"
++#include "nsIContentViewerContainer.h"
++#include "nsIDeprecationWarner.h"
++#include "nsIDocCharset.h"
++#include "nsIDocShell.h"
++#include "nsIDocShellLoadInfo.h"
++#include "nsIDocShellTreeItem.h"
++#include "nsIDOMStorageManager.h"
++#include "nsIInterfaceRequestor.h"
++#include "nsILinkHandler.h"
++#include "nsILoadContext.h"
++#include "nsINamed.h"
++#include "nsINetworkInterceptController.h"
++#include "nsIRefreshURI.h"
++#include "nsIScrollable.h"
++#include "nsITabParent.h"
++#include "nsITextScroll.h"
++#include "nsITimer.h"
++#include "nsIWebNavigation.h"
++#include "nsIWebPageDescriptor.h"
++#include "nsIWebProgressListener.h"
++#include "nsIWebShellServices.h"
++
++#include "nsAutoPtr.h"
+ #include "nsCOMPtr.h"
++#include "nsContentPolicyUtils.h"
++#include "nsContentUtils.h"
++#include "nsCRT.h"
++#include "nsDocLoader.h"
+ #include "nsPoint.h" // mCurrent/mDefaultScrollbarPreferences
++#include "nsRect.h"
+ #include "nsString.h"
+-#include "nsAutoPtr.h"
+ #include "nsThreadUtils.h"
+-#include "nsContentUtils.h"
++
++#include "GeckoProfiler.h"
++#include "jsapi.h"
++#include "prtime.h"
++#include "Units.h"
++
+ #include "timeline/ObservedDocShell.h"
+ #include "timeline/TimelineConsumers.h"
+ #include "timeline/TimelineMarker.h"
+ 
+-// Threshold value in ms for META refresh based redirects
+-#define REFRESH_REDIRECT_TIMER 15000
+-
+ // Interfaces Needed
+-#include "nsIDocCharset.h"
+-#include "nsIInterfaceRequestor.h"
+-#include "nsINamed.h"
+-#include "nsIRefreshURI.h"
+-#include "nsIWebNavigation.h"
+-#include "nsIWebPageDescriptor.h"
+-#include "nsIWebProgressListener.h"
+-#include "nsIDocShellLoadInfo.h"
+-#include "nsIAuthPromptProvider.h"
+-#include "nsILoadContext.h"
+-#include "nsIWebShellServices.h"
+-#include "nsILinkHandler.h"
+-#include "nsIClipboardCommands.h"
+-#include "nsITabParent.h"
+-#include "nsCRT.h"
+-#include "prtime.h"
+-#include "nsRect.h"
+-#include "Units.h"
+-#include "nsIDeprecationWarner.h"
+ 
+ namespace mozilla {
+ class Encoding;
+ class HTMLEditor;
+ enum class TaskCategory;
+ namespace dom {
+ class ClientInfo;
+ class ClientSource;
+ class EventTarget;
+ typedef uint32_t ScreenOrientationInternal;
+ } // namespace dom
+ } // namespace mozilla
+ 
+-class nsDocShell;
+-class nsDOMNavigationTiming;
+-class nsGlobalWindow;
+-class nsIController;
+-class nsIScrollableFrame;
+-class OnLinkClickEvent;
+-class nsDSURIContentListener;
+-class nsDocShellEditorData;
+ class nsIClipboardDragDropHookList;
+ class nsICommandManager;
+ class nsIContentViewer;
++class nsIController;
++class nsIDocShellTreeOwner;
+ class nsIDocument;
+ class nsIDOMNode;
+-class nsIDocShellTreeOwner;
+ class nsIGlobalHistory2;
+ class nsIHttpChannel;
+ class nsIMutableArray;
+ class nsIPrompt;
++class nsIScrollableFrame;
++class nsISecureBrowserUI;
+ class nsISHistory;
+-class nsISecureBrowserUI;
+ class nsIStringBundle;
+ class nsIURIFixup;
+ class nsIURILoader;
+ class nsIWebBrowserFind;
+ class nsIWidget;
++
++class nsDocShell;
++class nsDocShellEditorData;
++class nsDOMNavigationTiming;
++class nsDSURIContentListener;
++class nsGlobalWindow;
++
+ class FramingChecker;
++class OnLinkClickEvent;
+ 
+ /* internally used ViewMode types */
+ enum ViewMode
+ {
+   viewNormal = 0x0,
+   viewSource = 0x1
+ };
+ 

frg/work-js/mozilla-release/patches/1406161-2-59a1.patch

@@ -0,0 +1,1404 @@
+# HG changeset patch
+# User Samael Wang <freesamael@gmail.com>
+# Date 1513379383 21600
+# Node ID 33cb29987d2093b92a84dac9fb9bb9907811a3a8
+# Parent  e247144f1933cf5aed9b9d858e1f45ec3325f072
+Bug 1406161 - Part 2: Reorder docshell members and remove unnecessary `virtual` or `NS_IMETHOD` keywords. r=smaug
+
+MozReview-Commit-ID: KuEchFzFu7E
+
+diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
+--- a/docshell/base/nsDocShell.cpp
++++ b/docshell/base/nsDocShell.cpp
+@@ -742,33 +742,46 @@ DecreasePrivateDocShellCount()
+     if (obsvc) {
+       obsvc->NotifyObservers(nullptr, "last-pb-context-exited", nullptr);
+     }
+   }
+ }
+ 
+ nsDocShell::nsDocShell()
+   : nsDocLoader()
++  , mForcedCharset(nullptr)
++  , mParentCharset(nullptr)
++  , mTreeOwner(nullptr)
+   , mDefaultScrollbarPref(Scrollbar_Auto, Scrollbar_Auto)
+-  , mReferrerPolicy(0)
+-  , mFailedLoadType(0)
+-  , mTreeOwner(nullptr)
+   , mCharsetReloadState(eCharsetReloadInit)
+-  , mChildOffset(0)
+-  , mBusyFlags(BUSY_FLAGS_NONE)
+-  , mAppType(nsIDocShell::APP_TYPE_UNKNOWN)
+-  , mLoadType(0)
++  , mOrientationLock(eScreenOrientation_None)
++  , mParentCharsetSource(0)
+   , mMarginWidth(-1)
+   , mMarginHeight(-1)
+   , mItemType(typeContent)
+   , mPreviousTransIndex(-1)
+   , mLoadedTransIndex(-1)
++  , mChildOffset(0)
+   , mSandboxFlags(0)
+-  , mOrientationLock(eScreenOrientation_None)
++  , mBusyFlags(BUSY_FLAGS_NONE)
++  , mAppType(nsIDocShell::APP_TYPE_UNKNOWN)
++  , mLoadType(0)
++  , mDefaultLoadFlags(nsIRequest::LOAD_NORMAL)
++  , mReferrerPolicy(0)
++  , mFailedLoadType(0)
++  , mFrameType(FRAME_TYPE_REGULAR)
++  , mPrivateBrowsingId(0)
++  , mDisplayMode(nsIDocShell::DISPLAY_MODE_BROWSER)
++  , mJSRunToCompletionDepth(0)
++  , mTouchEventsOverride(nsIDocShell::TOUCHEVENTS_OVERRIDE_NONE)
+   , mFullscreenAllowed(CHECK_ATTRIBUTES)
++  , mCreatingDocument(false)
++#ifdef DEBUG
++  , mInEnsureScriptEnv(false)
++#endif
+   , mCreated(false)
+   , mAllowSubframes(true)
+   , mAllowPlugins(true)
+   , mAllowJavascript(true)
+   , mAllowMetaRedirects(true)
+   , mAllowImages(true)
+   , mAllowMedia(true)
+   , mAllowDNSPrefetch(true)
+@@ -798,29 +811,16 @@ nsDocShell::nsDocShell()
+   , mIsExecutingOnLoadHandler(false)
+   , mIsPrintingOrPP(false)
+   , mSavingOldViewer(false)
+   , mDynamicallyCreated(false)
+   , mAffectPrivateSessionLifetime(true)
+   , mInvisible(false)
+   , mHasLoadedNonBlankURI(false)
+   , mBlankTiming(false)
+-  , mCreatingDocument(false)
+-#ifdef DEBUG
+-  , mInEnsureScriptEnv(false)
+-#endif
+-  , mDefaultLoadFlags(nsIRequest::LOAD_NORMAL)
+-  , mFrameType(FRAME_TYPE_REGULAR)
+-  , mPrivateBrowsingId(0)
+-  , mDisplayMode(nsIDocShell::DISPLAY_MODE_BROWSER)
+-  , mForcedCharset(nullptr)
+-  , mParentCharset(nullptr)
+-  , mParentCharsetSource(0)
+-  , mJSRunToCompletionDepth(0)
+-  , mTouchEventsOverride(nsIDocShell::TOUCHEVENTS_OVERRIDE_NONE)
+ {
+   AssertOriginAttributesMatchPrivateBrowsing();
+ 
+   nsContentUtils::GenerateUUIDInPlace(mHistoryID);
+ 
+   if (gDocShellCount++ == 0) {
+     NS_ASSERTION(sURIFixup == nullptr,
+                  "Huh, sURIFixup not null in first nsDocShell ctor!");
+@@ -5444,17 +5444,17 @@ nsDocShell::DisplayLoadError(nsresult aE
+     prompter->Alert(nullptr, messageStr.get());
+   }
+ 
+   return NS_OK;
+ }
+ 
+ #define PREF_SAFEBROWSING_ALLOWOVERRIDE "browser.safebrowsing.allowOverride"
+ 
+-NS_IMETHODIMP
++nsresult
+ nsDocShell::LoadErrorPage(nsIURI* aURI, const char16_t* aURL,
+                           const char* aErrorPage,
+                           const char* aErrorType,
+                           const char16_t* aDescription,
+                           const char* aCSSClass,
+                           nsIChannel* aFailedChannel)
+ {
+ #if defined(DEBUG)
+@@ -13609,17 +13609,17 @@ nsDocShell::ConfirmRepost(bool* aRepost)
+   if (NS_FAILED(rv)) {
+     return rv;
+   }
+ 
+   *aRepost = (buttonPressed == 0);
+   return NS_OK;
+ }
+ 
+-NS_IMETHODIMP
++nsresult
+ nsDocShell::GetPromptAndStringBundle(nsIPrompt** aPrompt,
+                                      nsIStringBundle** aStringBundle)
+ {
+   NS_ENSURE_SUCCESS(GetInterface(NS_GET_IID(nsIPrompt), (void**)aPrompt),
+                     NS_ERROR_FAILURE);
+ 
+   nsCOMPtr<nsIStringBundleService> stringBundleService =
+     mozilla::services::GetStringBundleService();
+@@ -13664,17 +13664,17 @@ nsIScrollableFrame*
+ nsDocShell::GetRootScrollFrame()
+ {
+   nsCOMPtr<nsIPresShell> shell = GetPresShell();
+   NS_ENSURE_TRUE(shell, nullptr);
+ 
+   return shell->GetRootScrollFrameAsScrollable();
+ }
+ 
+-NS_IMETHODIMP
++nsresult
+ nsDocShell::EnsureScriptEnvironment()
+ {
+   if (mScriptGlobal) {
+     return NS_OK;
+   }
+ 
+   if (mIsBeingDestroyed) {
+     return NS_ERROR_NOT_AVAILABLE;
+@@ -13703,17 +13703,17 @@ nsDocShell::EnsureScriptEnvironment()
+   MOZ_ASSERT(mScriptGlobal);
+ 
+   mScriptGlobal->SetDocShell(this);
+ 
+   // Ensure the script object is set up to run script.
+   return mScriptGlobal->EnsureScriptEnvironment();
+ }
+ 
+-NS_IMETHODIMP
++nsresult
+ nsDocShell::EnsureEditorData()
+ {
+   bool openDocHasDetachedEditor = mOSHE && mOSHE->HasDetachedEditor();
+   if (!mEditorData && !mIsBeingDestroyed && !openDocHasDetachedEditor) {
+     // We shouldn't recreate the editor data if it already exists, or
+     // we're shutting down, or we already have a detached editor data
+     // stored in the session history. We should only have one editordata
+     // per docshell.
+@@ -13728,17 +13728,17 @@ nsDocShell::EnsureTransferableHookData()
+ {
+   if (!mTransferableHookData) {
+     mTransferableHookData = new nsTransferableHookData();
+   }
+ 
+   return NS_OK;
+ }
+ 
+-NS_IMETHODIMP
++nsresult
+ nsDocShell::EnsureFind()
+ {
+   nsresult rv;
+   if (!mFind) {
+     mFind = do_CreateInstance("@mozilla.org/embedcomp/find;1", &rv);
+     if (NS_FAILED(rv)) {
+       return rv;
+     }
+diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
+--- a/docshell/base/nsDocShell.h
++++ b/docshell/base/nsDocShell.h
+@@ -131,17 +131,17 @@ public:
+ 
+   RefPtr<nsDocShell> mDocShell;
+   nsCOMPtr<nsIURI> mURI;
+   nsCOMPtr<nsIPrincipal> mPrincipal;
+   int32_t mDelay;
+   bool mRepeat;
+   bool mMetaRefresh;
+ 
+-protected:
++private:
+   virtual ~nsRefreshTimer();
+ };
+ 
+ enum eCharsetReloadState
+ {
+   eCharsetReloadInit,
+   eCharsetReloadRequested,
+   eCharsetReloadStopOrigional
+@@ -164,30 +164,48 @@ class nsDocShell final
+   , public nsIWebShellServices
+   , public nsILinkHandler
+   , public nsIClipboardCommands
+   , public nsIDOMStorageManager
+   , public nsINetworkInterceptController
+   , public nsIDeprecationWarner
+   , public mozilla::SupportsWeakPtr<nsDocShell>
+ {
+-  friend class nsDSURIContentListener;
+-  friend class FramingChecker;
+-  using Encoding = mozilla::Encoding;
++public:
++  // Event type dispatched by RestorePresentation
++  class RestorePresentationEvent : public mozilla::Runnable
++  {
++  public:
++    NS_DECL_NSIRUNNABLE
++    explicit RestorePresentationEvent(nsDocShell* aDs)
++      : mozilla::Runnable("nsDocShell::RestorePresentationEvent")
++      , mDocShell(aDs)
++    {
++    }
++    void Revoke() { mDocShell = nullptr; }
++  private:
++    RefPtr<nsDocShell> mDocShell;
++  };
+ 
+-public:
++  class InterfaceRequestorProxy : public nsIInterfaceRequestor
++  {
++  public:
++    explicit InterfaceRequestorProxy(nsIInterfaceRequestor* aRequestor);
++    NS_DECL_THREADSAFE_ISUPPORTS
++    NS_DECL_NSIINTERFACEREQUESTOR
++
++  private:
++    virtual ~InterfaceRequestorProxy();
++    InterfaceRequestorProxy() {}
++    nsWeakPtr mWeakPtr;
++  };
++
+   MOZ_DECLARE_WEAKREFERENCE_TYPENAME(nsDocShell)
+-
+-  nsDocShell();
+-
+-  virtual nsresult Init() override;
+-
+   NS_DECL_ISUPPORTS_INHERITED
+   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(nsDocShell, nsDocLoader)
+-
+   NS_DECL_NSIDOCSHELL
+   NS_DECL_NSIDOCSHELLTREEITEM
+   NS_DECL_NSIWEBNAVIGATION
+   NS_DECL_NSIBASEWINDOW
+   NS_DECL_NSISCROLLABLE
+   NS_DECL_NSITEXTSCROLL
+   NS_DECL_NSIDOCCHARSET
+   NS_DECL_NSIINTERFACEREQUESTOR
+@@ -195,29 +213,33 @@ public:
+   NS_DECL_NSIREFRESHURI
+   NS_DECL_NSICONTENTVIEWERCONTAINER
+   NS_DECL_NSIWEBPAGEDESCRIPTOR
+   NS_DECL_NSIAUTHPROMPTPROVIDER
+   NS_DECL_NSICLIPBOARDCOMMANDS
+   NS_DECL_NSIWEBSHELLSERVICES
+   NS_DECL_NSINETWORKINTERCEPTCONTROLLER
+   NS_DECL_NSIDEPRECATIONWARNER
++
+   NS_FORWARD_SAFE_NSIDOMSTORAGEMANAGER(TopSessionStorageManager())
+ 
++  // Need to implement (and forward) nsISecurityEventSink, because
++  // nsIWebProgressListener has methods with identical names...
++  NS_FORWARD_NSISECURITYEVENTSINK(nsDocLoader::)
++
++  nsDocShell();
++  virtual nsresult Init() override;
++
+   NS_IMETHOD Stop() override
+   {
+     // Need this here because otherwise nsIWebNavigation::Stop
+     // overrides the docloader's Stop()
+     return nsDocLoader::Stop();
+   }
+ 
+-  // Need to implement (and forward) nsISecurityEventSink, because
+-  // nsIWebProgressListener has methods with identical names...
+-  NS_FORWARD_NSISECURITYEVENTSINK(nsDocLoader::)
+-
+   // nsILinkHandler
+   NS_IMETHOD OnLinkClick(nsIContent* aContent,
+                          nsIURI* aURI,
+                          const char16_t* aTargetSpec,
+                          const nsAString& aFileName,
+                          nsIInputStream* aPostDataStream,
+                          int64_t aPostDataStreamLength,
+                          nsIInputStream* aHeadersDataStream,
+@@ -251,64 +273,64 @@ public:
+   NS_IMETHOD GetNestedFrameId(uint64_t*) override;
+   NS_IMETHOD GetIsContent(bool*) override;
+   NS_IMETHOD GetUsePrivateBrowsing(bool*) override;
+   NS_IMETHOD SetUsePrivateBrowsing(bool) override;
+   NS_IMETHOD SetPrivateBrowsing(bool) override;
+   NS_IMETHOD GetUseRemoteTabs(bool*) override;
+   NS_IMETHOD SetRemoteTabs(bool) override;
+   NS_IMETHOD GetScriptableOriginAttributes(JS::MutableHandle<JS::Value>) override;
++  NS_IMETHOD_(void) GetOriginAttributes(mozilla::OriginAttributes& aAttrs) override;
+ 
+   // Restores a cached presentation from history (mLSHE).
+   // This method swaps out the content viewer and simulates loads for
+   // subframes. It then simulates the completion of the toplevel load.
+   nsresult RestoreFromHistory();
+ 
+   // Perform a URI load from a refresh timer. This is just like the
+   // ForceRefreshURI method on nsIRefreshURI, but makes sure to take
+   // the timer involved out of mRefreshURIList if it's there.
+   // aTimer must not be null.
+   nsresult ForceRefreshURIFromTimer(nsIURI* aURI, nsIPrincipal* aPrincipal,
+                                     int32_t aDelay,
+                                     bool aMetaRefresh, nsITimer* aTimer);
+ 
+-  friend class OnLinkClickEvent;
+-
+-  static bool SandboxFlagsImplyCookies(const uint32_t &aSandboxFlags);
+-
+   // We need dummy OnLocationChange in some cases to update the UI without
+   // updating security info.
+   void FireDummyOnLocationChange()
+   {
+     FireOnLocationChange(this, nullptr, mCurrentURI,
+                          LOCATION_CHANGE_SAME_DOCUMENT);
+   }
+ 
+   nsresult HistoryTransactionRemoved(int32_t aIndex);
+ 
+   // Notify Scroll observers when an async panning/zooming transform
+   // has started being applied
+   void NotifyAsyncPanZoomStarted();
++
+   // Notify Scroll observers when an async panning/zooming transform
+   // is no longer applied
+   void NotifyAsyncPanZoomStopped();
+ 
+   void SetInFrameSwap(bool aInSwap)
+   {
+     mInFrameSwap = aInSwap;
+   }
+   bool InFrameSwap();
+ 
+-  const Encoding* GetForcedCharset() { return mForcedCharset; }
++  const mozilla::Encoding* GetForcedCharset() { return mForcedCharset; }
+ 
+   mozilla::HTMLEditor* GetHTMLEditorInternal();
+   nsresult SetHTMLEditorInternal(mozilla::HTMLEditor* aHTMLEditor);
+ 
+   nsDOMNavigationTiming* GetNavigationTiming() const;
+ 
++  nsresult SetOriginAttributes(const mozilla::OriginAttributes& aAttrs);
++
+   /**
+    * Get the list of ancestor principals for this docshell.  The list is meant
+    * to be the list of principals of the documents this docshell is "nested
+    * through" in the sense of
+    * <https://html.spec.whatwg.org/multipage/browsers.html#browsing-context-nested-through>.
+    * In practice, it is defined as follows:
+    *
+    * If this is an <iframe mozbrowser> or a toplevel content docshell
+@@ -356,31 +378,38 @@ public:
+    *
+    * This method steals the data from the passed-in array.
+    */
+   void SetAncestorOuterWindowIDs(nsTArray<uint64_t>&& aAncestorOuterWindowIDs)
+   {
+     mAncestorOuterWindowIDs = mozilla::Move(aAncestorOuterWindowIDs);
+   }
+ 
+-private:
+-  bool CanSetOriginAttributes();
+-
+-public:
+-  const mozilla::OriginAttributes&
+-  GetOriginAttributes()
++  const mozilla::OriginAttributes& GetOriginAttributes()
+   {
+     return mOriginAttributes;
+   }
+ 
+-  nsresult SetOriginAttributes(const mozilla::OriginAttributes& aAttrs);
++  static bool SandboxFlagsImplyCookies(const uint32_t &aSandboxFlags);
++
++  // Tell the favicon service that aNewURI has the same favicon as aOldURI.
++  static void CopyFavicon(nsIURI* aOldURI,
++                          nsIURI* aNewURI,
++                          nsIPrincipal* aLoadingPrincipal,
++                          bool aInPrivateBrowsing);
+ 
+-private:
+-  // An observed docshell wrapper is created when recording markers is enabled.
+-  mozilla::UniquePtr<mozilla::ObservedDocShell> mObserved;
++  static nsDocShell* Cast(nsIDocShell* aDocShell)
++  {
++    return static_cast<nsDocShell*>(aDocShell);
++  }
++
++private: // member functions
++  friend class nsDSURIContentListener;
++  friend class FramingChecker;
++  friend class OnLinkClickEvent;
+ 
+   // It is necessary to allow adding a timeline marker wherever a docshell
+   // instance is available. This operation happens frequently and needs to
+   // be very fast, so instead of using a Map or having to search for some
+   // docshell-specific markers storage, a pointer to an `ObservedDocShell` is
+   // is stored on docshells directly.
+   friend void mozilla::TimelineConsumers::AddConsumer(nsDocShell*);
+   friend void mozilla::TimelineConsumers::RemoveConsumer(nsDocShell*);
+@@ -389,60 +418,170 @@ private:
+   friend void mozilla::TimelineConsumers::AddMarkerForDocShell(
+     nsDocShell*, const char*, const TimeStamp&, MarkerTracingType,
+     MarkerStackRequest);
+   friend void mozilla::TimelineConsumers::AddMarkerForDocShell(
+     nsDocShell*, UniquePtr<AbstractTimelineMarker>&&);
+   friend void mozilla::TimelineConsumers::PopMarkers(nsDocShell*,
+     JSContext*, nsTArray<dom::ProfileTimelineMarker>&);
+ 
+-public:
+-  // Tell the favicon service that aNewURI has the same favicon as aOldURI.
+-  static void CopyFavicon(nsIURI* aOldURI,
+-                          nsIURI* aNewURI,
+-                          nsIPrincipal* aLoadingPrincipal,
+-                          bool aInPrivateBrowsing);
++  // Callback prototype for WalkHistoryEntries.
++  // aEntry is the child history entry, aShell is its corresponding docshell,
++  // aChildIndex is the child's index in its parent entry, and aData is
++  // the opaque pointer passed to WalkHistoryEntries.
++  typedef nsresult(*WalkHistoryEntriesFunc)(nsISHEntry* aEntry,
++                                            nsDocShell* aShell,
++                                            int32_t aChildIndex,
++                                            void* aData);
++
++  // Clone a session history tree for subframe navigation.
++  // The tree rooted at |aSrcEntry| will be cloned into |aDestEntry|, except
++  // for the entry with id |aCloneID|, which will be replaced with
++  // |aReplaceEntry|. |aSrcShell| is a (possibly null) docshell which
++  // corresponds to |aSrcEntry| via its mLSHE or mOHE pointers, and will
++  // have that pointer updated to point to the cloned history entry.
++  // If aCloneChildren is true then the children of the entry with id
++  // |aCloneID| will be cloned into |aReplaceEntry|.
++  static nsresult CloneAndReplace(nsISHEntry* aSrcEntry,
++                                  nsDocShell* aSrcShell,
++                                  uint32_t aCloneID,
++                                  nsISHEntry* aReplaceEntry,
++                                  bool aCloneChildren,
++                                  nsISHEntry** aDestEntry);
+ 
+-  static nsDocShell* Cast(nsIDocShell* aDocShell)
++  // Child-walking callback for CloneAndReplace
++  static nsresult CloneAndReplaceChild(nsISHEntry* aEntry, nsDocShell* aShell,
++                                       int32_t aChildIndex, void* aData);
++
++
++  // Child-walking callback for SetHistoryEntry
++  static nsresult SetChildHistoryEntry(nsISHEntry* aEntry, nsDocShell* aShell,
++                                       int32_t aEntryIndex, void* aData);
++
++  // For each child of aRootEntry, find the corresponding docshell which is
++  // a child of aRootShell, and call aCallback. The opaque pointer aData
++  // is passed to the callback.
++  static nsresult WalkHistoryEntries(nsISHEntry* aRootEntry,
++                                     nsDocShell* aRootShell,
++                                     WalkHistoryEntriesFunc aCallback,
++                                     void* aData);
++
++  // Security checks to prevent frameset spoofing. See comments at
++  // implementation sites.
++  static bool CanAccessItem(nsIDocShellTreeItem* aTargetItem,
++                            nsIDocShellTreeItem* aAccessingItem,
++                            bool aConsiderOpener = true);
++  static bool ValidateOrigin(nsIDocShellTreeItem* aOriginTreeItem,
++                             nsIDocShellTreeItem* aTargetTreeItem);
++
++  static inline uint32_t PRTimeToSeconds(PRTime aTimeUsec)
+   {
+-    return static_cast<nsDocShell*>(aDocShell);
++    PRTime usecPerSec = PR_USEC_PER_SEC;
++    return uint32_t(aTimeUsec /= usecPerSec);
+   }
+ 
+-protected:
++  static const nsCString FrameTypeToString(uint32_t aFrameType)
++  {
++    switch (aFrameType) {
++      case FRAME_TYPE_BROWSER:
++        return NS_LITERAL_CSTRING("browser");
++      case FRAME_TYPE_REGULAR:
++        return NS_LITERAL_CSTRING("regular");
++      default:
++        NS_ERROR("Unknown frame type");
++        return EmptyCString();
++    }
++  }
++
+   virtual ~nsDocShell();
++
++  //
++  // nsDocLoader
++  //
++
+   virtual void DestroyChildren() override;
+ 
++  // Overridden from nsDocLoader, this provides more information than the
++  // normal OnStateChange with flags STATE_REDIRECTING
++  virtual void OnRedirectStateChange(nsIChannel* aOldChannel,
++                                     nsIChannel* aNewChannel,
++                                     uint32_t aRedirectFlags,
++                                     uint32_t aStateFlags) override;
++
++  // Override the parent setter from nsDocLoader
++  virtual nsresult SetDocLoaderParent(nsDocLoader* aLoader) override;
++
++  //
+   // Content Viewer Management
++  //
++
+   nsresult EnsureContentViewer();
++
+   // aPrincipal can be passed in if the caller wants. If null is
+   // passed in, the about:blank principal will end up being used.
+   nsresult CreateAboutBlankContentViewer(nsIPrincipal* aPrincipal,
+                                          nsIURI* aBaseURI,
+                                          bool aTryToSaveOldPresentation = true,
+                                          bool aCheckPermitUnload = true);
++
+   nsresult CreateContentViewer(const nsACString& aContentType,
+                                nsIRequest* aRequest,
+                                nsIStreamListener** aContentHandler);
++
+   nsresult NewContentViewerObj(const nsACString& aContentType,
+                                nsIRequest* aRequest, nsILoadGroup* aLoadGroup,
+                                nsIStreamListener** aContentHandler,
+                                nsIContentViewer** aViewer);
++
+   nsresult SetupNewViewer(nsIContentViewer* aNewViewer);
+ 
+-  void SetupReferrerFromChannel(nsIChannel* aChannel);
++  //
++  // Session History
++  //
++
++  bool ShouldAddToSessionHistory(nsIURI* aURI, nsIChannel* aChannel);
+ 
+-  nsresult GetEldestPresContext(nsPresContext** aPresContext);
++  // Either aChannel or aOwner must be null. If aChannel is
++  // present, the owner should be gotten from it.
++  // If aCloneChildren is true, then our current session history's
++  // children will be cloned onto the new entry. This should be
++  // used when we aren't actually changing the document while adding
++  // the new session history entry.
++
++  nsresult AddToSessionHistory(nsIURI* aURI, nsIChannel* aChannel,
++                               nsIPrincipal* aTriggeringPrincipal,
++                               nsIPrincipal* aPrincipalToInherit,
++                               bool aCloneChildren,
++                               nsISHEntry** aNewEntry);
++
++  nsresult AddChildSHEntryToParent(nsISHEntry* aNewEntry, int32_t aChildOffset,
++                                   bool aCloneChildren);
+ 
+-  // Get the principal that we'll set on the channel if we're inheriting. If
+-  // aConsiderCurrentDocument is true, we try to use the current document if
+-  // at all possible. If that fails, we fall back on the parent document.
+-  // If that fails too, we force creation of a content viewer and use the
+-  // resulting principal. If aConsiderCurrentDocument is false, we just look
+-  // at the parent.
+-  nsIPrincipal* GetInheritedPrincipal(bool aConsiderCurrentDocument);
++  nsresult AddChildSHEntryInternal(nsISHEntry* aCloneRef, nsISHEntry* aNewEntry,
++                                   int32_t aChildOffset, uint32_t aLoadType,
++                                   bool aCloneChildren);
++
++  // Determine whether this docshell corresponds to the given history entry,
++  // via having a pointer to it in mOSHE or mLSHE.
++  bool HasHistoryEntry(nsISHEntry* aEntry) const
++  {
++    return aEntry && (aEntry == mOSHE || aEntry == mLSHE);
++  }
++
++  // Update any pointers (mOSHE or mLSHE) to aOldEntry to point to aNewEntry
++  void SwapHistoryEntries(nsISHEntry* aOldEntry, nsISHEntry* aNewEntry);
++
++  // Call this method to swap in a new history entry to m[OL]SHE, rather than
++  // setting it directly. This completes the navigation in all docshells
++  // in the case of a subframe navigation.
++  void SetHistoryEntry(nsCOMPtr<nsISHEntry>* aPtr, nsISHEntry* aEntry);
++
++  //
++  // URI Load
++  //
+ 
+   // Actually open a channel and perform a URI load. Callers need to pass a
+   // non-null aTriggeringPrincipal which initiated the URI load. Please note
+   // that aTriggeringPrincipal will be used for performing security checks.
+   // If the argument aURI is provided by the web, then please do not pass a
+   // SystemPrincipal as the triggeringPrincipal. If principalToInherit is
+   // null, then no inheritance of any sort will happen and the load will
+   // get a principal based on the URI being loaded.
+@@ -472,18 +611,20 @@ protected:
+                      nsIDocShell** aDocShell,
+                      nsIRequest** aRequest,
+                      bool aIsNewWindowTarget,
+                      bool aBypassClassifier,
+                      bool aForceAllowCookies,
+                      const nsAString& aSrcdoc,
+                      nsIURI* aBaseURI,
+                      nsContentPolicyType aContentPolicyType);
++
+   nsresult AddHeadersToChannel(nsIInputStream* aHeadersData,
+                                nsIChannel* aChannel);
++
+   nsresult DoChannelLoad(nsIChannel* aChannel,
+                          nsIURILoader* aURILoader,
+                          bool aBypassClassifier);
+ 
+   nsresult ScrollToAnchor(bool aCurHasRef,
+                           bool aNewHasRef,
+                           nsACString& aNewHash,
+                           uint32_t aLoadType);
+@@ -509,107 +650,52 @@ protected:
+   bool OnNewURI(nsIURI* aURI, nsIChannel* aChannel,
+                 nsIPrincipal* aTriggeringPrincipal,
+                 nsIPrincipal* aPrincipalToInherit,
+                 uint32_t aLoadType,
+                 bool aFireOnLocationChange,
+                 bool aAddToGlobalHistory,
+                 bool aCloneSHChildren);
+ 
+-  void SetReferrerURI(nsIURI* aURI);
+-  void SetReferrerPolicy(uint32_t aReferrerPolicy);
++  // Helper method that is called when a new document (including any
++  // sub-documents - ie. frames) has been completely loaded.
++  nsresult EndPageLoad(nsIWebProgress* aProgress,
++                       nsIChannel* aChannel,
++                       nsresult aResult);
+ 
+-  // Session History
+-  bool ShouldAddToSessionHistory(nsIURI* aURI, nsIChannel* aChannel);
+-  // Either aChannel or aOwner must be null. If aChannel is
+-  // present, the owner should be gotten from it.
+-  // If aCloneChildren is true, then our current session history's
+-  // children will be cloned onto the new entry. This should be
+-  // used when we aren't actually changing the document while adding
+-  // the new session history entry.
+-  nsresult AddToSessionHistory(nsIURI* aURI, nsIChannel* aChannel,
+-                               nsIPrincipal* aTriggeringPrincipal,
+-                               nsIPrincipal* aPrincipalToInherit,
+-                               bool aCloneChildren,
+-                               nsISHEntry** aNewEntry);
+-  nsresult AddChildSHEntryToParent(nsISHEntry* aNewEntry, int32_t aChildOffset,
+-                                   bool aCloneChildren);
+-
+-  nsresult AddChildSHEntryInternal(nsISHEntry* aCloneRef, nsISHEntry* aNewEntry,
+-                                   int32_t aChildOffset, uint32_t aLoadType,
+-                                   bool aCloneChildren);
+-
+-  nsresult LoadHistoryEntry(nsISHEntry* aEntry, uint32_t aLoadType);
+-  nsresult PersistLayoutHistoryState();
+ 
+-  // Clone a session history tree for subframe navigation.
+-  // The tree rooted at |aSrcEntry| will be cloned into |aDestEntry|, except
+-  // for the entry with id |aCloneID|, which will be replaced with
+-  // |aReplaceEntry|. |aSrcShell| is a (possibly null) docshell which
+-  // corresponds to |aSrcEntry| via its mLSHE or mOHE pointers, and will
+-  // have that pointer updated to point to the cloned history entry.
+-  // If aCloneChildren is true then the children of the entry with id
+-  // |aCloneID| will be cloned into |aReplaceEntry|.
+-  static nsresult CloneAndReplace(nsISHEntry* aSrcEntry,
+-                                  nsDocShell* aSrcShell,
+-                                  uint32_t aCloneID,
+-                                  nsISHEntry* aReplaceEntry,
+-                                  bool aCloneChildren,
+-                                  nsISHEntry** aDestEntry);
++  nsresult LoadErrorPage(nsIURI* aURI, const char16_t* aURL,
++                           const char* aErrorPage,
++                           const char* aErrorType,
++                           const char16_t* aDescription,
++                           const char* aCSSClass,
++                           nsIChannel* aFailedChannel);
+ 
+-  // Child-walking callback for CloneAndReplace
+-  static nsresult CloneAndReplaceChild(nsISHEntry* aEntry, nsDocShell* aShell,
+-                                       int32_t aChildIndex, void* aData);
+-
+-  nsresult GetRootSessionHistory(nsISHistory** aReturn);
+-  nsresult GetHttpChannel(nsIChannel* aChannel, nsIHttpChannel** aReturn);
+-  bool ShouldDiscardLayoutState(nsIHttpChannel* aChannel);
+-
+-  // Determine whether this docshell corresponds to the given history entry,
+-  // via having a pointer to it in mOSHE or mLSHE.
+-  bool HasHistoryEntry(nsISHEntry* aEntry) const
++  bool DisplayLoadError(nsresult aError, nsIURI* aURI, const char16_t* aURL,
++                        nsIChannel* aFailedChannel)
+   {
+-    return aEntry && (aEntry == mOSHE || aEntry == mLSHE);
++    bool didDisplayLoadError = false;
++    DisplayLoadError(aError, aURI, aURL, aFailedChannel, &didDisplayLoadError);
++    return didDisplayLoadError;
+   }
+ 
+-  // Update any pointers (mOSHE or mLSHE) to aOldEntry to point to aNewEntry
+-  void SwapHistoryEntries(nsISHEntry* aOldEntry, nsISHEntry* aNewEntry);
+-
+-  // Call this method to swap in a new history entry to m[OL]SHE, rather than
+-  // setting it directly. This completes the navigation in all docshells
+-  // in the case of a subframe navigation.
+-  void SetHistoryEntry(nsCOMPtr<nsISHEntry>* aPtr, nsISHEntry* aEntry);
+-
+-  // Child-walking callback for SetHistoryEntry
+-  static nsresult SetChildHistoryEntry(nsISHEntry* aEntry, nsDocShell* aShell,
+-                                       int32_t aEntryIndex, void* aData);
++  //
++  // Uncategorized
++  //
+ 
+-  // Callback prototype for WalkHistoryEntries.
+-  // aEntry is the child history entry, aShell is its corresponding docshell,
+-  // aChildIndex is the child's index in its parent entry, and aData is
+-  // the opaque pointer passed to WalkHistoryEntries.
+-  typedef nsresult(*WalkHistoryEntriesFunc)(nsISHEntry* aEntry,
+-                                            nsDocShell* aShell,
+-                                            int32_t aChildIndex,
+-                                            void* aData);
++  // Get the principal that we'll set on the channel if we're inheriting. If
++  // aConsiderCurrentDocument is true, we try to use the current document if
++  // at all possible. If that fails, we fall back on the parent document.
++  // If that fails too, we force creation of a content viewer and use the
++  // resulting principal. If aConsiderCurrentDocument is false, we just look
++  // at the parent.
++  nsIPrincipal* GetInheritedPrincipal(bool aConsiderCurrentDocument);
+ 
+-  // For each child of aRootEntry, find the corresponding docshell which is
+-  // a child of aRootShell, and call aCallback. The opaque pointer aData
+-  // is passed to the callback.
+-  static nsresult WalkHistoryEntries(nsISHEntry* aRootEntry,
+-                                     nsDocShell* aRootShell,
+-                                     WalkHistoryEntriesFunc aCallback,
+-                                     void* aData);
+-
+-  // overridden from nsDocLoader, this provides more information than the
+-  // normal OnStateChange with flags STATE_REDIRECTING
+-  virtual void OnRedirectStateChange(nsIChannel* aOldChannel,
+-                                     nsIChannel* aNewChannel,
+-                                     uint32_t aRedirectFlags,
+-                                     uint32_t aStateFlags) override;
++  nsresult CreatePrincipalFromReferrer(nsIURI* aReferrer,
++                                       nsIPrincipal** aResult);
+ 
+   /**
+    * Helper function that determines if channel is an HTTP POST.
+    *
+    * @param aChannel
+    *        The channel to test
+    *
+    * @return True iff channel is an HTTP post.
+@@ -676,76 +762,21 @@ protected:
+    *        For HTTP channels, the response code (0 otherwise).
+    */
+   void AddURIVisit(nsIURI* aURI,
+                    nsIURI* aReferrerURI,
+                    nsIURI* aPreviousURI,
+                    uint32_t aChannelRedirectFlags,
+                    uint32_t aResponseStatus = 0);
+ 
+-  // Helper Routines
+-  nsresult ConfirmRepost(bool* aRepost);
+-  NS_IMETHOD GetPromptAndStringBundle(nsIPrompt** aPrompt,
+-                                      nsIStringBundle** aStringBundle);
+-  NS_IMETHOD GetChildOffset(nsIDOMNode* aChild, nsIDOMNode* aParent,
+-                            int32_t* aOffset);
+-  nsIScrollableFrame* GetRootScrollFrame();
+-  NS_IMETHOD EnsureScriptEnvironment();
+-  NS_IMETHOD EnsureEditorData();
+-  nsresult EnsureTransferableHookData();
+-  NS_IMETHOD EnsureFind();
+-  nsresult RefreshURIFromQueue();
+-  NS_IMETHOD LoadErrorPage(nsIURI* aURI, const char16_t* aURL,
+-                           const char* aErrorPage,
+-                           const char* aErrorType,
+-                           const char16_t* aDescription,
+-                           const char* aCSSClass,
+-                           nsIChannel* aFailedChannel);
+-  bool IsPrintingOrPP(bool aDisplayErrorDialog = true);
+-  bool IsNavigationAllowed(bool aDisplayPrintErrorDialog = true,
+-                           bool aCheckIfUnloadFired = true);
+-
+-  nsresult SetBaseUrlForWyciwyg(nsIContentViewer* aContentViewer);
+-
+-  static inline uint32_t PRTimeToSeconds(PRTime aTimeUsec)
+-  {
+-    PRTime usecPerSec = PR_USEC_PER_SEC;
+-    return uint32_t(aTimeUsec /= usecPerSec);
+-  }
+-
+-  inline bool UseErrorPages()
+-  {
+-    return (mObserveErrorPages ? sUseErrorPages : mUseErrorPages);
+-  }
+-
+-  bool IsFrame();
+-
+-  //
+-  // Helper method that is called when a new document (including any
+-  // sub-documents - ie. frames) has been completely loaded.
+-  //
+-  virtual nsresult EndPageLoad(nsIWebProgress* aProgress,
+-                               nsIChannel* aChannel,
+-                               nsresult aResult);
+-
+   // Sets the current document's current state object to the given SHEntry's
+   // state object. The current state object is eventually given to the page
+   // in the PopState event.
+   nsresult SetDocCurrentStateObj(nsISHEntry* aShEntry);
+ 
+-  nsresult CheckLoadingPermissions();
+-
+-  // Security checks to prevent frameset spoofing. See comments at
+-  // implementation sites.
+-  static bool CanAccessItem(nsIDocShellTreeItem* aTargetItem,
+-                            nsIDocShellTreeItem* aAccessingItem,
+-                            bool aConsiderOpener = true);
+-  static bool ValidateOrigin(nsIDocShellTreeItem* aOriginTreeItem,
+-                             nsIDocShellTreeItem* aTargetTreeItem);
+-
+   // Returns true if would have called FireOnLocationChange,
+   // but did not because aFireOnLocationChange was false on entry.
+   // In this case it is the caller's responsibility to ensure
+   // FireOnLocationChange is called.
+   // In all other cases false is returned.
+   bool SetCurrentURI(nsIURI* aURI, nsIRequest* aRequest,
+                      bool aFireOnLocationChange,
+                      uint32_t aLocationFlags);
+@@ -805,32 +836,19 @@ protected:
+   void DoGetPositionAndSize(int32_t* aX, int32_t* aY, int32_t* aWidth,
+                             int32_t* aHeight);
+ 
+   // Call this when a URI load is handed to us (via OnLinkClick or
+   // InternalLoad). This makes sure that we're not inside unload, or that if
+   // we are it's still OK to load this URI.
+   bool IsOKToLoadURI(nsIURI* aURI);
+ 
+-  void ReattachEditorToWindow(nsISHEntry* aSHEntry);
+-
+-  nsCOMPtr<nsIDOMStorageManager> mSessionStorageManager;
+-  nsIDOMStorageManager* TopSessionStorageManager();
+-
+   // helpers for executing commands
+   nsresult GetControllerForCommand(const char* aCommand,
+                                    nsIController** aResult);
+-  nsresult EnsureCommandHandler();
+-
+-  nsIChannel* GetCurrentDocChannel();
+-
+-  bool ShouldBlockLoadingForBackButton();
+-
+-  // Convenience method for getting our parent docshell. Can return null
+-  already_AddRefed<nsDocShell> GetParentDocshell();
+ 
+   // Possibly create a ClientSource object to represent an initial about:blank
+   // window that has not been allocated yet.  Normally we try not to create
+   // this about:blank window until something calls GetDocument().  We still need
+   // the ClientSource to exist for this conceptual window, though.
+   //
+   // The ClientSource is created with the given principal if specified.  If
+   // the principal is not provided we will attempt to inherit it when we
+@@ -842,120 +860,163 @@ protected:
+   void MaybeCreateInitialClientSource(nsIPrincipal* aPrincipal = nullptr);
+ 
+   // Return the ClientInfo for the initial about:blank window, if it exists
+   // or we have speculatively created a ClientSource in
+   // MaybeCreateInitialClientSource().  This can return a ClientInfo object
+   // even if GetExtantDoc() returns nullptr.
+   mozilla::Maybe<mozilla::dom::ClientInfo> GetInitialClientInfo() const;
+ 
+-protected:
+-  nsresult GetCurScrollPos(int32_t aScrollOrientation, int32_t* aCurPos);
+-  nsresult SetCurScrollPosEx(int32_t aCurHorizontalPos,
+-                             int32_t aCurVerticalPos);
+-
+-  // Override the parent setter from nsDocLoader
+-  virtual nsresult SetDocLoaderParent(nsDocLoader* aLoader) override;
+-
+-  void ClearFrameHistory(nsISHEntry* aEntry);
+-
+   /**
+    * Initializes mTiming if it isn't yet.
+    * After calling this, mTiming is non-null. This method returns true if the
+    * initialization of the Timing can be reset (basically this is true if a new
+    * Timing object is created).
+    * In case the loading is aborted, MaybeResetInitTiming() can be called
+    * passing the return value of MaybeInitTiming(): if it's possible to reset
+    * the Timing, this method will do it.
+    */
+   MOZ_MUST_USE bool MaybeInitTiming();
+   void MaybeResetInitTiming(bool aReset);
+ 
+-  bool DisplayLoadError(nsresult aError, nsIURI* aURI, const char16_t* aURL,
+-                        nsIChannel* aFailedChannel)
++  // Separate function to do the actual name (i.e. not _top, _self etc.)
++  // searching for FindItemWithName.
++  nsresult DoFindItemWithName(const nsAString& aName,
++                              nsIDocShellTreeItem* aRequestor,
++                              nsIDocShellTreeItem* aOriginalRequestor,
++                              bool aSkipTabGroup,
++                              nsIDocShellTreeItem** aResult);
++
++  // Convenience method for getting our parent docshell. Can return null
++  already_AddRefed<nsDocShell> GetParentDocshell();
++
++  // Helper assertion to enforce that mInPrivateBrowsing is in sync with
++  // OriginAttributes.mPrivateBrowsingId
++  void AssertOriginAttributesMatchPrivateBrowsing();
++
++  // Notify consumers of a search being loaded through the observer service:
++  void MaybeNotifyKeywordSearchLoading(const nsString& aProvider,
++                                       const nsString& aKeyword);
++
++  // Internal implementation of nsIDocShell::FirePageHideNotification.
++  // If aSkipCheckingDynEntries is true, it will not try to remove dynamic
++  // subframe entries. This is to avoid redundant RemoveDynEntries calls in all
++  // children docshells.
++  void FirePageHideNotificationInternal(bool aIsUnload,
++                                        bool aSkipCheckingDynEntries);
++
++  // Dispatch a runnable to the TabGroup associated to this docshell.
++  nsresult DispatchToTabGroup(mozilla::TaskCategory aCategory,
++                              already_AddRefed<nsIRunnable>&& aRunnable);
++
++  NS_IMETHOD GetChildOffset(nsIDOMNode* aChild, nsIDOMNode* aParent,
++                            int32_t* aOffset);
++
++  void SetupReferrerFromChannel(nsIChannel* aChannel);
++  void SetReferrerURI(nsIURI* aURI);
++  void SetReferrerPolicy(uint32_t aReferrerPolicy);
++  void ReattachEditorToWindow(nsISHEntry* aSHEntry);
++  void RecomputeCanExecuteScripts();
++  void ClearFrameHistory(nsISHEntry* aEntry);
++  void UpdateGlobalHistoryTitle(nsIURI* aURI);
++  bool IsFrame();
++  bool CanSetOriginAttributes();
++  bool ShouldBlockLoadingForBackButton();
++  bool ShouldDiscardLayoutState(nsIHttpChannel* aChannel);
++  bool HasUnloadedParent();
++  bool JustStartedNetworkLoad();
++  bool IsPrintingOrPP(bool aDisplayErrorDialog = true);
++  bool IsNavigationAllowed(bool aDisplayPrintErrorDialog = true,
++                           bool aCheckIfUnloadFired = true);
++  uint32_t GetInheritedFrameType();
++  nsIScrollableFrame* GetRootScrollFrame();
++  nsIDOMStorageManager* TopSessionStorageManager();
++  nsIChannel* GetCurrentDocChannel();
++  nsresult EnsureScriptEnvironment();
++  nsresult EnsureEditorData();
++  nsresult EnsureTransferableHookData();
++  nsresult EnsureFind();
++  nsresult EnsureCommandHandler();
++  nsresult RefreshURIFromQueue();
++  nsresult GetEldestPresContext(nsPresContext** aPresContext);
++  nsresult CheckLoadingPermissions();
++  nsresult PersistLayoutHistoryState();
++  nsresult LoadHistoryEntry(nsISHEntry* aEntry, uint32_t aLoadType);
++  nsresult SetBaseUrlForWyciwyg(nsIContentViewer* aContentViewer);
++  nsresult GetRootSessionHistory(nsISHistory** aReturn);
++  nsresult GetHttpChannel(nsIChannel* aChannel, nsIHttpChannel** aReturn);
++  nsresult ConfirmRepost(bool* aRepost);
++  nsresult GetPromptAndStringBundle(nsIPrompt** aPrompt,
++                                    nsIStringBundle** aStringBundle);
++  nsresult GetCurScrollPos(int32_t aScrollOrientation, int32_t* aCurPos);
++  nsresult SetCurScrollPosEx(int32_t aCurHorizontalPos,
++                             int32_t aCurVerticalPos);
++
++  inline bool UseErrorPages()
+   {
+-    bool didDisplayLoadError = false;
+-    DisplayLoadError(aError, aURI, aURL, aFailedChannel, &didDisplayLoadError);
+-    return didDisplayLoadError;
++    return (mObserveErrorPages ? sUseErrorPages : mUseErrorPages);
+   }
+ 
+-public:
+-  // Event type dispatched by RestorePresentation
+-  class RestorePresentationEvent : public mozilla::Runnable
+-  {
+-  public:
+-    NS_DECL_NSIRUNNABLE
+-    explicit RestorePresentationEvent(nsDocShell* aDs)
+-      : mozilla::Runnable("nsDocShell::RestorePresentationEvent")
+-      , mDocShell(aDs)
+-    {
+-    }
+-    void Revoke() { mDocShell = nullptr; }
+-  private:
+-    RefPtr<nsDocShell> mDocShell;
+-  };
++private: // data members
++  static nsIURIFixup* sURIFixup;
+ 
+-protected:
+-  bool JustStartedNetworkLoad();
++  // Cached value of the "browser.xul.error_pages.enabled" preference.
++  static bool sUseErrorPages;
++
++#ifdef DEBUG
++  // We're counting the number of |nsDocShells| to help find leaks
++  static unsigned long gNumberOfDocShells;
++#endif /* DEBUG */
+ 
+-  nsresult CreatePrincipalFromReferrer(nsIURI* aReferrer,
+-                                       nsIPrincipal** aResult);
+-
+-  static const nsCString FrameTypeToString(uint32_t aFrameType)
+-  {
+-    switch (aFrameType) {
+-      case FRAME_TYPE_BROWSER:
+-        return NS_LITERAL_CSTRING("browser");
+-      case FRAME_TYPE_REGULAR:
+-        return NS_LITERAL_CSTRING("regular");
+-      default:
+-        NS_ERROR("Unknown frame type");
+-        return EmptyCString();
+-    }
+-  }
+-
+-  uint32_t GetInheritedFrameType();
+-
+-  bool HasUnloadedParent();
+-
+-  void UpdateGlobalHistoryTitle(nsIURI* aURI);
+-
+-  NS_IMETHOD_(void) GetOriginAttributes(mozilla::OriginAttributes& aAttrs) override;
++  nsID mHistoryID;
++  nsString mName;
++  nsString mTitle;
++  nsString mCustomUserAgent;
++  nsCString mOriginalUriString;
++  nsWeakPtr mOnePermittedSandboxedNavigator;
++  nsWeakPtr mOpener;
++  nsTObserverArray<nsWeakPtr> mPrivacyObservers;
++  nsTObserverArray<nsWeakPtr> mReflowObservers;
++  nsTObserverArray<nsWeakPtr> mScrollObservers;
++  mozilla::OriginAttributes mOriginAttributes;
++  mozilla::UniquePtr<mozilla::dom::ClientSource> mInitialClientSource;
++  RefPtr<nsDOMNavigationTiming> mTiming;
++  RefPtr<nsDSURIContentListener> mContentListener;
++  RefPtr<nsGlobalWindow> mScriptGlobal;
++  nsCOMPtr<nsIPrincipal> mParentCharsetPrincipal;
++  nsCOMPtr<nsIMutableArray> mRefreshURIList;
++  nsCOMPtr<nsIMutableArray> mSavedRefreshURIList;
++  nsCOMPtr<nsIDOMStorageManager> mSessionStorageManager;
++  nsCOMPtr<nsIContentViewer> mContentViewer;
++  nsCOMPtr<nsIWidget> mParentWidget;
++  nsCOMPtr<nsISHistory> mSessionHistory;
++  nsCOMPtr<nsIGlobalHistory2> mGlobalHistory;
++  nsCOMPtr<nsIWebBrowserFind> mFind;
++  nsCOMPtr<nsICommandManager> mCommandManager;
+ 
+   // Dimensions of the docshell
+   nsIntRect mBounds;
+-  nsString mName;
+-  nsString mTitle;
+-  nsString mCustomUserAgent;
+ 
+   /**
+    * Content-Type Hint of the most-recently initiated load. Used for
+    * session history entries.
+    */
+   nsCString mContentTypeHint;
+-  nsIntPoint mDefaultScrollbarPref; // persistent across doc loads
+ 
+-  nsCOMPtr<nsIMutableArray> mRefreshURIList;
+-  nsCOMPtr<nsIMutableArray> mSavedRefreshURIList;
+-  RefPtr<nsDSURIContentListener> mContentListener;
+-  nsCOMPtr<nsIContentViewer> mContentViewer;
+-  nsCOMPtr<nsIWidget> mParentWidget;
++  // An observed docshell wrapper is created when recording markers is enabled.
++  mozilla::UniquePtr<mozilla::ObservedDocShell> mObserved;
+ 
+   // mCurrentURI should be marked immutable on set if possible.
+   nsCOMPtr<nsIURI> mCurrentURI;
+   nsCOMPtr<nsIURI> mReferrerURI;
+-  uint32_t mReferrerPolicy;
+-  RefPtr<nsGlobalWindow> mScriptGlobal;
+-  nsCOMPtr<nsISHistory> mSessionHistory;
+-  nsCOMPtr<nsIGlobalHistory2> mGlobalHistory;
+-  nsCOMPtr<nsIWebBrowserFind> mFind;
+-  nsCOMPtr<nsICommandManager> mCommandManager;
++
+   // Reference to the SHEntry for this docshell until the page is destroyed.
+   // Somebody give me better name
+   nsCOMPtr<nsISHEntry> mOSHE;
++
+   // Reference to the SHEntry for this docshell until the page is loaded
+   // Somebody give me better name.
+   // If mLSHE is non-null, non-pushState subframe loads don't create separate
+   // root history entries. That is, frames loaded during the parent page
+   // load don't generate history entries the way frame navigation after the
+   // parent has loaded does. (This isn't the only purpose of mLSHE.)
+   nsCOMPtr<nsISHEntry> mLSHE;
+ 
+@@ -975,64 +1036,107 @@ protected:
+ 
+   // The URI we're currently loading. This is only relevant during the
+   // firing of a pagehide/unload. The caller of FirePageHideNotification()
+   // is responsible for setting it and unsetting it. It may be null if the
+   // pagehide/unload is happening for some reason other than just loading a
+   // new URI.
+   nsCOMPtr<nsIURI> mLoadingURI;
+ 
++  // Our list of ancestor principals.
++  nsTArray<nsCOMPtr<nsIPrincipal>> mAncestorPrincipals;
++
++  // Our list of ancestor outerWindowIDs.
++  nsTArray<uint64_t> mAncestorOuterWindowIDs;
++
+   // Set in LoadErrorPage from the method argument and used later
+   // in CreateContentViewer. We have to delay an shistory entry creation
+   // for which these objects are needed.
+   nsCOMPtr<nsIURI> mFailedURI;
+   nsCOMPtr<nsIChannel> mFailedChannel;
+-  uint32_t mFailedLoadType;
+ 
+   // Set in DoURILoad when either the LOAD_RELOAD_ALLOW_MIXED_CONTENT flag or
+   // the LOAD_NORMAL_ALLOW_MIXED_CONTENT flag is set.
+   // Checked in nsMixedContentBlocker, to see if the channels match.
+   nsCOMPtr<nsIChannel> mMixedContentChannel;
+ 
++  const mozilla::Encoding* mForcedCharset;
++  const mozilla::Encoding* mParentCharset;
++
+   // WEAK REFERENCES BELOW HERE.
+   // Note these are intentionally not addrefd. Doing so will create a cycle.
+   // For that reasons don't use nsCOMPtr.
+ 
+-  nsIDocShellTreeOwner* mTreeOwner;  // Weak Reference
++  nsIDocShellTreeOwner* mTreeOwner; // Weak Reference
+ 
+   nsCOMPtr<mozilla::dom::EventTarget> mChromeEventHandler;
+ 
++  nsIntPoint mDefaultScrollbarPref; // persistent across doc loads
++
+   eCharsetReloadState mCharsetReloadState;
+ 
+-  // Offset in the parent's child list.
+-  // -1 if the docshell is added dynamically to the parent shell.
+-  int32_t mChildOffset;
+-  uint32_t mBusyFlags;
+-  uint32_t mAppType;
+-  uint32_t mLoadType;
++  // The orientation lock as described by
++  // https://w3c.github.io/screen-orientation/
++  mozilla::dom::ScreenOrientationInternal mOrientationLock;
+ 
++  int32_t mParentCharsetSource;
+   int32_t mMarginWidth;
+   int32_t mMarginHeight;
+ 
+   // This can either be a content docshell or a chrome docshell. After
+   // Create() is called, the type is not expected to change.
+   int32_t mItemType;
+ 
+   // Index into the SHTransaction list, indicating the previous and current
+   // transaction at the time that this DocShell begins to load. Consequently
+   // root docshell's indices can differ from child docshells'.
+   int32_t mPreviousTransIndex;
+   int32_t mLoadedTransIndex;
+ 
++  // Offset in the parent's child list.
++  // -1 if the docshell is added dynamically to the parent shell.
++  int32_t mChildOffset;
++
+   uint32_t mSandboxFlags;
+-  nsWeakPtr mOnePermittedSandboxedNavigator;
++  uint32_t mBusyFlags;
++  uint32_t mAppType;
++  uint32_t mLoadType;
++  uint32_t mDefaultLoadFlags;
++  uint32_t mReferrerPolicy;
++  uint32_t mFailedLoadType;
++
++  // Are we a regular frame, a browser frame, or an app frame?
++  uint32_t mFrameType;
+ 
+-  // The orientation lock as described by
+-  // https://w3c.github.io/screen-orientation/
+-  mozilla::dom::ScreenOrientationInternal mOrientationLock;
++  // This represents the state of private browsing in the docshell.
++  // Currently treated as a binary value: 1 - in private mode, 0 - not private mode
++  // On content docshells mPrivateBrowsingId == mOriginAttributes.mPrivateBrowsingId
++  // On chrome docshells this value will be set, but not have the corresponding
++  // origin attribute set.
++  uint32_t mPrivateBrowsingId;
++
++  // This represents the CSS display-mode we are currently using.
++  // It can be any of the following values from nsIDocShell.idl:
++  //
++  // DISPLAY_MODE_BROWSER = 0
++  // DISPLAY_MODE_MINIMAL_UI = 1
++  // DISPLAY_MODE_STANDALONE = 2
++  // DISPLAY_MODE_FULLSCREEN = 3
++  //
++  // This is mostly used for media queries. The integer values above
++  // match those used in nsStyleConsts.h
++  uint32_t mDisplayMode;
++
++  // A depth count of how many times NotifyRunToCompletionStart
++  // has been called without a matching NotifyRunToCompletionStop.
++  uint32_t mJSRunToCompletionDepth;
++
++  // Whether or not touch events are overridden. Possible values are defined
++  // as constants in the nsIDocShell.idl file.
++  uint32_t mTouchEventsOverride;
+ 
+   // mFullscreenAllowed stores how we determine whether fullscreen is allowed
+   // when GetFullscreenAllowed() is called. Fullscreen is allowed in a
+   // docshell when all containing iframes have the allowfullscreen
+   // attribute set to true. When mFullscreenAllowed is CHECK_ATTRIBUTES
+   // we check this docshell's containing frame for the allowfullscreen
+   // attribute, and recurse onto the parent docshell to ensure all containing
+   // frames also have the allowfullscreen attribute. If we find an ancestor
+@@ -1044,18 +1148,22 @@ protected:
+   enum FullscreenAllowedState : uint8_t
+   {
+     CHECK_ATTRIBUTES,
+     PARENT_ALLOWS,
+     PARENT_PROHIBITS
+   };
+   FullscreenAllowedState mFullscreenAllowed;
+ 
+-  // Cached value of the "browser.xul.error_pages.enabled" preference.
+-  static bool sUseErrorPages;
++  // The following two fields cannot be declared as bit fields
++  // because of uses with AutoRestore.
++  bool mCreatingDocument; // (should be) debugging only
++#ifdef DEBUG
++  bool mInEnsureScriptEnv;
++#endif
+ 
+   bool mCreated : 1;
+   bool mAllowSubframes : 1;
+   bool mAllowPlugins : 1;
+   bool mAllowJavascript : 1;
+   bool mAllowMetaRedirects : 1;
+   bool mAllowImages : 1;
+   bool mAllowMedia : 1;
+@@ -1078,17 +1186,16 @@ protected:
+   bool mWindowDraggingAllowed : 1;
+   bool mInFrameSwap : 1;
+   bool mInheritPrivateBrowsingId : 1;
+ 
+   // Because scriptability depends on the mAllowJavascript values of our
+   // ancestors, we cache the effective scriptability and recompute it when
+   // it might have changed;
+   bool mCanExecuteScripts : 1;
+-  void RecomputeCanExecuteScripts();
+ 
+   // This boolean is set to true right before we fire pagehide and generally
+   // unset when we embed a new content viewer. While it's true no navigation
+   // is allowed in this docshell.
+   bool mFiredUnloadEvent : 1;
+ 
+   // this flag is for bug #21358. a docshell may load many urls
+   // which don't result in new documents being created (i.e. a new
+@@ -1114,120 +1221,11 @@ protected:
+   bool mAffectPrivateSessionLifetime : 1;
+   bool mInvisible : 1;
+   bool mHasLoadedNonBlankURI : 1;
+ 
+   // This flag means that mTiming has been initialized but nulled out.
+   // We will check the innerWin's timing before creating a new one
+   // in MaybeInitTiming()
+   bool mBlankTiming : 1;
+-
+-  // The following two fields cannot be declared as bit fields
+-  // because of uses with AutoRestore.
+-  bool mCreatingDocument; // (should be) debugging only
+-#ifdef DEBUG
+-  bool mInEnsureScriptEnv;
+-#endif
+-
+-  nsID mHistoryID;
+-  uint32_t mDefaultLoadFlags;
+-
+-  static nsIURIFixup* sURIFixup;
+-
+-  RefPtr<nsDOMNavigationTiming> mTiming;
+-
+-  // Are we a regular frame, a browser frame, or an app frame?
+-  uint32_t mFrameType;
+-
+-  // This represents the state of private browsing in the docshell.
+-  // Currently treated as a binary value: 1 - in private mode, 0 - not private mode
+-  // On content docshells mPrivateBrowsingId == mOriginAttributes.mPrivateBrowsingId
+-  // On chrome docshells this value will be set, but not have the corresponding
+-  // origin attribute set.
+-  uint32_t mPrivateBrowsingId;
+-
+-  // This represents the CSS display-mode we are currently using.
+-  // It can be any of the following values from nsIDocShell.idl:
+-  //
+-  // DISPLAY_MODE_BROWSER = 0
+-  // DISPLAY_MODE_MINIMAL_UI = 1
+-  // DISPLAY_MODE_STANDALONE = 2
+-  // DISPLAY_MODE_FULLSCREEN = 3
+-  //
+-  // This is mostly used for media queries. The integer values above
+-  // match those used in nsStyleConsts.h
+-  uint32_t mDisplayMode;
+-
+-private:
+-  const Encoding* mForcedCharset;
+-  const Encoding* mParentCharset;
+-  int32_t mParentCharsetSource;
+-  nsCOMPtr<nsIPrincipal> mParentCharsetPrincipal;
+-  nsTObserverArray<nsWeakPtr> mPrivacyObservers;
+-  nsTObserverArray<nsWeakPtr> mReflowObservers;
+-  nsTObserverArray<nsWeakPtr> mScrollObservers;
+-  nsCString mOriginalUriString;
+-  nsWeakPtr mOpener;
+-  mozilla::OriginAttributes mOriginAttributes;
+-
+-  mozilla::UniquePtr<mozilla::dom::ClientSource> mInitialClientSource;
+-
+-  // A depth count of how many times NotifyRunToCompletionStart
+-  // has been called without a matching NotifyRunToCompletionStop.
+-  uint32_t mJSRunToCompletionDepth;
+-
+-  // Whether or not touch events are overridden. Possible values are defined
+-  // as constants in the nsIDocShell.idl file.
+-  uint32_t mTouchEventsOverride;
+-
+-  // Our list of ancestor principals.
+-  nsTArray<nsCOMPtr<nsIPrincipal>> mAncestorPrincipals;
+-  // Our list of ancestor outerWindowIDs.
+-  nsTArray<uint64_t> mAncestorOuterWindowIDs;
+-
+-  // Separate function to do the actual name (i.e. not _top, _self etc.)
+-  // searching for FindItemWithName.
+-  nsresult DoFindItemWithName(const nsAString& aName,
+-                              nsIDocShellTreeItem* aRequestor,
+-                              nsIDocShellTreeItem* aOriginalRequestor,
+-                              bool aSkipTabGroup,
+-                              nsIDocShellTreeItem** aResult);
+-
+-  // Helper assertion to enforce that mInPrivateBrowsing is in sync with
+-  // OriginAttributes.mPrivateBrowsingId
+-  void AssertOriginAttributesMatchPrivateBrowsing();
+-
+-  // Notify consumers of a search being loaded through the observer service:
+-  void MaybeNotifyKeywordSearchLoading(const nsString& aProvider,
+-                                       const nsString& aKeyword);
+-
+-  // Internal implementation of nsIDocShell::FirePageHideNotification.
+-  // If aSkipCheckingDynEntries is true, it will not try to remove dynamic
+-  // subframe entries. This is to avoid redundant RemoveDynEntries calls in all
+-  // children docshells.
+-  void FirePageHideNotificationInternal(bool aIsUnload,
+-                                        bool aSkipCheckingDynEntries);
+-
+-  // Dispatch a runnable to the TabGroup associated to this docshell.
+-  nsresult DispatchToTabGroup(mozilla::TaskCategory aCategory,
+-                              already_AddRefed<nsIRunnable>&& aRunnable);
+-
+-#ifdef DEBUG
+-  // We're counting the number of |nsDocShells| to help find leaks
+-  static unsigned long gNumberOfDocShells;
+-#endif /* DEBUG */
+-
+-public:
+-  class InterfaceRequestorProxy : public nsIInterfaceRequestor
+-  {
+-  public:
+-    explicit InterfaceRequestorProxy(nsIInterfaceRequestor* aRequestor);
+-    NS_DECL_THREADSAFE_ISUPPORTS
+-    NS_DECL_NSIINTERFACEREQUESTOR
+-
+-  protected:
+-    virtual ~InterfaceRequestorProxy();
+-    InterfaceRequestorProxy() {}
+-    nsWeakPtr mWeakPtr;
+-  };
+ };
+ 
+ #endif /* nsDocShell_h__ */

frg/work-js/mozilla-release/patches/1406161-3-59a1.patch

@@ -0,0 +1,80 @@
+# HG changeset patch
+# User Samael Wang <freesamael@gmail.com>
+# Date 1513379702 21600
+# Node ID 82763191a3c00fe1edb2670ec6b399fb3003e8a7
+# Parent  df345df156805b38899c3b7bf8a30cc7e9ba6dbe
+Bug 1406161 - Part 3: Remove a dead member function. r=smaug
+
+MozReview-Commit-ID: LYNUZhvnAdm
+
+diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
+--- a/docshell/base/nsDocShell.cpp
++++ b/docshell/base/nsDocShell.cpp
+@@ -13627,44 +13627,16 @@ nsDocShell::GetPromptAndStringBundle(nsI
+ 
+   NS_ENSURE_SUCCESS(
+     stringBundleService->CreateBundle(kAppstringsBundleURL, aStringBundle),
+     NS_ERROR_FAILURE);
+ 
+   return NS_OK;
+ }
+ 
+-NS_IMETHODIMP
+-nsDocShell::GetChildOffset(nsIDOMNode* aChild, nsIDOMNode* aParent,
+-                           int32_t* aOffset)
+-{
+-  NS_ENSURE_ARG_POINTER(aChild || aParent);
+-
+-  nsCOMPtr<nsIDOMNodeList> childNodes;
+-  NS_ENSURE_SUCCESS(aParent->GetChildNodes(getter_AddRefs(childNodes)),
+-                    NS_ERROR_FAILURE);
+-  NS_ENSURE_TRUE(childNodes, NS_ERROR_FAILURE);
+-
+-  int32_t i = 0;
+-
+-  for (; true; i++) {
+-    nsCOMPtr<nsIDOMNode> childNode;
+-    NS_ENSURE_SUCCESS(childNodes->Item(i, getter_AddRefs(childNode)),
+-                      NS_ERROR_FAILURE);
+-    NS_ENSURE_TRUE(childNode, NS_ERROR_FAILURE);
+-
+-    if (childNode.get() == aChild) {
+-      *aOffset = i;
+-      return NS_OK;
+-    }
+-  }
+-
+-  return NS_ERROR_FAILURE;
+-}
+-
+ nsIScrollableFrame*
+ nsDocShell::GetRootScrollFrame()
+ {
+   nsCOMPtr<nsIPresShell> shell = GetPresShell();
+   NS_ENSURE_TRUE(shell, nullptr);
+ 
+   return shell->GetRootScrollFrameAsScrollable();
+ }
+diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
+--- a/docshell/base/nsDocShell.h
++++ b/docshell/base/nsDocShell.h
+@@ -902,19 +902,16 @@ private: // member functions
+   // children docshells.
+   void FirePageHideNotificationInternal(bool aIsUnload,
+                                         bool aSkipCheckingDynEntries);
+ 
+   // Dispatch a runnable to the TabGroup associated to this docshell.
+   nsresult DispatchToTabGroup(mozilla::TaskCategory aCategory,
+                               already_AddRefed<nsIRunnable>&& aRunnable);
+ 
+-  NS_IMETHOD GetChildOffset(nsIDOMNode* aChild, nsIDOMNode* aParent,
+-                            int32_t* aOffset);
+-
+   void SetupReferrerFromChannel(nsIChannel* aChannel);
+   void SetReferrerURI(nsIURI* aURI);
+   void SetReferrerPolicy(uint32_t aReferrerPolicy);
+   void ReattachEditorToWindow(nsISHEntry* aSHEntry);
+   void RecomputeCanExecuteScripts();
+   void ClearFrameHistory(nsISHEntry* aEntry);
+   void UpdateGlobalHistoryTitle(nsIURI* aURI);
+   bool IsFrame();

frg/work-js/mozilla-release/patches/1406161-4-59a1.patch

@@ -0,0 +1,1237 @@
+# HG changeset patch
+# User Samael Wang <freesamael@gmail.com>
+# Date 1513649976 21600
+# Node ID ec9ea72e98ddd81a431cbe344f46acd59f663d5f
+# Parent  c471c4e4e5f8b04ac458e762649b1f94f82e5730
+Bug 1406161 - Part 4: Move nsPingListener and nsRefreshTimer to separate files. r=smaug
+
+MozReview-Commit-ID: 9Z6i9yWoQwj
+
+diff --git a/docshell/base/moz.build b/docshell/base/moz.build
+--- a/docshell/base/moz.build
++++ b/docshell/base/moz.build
+@@ -86,16 +86,18 @@ UNIFIED_SOURCES += [
+     'nsDefaultURIFixup.cpp',
+     'nsDocShell.cpp',
+     'nsDocShellEditorData.cpp',
+     'nsDocShellEnumerator.cpp',
+     'nsDocShellLoadInfo.cpp',
+     'nsDocShellTransferableHooks.cpp',
+     'nsDocShellTreeOwner.cpp',
+     'nsDSURIContentListener.cpp',
++    'nsPingListener.cpp',
++    'nsRefreshTimer.cpp',
+     'nsWebNavigationInfo.cpp',
+     'SerializedLoadContext.cpp',
+ ]
+ 
+ if not CONFIG['MOZ_PLACES']:
+     UNIFIED_SOURCES += ['nsDownloadHistory.cpp']
+ 
+ include('/ipc/chromium/chromium-config.mozbuild')
+diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
+--- a/docshell/base/nsDocShell.cpp
++++ b/docshell/base/nsDocShell.cpp
+@@ -128,17 +128,16 @@
+ #include "nsIStructuredCloneContainer.h"
+ #include "nsISupportsPrimitives.h"
+ #include "nsITabChild.h"
+ #include "nsITextToSubURI.h"
+ #include "nsITimedChannel.h"
+ #include "nsITimer.h"
+ #include "nsITransportSecurityInfo.h"
+ #include "nsIUploadChannel.h"
+-#include "nsIUploadChannel2.h"
+ #include "nsIURIFixup.h"
+ #include "nsIURILoader.h"
+ #include "nsIURL.h"
+ #include "nsIViewSourceChannel.h"
+ #include "nsIWebBrowserChrome.h"
+ #include "nsIWebBrowserChrome3.h"
+ #include "nsIWebBrowserChromeFocus.h"
+ #include "nsIWebBrowserFind.h"
+@@ -179,23 +178,23 @@
+ #include "nsError.h"
+ #include "nsEscape.h"
+ #include "nsFocusManager.h"
+ #include "nsGlobalWindow.h"
+ #include "nsJSEnvironment.h"
+ #include "nsNetCID.h"
+ #include "nsNetUtil.h"
+ #include "nsObjectLoadingContent.h"
++#include "nsPingListener.h"
+ #include "nsPoint.h"
+ #include "nsQueryObject.h"
+ #include "nsRect.h"
++#include "nsRefreshTimer.h"
+ #include "nsSandboxFlags.h"
+ #include "nsSHistory.h"
+-#include "nsStreamUtils.h"
+-#include "nsStringStream.h"
+ #include "nsStructuredCloneContainer.h"
+ #include "nsSubDocumentFrame.h"
+ #include "nsView.h"
+ #include "nsViewManager.h"
+ #include "nsViewSourceHandler.h"
+ #include "nsWhitespaceTokenizer.h"
+ #include "nsWidgetsCID.h"
+ #include "nsXULAppAPI.h"
+@@ -276,395 +275,16 @@ FavorPerformanceHint(bool aPerfOverStarv
+   if (appShell) {
+     appShell->FavorPerformanceHint(
+       aPerfOverStarvation,
+       Preferences::GetUint("docshell.event_starvation_delay_hint",
+                            NS_EVENT_STARVATION_DELAY_HINT));
+   }
+ }
+ 
+-//*****************************************************************************
+-// <a ping> support
+-//*****************************************************************************
+-
+-#define PREF_PINGS_ENABLED           "browser.send_pings"
+-#define PREF_PINGS_MAX_PER_LINK      "browser.send_pings.max_per_link"
+-#define PREF_PINGS_REQUIRE_SAME_HOST "browser.send_pings.require_same_host"
+-
+-// Check prefs to see if pings are enabled and if so what restrictions might
+-// be applied.
+-//
+-// @param maxPerLink
+-//   This parameter returns the number of pings that are allowed per link click
+-//
+-// @param requireSameHost
+-//   This parameter returns true if pings are restricted to the same host as
+-//   the document in which the click occurs.  If the same host restriction is
+-//   imposed, then we still allow for pings to cross over to different
+-//   protocols and ports for flexibility and because it is not possible to send
+-//   a ping via FTP.
+-//
+-// @returns
+-//   true if pings are enabled and false otherwise.
+-//
+-static bool
+-PingsEnabled(int32_t* aMaxPerLink, bool* aRequireSameHost)
+-{
+-  bool allow = Preferences::GetBool(PREF_PINGS_ENABLED, false);
+-
+-  *aMaxPerLink = 1;
+-  *aRequireSameHost = true;
+-
+-  if (allow) {
+-    Preferences::GetInt(PREF_PINGS_MAX_PER_LINK, aMaxPerLink);
+-    Preferences::GetBool(PREF_PINGS_REQUIRE_SAME_HOST, aRequireSameHost);
+-  }
+-
+-  return allow;
+-}
+-
+-typedef void (*ForEachPingCallback)(void* closure, nsIContent* content,
+-                                    nsIURI* uri, nsIIOService* ios);
+-
+-static bool
+-IsElementAnchor(nsIContent* aContent)
+-{
+-  // Make sure we are dealing with either an <A> or <AREA> element in the HTML
+-  // or XHTML namespace.
+-  return aContent->IsAnyOfHTMLElements(nsGkAtoms::a, nsGkAtoms::area);
+-}
+-
+-static void
+-ForEachPing(nsIContent* aContent, ForEachPingCallback aCallback, void* aClosure)
+-{
+-  // NOTE: Using nsIDOMHTMLAnchorElement::GetPing isn't really worth it here
+-  //       since we'd still need to parse the resulting string.  Instead, we
+-  //       just parse the raw attribute.  It might be nice if the content node
+-  //       implemented an interface that exposed an enumeration of nsIURIs.
+-
+-  // Make sure we are dealing with either an <A> or <AREA> element in the HTML
+-  // or XHTML namespace.
+-  if (!IsElementAnchor(aContent)) {
+-    return;
+-  }
+-
+-  nsAutoString value;
+-  aContent->AsElement()->GetAttr(kNameSpaceID_None, nsGkAtoms::ping, value);
+-  if (value.IsEmpty()) {
+-    return;
+-  }
+-
+-  nsCOMPtr<nsIIOService> ios = do_GetIOService();
+-  if (!ios) {
+-    return;
+-  }
+-
+-  nsIDocument* doc = aContent->OwnerDoc();
+-  nsAutoCString charset;
+-  doc->GetDocumentCharacterSet()->Name(charset);
+-
+-  nsWhitespaceTokenizer tokenizer(value);
+-
+-  while (tokenizer.hasMoreTokens()) {
+-    nsCOMPtr<nsIURI> uri, baseURI = aContent->GetBaseURI();
+-    ios->NewURI(NS_ConvertUTF16toUTF8(tokenizer.nextToken()),
+-                charset.get(), baseURI, getter_AddRefs(uri));
+-    // if we can't generate a valid URI, then there is nothing to do
+-    if (!uri) {
+-      continue;
+-    }
+-    // Explicitly not allow loading data: URIs
+-    bool isDataScheme =
+-      (NS_SUCCEEDED(uri->SchemeIs("data", &isDataScheme)) && isDataScheme);
+-
+-    if (!isDataScheme) {
+-      aCallback(aClosure, aContent, uri, ios);
+-    }
+-  }
+-}
+-
+-//----------------------------------------------------------------------
+-
+-// We wait this many milliseconds before killing the ping channel...
+-#define PING_TIMEOUT 10000
+-
+-static void
+-OnPingTimeout(nsITimer* aTimer, void* aClosure)
+-{
+-  nsILoadGroup* loadGroup = static_cast<nsILoadGroup*>(aClosure);
+-  if (loadGroup) {
+-    loadGroup->Cancel(NS_ERROR_ABORT);
+-  }
+-}
+-
+-class nsPingListener final
+-  : public nsIStreamListener
+-{
+-public:
+-  NS_DECL_ISUPPORTS
+-  NS_DECL_NSIREQUESTOBSERVER
+-  NS_DECL_NSISTREAMLISTENER
+-
+-  nsPingListener()
+-  {
+-  }
+-
+-  void SetLoadGroup(nsILoadGroup* aLoadGroup) {
+-    mLoadGroup = aLoadGroup;
+-  }
+-
+-  nsresult StartTimeout(DocGroup* aDocGroup);
+-
+-private:
+-  ~nsPingListener();
+-
+-  nsCOMPtr<nsILoadGroup> mLoadGroup;
+-  nsCOMPtr<nsITimer> mTimer;
+-};
+-
+-NS_IMPL_ISUPPORTS(nsPingListener, nsIStreamListener, nsIRequestObserver)
+-
+-nsPingListener::~nsPingListener()
+-{
+-  if (mTimer) {
+-    mTimer->Cancel();
+-    mTimer = nullptr;
+-  }
+-}
+-
+-nsresult
+-nsPingListener::StartTimeout(DocGroup* aDocGroup)
+-{
+-  NS_ENSURE_ARG(aDocGroup);
+-
+-  return NS_NewTimerWithFuncCallback(getter_AddRefs(mTimer),
+-                                     OnPingTimeout,
+-                                     mLoadGroup,
+-                                     PING_TIMEOUT,
+-                                     nsITimer::TYPE_ONE_SHOT,
+-                                     "nsPingListener::StartTimeout",
+-                                     aDocGroup->EventTargetFor(TaskCategory::Network));
+-}
+-
+-NS_IMETHODIMP
+-nsPingListener::OnStartRequest(nsIRequest* aRequest, nsISupports* aContext)
+-{
+-  return NS_OK;
+-}
+-
+-NS_IMETHODIMP
+-nsPingListener::OnDataAvailable(nsIRequest* aRequest, nsISupports* aContext,
+-                                nsIInputStream* aStream, uint64_t aOffset,
+-                                uint32_t aCount)
+-{
+-  uint32_t result;
+-  return aStream->ReadSegments(NS_DiscardSegment, nullptr, aCount, &result);
+-}
+-
+-NS_IMETHODIMP
+-nsPingListener::OnStopRequest(nsIRequest* aRequest, nsISupports* aContext,
+-                              nsresult aStatus)
+-{
+-  mLoadGroup = nullptr;
+-
+-  if (mTimer) {
+-    mTimer->Cancel();
+-    mTimer = nullptr;
+-  }
+-
+-  return NS_OK;
+-}
+-
+-struct MOZ_STACK_CLASS SendPingInfo
+-{
+-  int32_t numPings;
+-  int32_t maxPings;
+-  bool requireSameHost;
+-  nsIURI* target;
+-  nsIURI* referrer;
+-  nsIDocShell* docShell;
+-  uint32_t referrerPolicy;
+-};
+-
+-static void
+-SendPing(void* aClosure, nsIContent* aContent, nsIURI* aURI,
+-         nsIIOService* aIOService)
+-{
+-  SendPingInfo* info = static_cast<SendPingInfo*>(aClosure);
+-  if (info->maxPings > -1 && info->numPings >= info->maxPings) {
+-    return;
+-  }
+-
+-  nsIDocument* doc = aContent->OwnerDoc();
+-
+-  nsCOMPtr<nsIChannel> chan;
+-  NS_NewChannel(getter_AddRefs(chan),
+-                aURI,
+-                doc,
+-                info->requireSameHost
+-                  ? nsILoadInfo::SEC_REQUIRE_SAME_ORIGIN_DATA_IS_BLOCKED
+-                  : nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_DATA_IS_NULL,
+-                nsIContentPolicy::TYPE_PING,
+-                nullptr, // aLoadGroup
+-                nullptr, // aCallbacks
+-                nsIRequest::LOAD_NORMAL, // aLoadFlags,
+-                aIOService);
+-
+-  if (!chan) {
+-    return;
+-  }
+-
+-  // Don't bother caching the result of this URI load, but do not exempt
+-  // it from Safe Browsing.
+-  chan->SetLoadFlags(nsIRequest::INHIBIT_CACHING | nsIChannel::LOAD_CLASSIFY_URI);
+-
+-  nsCOMPtr<nsIHttpChannel> httpChan = do_QueryInterface(chan);
+-  if (!httpChan) {
+-    return;
+-  }
+-
+-  // This is needed in order for 3rd-party cookie blocking to work.
+-  nsCOMPtr<nsIHttpChannelInternal> httpInternal = do_QueryInterface(httpChan);
+-  nsresult rv;
+-  if (httpInternal) {
+-    rv = httpInternal->SetDocumentURI(doc->GetDocumentURI());
+-    MOZ_ASSERT(NS_SUCCEEDED(rv));
+-  }
+-
+-  rv = httpChan->SetRequestMethod(NS_LITERAL_CSTRING("POST"));
+-  MOZ_ASSERT(NS_SUCCEEDED(rv));
+-
+-  // Remove extraneous request headers (to reduce request size)
+-  rv = httpChan->SetRequestHeader(NS_LITERAL_CSTRING("accept"),
+-                                  EmptyCString(), false);
+-  MOZ_ASSERT(NS_SUCCEEDED(rv));
+-  rv = httpChan->SetRequestHeader(NS_LITERAL_CSTRING("accept-language"),
+-                                  EmptyCString(), false);
+-  MOZ_ASSERT(NS_SUCCEEDED(rv));
+-  rv = httpChan->SetRequestHeader(NS_LITERAL_CSTRING("accept-encoding"),
+-                                  EmptyCString(), false);
+-  MOZ_ASSERT(NS_SUCCEEDED(rv));
+-
+-  // Always send a Ping-To header.
+-  nsAutoCString pingTo;
+-  if (NS_SUCCEEDED(info->target->GetSpec(pingTo))) {
+-    rv = httpChan->SetRequestHeader(NS_LITERAL_CSTRING("Ping-To"), pingTo, false);
+-    MOZ_ASSERT(NS_SUCCEEDED(rv));
+-  }
+-
+-  nsCOMPtr<nsIScriptSecurityManager> sm =
+-    do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID);
+-
+-  if (sm && info->referrer) {
+-    bool referrerIsSecure;
+-    uint32_t flags = nsIProtocolHandler::URI_SAFE_TO_LOAD_IN_SECURE_CONTEXT;
+-    rv = NS_URIChainHasFlags(info->referrer, flags, &referrerIsSecure);
+-
+-    // Default to sending less data if NS_URIChainHasFlags() fails.
+-    referrerIsSecure = NS_FAILED(rv) || referrerIsSecure;
+-
+-    bool sameOrigin =
+-      NS_SUCCEEDED(sm->CheckSameOriginURI(info->referrer, aURI, false));
+-
+-    // If both the address of the document containing the hyperlink being
+-    // audited and "ping URL" have the same origin or the document containing
+-    // the hyperlink being audited was not retrieved over an encrypted
+-    // connection, send a Ping-From header.
+-    if (sameOrigin || !referrerIsSecure) {
+-      nsAutoCString pingFrom;
+-      if (NS_SUCCEEDED(info->referrer->GetSpec(pingFrom))) {
+-        rv = httpChan->SetRequestHeader(NS_LITERAL_CSTRING("Ping-From"),
+-                                        pingFrom, false);
+-        MOZ_ASSERT(NS_SUCCEEDED(rv));
+-      }
+-    }
+-
+-    // If the document containing the hyperlink being audited was not retrieved
+-    // over an encrypted connection and its address does not have the same
+-    // origin as "ping URL", send a referrer.
+-    if (!sameOrigin && !referrerIsSecure) {
+-      rv = httpChan->SetReferrerWithPolicy(info->referrer, info->referrerPolicy);
+-      MOZ_ASSERT(NS_SUCCEEDED(rv));
+-    }
+-  }
+-
+-  nsCOMPtr<nsIUploadChannel2> uploadChan = do_QueryInterface(httpChan);
+-  if (!uploadChan) {
+-    return;
+-  }
+-
+-  NS_NAMED_LITERAL_CSTRING(uploadData, "PING");
+-
+-  nsCOMPtr<nsIInputStream> uploadStream;
+-  rv = NS_NewCStringInputStream(getter_AddRefs(uploadStream), uploadData);
+-  if (NS_WARN_IF(NS_FAILED(rv))) {
+-    return;
+-  }
+-
+-  uploadChan->ExplicitSetUploadStream(uploadStream,
+-                                      NS_LITERAL_CSTRING("text/ping"),
+-                                      uploadData.Length(),
+-                                      NS_LITERAL_CSTRING("POST"), false);
+-
+-  // The channel needs to have a loadgroup associated with it, so that we can
+-  // cancel the channel and any redirected channels it may create.
+-  nsCOMPtr<nsILoadGroup> loadGroup = do_CreateInstance(NS_LOADGROUP_CONTRACTID);
+-  if (!loadGroup) {
+-    return;
+-  }
+-  nsCOMPtr<nsIInterfaceRequestor> callbacks = do_QueryInterface(info->docShell);
+-  loadGroup->SetNotificationCallbacks(callbacks);
+-  chan->SetLoadGroup(loadGroup);
+-
+-  RefPtr<nsPingListener> pingListener = new nsPingListener();
+-  chan->AsyncOpen2(pingListener);
+-
+-  // Even if AsyncOpen failed, we still count this as a successful ping.  It's
+-  // possible that AsyncOpen may have failed after triggering some background
+-  // process that may have written something to the network.
+-  info->numPings++;
+-
+-  // Prevent ping requests from stalling and never being garbage collected...
+-  if (NS_FAILED(pingListener->StartTimeout(doc->GetDocGroup()))) {
+-    // If we failed to setup the timer, then we should just cancel the channel
+-    // because we won't be able to ensure that it goes away in a timely manner.
+-    chan->Cancel(NS_ERROR_ABORT);
+-    return;
+-  }
+-  // if the channel openend successfully, then make the pingListener hold
+-  // a strong reference to the loadgroup which is released in ::OnStopRequest
+-  pingListener->SetLoadGroup(loadGroup);
+-}
+-
+-// Spec: http://whatwg.org/specs/web-apps/current-work/#ping
+-static void
+-DispatchPings(nsIDocShell* aDocShell,
+-              nsIContent* aContent,
+-              nsIURI* aTarget,
+-              nsIURI* aReferrer,
+-              uint32_t aReferrerPolicy)
+-{
+-  SendPingInfo info;
+-
+-  if (!PingsEnabled(&info.maxPings, &info.requireSameHost)) {
+-    return;
+-  }
+-  if (info.maxPings == 0) {
+-    return;
+-  }
+-
+-  info.numPings = 0;
+-  info.target = aTarget;
+-  info.referrer = aReferrer;
+-  info.referrerPolicy = aReferrerPolicy;
+-  info.docShell = aDocShell;
+-
+-  ForEachPing(aContent, SendPing, &info);
+-}
+-
+ static nsDOMNavigationTiming::Type
+ ConvertLoadTypeToNavigationType(uint32_t aLoadType)
+ {
+   // Not initialized, assume it's normal load.
+   if (aLoadType == 0) {
+     aLoadType = LOAD_NORMAL;
+   }
+ 
+@@ -13784,60 +13404,16 @@ NS_IMETHODIMP
+ nsDocShell::SetLayoutHistoryState(nsILayoutHistoryState* aLayoutHistoryState)
+ {
+   if (mOSHE) {
+     mOSHE->SetLayoutHistoryState(aLayoutHistoryState);
+   }
+   return NS_OK;
+ }
+ 
+-nsRefreshTimer::nsRefreshTimer(nsDocShell* aDocShell,
+-                               nsIURI* aURI,
+-                               nsIPrincipal* aPrincipal,
+-                               int32_t aDelay, bool aRepeat, bool aMetaRefresh)
+-  : mDocShell(aDocShell), mURI(aURI), mPrincipal(aPrincipal),
+-    mDelay(aDelay), mRepeat(aRepeat),
+-    mMetaRefresh(aMetaRefresh)
+-{
+-}
+-
+-nsRefreshTimer::~nsRefreshTimer()
+-{
+-}
+-
+-NS_IMPL_ADDREF(nsRefreshTimer)
+-NS_IMPL_RELEASE(nsRefreshTimer)
+-
+-NS_INTERFACE_MAP_BEGIN(nsRefreshTimer)
+-  NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsITimerCallback)
+-  NS_INTERFACE_MAP_ENTRY(nsITimerCallback)
+-  NS_INTERFACE_MAP_ENTRY(nsINamed)
+-NS_INTERFACE_MAP_END
+-
+-NS_IMETHODIMP
+-nsRefreshTimer::Notify(nsITimer* aTimer)
+-{
+-  NS_ASSERTION(mDocShell, "DocShell is somehow null");
+-
+-  if (mDocShell && aTimer) {
+-    // Get the delay count to determine load type
+-    uint32_t delay = 0;
+-    aTimer->GetDelay(&delay);
+-    mDocShell->ForceRefreshURIFromTimer(mURI, mPrincipal, delay, mMetaRefresh, aTimer);
+-  }
+-  return NS_OK;
+-}
+-
+-NS_IMETHODIMP
+-nsRefreshTimer::GetName(nsACString& aName)
+-{
+-  aName.AssignLiteral("nsRefreshTimer");
+-  return NS_OK;
+-}
+-
+ nsDocShell::InterfaceRequestorProxy::InterfaceRequestorProxy(
+     nsIInterfaceRequestor* aRequestor)
+ {
+   if (aRequestor) {
+     mWeakPtr = do_GetWeakReference(aRequestor);
+   }
+ }
+ 
+@@ -14339,16 +13915,24 @@ nsDocShell::OnLinkClick(nsIContent* aCon
+   nsCOMPtr<nsIRunnable> ev =
+     new OnLinkClickEvent(this, aContent, aURI, target.get(), aFileName,
+                          aPostDataStream, aPostDataStreamLength,
+                          aHeadersDataStream, noOpenerImplied,
+                          aIsTrusted, aTriggeringPrincipal);
+   return DispatchToTabGroup(TaskCategory::UI, ev.forget());
+ }
+ 
++static bool
++IsElementAnchorOrArea(nsIContent* aContent)
++{
++  // Make sure we are dealing with either an <A> or <AREA> element in the HTML
++  // or XHTML namespace.
++  return aContent->IsAnyOfHTMLElements(nsGkAtoms::a, nsGkAtoms::area);
++}
++
+ NS_IMETHODIMP
+ nsDocShell::OnLinkClickSync(nsIContent* aContent,
+                             nsIURI* aURI,
+                             const char16_t* aTargetSpec,
+                             const nsAString& aFileName,
+                             nsIInputStream* aPostDataStream,
+                             int64_t aPostDataStreamLength,
+                             nsIInputStream* aHeadersDataStream,
+@@ -14397,17 +13981,17 @@ nsDocShell::OnLinkClickSync(nsIContent* 
+         if (NS_SUCCEEDED(rv) && !isExposed) {
+           return extProtService->LoadURI(aURI, this);
+         }
+       }
+     }
+   }
+ 
+   uint32_t flags = INTERNAL_LOAD_FLAGS_NONE;
+-  if (IsElementAnchor(aContent)) {
++  if (IsElementAnchorOrArea(aContent)) {
+     MOZ_ASSERT(aContent->IsHTMLElement());
+     nsAutoString referrer;
+     aContent->AsElement()->GetAttr(kNameSpaceID_None, nsGkAtoms::rel, referrer);
+     nsWhitespaceTokenizerTemplate<nsContentUtils::IsHTMLWhitespace> tok(referrer);
+     while (tok.hasMoreTokens()) {
+       const nsAString& token = tok.nextToken();
+       if (token.LowerCaseEqualsLiteral("noreferrer")) {
+         flags |= INTERNAL_LOAD_FLAGS_DONT_SEND_REFERRER |
+@@ -14444,17 +14028,17 @@ nsDocShell::OnLinkClickSync(nsIContent* 
+   }
+ 
+   nsCOMPtr<nsIURI> referer = refererDoc->GetDocumentURI();
+   uint32_t refererPolicy = refererDoc->GetReferrerPolicy();
+ 
+   // get referrer attribute from clicked link and parse it
+   // if per element referrer is enabled, the element referrer overrules
+   // the document wide referrer
+-  if (IsElementAnchor(aContent)) {
++  if (IsElementAnchorOrArea(aContent)) {
+     net::ReferrerPolicy refPolEnum = aContent->AsElement()->GetReferrerPolicyAsEnum();
+     if (refPolEnum != net::RP_Unset) {
+       refererPolicy = refPolEnum;
+     }
+   }
+ 
+   // referer could be null here in some odd cases, but that's ok,
+   // we'll just load the link w/o sending a referer in those cases.
+@@ -14513,17 +14097,17 @@ nsDocShell::OnLinkClickSync(nsIContent* 
+                              nullptr,                   // No SHEntry
+                              true,                      // first party site
+                              VoidString(),              // No srcdoc
+                              this,                      // We are the source
+                              nullptr,                   // baseURI not needed
+                              aDocShell,                 // DocShell out-param
+                              aRequest);                 // Request out-param
+   if (NS_SUCCEEDED(rv)) {
+-    DispatchPings(this, aContent, aURI, referer, refererPolicy);
++    nsPingListener::DispatchPings(this, aContent, aURI, referer, refererPolicy);
+   }
+   return rv;
+ }
+ 
+ NS_IMETHODIMP
+ nsDocShell::OnOverLink(nsIContent* aContent,
+                        nsIURI* aURI,
+                        const char16_t* aTargetSpec)
+diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
+--- a/docshell/base/nsDocShell.h
++++ b/docshell/base/nsDocShell.h
+@@ -25,23 +25,21 @@
+ #include "nsIDocCharset.h"
+ #include "nsIDocShell.h"
+ #include "nsIDocShellLoadInfo.h"
+ #include "nsIDocShellTreeItem.h"
+ #include "nsIDOMStorageManager.h"
+ #include "nsIInterfaceRequestor.h"
+ #include "nsILinkHandler.h"
+ #include "nsILoadContext.h"
+-#include "nsINamed.h"
+ #include "nsINetworkInterceptController.h"
+ #include "nsIRefreshURI.h"
+ #include "nsIScrollable.h"
+ #include "nsITabParent.h"
+ #include "nsITextScroll.h"
+-#include "nsITimer.h"
+ #include "nsIWebNavigation.h"
+ #include "nsIWebPageDescriptor.h"
+ #include "nsIWebProgressListener.h"
+ #include "nsIWebShellServices.h"
+ 
+ #include "nsAutoPtr.h"
+ #include "nsCOMPtr.h"
+ #include "nsContentPolicyUtils.h"
+@@ -107,44 +105,16 @@ class OnLinkClickEvent;
+ 
+ /* internally used ViewMode types */
+ enum ViewMode
+ {
+   viewNormal = 0x0,
+   viewSource = 0x1
+ };
+ 
+-class nsRefreshTimer : public nsITimerCallback
+-                     , public nsINamed
+-{
+-public:
+-  nsRefreshTimer(nsDocShell* aDocShell,
+-                 nsIURI* aURI,
+-                 nsIPrincipal* aPrincipal,
+-                 int32_t aDelay,
+-                 bool aRepeat,
+-                 bool aMetaRefresh);
+-
+-  NS_DECL_THREADSAFE_ISUPPORTS
+-  NS_DECL_NSITIMERCALLBACK
+-  NS_DECL_NSINAMED
+-
+-  int32_t GetDelay() { return mDelay ;}
+-
+-  RefPtr<nsDocShell> mDocShell;
+-  nsCOMPtr<nsIURI> mURI;
+-  nsCOMPtr<nsIPrincipal> mPrincipal;
+-  int32_t mDelay;
+-  bool mRepeat;
+-  bool mMetaRefresh;
+-
+-private:
+-  virtual ~nsRefreshTimer();
+-};
+-
+ enum eCharsetReloadState
+ {
+   eCharsetReloadInit,
+   eCharsetReloadRequested,
+   eCharsetReloadStopOrigional
+ };
+ 
+ class nsDocShell final
+diff --git a/docshell/base/nsPingListener.cpp b/docshell/base/nsPingListener.cpp
+new file mode 100644
+--- /dev/null
++++ b/docshell/base/nsPingListener.cpp
+@@ -0,0 +1,370 @@
++/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
++/* vim: set ts=8 sts=2 et sw=2 tw=80: */
++/* This Source Code Form is subject to the terms of the Mozilla Public
++ * License, v. 2.0. If a copy of the MPL was not distributed with this
++ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
++
++#include "nsPingListener.h"
++
++#include "mozilla/Preferences.h"
++
++#include "mozilla/dom/DocGroup.h"
++
++#include "nsIDocument.h"
++#include "nsIHttpChannelInternal.h"
++#include "nsIInputStream.h"
++#include "nsIProtocolHandler.h"
++#include "nsIUploadChannel2.h"
++
++#include "nsDocument.h"
++#include "nsNetUtil.h"
++#include "nsStreamUtils.h"
++#include "nsStringStream.h"
++#include "nsWhitespaceTokenizer.h"
++
++using namespace mozilla;
++using namespace mozilla::dom;
++
++NS_IMPL_ISUPPORTS(nsPingListener, nsIStreamListener, nsIRequestObserver)
++
++//*****************************************************************************
++// <a ping> support
++//*****************************************************************************
++
++#define PREF_PINGS_ENABLED           "browser.send_pings"
++#define PREF_PINGS_MAX_PER_LINK      "browser.send_pings.max_per_link"
++#define PREF_PINGS_REQUIRE_SAME_HOST "browser.send_pings.require_same_host"
++
++// Check prefs to see if pings are enabled and if so what restrictions might
++// be applied.
++//
++// @param maxPerLink
++//   This parameter returns the number of pings that are allowed per link click
++//
++// @param requireSameHost
++//   This parameter returns true if pings are restricted to the same host as
++//   the document in which the click occurs.  If the same host restriction is
++//   imposed, then we still allow for pings to cross over to different
++//   protocols and ports for flexibility and because it is not possible to send
++//   a ping via FTP.
++//
++// @returns
++//   true if pings are enabled and false otherwise.
++//
++static bool
++PingsEnabled(int32_t* aMaxPerLink, bool* aRequireSameHost)
++{
++  bool allow = Preferences::GetBool(PREF_PINGS_ENABLED, false);
++
++  *aMaxPerLink = 1;
++  *aRequireSameHost = true;
++
++  if (allow) {
++    Preferences::GetInt(PREF_PINGS_MAX_PER_LINK, aMaxPerLink);
++    Preferences::GetBool(PREF_PINGS_REQUIRE_SAME_HOST, aRequireSameHost);
++  }
++
++  return allow;
++}
++
++// We wait this many milliseconds before killing the ping channel...
++#define PING_TIMEOUT 10000
++
++static void
++OnPingTimeout(nsITimer* aTimer, void* aClosure)
++{
++  nsILoadGroup* loadGroup = static_cast<nsILoadGroup*>(aClosure);
++  if (loadGroup) {
++    loadGroup->Cancel(NS_ERROR_ABORT);
++  }
++}
++
++struct MOZ_STACK_CLASS SendPingInfo
++{
++  int32_t numPings;
++  int32_t maxPings;
++  bool requireSameHost;
++  nsIURI* target;
++  nsIURI* referrer;
++  nsIDocShell* docShell;
++  uint32_t referrerPolicy;
++};
++
++static void
++SendPing(void* aClosure, nsIContent* aContent, nsIURI* aURI,
++         nsIIOService* aIOService)
++{
++  SendPingInfo* info = static_cast<SendPingInfo*>(aClosure);
++  if (info->maxPings > -1 && info->numPings >= info->maxPings) {
++    return;
++  }
++
++  nsIDocument* doc = aContent->OwnerDoc();
++
++  nsCOMPtr<nsIChannel> chan;
++  NS_NewChannel(getter_AddRefs(chan),
++                aURI,
++                doc,
++                info->requireSameHost
++                  ? nsILoadInfo::SEC_REQUIRE_SAME_ORIGIN_DATA_IS_BLOCKED
++                  : nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_DATA_IS_NULL,
++                nsIContentPolicy::TYPE_PING,
++                nullptr, // aLoadGroup
++                nullptr, // aCallbacks
++                nsIRequest::LOAD_NORMAL, // aLoadFlags,
++                aIOService);
++
++  if (!chan) {
++    return;
++  }
++
++  // Don't bother caching the result of this URI load, but do not exempt
++  // it from Safe Browsing.
++  chan->SetLoadFlags(nsIRequest::INHIBIT_CACHING | nsIChannel::LOAD_CLASSIFY_URI);
++
++  nsCOMPtr<nsIHttpChannel> httpChan = do_QueryInterface(chan);
++  if (!httpChan) {
++    return;
++  }
++
++  // This is needed in order for 3rd-party cookie blocking to work.
++  nsCOMPtr<nsIHttpChannelInternal> httpInternal = do_QueryInterface(httpChan);
++  nsresult rv;
++  if (httpInternal) {
++    rv = httpInternal->SetDocumentURI(doc->GetDocumentURI());
++    MOZ_ASSERT(NS_SUCCEEDED(rv));
++  }
++
++  rv = httpChan->SetRequestMethod(NS_LITERAL_CSTRING("POST"));
++  MOZ_ASSERT(NS_SUCCEEDED(rv));
++
++  // Remove extraneous request headers (to reduce request size)
++  rv = httpChan->SetRequestHeader(NS_LITERAL_CSTRING("accept"),
++                                  EmptyCString(), false);
++  MOZ_ASSERT(NS_SUCCEEDED(rv));
++  rv = httpChan->SetRequestHeader(NS_LITERAL_CSTRING("accept-language"),
++                                  EmptyCString(), false);
++  MOZ_ASSERT(NS_SUCCEEDED(rv));
++  rv = httpChan->SetRequestHeader(NS_LITERAL_CSTRING("accept-encoding"),
++                                  EmptyCString(), false);
++  MOZ_ASSERT(NS_SUCCEEDED(rv));
++
++  // Always send a Ping-To header.
++  nsAutoCString pingTo;
++  if (NS_SUCCEEDED(info->target->GetSpec(pingTo))) {
++    rv = httpChan->SetRequestHeader(NS_LITERAL_CSTRING("Ping-To"), pingTo, false);
++    MOZ_ASSERT(NS_SUCCEEDED(rv));
++  }
++
++  nsCOMPtr<nsIScriptSecurityManager> sm =
++    do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID);
++
++  if (sm && info->referrer) {
++    bool referrerIsSecure;
++    uint32_t flags = nsIProtocolHandler::URI_SAFE_TO_LOAD_IN_SECURE_CONTEXT;
++    rv = NS_URIChainHasFlags(info->referrer, flags, &referrerIsSecure);
++
++    // Default to sending less data if NS_URIChainHasFlags() fails.
++    referrerIsSecure = NS_FAILED(rv) || referrerIsSecure;
++
++    bool sameOrigin =
++      NS_SUCCEEDED(sm->CheckSameOriginURI(info->referrer, aURI, false));
++
++    // If both the address of the document containing the hyperlink being
++    // audited and "ping URL" have the same origin or the document containing
++    // the hyperlink being audited was not retrieved over an encrypted
++    // connection, send a Ping-From header.
++    if (sameOrigin || !referrerIsSecure) {
++      nsAutoCString pingFrom;
++      if (NS_SUCCEEDED(info->referrer->GetSpec(pingFrom))) {
++        rv = httpChan->SetRequestHeader(NS_LITERAL_CSTRING("Ping-From"),
++                                        pingFrom, false);
++        MOZ_ASSERT(NS_SUCCEEDED(rv));
++      }
++    }
++
++    // If the document containing the hyperlink being audited was not retrieved
++    // over an encrypted connection and its address does not have the same
++    // origin as "ping URL", send a referrer.
++    if (!sameOrigin && !referrerIsSecure) {
++      rv = httpChan->SetReferrerWithPolicy(info->referrer, info->referrerPolicy);
++      MOZ_ASSERT(NS_SUCCEEDED(rv));
++    }
++  }
++
++  nsCOMPtr<nsIUploadChannel2> uploadChan = do_QueryInterface(httpChan);
++  if (!uploadChan) {
++    return;
++  }
++
++  NS_NAMED_LITERAL_CSTRING(uploadData, "PING");
++
++  nsCOMPtr<nsIInputStream> uploadStream;
++  rv = NS_NewCStringInputStream(getter_AddRefs(uploadStream), uploadData);
++  if (NS_WARN_IF(NS_FAILED(rv))) {
++    return;
++  }
++
++  uploadChan->ExplicitSetUploadStream(uploadStream,
++                                      NS_LITERAL_CSTRING("text/ping"),
++                                      uploadData.Length(),
++                                      NS_LITERAL_CSTRING("POST"), false);
++
++  // The channel needs to have a loadgroup associated with it, so that we can
++  // cancel the channel and any redirected channels it may create.
++  nsCOMPtr<nsILoadGroup> loadGroup = do_CreateInstance(NS_LOADGROUP_CONTRACTID);
++  if (!loadGroup) {
++    return;
++  }
++  nsCOMPtr<nsIInterfaceRequestor> callbacks = do_QueryInterface(info->docShell);
++  loadGroup->SetNotificationCallbacks(callbacks);
++  chan->SetLoadGroup(loadGroup);
++
++  RefPtr<nsPingListener> pingListener = new nsPingListener();
++  chan->AsyncOpen2(pingListener);
++
++  // Even if AsyncOpen failed, we still count this as a successful ping.  It's
++  // possible that AsyncOpen may have failed after triggering some background
++  // process that may have written something to the network.
++  info->numPings++;
++
++  // Prevent ping requests from stalling and never being garbage collected...
++  if (NS_FAILED(pingListener->StartTimeout(doc->GetDocGroup()))) {
++    // If we failed to setup the timer, then we should just cancel the channel
++    // because we won't be able to ensure that it goes away in a timely manner.
++    chan->Cancel(NS_ERROR_ABORT);
++    return;
++  }
++  // if the channel openend successfully, then make the pingListener hold
++  // a strong reference to the loadgroup which is released in ::OnStopRequest
++  pingListener->SetLoadGroup(loadGroup);
++}
++
++typedef void (*ForEachPingCallback)(void* closure, nsIContent* content,
++                                    nsIURI* uri, nsIIOService* ios);
++
++static void
++ForEachPing(nsIContent* aContent, ForEachPingCallback aCallback, void* aClosure)
++{
++  // NOTE: Using nsIDOMHTMLAnchorElement::GetPing isn't really worth it here
++  //       since we'd still need to parse the resulting string.  Instead, we
++  //       just parse the raw attribute.  It might be nice if the content node
++  //       implemented an interface that exposed an enumeration of nsIURIs.
++
++  // Make sure we are dealing with either an <A> or <AREA> element in the HTML
++  // or XHTML namespace.
++  if (!aContent->IsAnyOfHTMLElements(nsGkAtoms::a, nsGkAtoms::area)) {
++    return;
++  }
++
++  nsAutoString value;
++  aContent->AsElement()->GetAttr(kNameSpaceID_None, nsGkAtoms::ping, value);
++  if (value.IsEmpty()) {
++    return;
++  }
++
++  nsCOMPtr<nsIIOService> ios = do_GetIOService();
++  if (!ios) {
++    return;
++  }
++
++  nsIDocument* doc = aContent->OwnerDoc();
++  nsAutoCString charset;
++  doc->GetDocumentCharacterSet()->Name(charset);
++
++  nsWhitespaceTokenizer tokenizer(value);
++
++  while (tokenizer.hasMoreTokens()) {
++    nsCOMPtr<nsIURI> uri, baseURI = aContent->GetBaseURI();
++    ios->NewURI(NS_ConvertUTF16toUTF8(tokenizer.nextToken()),
++                charset.get(), baseURI, getter_AddRefs(uri));
++    // if we can't generate a valid URI, then there is nothing to do
++    if (!uri) {
++      continue;
++    }
++    // Explicitly not allow loading data: URIs
++    bool isDataScheme =
++      (NS_SUCCEEDED(uri->SchemeIs("data", &isDataScheme)) && isDataScheme);
++
++    if (!isDataScheme) {
++      aCallback(aClosure, aContent, uri, ios);
++    }
++  }
++}
++
++// Spec: http://whatwg.org/specs/web-apps/current-work/#ping
++/*static*/ void
++nsPingListener::DispatchPings(nsIDocShell* aDocShell,
++                              nsIContent* aContent,
++                              nsIURI* aTarget,
++                              nsIURI* aReferrer,
++                              uint32_t aReferrerPolicy)
++{
++  SendPingInfo info;
++
++  if (!PingsEnabled(&info.maxPings, &info.requireSameHost)) {
++    return;
++  }
++  if (info.maxPings == 0) {
++    return;
++  }
++
++  info.numPings = 0;
++  info.target = aTarget;
++  info.referrer = aReferrer;
++  info.referrerPolicy = aReferrerPolicy;
++  info.docShell = aDocShell;
++
++  ForEachPing(aContent, SendPing, &info);
++}
++
++nsPingListener::~nsPingListener()
++{
++  if (mTimer) {
++    mTimer->Cancel();
++    mTimer = nullptr;
++  }
++}
++
++nsresult
++nsPingListener::StartTimeout(DocGroup* aDocGroup)
++{
++  NS_ENSURE_ARG(aDocGroup);
++
++  return NS_NewTimerWithFuncCallback(getter_AddRefs(mTimer),
++                                     OnPingTimeout,
++                                     mLoadGroup,
++                                     PING_TIMEOUT,
++                                     nsITimer::TYPE_ONE_SHOT,
++                                     "nsPingListener::StartTimeout",
++                                     aDocGroup->EventTargetFor(TaskCategory::Network));
++}
++
++NS_IMETHODIMP
++nsPingListener::OnStartRequest(nsIRequest* aRequest, nsISupports* aContext)
++{
++  return NS_OK;
++}
++
++NS_IMETHODIMP
++nsPingListener::OnDataAvailable(nsIRequest* aRequest, nsISupports* aContext,
++                                nsIInputStream* aStream, uint64_t aOffset,
++                                uint32_t aCount)
++{
++  uint32_t result;
++  return aStream->ReadSegments(NS_DiscardSegment, nullptr, aCount, &result);
++}
++
++NS_IMETHODIMP
++nsPingListener::OnStopRequest(nsIRequest* aRequest, nsISupports* aContext,
++                              nsresult aStatus)
++{
++  mLoadGroup = nullptr;
++
++  if (mTimer) {
++    mTimer->Cancel();
++    mTimer = nullptr;
++  }
++
++  return NS_OK;
++}
+diff --git a/docshell/base/nsPingListener.h b/docshell/base/nsPingListener.h
+new file mode 100644
+--- /dev/null
++++ b/docshell/base/nsPingListener.h
+@@ -0,0 +1,55 @@
++/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
++/* vim: set ts=8 sts=2 et sw=2 tw=80: */
++/* This Source Code Form is subject to the terms of the Mozilla Public
++ * License, v. 2.0. If a copy of the MPL was not distributed with this
++ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
++
++#ifndef nsPingListener_h__
++#define nsPingListener_h__
++
++#include "nsIStreamListener.h"
++
++#include "nsCOMPtr.h"
++
++namespace mozilla {
++namespace dom {
++class DocGroup;
++}
++}
++
++class nsIContent;
++class nsIDocShell;
++class nsILoadGroup;
++class nsITimer;
++class nsIURI;
++
++class nsPingListener final : public nsIStreamListener
++{
++public:
++  NS_DECL_ISUPPORTS
++  NS_DECL_NSIREQUESTOBSERVER
++  NS_DECL_NSISTREAMLISTENER
++
++  nsPingListener()
++  {
++  }
++
++  void SetLoadGroup(nsILoadGroup* aLoadGroup) {
++    mLoadGroup = aLoadGroup;
++  }
++
++  nsresult StartTimeout(mozilla::dom::DocGroup* aDocGroup);
++
++  static void DispatchPings(nsIDocShell* aDocShell,
++              nsIContent* aContent,
++              nsIURI* aTarget,
++              nsIURI* aReferrer,
++              uint32_t aReferrerPolicy);
++private:
++  ~nsPingListener();
++
++  nsCOMPtr<nsILoadGroup> mLoadGroup;
++  nsCOMPtr<nsITimer> mTimer;
++};
++
++#endif /* nsPingListener_h__ */
+diff --git a/docshell/base/nsRefreshTimer.cpp b/docshell/base/nsRefreshTimer.cpp
+new file mode 100644
+--- /dev/null
++++ b/docshell/base/nsRefreshTimer.cpp
+@@ -0,0 +1,56 @@
++/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
++/* vim: set ts=8 sts=2 et sw=2 tw=80: */
++/* This Source Code Form is subject to the terms of the Mozilla Public
++ * License, v. 2.0. If a copy of the MPL was not distributed with this
++ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
++
++#include "nsRefreshTimer.h"
++
++#include "nsIURI.h"
++#include "nsIPrincipal.h"
++
++#include "nsDocShell.h"
++
++NS_IMPL_ADDREF(nsRefreshTimer)
++NS_IMPL_RELEASE(nsRefreshTimer)
++
++NS_INTERFACE_MAP_BEGIN(nsRefreshTimer)
++  NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsITimerCallback)
++  NS_INTERFACE_MAP_ENTRY(nsITimerCallback)
++  NS_INTERFACE_MAP_ENTRY(nsINamed)
++NS_INTERFACE_MAP_END
++
++nsRefreshTimer::nsRefreshTimer(nsDocShell* aDocShell,
++                               nsIURI* aURI,
++                               nsIPrincipal* aPrincipal,
++                               int32_t aDelay, bool aRepeat, bool aMetaRefresh)
++  : mDocShell(aDocShell), mURI(aURI), mPrincipal(aPrincipal),
++    mDelay(aDelay), mRepeat(aRepeat),
++    mMetaRefresh(aMetaRefresh)
++{
++}
++
++nsRefreshTimer::~nsRefreshTimer()
++{
++}
++
++NS_IMETHODIMP
++nsRefreshTimer::Notify(nsITimer* aTimer)
++{
++  NS_ASSERTION(mDocShell, "DocShell is somehow null");
++
++  if (mDocShell && aTimer) {
++    // Get the delay count to determine load type
++    uint32_t delay = 0;
++    aTimer->GetDelay(&delay);
++    mDocShell->ForceRefreshURIFromTimer(mURI, mPrincipal, delay, mMetaRefresh, aTimer);
++  }
++  return NS_OK;
++}
++
++NS_IMETHODIMP
++nsRefreshTimer::GetName(nsACString& aName)
++{
++  aName.AssignLiteral("nsRefreshTimer");
++  return NS_OK;
++}
+diff --git a/docshell/base/nsRefreshTimer.h b/docshell/base/nsRefreshTimer.h
+new file mode 100644
+--- /dev/null
++++ b/docshell/base/nsRefreshTimer.h
+@@ -0,0 +1,47 @@
++/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
++/* vim: set ts=8 sts=2 et sw=2 tw=80: */
++/* This Source Code Form is subject to the terms of the Mozilla Public
++ * License, v. 2.0. If a copy of the MPL was not distributed with this
++ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
++
++#ifndef nsRefreshTimer_h__
++#define nsRefreshTimer_h__
++
++#include "nsINamed.h"
++#include "nsITimer.h"
++
++#include "nsCOMPtr.h"
++
++class nsDocShell;
++class nsIURI;
++class nsIPrincipal;
++
++class nsRefreshTimer : public nsITimerCallback
++                     , public nsINamed
++{
++public:
++  nsRefreshTimer(nsDocShell* aDocShell,
++                 nsIURI* aURI,
++                 nsIPrincipal* aPrincipal,
++                 int32_t aDelay,
++                 bool aRepeat,
++                 bool aMetaRefresh);
++
++  NS_DECL_THREADSAFE_ISUPPORTS
++  NS_DECL_NSITIMERCALLBACK
++  NS_DECL_NSINAMED
++
++  int32_t GetDelay() { return mDelay ;}
++
++  RefPtr<nsDocShell> mDocShell;
++  nsCOMPtr<nsIURI> mURI;
++  nsCOMPtr<nsIPrincipal> mPrincipal;
++  int32_t mDelay;
++  bool mRepeat;
++  bool mMetaRefresh;
++
++private:
++  virtual ~nsRefreshTimer();
++};
++
++#endif /* nsRefreshTimer_h__ */

frg/work-js/mozilla-release/patches/1406161-5-59a1.patch

@@ -0,0 +1,647 @@
+# HG changeset patch
+# User Samael Wang <freesamael@gmail.com>
+# Date 1513667582 -28800
+# Node ID 62a61710cf861f3aaf9acb4db3f8c3fee979c493
+# Parent  833676affbe0bb015849d940503d413f54e3bbd8
+Bug 1406161 - Part 5: Move LoadType convertion functions to nsDocShellLoadTypes.h. r=smaug
+
+MozReview-Commit-ID: Ccw7cDE20m3
+
+diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
+--- a/docshell/base/nsDocShell.cpp
++++ b/docshell/base/nsDocShell.cpp
+@@ -275,67 +275,16 @@ FavorPerformanceHint(bool aPerfOverStarv
+   if (appShell) {
+     appShell->FavorPerformanceHint(
+       aPerfOverStarvation,
+       Preferences::GetUint("docshell.event_starvation_delay_hint",
+                            NS_EVENT_STARVATION_DELAY_HINT));
+   }
+ }
+ 
+-static nsDOMNavigationTiming::Type
+-ConvertLoadTypeToNavigationType(uint32_t aLoadType)
+-{
+-  // Not initialized, assume it's normal load.
+-  if (aLoadType == 0) {
+-    aLoadType = LOAD_NORMAL;
+-  }
+-
+-  auto result = nsDOMNavigationTiming::TYPE_RESERVED;
+-  switch (aLoadType) {
+-    case LOAD_NORMAL:
+-    case LOAD_NORMAL_EXTERNAL:
+-    case LOAD_NORMAL_BYPASS_CACHE:
+-    case LOAD_NORMAL_BYPASS_PROXY:
+-    case LOAD_NORMAL_BYPASS_PROXY_AND_CACHE:
+-    case LOAD_NORMAL_REPLACE:
+-    case LOAD_NORMAL_ALLOW_MIXED_CONTENT:
+-    case LOAD_LINK:
+-    case LOAD_STOP_CONTENT:
+-    case LOAD_REPLACE_BYPASS_CACHE:
+-      result = nsDOMNavigationTiming::TYPE_NAVIGATE;
+-      break;
+-    case LOAD_HISTORY:
+-      result = nsDOMNavigationTiming::TYPE_BACK_FORWARD;
+-      break;
+-    case LOAD_RELOAD_NORMAL:
+-    case LOAD_RELOAD_CHARSET_CHANGE:
+-    case LOAD_RELOAD_CHARSET_CHANGE_BYPASS_PROXY_AND_CACHE:
+-    case LOAD_RELOAD_CHARSET_CHANGE_BYPASS_CACHE:
+-    case LOAD_RELOAD_BYPASS_CACHE:
+-    case LOAD_RELOAD_BYPASS_PROXY:
+-    case LOAD_RELOAD_BYPASS_PROXY_AND_CACHE:
+-    case LOAD_RELOAD_ALLOW_MIXED_CONTENT:
+-      result = nsDOMNavigationTiming::TYPE_RELOAD;
+-      break;
+-    case LOAD_STOP_CONTENT_AND_REPLACE:
+-    case LOAD_REFRESH:
+-    case LOAD_BYPASS_HISTORY:
+-    case LOAD_ERROR_PAGE:
+-    case LOAD_PUSHSTATE:
+-      result = nsDOMNavigationTiming::TYPE_RESERVED;
+-      break;
+-    default:
+-      // NS_NOTREACHED("Unexpected load type value");
+-      result = nsDOMNavigationTiming::TYPE_RESERVED;
+-      break;
+-  }
+-
+-  return result;
+-}
+-
+ static nsISHEntry* GetRootSHEntry(nsISHEntry* aEntry);
+ 
+ static void
+ IncreasePrivateDocShellCount()
+ {
+   gNumberOfPrivateDocShells++;
+   if (gNumberOfPrivateDocShells > 1 ||
+       !XRE_IsContentProcess()) {
+@@ -709,181 +658,16 @@ nsDocShell::GetInterface(const nsIID& aI
+   } else {
+     return nsDocLoader::GetInterface(aIID, aSink);
+   }
+ 
+   NS_IF_ADDREF(((nsISupports*)*aSink));
+   return *aSink ? NS_OK : NS_NOINTERFACE;
+ }
+ 
+-uint32_t
+-nsDocShell::ConvertDocShellLoadInfoToLoadType(
+-    nsDocShellInfoLoadType aDocShellLoadType)
+-{
+-  uint32_t loadType = LOAD_NORMAL;
+-
+-  switch (aDocShellLoadType) {
+-    case nsIDocShellLoadInfo::loadNormal:
+-      loadType = LOAD_NORMAL;
+-      break;
+-    case nsIDocShellLoadInfo::loadNormalReplace:
+-      loadType = LOAD_NORMAL_REPLACE;
+-      break;
+-    case nsIDocShellLoadInfo::loadNormalExternal:
+-      loadType = LOAD_NORMAL_EXTERNAL;
+-      break;
+-    case nsIDocShellLoadInfo::loadHistory:
+-      loadType = LOAD_HISTORY;
+-      break;
+-    case nsIDocShellLoadInfo::loadNormalBypassCache:
+-      loadType = LOAD_NORMAL_BYPASS_CACHE;
+-      break;
+-    case nsIDocShellLoadInfo::loadNormalBypassProxy:
+-      loadType = LOAD_NORMAL_BYPASS_PROXY;
+-      break;
+-    case nsIDocShellLoadInfo::loadNormalBypassProxyAndCache:
+-      loadType = LOAD_NORMAL_BYPASS_PROXY_AND_CACHE;
+-      break;
+-    case nsIDocShellLoadInfo::loadNormalAllowMixedContent:
+-      loadType = LOAD_NORMAL_ALLOW_MIXED_CONTENT;
+-      break;
+-    case nsIDocShellLoadInfo::loadReloadNormal:
+-      loadType = LOAD_RELOAD_NORMAL;
+-      break;
+-    case nsIDocShellLoadInfo::loadReloadCharsetChange:
+-      loadType = LOAD_RELOAD_CHARSET_CHANGE;
+-      break;
+-    case nsIDocShellLoadInfo::loadReloadCharsetChangeBypassCache:
+-      loadType = LOAD_RELOAD_CHARSET_CHANGE_BYPASS_CACHE;
+-      break;
+-    case nsIDocShellLoadInfo::loadReloadCharsetChangeBypassProxyAndCache:
+-      loadType = LOAD_RELOAD_CHARSET_CHANGE_BYPASS_PROXY_AND_CACHE;
+-      break;
+-    case nsIDocShellLoadInfo::loadReloadBypassCache:
+-      loadType = LOAD_RELOAD_BYPASS_CACHE;
+-      break;
+-    case nsIDocShellLoadInfo::loadReloadBypassProxy:
+-      loadType = LOAD_RELOAD_BYPASS_PROXY;
+-      break;
+-    case nsIDocShellLoadInfo::loadReloadBypassProxyAndCache:
+-      loadType = LOAD_RELOAD_BYPASS_PROXY_AND_CACHE;
+-      break;
+-    case nsIDocShellLoadInfo::loadLink:
+-      loadType = LOAD_LINK;
+-      break;
+-    case nsIDocShellLoadInfo::loadRefresh:
+-      loadType = LOAD_REFRESH;
+-      break;
+-    case nsIDocShellLoadInfo::loadBypassHistory:
+-      loadType = LOAD_BYPASS_HISTORY;
+-      break;
+-    case nsIDocShellLoadInfo::loadStopContent:
+-      loadType = LOAD_STOP_CONTENT;
+-      break;
+-    case nsIDocShellLoadInfo::loadStopContentAndReplace:
+-      loadType = LOAD_STOP_CONTENT_AND_REPLACE;
+-      break;
+-    case nsIDocShellLoadInfo::loadPushState:
+-      loadType = LOAD_PUSHSTATE;
+-      break;
+-    case nsIDocShellLoadInfo::loadReplaceBypassCache:
+-      loadType = LOAD_REPLACE_BYPASS_CACHE;
+-      break;
+-    case nsIDocShellLoadInfo::loadReloadMixedContent:
+-      loadType = LOAD_RELOAD_ALLOW_MIXED_CONTENT;
+-      break;
+-    default:
+-      NS_NOTREACHED("Unexpected nsDocShellInfoLoadType value");
+-  }
+-
+-  return loadType;
+-}
+-
+-nsDocShellInfoLoadType
+-nsDocShell::ConvertLoadTypeToDocShellLoadInfo(uint32_t aLoadType)
+-{
+-  nsDocShellInfoLoadType docShellLoadType = nsIDocShellLoadInfo::loadNormal;
+-  switch (aLoadType) {
+-    case LOAD_NORMAL:
+-      docShellLoadType = nsIDocShellLoadInfo::loadNormal;
+-      break;
+-    case LOAD_NORMAL_REPLACE:
+-      docShellLoadType = nsIDocShellLoadInfo::loadNormalReplace;
+-      break;
+-    case LOAD_NORMAL_EXTERNAL:
+-      docShellLoadType = nsIDocShellLoadInfo::loadNormalExternal;
+-      break;
+-    case LOAD_NORMAL_BYPASS_CACHE:
+-      docShellLoadType = nsIDocShellLoadInfo::loadNormalBypassCache;
+-      break;
+-    case LOAD_NORMAL_BYPASS_PROXY:
+-      docShellLoadType = nsIDocShellLoadInfo::loadNormalBypassProxy;
+-      break;
+-    case LOAD_NORMAL_BYPASS_PROXY_AND_CACHE:
+-      docShellLoadType = nsIDocShellLoadInfo::loadNormalBypassProxyAndCache;
+-      break;
+-    case LOAD_NORMAL_ALLOW_MIXED_CONTENT:
+-      docShellLoadType = nsIDocShellLoadInfo::loadNormalAllowMixedContent;
+-      break;
+-    case LOAD_HISTORY:
+-      docShellLoadType = nsIDocShellLoadInfo::loadHistory;
+-      break;
+-    case LOAD_RELOAD_NORMAL:
+-      docShellLoadType = nsIDocShellLoadInfo::loadReloadNormal;
+-      break;
+-    case LOAD_RELOAD_CHARSET_CHANGE:
+-      docShellLoadType = nsIDocShellLoadInfo::loadReloadCharsetChange;
+-      break;
+-    case LOAD_RELOAD_CHARSET_CHANGE_BYPASS_CACHE:
+-      docShellLoadType = nsIDocShellLoadInfo::loadReloadCharsetChangeBypassCache;
+-      break;
+-    case LOAD_RELOAD_CHARSET_CHANGE_BYPASS_PROXY_AND_CACHE:
+-      docShellLoadType = nsIDocShellLoadInfo::loadReloadCharsetChangeBypassProxyAndCache;
+-      break;
+-    case LOAD_RELOAD_BYPASS_CACHE:
+-      docShellLoadType = nsIDocShellLoadInfo::loadReloadBypassCache;
+-      break;
+-    case LOAD_RELOAD_BYPASS_PROXY:
+-      docShellLoadType = nsIDocShellLoadInfo::loadReloadBypassProxy;
+-      break;
+-    case LOAD_RELOAD_BYPASS_PROXY_AND_CACHE:
+-      docShellLoadType = nsIDocShellLoadInfo::loadReloadBypassProxyAndCache;
+-      break;
+-    case LOAD_LINK:
+-      docShellLoadType = nsIDocShellLoadInfo::loadLink;
+-      break;
+-    case LOAD_REFRESH:
+-      docShellLoadType = nsIDocShellLoadInfo::loadRefresh;
+-      break;
+-    case LOAD_BYPASS_HISTORY:
+-    case LOAD_ERROR_PAGE:
+-      docShellLoadType = nsIDocShellLoadInfo::loadBypassHistory;
+-      break;
+-    case LOAD_STOP_CONTENT:
+-      docShellLoadType = nsIDocShellLoadInfo::loadStopContent;
+-      break;
+-    case LOAD_STOP_CONTENT_AND_REPLACE:
+-      docShellLoadType = nsIDocShellLoadInfo::loadStopContentAndReplace;
+-      break;
+-    case LOAD_PUSHSTATE:
+-      docShellLoadType = nsIDocShellLoadInfo::loadPushState;
+-      break;
+-    case LOAD_REPLACE_BYPASS_CACHE:
+-      docShellLoadType = nsIDocShellLoadInfo::loadReplaceBypassCache;
+-      break;
+-    case LOAD_RELOAD_ALLOW_MIXED_CONTENT:
+-      docShellLoadType = nsIDocShellLoadInfo::loadReloadMixedContent;
+-      break;
+-    default:
+-      NS_NOTREACHED("Unexpected load type value");
+-  }
+-
+-  return docShellLoadType;
+-}
+-
+ NS_IMETHODIMP
+ nsDocShell::LoadURI(nsIURI* aURI,
+                     nsIDocShellLoadInfo* aLoadInfo,
+                     uint32_t aLoadFlags,
+                     bool aFirstParty)
+ {
+   NS_PRECONDITION(aLoadInfo || (aLoadFlags & EXTRA_LOAD_FLAGS) == 0,
+                   "Unexpected flags");
+@@ -933,17 +717,17 @@ nsDocShell::LoadURI(nsIURI* aURI,
+     aLoadInfo->GetReferrer(getter_AddRefs(referrer));
+     aLoadInfo->GetOriginalURI(getter_AddRefs(originalURI));
+     GetMaybeResultPrincipalURI(aLoadInfo, resultPrincipalURI);
+     aLoadInfo->GetKeepResultPrincipalURIIfSet(&keepResultPrincipalURIIfSet);
+     aLoadInfo->GetLoadReplace(&loadReplace);
+     nsDocShellInfoLoadType lt = nsIDocShellLoadInfo::loadNormal;
+     aLoadInfo->GetLoadType(&lt);
+     // Get the appropriate loadType from nsIDocShellLoadInfo type
+-    loadType = ConvertDocShellLoadInfoToLoadType(lt);
++    loadType = ConvertDocShellInfoLoadTypeToLoadType(lt);
+ 
+     aLoadInfo->GetTriggeringPrincipal(getter_AddRefs(triggeringPrincipal));
+     aLoadInfo->GetInheritPrincipal(&inheritPrincipal);
+     aLoadInfo->GetPrincipalIsExplicit(&principalIsExplicit);
+     aLoadInfo->GetSHEntry(getter_AddRefs(shEntry));
+     aLoadInfo->GetTarget(getter_Copies(target));
+     aLoadInfo->GetPostDataStream(getter_AddRefs(postStream));
+     aLoadInfo->GetHeadersStream(getter_AddRefs(headersStream));
+@@ -1277,17 +1061,17 @@ nsDocShell::LoadStream(nsIInputStream* a
+   }
+ 
+   uint32_t loadType = LOAD_NORMAL;
+   nsCOMPtr<nsIPrincipal> triggeringPrincipal;
+   if (aLoadInfo) {
+     nsDocShellInfoLoadType lt = nsIDocShellLoadInfo::loadNormal;
+     (void)aLoadInfo->GetLoadType(&lt);
+     // Get the appropriate LoadType from nsIDocShellLoadInfo type
+-    loadType = ConvertDocShellLoadInfoToLoadType(lt);
++    loadType = ConvertDocShellInfoLoadTypeToLoadType(lt);
+     aLoadInfo->GetTriggeringPrincipal(getter_AddRefs(triggeringPrincipal));
+   }
+ 
+   NS_ENSURE_SUCCESS(Stop(nsIWebNavigation::STOP_NETWORK), NS_ERROR_FAILURE);
+ 
+   mLoadType = loadType;
+ 
+   if (!triggeringPrincipal) {
+@@ -4612,17 +4396,17 @@ nsDocShell::LoadURIWithOptions(const cha
+     popupState = openOverridden;
+   }
+   nsAutoPopupStatePusher statePusher(popupState);
+ 
+   bool forceAllowDataURI =
+     aLoadFlags & LOAD_FLAGS_FORCE_ALLOW_DATA_URI;
+ 
+   // Don't pass certain flags that aren't needed and end up confusing
+-  // ConvertLoadTypeToDocShellLoadInfo.  We do need to ensure that they are
++  // ConvertLoadTypeToDocShellInfoLoadType.  We do need to ensure that they are
+   // passed to LoadURI though, since it uses them.
+   uint32_t extraFlags = (aLoadFlags & EXTRA_LOAD_FLAGS);
+   aLoadFlags &= ~EXTRA_LOAD_FLAGS;
+ 
+   nsCOMPtr<nsIDocShellLoadInfo> loadInfo;
+   rv = CreateLoadInfo(getter_AddRefs(loadInfo));
+   if (NS_FAILED(rv)) {
+     return rv;
+@@ -4634,17 +4418,17 @@ nsDocShell::LoadURIWithOptions(const cha
+    */
+   uint32_t loadType;
+   if (aLoadFlags & LOAD_FLAGS_ALLOW_MIXED_CONTENT) {
+     loadType = MAKE_LOAD_TYPE(LOAD_NORMAL_ALLOW_MIXED_CONTENT, aLoadFlags);
+   } else {
+     loadType = MAKE_LOAD_TYPE(LOAD_NORMAL, aLoadFlags);
+   }
+ 
+-  loadInfo->SetLoadType(ConvertLoadTypeToDocShellLoadInfo(loadType));
++  loadInfo->SetLoadType(ConvertLoadTypeToDocShellInfoLoadType(loadType));
+   loadInfo->SetPostDataStream(postStream);
+   loadInfo->SetReferrer(aReferringURI);
+   loadInfo->SetReferrerPolicy(aReferrerPolicy);
+   loadInfo->SetHeadersStream(aHeaderStream);
+   loadInfo->SetBaseURI(aBaseURI);
+   loadInfo->SetTriggeringPrincipal(aTriggeringPrincipal);
+   loadInfo->SetForceAllowDataURI(forceAllowDataURI);
+ 
+@@ -9823,17 +9607,17 @@ nsDocShell::InternalLoad(nsIURI* aURI,
+         loadInfo->SetKeepResultPrincipalURIIfSet(aKeepResultPrincipalURIIfSet);
+         loadInfo->SetLoadReplace(aLoadReplace);
+         loadInfo->SetTriggeringPrincipal(aTriggeringPrincipal);
+         loadInfo->SetInheritPrincipal(
+           aFlags & INTERNAL_LOAD_FLAGS_INHERIT_PRINCIPAL);
+         // Explicit principal because we do not want any guesses as to what the
+         // principal to inherit is: it should be aTriggeringPrincipal.
+         loadInfo->SetPrincipalIsExplicit(true);
+-        loadInfo->SetLoadType(ConvertLoadTypeToDocShellLoadInfo(LOAD_LINK));
++        loadInfo->SetLoadType(ConvertLoadTypeToDocShellInfoLoadType(LOAD_LINK));
+         loadInfo->SetForceAllowDataURI(aFlags & INTERNAL_LOAD_FLAGS_FORCE_ALLOW_DATA_URI);
+ 
+         rv = win->Open(NS_ConvertUTF8toUTF16(spec),
+                        aWindowTarget, // window name
+                        EmptyString(), // Features
+                        loadInfo,
+                        true, // aForceNoOpener
+                        getter_AddRefs(newWin));
+diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
+--- a/docshell/base/nsDocShell.h
++++ b/docshell/base/nsDocShell.h
+@@ -226,20 +226,16 @@ public:
+                              nsIDocShell** aDocShell = 0,
+                              nsIRequest** aRequest = 0,
+                              nsIPrincipal* aTriggeringPrincipal = nullptr) override;
+   NS_IMETHOD OnOverLink(nsIContent* aContent,
+                         nsIURI* aURI,
+                         const char16_t* aTargetSpec) override;
+   NS_IMETHOD OnLeaveLink() override;
+ 
+-  nsDocShellInfoLoadType ConvertLoadTypeToDocShellLoadInfo(uint32_t aLoadType);
+-  uint32_t ConvertDocShellLoadInfoToLoadType(
+-    nsDocShellInfoLoadType aDocShellLoadType);
+-
+   // Don't use NS_DECL_NSILOADCONTEXT because some of nsILoadContext's methods
+   // are shared with nsIDocShell (appID, etc.) and can't be declared twice.
+   NS_IMETHOD GetAssociatedWindow(mozIDOMWindowProxy**) override;
+   NS_IMETHOD GetTopWindow(mozIDOMWindowProxy**) override;
+   NS_IMETHOD GetTopFrameElement(nsIDOMElement**) override;
+   NS_IMETHOD GetNestedFrameId(uint64_t*) override;
+   NS_IMETHOD GetIsContent(bool*) override;
+   NS_IMETHOD GetUsePrivateBrowsing(bool*) override;
+diff --git a/docshell/base/nsDocShellLoadTypes.h b/docshell/base/nsDocShellLoadTypes.h
+--- a/docshell/base/nsDocShellLoadTypes.h
++++ b/docshell/base/nsDocShellLoadTypes.h
+@@ -4,17 +4,19 @@
+  * License, v. 2.0. If a copy of the MPL was not distributed with this
+  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+ 
+ #ifndef nsDocShellLoadTypes_h_
+ #define nsDocShellLoadTypes_h_
+ 
+ #ifdef MOZILLA_INTERNAL_API
+ 
++#include "nsDOMNavigationTiming.h"
+ #include "nsIDocShell.h"
++#include "nsIDocShellLoadInfo.h"
+ #include "nsIWebNavigation.h"
+ 
+ /**
+  * Load flag for error pages. This uses one of the reserved flag
+  * values from nsIWebNavigation.
+  */
+ #define LOAD_FLAGS_ERROR_PAGE 0x0001U
+ 
+@@ -67,16 +69,17 @@ enum LoadType
+    * Docshell. Instead, Docshell triggers the load itself when a
+    * consumer-triggered load failed.
+    */
+   LOAD_ERROR_PAGE = MAKE_LOAD_TYPE(nsIDocShell::LOAD_CMD_NORMAL,
+                                    LOAD_FLAGS_ERROR_PAGE)
+ 
+   // NOTE: Adding a new value? Remember to update IsValidLoadType!
+ };
++
+ static inline bool
+ IsValidLoadType(uint32_t aLoadType)
+ {
+   switch (aLoadType) {
+     case LOAD_NORMAL:
+     case LOAD_NORMAL_REPLACE:
+     case LOAD_NORMAL_EXTERNAL:
+     case LOAD_NORMAL_BYPASS_CACHE:
+@@ -112,10 +115,224 @@ IsForceReloadType(uint32_t aLoadType) {
+     case LOAD_RELOAD_BYPASS_PROXY:
+     case LOAD_RELOAD_BYPASS_PROXY_AND_CACHE:
+     case LOAD_RELOAD_ALLOW_MIXED_CONTENT:
+       return true;
+   }
+   return false;
+ }
+ 
++static inline nsDocShellInfoLoadType
++ConvertLoadTypeToDocShellInfoLoadType(uint32_t aLoadType)
++{
++  nsDocShellInfoLoadType docShellLoadType = nsIDocShellLoadInfo::loadNormal;
++  switch (aLoadType) {
++    case LOAD_NORMAL:
++      docShellLoadType = nsIDocShellLoadInfo::loadNormal;
++      break;
++    case LOAD_NORMAL_REPLACE:
++      docShellLoadType = nsIDocShellLoadInfo::loadNormalReplace;
++      break;
++    case LOAD_NORMAL_EXTERNAL:
++      docShellLoadType = nsIDocShellLoadInfo::loadNormalExternal;
++      break;
++    case LOAD_NORMAL_BYPASS_CACHE:
++      docShellLoadType = nsIDocShellLoadInfo::loadNormalBypassCache;
++      break;
++    case LOAD_NORMAL_BYPASS_PROXY:
++      docShellLoadType = nsIDocShellLoadInfo::loadNormalBypassProxy;
++      break;
++    case LOAD_NORMAL_BYPASS_PROXY_AND_CACHE:
++      docShellLoadType = nsIDocShellLoadInfo::loadNormalBypassProxyAndCache;
++      break;
++    case LOAD_NORMAL_ALLOW_MIXED_CONTENT:
++      docShellLoadType = nsIDocShellLoadInfo::loadNormalAllowMixedContent;
++      break;
++    case LOAD_HISTORY:
++      docShellLoadType = nsIDocShellLoadInfo::loadHistory;
++      break;
++    case LOAD_RELOAD_NORMAL:
++      docShellLoadType = nsIDocShellLoadInfo::loadReloadNormal;
++      break;
++    case LOAD_RELOAD_CHARSET_CHANGE:
++      docShellLoadType = nsIDocShellLoadInfo::loadReloadCharsetChange;
++      break;
++    case LOAD_RELOAD_CHARSET_CHANGE_BYPASS_CACHE:
++      docShellLoadType = nsIDocShellLoadInfo::loadReloadCharsetChangeBypassCache;
++      break;
++    case LOAD_RELOAD_CHARSET_CHANGE_BYPASS_PROXY_AND_CACHE:
++      docShellLoadType = nsIDocShellLoadInfo::loadReloadCharsetChangeBypassProxyAndCache;
++      break;
++    case LOAD_RELOAD_BYPASS_CACHE:
++      docShellLoadType = nsIDocShellLoadInfo::loadReloadBypassCache;
++      break;
++    case LOAD_RELOAD_BYPASS_PROXY:
++      docShellLoadType = nsIDocShellLoadInfo::loadReloadBypassProxy;
++      break;
++    case LOAD_RELOAD_BYPASS_PROXY_AND_CACHE:
++      docShellLoadType = nsIDocShellLoadInfo::loadReloadBypassProxyAndCache;
++      break;
++    case LOAD_LINK:
++      docShellLoadType = nsIDocShellLoadInfo::loadLink;
++      break;
++    case LOAD_REFRESH:
++      docShellLoadType = nsIDocShellLoadInfo::loadRefresh;
++      break;
++    case LOAD_BYPASS_HISTORY:
++    case LOAD_ERROR_PAGE:
++      docShellLoadType = nsIDocShellLoadInfo::loadBypassHistory;
++      break;
++    case LOAD_STOP_CONTENT:
++      docShellLoadType = nsIDocShellLoadInfo::loadStopContent;
++      break;
++    case LOAD_STOP_CONTENT_AND_REPLACE:
++      docShellLoadType = nsIDocShellLoadInfo::loadStopContentAndReplace;
++      break;
++    case LOAD_PUSHSTATE:
++      docShellLoadType = nsIDocShellLoadInfo::loadPushState;
++      break;
++    case LOAD_REPLACE_BYPASS_CACHE:
++      docShellLoadType = nsIDocShellLoadInfo::loadReplaceBypassCache;
++      break;
++    case LOAD_RELOAD_ALLOW_MIXED_CONTENT:
++      docShellLoadType = nsIDocShellLoadInfo::loadReloadMixedContent;
++      break;
++    default:
++      NS_NOTREACHED("Unexpected load type value");
++  }
++
++  return docShellLoadType;
++}
++
++static inline uint32_t
++ConvertDocShellInfoLoadTypeToLoadType(nsDocShellInfoLoadType aDocShellLoadType)
++{
++  uint32_t loadType = LOAD_NORMAL;
++
++  switch (aDocShellLoadType) {
++    case nsIDocShellLoadInfo::loadNormal:
++      loadType = LOAD_NORMAL;
++      break;
++    case nsIDocShellLoadInfo::loadNormalReplace:
++      loadType = LOAD_NORMAL_REPLACE;
++      break;
++    case nsIDocShellLoadInfo::loadNormalExternal:
++      loadType = LOAD_NORMAL_EXTERNAL;
++      break;
++    case nsIDocShellLoadInfo::loadHistory:
++      loadType = LOAD_HISTORY;
++      break;
++    case nsIDocShellLoadInfo::loadNormalBypassCache:
++      loadType = LOAD_NORMAL_BYPASS_CACHE;
++      break;
++    case nsIDocShellLoadInfo::loadNormalBypassProxy:
++      loadType = LOAD_NORMAL_BYPASS_PROXY;
++      break;
++    case nsIDocShellLoadInfo::loadNormalBypassProxyAndCache:
++      loadType = LOAD_NORMAL_BYPASS_PROXY_AND_CACHE;
++      break;
++    case nsIDocShellLoadInfo::loadNormalAllowMixedContent:
++      loadType = LOAD_NORMAL_ALLOW_MIXED_CONTENT;
++      break;
++    case nsIDocShellLoadInfo::loadReloadNormal:
++      loadType = LOAD_RELOAD_NORMAL;
++      break;
++    case nsIDocShellLoadInfo::loadReloadCharsetChange:
++      loadType = LOAD_RELOAD_CHARSET_CHANGE;
++      break;
++    case nsIDocShellLoadInfo::loadReloadCharsetChangeBypassCache:
++      loadType = LOAD_RELOAD_CHARSET_CHANGE_BYPASS_CACHE;
++      break;
++    case nsIDocShellLoadInfo::loadReloadCharsetChangeBypassProxyAndCache:
++      loadType = LOAD_RELOAD_CHARSET_CHANGE_BYPASS_PROXY_AND_CACHE;
++      break;
++    case nsIDocShellLoadInfo::loadReloadBypassCache:
++      loadType = LOAD_RELOAD_BYPASS_CACHE;
++      break;
++    case nsIDocShellLoadInfo::loadReloadBypassProxy:
++      loadType = LOAD_RELOAD_BYPASS_PROXY;
++      break;
++    case nsIDocShellLoadInfo::loadReloadBypassProxyAndCache:
++      loadType = LOAD_RELOAD_BYPASS_PROXY_AND_CACHE;
++      break;
++    case nsIDocShellLoadInfo::loadLink:
++      loadType = LOAD_LINK;
++      break;
++    case nsIDocShellLoadInfo::loadRefresh:
++      loadType = LOAD_REFRESH;
++      break;
++    case nsIDocShellLoadInfo::loadBypassHistory:
++      loadType = LOAD_BYPASS_HISTORY;
++      break;
++    case nsIDocShellLoadInfo::loadStopContent:
++      loadType = LOAD_STOP_CONTENT;
++      break;
++    case nsIDocShellLoadInfo::loadStopContentAndReplace:
++      loadType = LOAD_STOP_CONTENT_AND_REPLACE;
++      break;
++    case nsIDocShellLoadInfo::loadPushState:
++      loadType = LOAD_PUSHSTATE;
++      break;
++    case nsIDocShellLoadInfo::loadReplaceBypassCache:
++      loadType = LOAD_REPLACE_BYPASS_CACHE;
++      break;
++    case nsIDocShellLoadInfo::loadReloadMixedContent:
++      loadType = LOAD_RELOAD_ALLOW_MIXED_CONTENT;
++      break;
++    default:
++      NS_NOTREACHED("Unexpected nsDocShellInfoLoadType value");
++  }
++
++  return loadType;
++}
++
++static inline nsDOMNavigationTiming::Type
++ConvertLoadTypeToNavigationType(uint32_t aLoadType)
++{
++  // Not initialized, assume it's normal load.
++  if (aLoadType == 0) {
++    aLoadType = LOAD_NORMAL;
++  }
++
++  auto result = nsDOMNavigationTiming::TYPE_RESERVED;
++  switch (aLoadType) {
++    case LOAD_NORMAL:
++    case LOAD_NORMAL_EXTERNAL:
++    case LOAD_NORMAL_BYPASS_CACHE:
++    case LOAD_NORMAL_BYPASS_PROXY:
++    case LOAD_NORMAL_BYPASS_PROXY_AND_CACHE:
++    case LOAD_NORMAL_REPLACE:
++    case LOAD_NORMAL_ALLOW_MIXED_CONTENT:
++    case LOAD_LINK:
++    case LOAD_STOP_CONTENT:
++    case LOAD_REPLACE_BYPASS_CACHE:
++      result = nsDOMNavigationTiming::TYPE_NAVIGATE;
++      break;
++    case LOAD_HISTORY:
++      result = nsDOMNavigationTiming::TYPE_BACK_FORWARD;
++      break;
++    case LOAD_RELOAD_NORMAL:
++    case LOAD_RELOAD_CHARSET_CHANGE:
++    case LOAD_RELOAD_CHARSET_CHANGE_BYPASS_PROXY_AND_CACHE:
++    case LOAD_RELOAD_CHARSET_CHANGE_BYPASS_CACHE:
++    case LOAD_RELOAD_BYPASS_CACHE:
++    case LOAD_RELOAD_BYPASS_PROXY:
++    case LOAD_RELOAD_BYPASS_PROXY_AND_CACHE:
++    case LOAD_RELOAD_ALLOW_MIXED_CONTENT:
++      result = nsDOMNavigationTiming::TYPE_RELOAD;
++      break;
++    case LOAD_STOP_CONTENT_AND_REPLACE:
++    case LOAD_REFRESH:
++    case LOAD_BYPASS_HISTORY:
++    case LOAD_ERROR_PAGE:
++    case LOAD_PUSHSTATE:
++      result = nsDOMNavigationTiming::TYPE_RESERVED;
++      break;
++    default:
++      result = nsDOMNavigationTiming::TYPE_RESERVED;
++      break;
++  }
++
++  return result;
++}
++
+ #endif // MOZILLA_INTERNAL_API
+ #endif

frg/work-js/mozilla-release/patches/1406161-6-59a1.patch

@@ -0,0 +1,814 @@
+# HG changeset patch
+# User Samael Wang <freesamael@gmail.com>
+# Date 1513679196 -28800
+# Node ID 4a7086f02b605337d91e9ca877faec138c83c02a
+# Parent  4e07700d7f0aaa411bf0a3e5496f403069817464
+Bug 1406161 - Part 6: Move shistory related static functions to nsSHistory. r=smaug
+
+MozReview-Commit-ID: 7rqo2rISCB5
+
+diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
+--- a/docshell/base/nsDocShell.cpp
++++ b/docshell/base/nsDocShell.cpp
+@@ -275,18 +275,16 @@ FavorPerformanceHint(bool aPerfOverStarv
+   if (appShell) {
+     appShell->FavorPerformanceHint(
+       aPerfOverStarvation,
+       Preferences::GetUint("docshell.event_starvation_delay_hint",
+                            NS_EVENT_STARVATION_DELAY_HINT));
+   }
+ }
+ 
+-static nsISHEntry* GetRootSHEntry(nsISHEntry* aEntry);
+-
+ static void
+ IncreasePrivateDocShellCount()
+ {
+   gNumberOfPrivateDocShells++;
+   if (gNumberOfPrivateDocShells > 1 ||
+       !XRE_IsContentProcess()) {
+     return;
+   }
+@@ -3958,18 +3956,18 @@ nsDocShell::AddChildSHEntryInternal(nsIS
+                                           getter_AddRefs(currentHE));
+     NS_ENSURE_TRUE(currentHE, NS_ERROR_FAILURE);
+ 
+     nsCOMPtr<nsISHEntry> currentEntry(do_QueryInterface(currentHE));
+     if (currentEntry) {
+       uint32_t cloneID = 0;
+       nsCOMPtr<nsISHEntry> nextEntry;
+       aCloneRef->GetID(&cloneID);
+-      rv = CloneAndReplace(currentEntry, this, cloneID, aNewEntry,
+-                           aCloneChildren, getter_AddRefs(nextEntry));
++      rv = nsSHistory::CloneAndReplace(currentEntry, this, cloneID,
++        aNewEntry, aCloneChildren, getter_AddRefs(nextEntry));
+ 
+       if (NS_SUCCEEDED(rv)) {
+         nsCOMPtr<nsISHistoryInternal> shPrivate =
+           do_QueryInterface(mSessionHistory);
+         NS_ENSURE_TRUE(shPrivate, NS_ERROR_FAILURE);
+         rv = shPrivate->AddEntry(nextEntry, true);
+       }
+     }
+@@ -11861,17 +11859,17 @@ nsDocShell::AddState(JS::Handle<JS::Valu
+ 
+   if (!aReplace) {
+     int32_t curIndex = -1;
+     rv = rootSH->GetIndex(&curIndex);
+     if (NS_SUCCEEDED(rv) && curIndex > -1) {
+       internalSH->EvictOutOfRangeContentViewers(curIndex);
+     }
+   } else {
+-    nsCOMPtr<nsISHEntry> rootSHEntry = GetRootSHEntry(newSHEntry);
++    nsCOMPtr<nsISHEntry> rootSHEntry = nsSHistory::GetRootSHEntry(newSHEntry);
+ 
+     int32_t index = -1;
+     rv = rootSH->GetIndexOfEntry(rootSHEntry, &index);
+     if (NS_SUCCEEDED(rv) && index > -1) {
+       internalSH->ReplaceEntry(index, rootSHEntry);
+     }
+   }
+ 
+@@ -12161,18 +12159,18 @@ nsDocShell::AddToSessionHistory(nsIURI* 
+ 
+   if (root == static_cast<nsIDocShellTreeItem*>(this) && mSessionHistory) {
+     // If we need to clone our children onto the new session
+     // history entry, do so now.
+     if (aCloneChildren && mOSHE) {
+       uint32_t cloneID;
+       mOSHE->GetID(&cloneID);
+       nsCOMPtr<nsISHEntry> newEntry;
+-      CloneAndReplace(mOSHE, this, cloneID, entry, true,
+-                      getter_AddRefs(newEntry));
++      nsSHistory::CloneAndReplace(mOSHE, this, cloneID, entry, true,
++                                  getter_AddRefs(newEntry));
+       NS_ASSERTION(entry == newEntry,
+                    "The new session history should be in the new entry");
+     }
+ 
+     // This is the root docshell
+     bool addToSHistory = !LOAD_TYPE_HAS_FLAGS(mLoadType, LOAD_FLAGS_REPLACE_HISTORY);
+     if (!addToSHistory) {
+       // Replace current entry in session history; If the requested index is
+@@ -12407,275 +12405,59 @@ nsDocShell::PersistLayoutHistoryState()
+     if (scrollRestorationIsManual && layoutState) {
+       layoutState->ResetScrollState();
+     }
+   }
+ 
+   return rv;
+ }
+ 
+-/* static */ nsresult
+-nsDocShell::WalkHistoryEntries(nsISHEntry* aRootEntry,
+-                               nsDocShell* aRootShell,
+-                               WalkHistoryEntriesFunc aCallback,
+-                               void* aData)
+-{
+-  NS_ENSURE_TRUE(aRootEntry, NS_ERROR_FAILURE);
+-
+-  nsCOMPtr<nsISHContainer> container(do_QueryInterface(aRootEntry));
+-  if (!container) {
+-    return NS_ERROR_FAILURE;
+-  }
+-
+-  int32_t childCount;
+-  container->GetChildCount(&childCount);
+-  for (int32_t i = 0; i < childCount; i++) {
+-    nsCOMPtr<nsISHEntry> childEntry;
+-    container->GetChildAt(i, getter_AddRefs(childEntry));
+-    if (!childEntry) {
+-      // childEntry can be null for valid reasons, for example if the
+-      // docshell at index i never loaded anything useful.
+-      // Remember to clone also nulls in the child array (bug 464064).
+-      aCallback(nullptr, nullptr, i, aData);
+-      continue;
+-    }
+-
+-    nsDocShell* childShell = nullptr;
+-    if (aRootShell) {
+-      // Walk the children of aRootShell and see if one of them
+-      // has srcChild as a SHEntry.
+-      nsTObserverArray<nsDocLoader*>::ForwardIterator iter(
+-        aRootShell->mChildList);
+-      while (iter.HasMore()) {
+-        nsDocShell* child = static_cast<nsDocShell*>(iter.GetNext());
+-
+-        if (child->HasHistoryEntry(childEntry)) {
+-          childShell = child;
+-          break;
+-        }
+-      }
+-    }
+-    nsresult rv = aCallback(childEntry, childShell, i, aData);
+-    NS_ENSURE_SUCCESS(rv, rv);
+-  }
+-
+-  return NS_OK;
+-}
+-
+-// callback data for WalkHistoryEntries
+-struct MOZ_STACK_CLASS CloneAndReplaceData
+-{
+-  CloneAndReplaceData(uint32_t aCloneID, nsISHEntry* aReplaceEntry,
+-                      bool aCloneChildren, nsISHEntry* aDestTreeParent)
+-    : cloneID(aCloneID)
+-    , cloneChildren(aCloneChildren)
+-    , replaceEntry(aReplaceEntry)
+-    , destTreeParent(aDestTreeParent)
+-  {
+-  }
+-
+-  uint32_t cloneID;
+-  bool cloneChildren;
+-  nsISHEntry* replaceEntry;
+-  nsISHEntry* destTreeParent;
+-  nsCOMPtr<nsISHEntry> resultEntry;
+-};
+-
+-/* static */ nsresult
+-nsDocShell::CloneAndReplaceChild(nsISHEntry* aEntry, nsDocShell* aShell,
+-                                 int32_t aEntryIndex, void* aData)
+-{
+-  nsCOMPtr<nsISHEntry> dest;
+-
+-  CloneAndReplaceData* data = static_cast<CloneAndReplaceData*>(aData);
+-  uint32_t cloneID = data->cloneID;
+-  nsISHEntry* replaceEntry = data->replaceEntry;
+-
+-  nsCOMPtr<nsISHContainer> container = do_QueryInterface(data->destTreeParent);
+-  if (!aEntry) {
+-    if (container) {
+-      container->AddChild(nullptr, aEntryIndex);
+-    }
+-    return NS_OK;
+-  }
+-
+-  uint32_t srcID;
+-  aEntry->GetID(&srcID);
+-
+-  nsresult rv = NS_OK;
+-  if (srcID == cloneID) {
+-    // Replace the entry
+-    dest = replaceEntry;
+-  } else {
+-    // Clone the SHEntry...
+-    rv = aEntry->Clone(getter_AddRefs(dest));
+-    NS_ENSURE_SUCCESS(rv, rv);
+-  }
+-  dest->SetIsSubFrame(true);
+-
+-  if (srcID != cloneID || data->cloneChildren) {
+-    // Walk the children
+-    CloneAndReplaceData childData(cloneID, replaceEntry,
+-                                  data->cloneChildren, dest);
+-    rv = WalkHistoryEntries(aEntry, aShell,
+-                            CloneAndReplaceChild, &childData);
+-    NS_ENSURE_SUCCESS(rv, rv);
+-  }
+-
+-  if (srcID != cloneID && aShell) {
+-    aShell->SwapHistoryEntries(aEntry, dest);
+-  }
+-
+-  if (container) {
+-    container->AddChild(dest, aEntryIndex);
+-  }
+-
+-  data->resultEntry = dest;
+-  return rv;
+-}
+-
+-/* static */ nsresult
+-nsDocShell::CloneAndReplace(nsISHEntry* aSrcEntry,
+-                            nsDocShell* aSrcShell,
+-                            uint32_t aCloneID,
+-                            nsISHEntry* aReplaceEntry,
+-                            bool aCloneChildren,
+-                            nsISHEntry** aResultEntry)
+-{
+-  NS_ENSURE_ARG_POINTER(aResultEntry);
+-  NS_ENSURE_TRUE(aReplaceEntry, NS_ERROR_FAILURE);
+-
+-  CloneAndReplaceData data(aCloneID, aReplaceEntry, aCloneChildren, nullptr);
+-  nsresult rv = CloneAndReplaceChild(aSrcEntry, aSrcShell, 0, &data);
+-
+-  data.resultEntry.swap(*aResultEntry);
+-  return rv;
+-}
+-
+ void
+ nsDocShell::SwapHistoryEntries(nsISHEntry* aOldEntry, nsISHEntry* aNewEntry)
+ {
+   if (aOldEntry == mOSHE) {
+     mOSHE = aNewEntry;
+   }
+ 
+   if (aOldEntry == mLSHE) {
+     mLSHE = aNewEntry;
+   }
+ }
+ 
+-struct SwapEntriesData
+-{
+-  nsDocShell* ignoreShell;     // constant; the shell to ignore
+-  nsISHEntry* destTreeRoot;    // constant; the root of the dest tree
+-  nsISHEntry* destTreeParent;  // constant; the node under destTreeRoot
+-                               // whose children will correspond to aEntry
+-};
+-
+-nsresult
+-nsDocShell::SetChildHistoryEntry(nsISHEntry* aEntry, nsDocShell* aShell,
+-                                 int32_t aEntryIndex, void* aData)
+-{
+-  SwapEntriesData* data = static_cast<SwapEntriesData*>(aData);
+-  nsDocShell* ignoreShell = data->ignoreShell;
+-
+-  if (!aShell || aShell == ignoreShell) {
+-    return NS_OK;
+-  }
+-
+-  nsISHEntry* destTreeRoot = data->destTreeRoot;
+-
+-  nsCOMPtr<nsISHEntry> destEntry;
+-  nsCOMPtr<nsISHContainer> container = do_QueryInterface(data->destTreeParent);
+-
+-  if (container) {
+-    // aEntry is a clone of some child of destTreeParent, but since the
+-    // trees aren't necessarily in sync, we'll have to locate it.
+-    // Note that we could set aShell's entry to null if we don't find a
+-    // corresponding entry under destTreeParent.
+-
+-    uint32_t targetID, id;
+-    aEntry->GetID(&targetID);
+-
+-    // First look at the given index, since this is the common case.
+-    nsCOMPtr<nsISHEntry> entry;
+-    container->GetChildAt(aEntryIndex, getter_AddRefs(entry));
+-    if (entry && NS_SUCCEEDED(entry->GetID(&id)) && id == targetID) {
+-      destEntry.swap(entry);
+-    } else {
+-      int32_t childCount;
+-      container->GetChildCount(&childCount);
+-      for (int32_t i = 0; i < childCount; ++i) {
+-        container->GetChildAt(i, getter_AddRefs(entry));
+-        if (!entry) {
+-          continue;
+-        }
+-
+-        entry->GetID(&id);
+-        if (id == targetID) {
+-          destEntry.swap(entry);
+-          break;
+-        }
+-      }
+-    }
+-  } else {
+-    destEntry = destTreeRoot;
+-  }
+-
+-  aShell->SwapHistoryEntries(aEntry, destEntry);
+-
+-  // Now handle the children of aEntry.
+-  SwapEntriesData childData = { ignoreShell, destTreeRoot, destEntry };
+-  return WalkHistoryEntries(aEntry, aShell, SetChildHistoryEntry, &childData);
+-}
+-
+-static nsISHEntry*
+-GetRootSHEntry(nsISHEntry* aEntry)
+-{
+-  nsCOMPtr<nsISHEntry> rootEntry = aEntry;
+-  nsISHEntry* result = nullptr;
+-  while (rootEntry) {
+-    result = rootEntry;
+-    result->GetParent(getter_AddRefs(rootEntry));
+-  }
+-
+-  return result;
+-}
+-
+ void
+ nsDocShell::SetHistoryEntry(nsCOMPtr<nsISHEntry>* aPtr, nsISHEntry* aEntry)
+ {
+   // We need to sync up the docshell and session history trees for
+   // subframe navigation.  If the load was in a subframe, we forward up to
+   // the root docshell, which will then recursively sync up all docshells
+   // to their corresponding entries in the new session history tree.
+   // If we don't do this, then we can cache a content viewer on the wrong
+   // cloned entry, and subsequently restore it at the wrong time.
+ 
+-  nsISHEntry* newRootEntry = GetRootSHEntry(aEntry);
++  nsISHEntry* newRootEntry = nsSHistory::GetRootSHEntry(aEntry);
+   if (newRootEntry) {
+     // newRootEntry is now the new root entry.
+     // Find the old root entry as well.
+ 
+     // Need a strong ref. on |oldRootEntry| so it isn't destroyed when
+     // SetChildHistoryEntry() does SwapHistoryEntries() (bug 304639).
+-    nsCOMPtr<nsISHEntry> oldRootEntry = GetRootSHEntry(*aPtr);
++    nsCOMPtr<nsISHEntry> oldRootEntry = nsSHistory::GetRootSHEntry(*aPtr);
+     if (oldRootEntry) {
+       nsCOMPtr<nsIDocShellTreeItem> rootAsItem;
+       GetSameTypeRootTreeItem(getter_AddRefs(rootAsItem));
+       nsCOMPtr<nsIDocShell> rootShell = do_QueryInterface(rootAsItem);
+       if (rootShell) { // if we're the root just set it, nothing to swap
+-        SwapEntriesData data = { this, newRootEntry };
++        nsSHistory::SwapEntriesData data = { this, newRootEntry };
+         nsIDocShell* rootIDocShell = static_cast<nsIDocShell*>(rootShell);
+         nsDocShell* rootDocShell = static_cast<nsDocShell*>(rootIDocShell);
+ 
+ #ifdef DEBUG
+         nsresult rv =
+ #endif
+-        SetChildHistoryEntry(oldRootEntry, rootDocShell, 0, &data);
++        nsSHistory::SetChildHistoryEntry(oldRootEntry, rootDocShell, 0, &data);
+         NS_ASSERTION(NS_SUCCEEDED(rv), "SetChildHistoryEntry failed");
+       }
+     }
+   }
+ 
+   *aPtr = aEntry;
+ }
+ 
+diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
+--- a/docshell/base/nsDocShell.h
++++ b/docshell/base/nsDocShell.h
+@@ -349,16 +349,26 @@ public:
+     mAncestorOuterWindowIDs = mozilla::Move(aAncestorOuterWindowIDs);
+   }
+ 
+   const mozilla::OriginAttributes& GetOriginAttributes()
+   {
+     return mOriginAttributes;
+   }
+ 
++  // Determine whether this docshell corresponds to the given history entry,
++  // via having a pointer to it in mOSHE or mLSHE.
++  bool HasHistoryEntry(nsISHEntry* aEntry) const
++  {
++    return aEntry && (aEntry == mOSHE || aEntry == mLSHE);
++  }
++
++  // Update any pointers (mOSHE or mLSHE) to aOldEntry to point to aNewEntry
++  void SwapHistoryEntries(nsISHEntry* aOldEntry, nsISHEntry* aNewEntry);
++
+   static bool SandboxFlagsImplyCookies(const uint32_t &aSandboxFlags);
+ 
+   // Tell the favicon service that aNewURI has the same favicon as aOldURI.
+   static void CopyFavicon(nsIURI* aOldURI,
+                           nsIURI* aNewURI,
+                           nsIPrincipal* aLoadingPrincipal,
+                           bool aInPrivateBrowsing);
+ 
+@@ -384,57 +394,16 @@ private: // member functions
+   friend void mozilla::TimelineConsumers::AddMarkerForDocShell(
+     nsDocShell*, const char*, const TimeStamp&, MarkerTracingType,
+     MarkerStackRequest);
+   friend void mozilla::TimelineConsumers::AddMarkerForDocShell(
+     nsDocShell*, UniquePtr<AbstractTimelineMarker>&&);
+   friend void mozilla::TimelineConsumers::PopMarkers(nsDocShell*,
+     JSContext*, nsTArray<dom::ProfileTimelineMarker>&);
+ 
+-  // Callback prototype for WalkHistoryEntries.
+-  // aEntry is the child history entry, aShell is its corresponding docshell,
+-  // aChildIndex is the child's index in its parent entry, and aData is
+-  // the opaque pointer passed to WalkHistoryEntries.
+-  typedef nsresult(*WalkHistoryEntriesFunc)(nsISHEntry* aEntry,
+-                                            nsDocShell* aShell,
+-                                            int32_t aChildIndex,
+-                                            void* aData);
+-
+-  // Clone a session history tree for subframe navigation.
+-  // The tree rooted at |aSrcEntry| will be cloned into |aDestEntry|, except
+-  // for the entry with id |aCloneID|, which will be replaced with
+-  // |aReplaceEntry|. |aSrcShell| is a (possibly null) docshell which
+-  // corresponds to |aSrcEntry| via its mLSHE or mOHE pointers, and will
+-  // have that pointer updated to point to the cloned history entry.
+-  // If aCloneChildren is true then the children of the entry with id
+-  // |aCloneID| will be cloned into |aReplaceEntry|.
+-  static nsresult CloneAndReplace(nsISHEntry* aSrcEntry,
+-                                  nsDocShell* aSrcShell,
+-                                  uint32_t aCloneID,
+-                                  nsISHEntry* aReplaceEntry,
+-                                  bool aCloneChildren,
+-                                  nsISHEntry** aDestEntry);
+-
+-  // Child-walking callback for CloneAndReplace
+-  static nsresult CloneAndReplaceChild(nsISHEntry* aEntry, nsDocShell* aShell,
+-                                       int32_t aChildIndex, void* aData);
+-
+-
+-  // Child-walking callback for SetHistoryEntry
+-  static nsresult SetChildHistoryEntry(nsISHEntry* aEntry, nsDocShell* aShell,
+-                                       int32_t aEntryIndex, void* aData);
+-
+-  // For each child of aRootEntry, find the corresponding docshell which is
+-  // a child of aRootShell, and call aCallback. The opaque pointer aData
+-  // is passed to the callback.
+-  static nsresult WalkHistoryEntries(nsISHEntry* aRootEntry,
+-                                     nsDocShell* aRootShell,
+-                                     WalkHistoryEntriesFunc aCallback,
+-                                     void* aData);
+-
+   // Security checks to prevent frameset spoofing. See comments at
+   // implementation sites.
+   static bool CanAccessItem(nsIDocShellTreeItem* aTargetItem,
+                             nsIDocShellTreeItem* aAccessingItem,
+                             bool aConsiderOpener = true);
+   static bool ValidateOrigin(nsIDocShellTreeItem* aOriginTreeItem,
+                              nsIDocShellTreeItem* aTargetTreeItem);
+ 
+@@ -520,26 +489,16 @@ private: // member functions
+ 
+   nsresult AddChildSHEntryToParent(nsISHEntry* aNewEntry, int32_t aChildOffset,
+                                    bool aCloneChildren);
+ 
+   nsresult AddChildSHEntryInternal(nsISHEntry* aCloneRef, nsISHEntry* aNewEntry,
+                                    int32_t aChildOffset, uint32_t aLoadType,
+                                    bool aCloneChildren);
+ 
+-  // Determine whether this docshell corresponds to the given history entry,
+-  // via having a pointer to it in mOSHE or mLSHE.
+-  bool HasHistoryEntry(nsISHEntry* aEntry) const
+-  {
+-    return aEntry && (aEntry == mOSHE || aEntry == mLSHE);
+-  }
+-
+-  // Update any pointers (mOSHE or mLSHE) to aOldEntry to point to aNewEntry
+-  void SwapHistoryEntries(nsISHEntry* aOldEntry, nsISHEntry* aNewEntry);
+-
+   // Call this method to swap in a new history entry to m[OL]SHE, rather than
+   // setting it directly. This completes the navigation in all docshells
+   // in the case of a subframe navigation.
+   void SetHistoryEntry(nsCOMPtr<nsISHEntry>* aPtr, nsISHEntry* aEntry);
+ 
+   //
+   // URI Load
+   //
+diff --git a/docshell/shistory/nsSHistory.cpp b/docshell/shistory/nsSHistory.cpp
+--- a/docshell/shistory/nsSHistory.cpp
++++ b/docshell/shistory/nsSHistory.cpp
+@@ -369,16 +369,233 @@ nsSHistory::Shutdown()
+     if (obsSvc) {
+       obsSvc->RemoveObserver(gObserver, "cacheservice:empty-cache");
+       obsSvc->RemoveObserver(gObserver, "memory-pressure");
+     }
+     gObserver = nullptr;
+   }
+ }
+ 
++// static
++nsISHEntry*
++nsSHistory::GetRootSHEntry(nsISHEntry* aEntry)
++{
++  nsCOMPtr<nsISHEntry> rootEntry = aEntry;
++  nsISHEntry* result = nullptr;
++  while (rootEntry) {
++    result = rootEntry;
++    result->GetParent(getter_AddRefs(rootEntry));
++  }
++
++  return result;
++}
++
++// static
++nsresult
++nsSHistory::WalkHistoryEntries(nsISHEntry* aRootEntry,
++                               nsDocShell* aRootShell,
++                               WalkHistoryEntriesFunc aCallback,
++                               void* aData)
++{
++  NS_ENSURE_TRUE(aRootEntry, NS_ERROR_FAILURE);
++
++  nsCOMPtr<nsISHContainer> container(do_QueryInterface(aRootEntry));
++  if (!container) {
++    return NS_ERROR_FAILURE;
++  }
++
++  int32_t childCount;
++  container->GetChildCount(&childCount);
++  for (int32_t i = 0; i < childCount; i++) {
++    nsCOMPtr<nsISHEntry> childEntry;
++    container->GetChildAt(i, getter_AddRefs(childEntry));
++    if (!childEntry) {
++      // childEntry can be null for valid reasons, for example if the
++      // docshell at index i never loaded anything useful.
++      // Remember to clone also nulls in the child array (bug 464064).
++      aCallback(nullptr, nullptr, i, aData);
++      continue;
++    }
++
++    nsDocShell* childShell = nullptr;
++    if (aRootShell) {
++      // Walk the children of aRootShell and see if one of them
++      // has srcChild as a SHEntry.
++      int32_t length;
++      aRootShell->GetChildCount(&length);
++      for (int32_t i = 0; i < length; i++) {
++        nsCOMPtr<nsIDocShellTreeItem> item;
++        nsresult rv = aRootShell->GetChildAt(i, getter_AddRefs(item));
++        NS_ENSURE_SUCCESS(rv, rv);
++        nsDocShell* child = static_cast<nsDocShell*>(item.get());
++        if (child->HasHistoryEntry(childEntry)) {
++          childShell = child;
++          break;
++        }
++      }
++    }
++    nsresult rv = aCallback(childEntry, childShell, i, aData);
++    NS_ENSURE_SUCCESS(rv, rv);
++  }
++
++  return NS_OK;
++}
++
++// callback data for WalkHistoryEntries
++struct MOZ_STACK_CLASS CloneAndReplaceData
++{
++  CloneAndReplaceData(uint32_t aCloneID, nsISHEntry* aReplaceEntry,
++                      bool aCloneChildren, nsISHEntry* aDestTreeParent)
++    : cloneID(aCloneID)
++    , cloneChildren(aCloneChildren)
++    , replaceEntry(aReplaceEntry)
++    , destTreeParent(aDestTreeParent)
++  {
++  }
++
++  uint32_t cloneID;
++  bool cloneChildren;
++  nsISHEntry* replaceEntry;
++  nsISHEntry* destTreeParent;
++  nsCOMPtr<nsISHEntry> resultEntry;
++};
++
++// static
++nsresult
++nsSHistory::CloneAndReplaceChild(nsISHEntry* aEntry,
++                                          nsDocShell* aShell,
++                                          int32_t aEntryIndex,
++                                          void* aData)
++{
++  nsCOMPtr<nsISHEntry> dest;
++
++  CloneAndReplaceData* data = static_cast<CloneAndReplaceData*>(aData);
++  uint32_t cloneID = data->cloneID;
++  nsISHEntry* replaceEntry = data->replaceEntry;
++
++  nsCOMPtr<nsISHContainer> container = do_QueryInterface(data->destTreeParent);
++  if (!aEntry) {
++    if (container) {
++      container->AddChild(nullptr, aEntryIndex);
++    }
++    return NS_OK;
++  }
++
++  uint32_t srcID;
++  aEntry->GetID(&srcID);
++
++  nsresult rv = NS_OK;
++  if (srcID == cloneID) {
++    // Replace the entry
++    dest = replaceEntry;
++  } else {
++    // Clone the SHEntry...
++    rv = aEntry->Clone(getter_AddRefs(dest));
++    NS_ENSURE_SUCCESS(rv, rv);
++  }
++  dest->SetIsSubFrame(true);
++
++  if (srcID != cloneID || data->cloneChildren) {
++    // Walk the children
++    CloneAndReplaceData childData(cloneID, replaceEntry,
++                                  data->cloneChildren, dest);
++    rv = WalkHistoryEntries(aEntry, aShell,
++                            CloneAndReplaceChild, &childData);
++    NS_ENSURE_SUCCESS(rv, rv);
++  }
++
++  if (srcID != cloneID && aShell) {
++    aShell->SwapHistoryEntries(aEntry, dest);
++  }
++
++  if (container) {
++    container->AddChild(dest, aEntryIndex);
++  }
++
++  data->resultEntry = dest;
++  return rv;
++}
++
++// static
++nsresult
++nsSHistory::CloneAndReplace(nsISHEntry* aSrcEntry,
++                                     nsDocShell* aSrcShell,
++                                     uint32_t aCloneID,
++                                     nsISHEntry* aReplaceEntry,
++                                     bool aCloneChildren,
++                                     nsISHEntry** aResultEntry)
++{
++  NS_ENSURE_ARG_POINTER(aResultEntry);
++  NS_ENSURE_TRUE(aReplaceEntry, NS_ERROR_FAILURE);
++
++  CloneAndReplaceData data(aCloneID, aReplaceEntry, aCloneChildren, nullptr);
++  nsresult rv = CloneAndReplaceChild(aSrcEntry, aSrcShell, 0, &data);
++
++  data.resultEntry.swap(*aResultEntry);
++  return rv;
++}
++
++// static
++nsresult
++nsSHistory::SetChildHistoryEntry(nsISHEntry* aEntry, nsDocShell* aShell,
++                                 int32_t aEntryIndex, void* aData)
++{
++  SwapEntriesData* data = static_cast<SwapEntriesData*>(aData);
++  nsDocShell* ignoreShell = data->ignoreShell;
++
++  if (!aShell || aShell == ignoreShell) {
++    return NS_OK;
++  }
++
++  nsISHEntry* destTreeRoot = data->destTreeRoot;
++
++  nsCOMPtr<nsISHEntry> destEntry;
++  nsCOMPtr<nsISHContainer> container = do_QueryInterface(data->destTreeParent);
++
++  if (container) {
++    // aEntry is a clone of some child of destTreeParent, but since the
++    // trees aren't necessarily in sync, we'll have to locate it.
++    // Note that we could set aShell's entry to null if we don't find a
++    // corresponding entry under destTreeParent.
++
++    uint32_t targetID, id;
++    aEntry->GetID(&targetID);
++
++    // First look at the given index, since this is the common case.
++    nsCOMPtr<nsISHEntry> entry;
++    container->GetChildAt(aEntryIndex, getter_AddRefs(entry));
++    if (entry && NS_SUCCEEDED(entry->GetID(&id)) && id == targetID) {
++      destEntry.swap(entry);
++    } else {
++      int32_t childCount;
++      container->GetChildCount(&childCount);
++      for (int32_t i = 0; i < childCount; ++i) {
++        container->GetChildAt(i, getter_AddRefs(entry));
++        if (!entry) {
++          continue;
++        }
++
++        entry->GetID(&id);
++        if (id == targetID) {
++          destEntry.swap(entry);
++          break;
++        }
++      }
++    }
++  } else {
++    destEntry = destTreeRoot;
++  }
++
++  aShell->SwapHistoryEntries(aEntry, destEntry);
++
++  // Now handle the children of aEntry.
++  SwapEntriesData childData = { ignoreShell, destTreeRoot, destEntry };
++  return WalkHistoryEntries(aEntry, aShell, SetChildHistoryEntry, &childData);
++}
++
+ /* Add an entry to the History list at mIndex and
+  * increment the index to point to the new entry
+  */
+ NS_IMETHODIMP
+ nsSHistory::AddEntry(nsISHEntry* aSHEntry, bool aPersist)
+ {
+   NS_ENSURE_ARG(aSHEntry);
+ 
+diff --git a/docshell/shistory/nsSHistory.h b/docshell/shistory/nsSHistory.h
+--- a/docshell/shistory/nsSHistory.h
++++ b/docshell/shistory/nsSHistory.h
+@@ -55,16 +55,25 @@ public:
+     }
+ 
+   private:
+     // HistoryTracker is owned by nsSHistory; it always outlives HistoryTracker
+     // so it's safe to use raw pointer here.
+     nsSHistory* mSHistory;
+   };
+ 
++  // Structure used in SetChildHistoryEntry
++  struct SwapEntriesData
++  {
++    nsDocShell* ignoreShell;     // constant; the shell to ignore
++    nsISHEntry* destTreeRoot;    // constant; the root of the dest tree
++    nsISHEntry* destTreeParent;  // constant; the node under destTreeRoot
++                                 // whose children will correspond to aEntry
++  };
++
+   nsSHistory();
+   NS_DECL_ISUPPORTS
+   NS_DECL_NSISHISTORY
+   NS_DECL_NSISHISTORYINTERNAL
+   NS_DECL_NSIWEBNAVIGATION
+ 
+   // One time initialization method called upon docshell module construction
+   static nsresult Startup();
+@@ -72,16 +81,60 @@ public:
+   static void UpdatePrefs();
+ 
+   // Max number of total cached content viewers.  If the pref
+   // browser.sessionhistory.max_total_viewers is negative, then
+   // this value is calculated based on the total amount of memory.
+   // Otherwise, it comes straight from the pref.
+   static uint32_t GetMaxTotalViewers() { return sHistoryMaxTotalViewers; }
+ 
++  // Get the root SHEntry from a given entry.
++  static nsISHEntry* GetRootSHEntry(nsISHEntry* aEntry);
++
++  // Callback prototype for WalkHistoryEntries.
++  // aEntry is the child history entry, aShell is its corresponding docshell,
++  // aChildIndex is the child's index in its parent entry, and aData is
++  // the opaque pointer passed to WalkHistoryEntries.
++  typedef nsresult(*WalkHistoryEntriesFunc)(nsISHEntry* aEntry,
++                                            nsDocShell* aShell,
++                                            int32_t aChildIndex,
++                                            void* aData);
++
++  // Clone a session history tree for subframe navigation.
++  // The tree rooted at |aSrcEntry| will be cloned into |aDestEntry|, except
++  // for the entry with id |aCloneID|, which will be replaced with
++  // |aReplaceEntry|. |aSrcShell| is a (possibly null) docshell which
++  // corresponds to |aSrcEntry| via its mLSHE or mOHE pointers, and will
++  // have that pointer updated to point to the cloned history entry.
++  // If aCloneChildren is true then the children of the entry with id
++  // |aCloneID| will be cloned into |aReplaceEntry|.
++  static nsresult CloneAndReplace(nsISHEntry* aSrcEntry,
++                                  nsDocShell* aSrcShell,
++                                  uint32_t aCloneID,
++                                  nsISHEntry* aReplaceEntry,
++                                  bool aCloneChildren,
++                                  nsISHEntry** aDestEntry);
++
++  // Child-walking callback for CloneAndReplace
++  static nsresult CloneAndReplaceChild(nsISHEntry* aEntry, nsDocShell* aShell,
++                                       int32_t aChildIndex, void* aData);
++
++
++  // Child-walking callback for SetHistoryEntry
++  static nsresult SetChildHistoryEntry(nsISHEntry* aEntry, nsDocShell* aShell,
++                                       int32_t aEntryIndex, void* aData);
++
++  // For each child of aRootEntry, find the corresponding docshell which is
++  // a child of aRootShell, and call aCallback. The opaque pointer aData
++  // is passed to the callback.
++  static nsresult WalkHistoryEntries(nsISHEntry* aRootEntry,
++                                     nsDocShell* aRootShell,
++                                     WalkHistoryEntriesFunc aCallback,
++                                     void* aData);
++
+ private:
+   virtual ~nsSHistory();
+   friend class nsSHEnumerator;
+   friend class nsSHistoryObserver;
+ 
+   nsresult GetTransactionAtIndex(int32_t aIndex, nsISHTransaction** aResult);
+   nsresult LoadDifferingEntries(nsISHEntry* aPrevEntry, nsISHEntry* aNextEntry,
+                                 nsIDocShell* aRootDocShell, long aLoadType,

frg/work-js/mozilla-release/patches/mozilla-central-push_423657.patch → frg/work-js/mozilla-release/patches/1407143-3-63a1.patch

@@ -3,17 +3,17 @@
 # Date 1529635253 -36000
 #      Fri Jun 22 12:40:53 2018 +1000
 # Node ID 868ac1e5e070b79a9691d05c3d677e05b46e0deb
-# Parent  195348dbc5ecfc991277378db5b1fa17f73c8e31
+# Parent  91b41dc937f3ee8a4ba822bc74d7010f6a0cf6a4
 Bug 1407143 (Part 3) - Relax some nursery empty assertions r=jonco
 
 diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
 --- a/js/src/gc/GC.cpp
 +++ b/js/src/gc/GC.cpp
-@@ -6832,17 +6832,16 @@ AutoHeapSession::AutoHeapSession(JSRunti
+@@ -6905,17 +6905,16 @@ AutoHeapSession::AutoHeapSession(JSRunti
    : runtime(rt),
      prevState(rt->heapState_),
      profilingStackFrame(rt->mainContextFromOwnThread(), HeapStateToLabel(heapState),
-                         ProfilingStackFrame::Category::GCCC)
+                         ProfilingStackFrame::Category::GC)
  {
      MOZ_ASSERT(CurrentThreadCanAccessRuntime(rt));
      MOZ_ASSERT(prevState == JS::HeapState::Idle);

frg/work-js/mozilla-release/patches/mozilla-central-push_423659.patch → frg/work-js/mozilla-release/patches/1407143-5-63a1.patch

@@ -3,13 +3,13 @@
 # Date 1529643702 -36000
 #      Fri Jun 22 15:01:42 2018 +1000
 # Node ID 49caa22a6bbfff827341fb6ac64a8adda45c2770
-# Parent  c8ffd9d8370a7ea6fa245c4d6ba4b235f34a8468
+# Parent  3dd204428a7bdcfcde8b0634ca04be6d7e3c1021
 Bug 1407143 (Part 5) - Don't collect nursery for every mark slice r=jonco
 
 diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
 --- a/js/src/gc/GC.cpp
 +++ b/js/src/gc/GC.cpp
-@@ -6881,16 +6881,17 @@ GCRuntime::resetIncrementalGC(gc::AbortR
+@@ -6954,16 +6954,17 @@ GCRuntime::resetIncrementalGC(gc::AbortR
              zone->arenas.unmarkPreMarkedFreeCells();
          }
  
@@ -27,7 +27,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
        }
  
        case State::Sweep: {
-@@ -6969,17 +6970,17 @@ GCRuntime::resetIncrementalGC(gc::AbortR
+@@ -7042,17 +7043,17 @@ GCRuntime::resetIncrementalGC(gc::AbortR
          MOZ_ASSERT(!zone->isCollectingFromAnyThread());
          MOZ_ASSERT(!zone->needsIncrementalBarrier());
          MOZ_ASSERT(!zone->isOnList());
@@ -46,7 +46,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
   * Temporarily disable barriers during GC slices.
   */
  class AutoDisableBarriers {
-@@ -7042,17 +7043,17 @@ static bool
+@@ -7115,17 +7116,17 @@ static bool
  ShouldCleanUpEverything(JS::gcreason::Reason reason, JSGCInvocationKind gckind)
  {
      // During shutdown, we must clean everything up, for the sake of leak
@@ -65,7 +65,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
      bool destroyingRuntime = (reason == JS::gcreason::DESTROY_RUNTIME);
  
      initialState = incrementalState;
-@@ -7071,17 +7072,17 @@ GCRuntime::incrementalCollectSlice(Slice
+@@ -7144,17 +7145,17 @@ GCRuntime::incrementalCollectSlice(Slice
  #ifdef DEBUG
      {
          char budgetBuffer[32];
@@ -84,7 +84,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
           * Yields between slices occurs at predetermined points in these modes;
           * the budget is not used.
           */
-@@ -7100,17 +7101,17 @@ GCRuntime::incrementalCollectSlice(Slice
+@@ -7173,17 +7174,17 @@ GCRuntime::incrementalCollectSlice(Slice
  
          incrementalState = State::MarkRoots;
  
@@ -103,7 +103,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
          incrementalState = State::Mark;
  
          if (isIncremental && useZeal && hasZealMode(ZealMode::YieldBeforeMarking))
-@@ -7129,35 +7130,59 @@ GCRuntime::incrementalCollectSlice(Slice
+@@ -7202,35 +7203,59 @@ GCRuntime::incrementalCollectSlice(Slice
          }
  
          if (drainMarkStack(budget, gcstats::PhaseKind::MARK) == NotFinished)
@@ -170,7 +170,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
  
          MOZ_FALLTHROUGH;
  
-@@ -7232,16 +7257,18 @@ GCRuntime::incrementalCollectSlice(Slice
+@@ -7305,16 +7330,18 @@ GCRuntime::incrementalCollectSlice(Slice
          }
  
          finishCollection();
@@ -189,7 +189,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
      MOZ_ASSERT(!rt->mainContextFromOwnThread()->suppressGC);
  
      if (!rt->gc.isIncrementalGCAllowed())
-@@ -7421,33 +7448,31 @@ GCRuntime::maybeCallGCCallback(JSGCStatu
+@@ -7494,33 +7521,31 @@ GCRuntime::maybeCallGCCallback(JSGCStatu
      if (gcCallbackDepth == 0) {
          // Restore scheduled zone information again.
          for (ZonesIter zone(rt, WithAtoms); !zone.done(); zone.next())
@@ -226,11 +226,11 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
      AutoGCSession session(rt, JS::HeapState::MajorCollecting);
  
      majorGCTriggerReason = JS::gcreason::NO_REASON;
+     interFrameGC = true;
  
      number++;
      if (!isIncrementalGCInProgress())
-         incMajorGcNumber();
-@@ -7479,35 +7504,63 @@ GCRuntime::gcCycle(bool nonincrementalBy
+@@ -7553,35 +7578,63 @@ GCRuntime::gcCycle(bool nonincrementalBy
      // We don't allow off-thread parsing to start while we're doing an
      // incremental GC of the atoms zone.
      if (rt->activeGCInAtomsZone())
@@ -297,7 +297,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
  {
      switch (reason) {
        case JS::gcreason::API:
-@@ -7632,17 +7685,17 @@ GCRuntime::collect(bool nonincrementalBy
+@@ -7706,17 +7759,17 @@ GCRuntime::collect(bool nonincrementalBy
  
      AutoTraceLog logGC(TraceLoggerForCurrentThread(), TraceLogger_GC);
      AutoStopVerifyingBarriers av(rt, IsShutdownGC(reason));
@@ -316,7 +316,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
          }
  
          /*
-@@ -7650,28 +7703,31 @@ GCRuntime::collect(bool nonincrementalBy
+@@ -7724,28 +7777,31 @@ GCRuntime::collect(bool nonincrementalBy
           * This happens in the following cases:
           *  - when we reset the current GC
           *  - when finalizers drop roots during shutdown
@@ -353,7 +353,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
 diff --git a/js/src/gc/GCRuntime.h b/js/src/gc/GCRuntime.h
 --- a/js/src/gc/GCRuntime.h
 +++ b/js/src/gc/GCRuntime.h
-@@ -512,17 +512,18 @@ class GCRuntime
+@@ -513,17 +513,18 @@ class GCRuntime
      void joinTask(GCParallelTask& task, gcstats::PhaseKind phase,
                    AutoLockHelperThreadState& locked);
  
@@ -373,7 +373,7 @@ diff --git a/js/src/gc/GCRuntime.h b/js/src/gc/GCRuntime.h
  
      // For ArenaLists::allocateFromArena()
      friend class ArenaLists;
-@@ -565,21 +566,37 @@ class GCRuntime
+@@ -566,21 +567,37 @@ class GCRuntime
      void checkCanCallAPI();
  
      // Check if the system state is such that GC has been supressed

frg/work-js/mozilla-release/patches/1416723-2-63a1.patch

@@ -2,7 +2,7 @@
 # User Benjamin Bouvier <benj@benj.me>
 # Date 1532438101 -7200
 # Node ID 4534ae540e86d686f29098cbcc2f932a6b83117b
-# Parent  5315300a16b51db71b64b3ea24cb25b205d8997b
+# Parent  2d786fee82f79c374da9d3ffb20a48abf56b3ce8
 Bug 1416723: Remove SIMD.js support; r=luke, r=nbp
 
 diff --git a/dom/serviceworkers/test/test_serviceworker_interfaces.js.1416723-2.later b/dom/serviceworkers/test/test_serviceworker_interfaces.js.1416723-2.later
@@ -12078,7 +12078,7 @@ diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
  #include "jit/JitSpewer.h"
  #include "jit/Linker.h"
  #include "jit/Lowering.h"
-@@ -1732,81 +1731,16 @@ TryAttachFunCallStub(JSContext* cx, ICCa
+@@ -2008,81 +2007,16 @@ TryAttachFunCallStub(JSContext* cx, ICCa
          *attached = true;
          stub->addNewStub(newStub);
          return true;
@@ -12160,7 +12160,7 @@ diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
  
      // Check for natives to which template objects can be attached. This is
      // done to provide templates to Ion for inlining these natives later on.
-@@ -1880,38 +1814,29 @@ GetTemplateObjectForNative(JSContext* cx
+@@ -2156,38 +2090,29 @@ GetTemplateObjectForNative(JSContext* cx
          return !!res;
      }
  
@@ -12195,7 +12195,7 @@ diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
  }
  
  static bool
- IsOptimizableConstStringSplit(const Value& callee, int argc, Value* args)
+ IsOptimizableConstStringSplit(Realm* callerRealm, const Value& callee, int argc, Value* args)
  {
      if (argc != 2 || !args[0].isString() || !args[1].isString())
          return false;
@@ -12280,7 +12280,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
  {
      js_delete(scriptCounts_);
  }
-@@ -6336,92 +6335,16 @@ CodeGenerator::visitNewTypedObject(LNewT
+@@ -6373,92 +6372,16 @@ CodeGenerator::visitNewTypedObject(LNewT
                                     StoreRegisterTo(object));
  
      TemplateObject templateObj(templateObject);
@@ -12373,7 +12373,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
  void
  CodeGenerator::visitNewNamedLambdaObject(LNewNamedLambdaObject* lir)
  {
-@@ -7132,17 +7055,17 @@ CodeGenerator::visitWasmCallI64(LWasmCal
+@@ -7169,17 +7092,17 @@ CodeGenerator::visitWasmCallI64(LWasmCal
  }
  
  void
@@ -12392,7 +12392,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
          masm.loadPtr(addr, tmp);
          addr = Address(tmp, 0);
      }
-@@ -7159,33 +7082,29 @@ CodeGenerator::visitWasmLoadGlobalVar(LW
+@@ -7196,33 +7119,29 @@ CodeGenerator::visitWasmLoadGlobalVar(LW
        // Aligned access: code is aligned on PageSize + there is padding
        // before the global data section.
        case MIRType::Int8x16:
@@ -12427,7 +12427,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
          masm.loadPtr(addr, tmp);
          addr = Address(tmp, 0);
      }
-@@ -7202,21 +7121,17 @@ CodeGenerator::visitWasmStoreGlobalVar(L
+@@ -7239,21 +7158,17 @@ CodeGenerator::visitWasmStoreGlobalVar(L
        // Aligned access: code is aligned on PageSize + there is padding
        // before the global data section.
        case MIRType::Int8x16:
@@ -12449,7 +12449,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
  void
  CodeGenerator::visitWasmLoadGlobalVarI64(LWasmLoadGlobalVarI64* ins)
  {
-@@ -10262,17 +10177,16 @@ CodeGenerator::link(JSContext* cx, Compi
+@@ -10299,17 +10214,16 @@ CodeGenerator::link(JSContext* cx, Compi
  
      RootedScript script(cx, gen->info().script());
      OptimizationLevel optimizationLevel = gen->optimizationInfo().level();
@@ -12467,7 +12467,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
          // Do a normal invalidate, except don't cancel offThread compilations,
          // since that will cancel this compilation too.
          Invalidate(cx, script, /* resetUses */ false, /* cancelOffThread*/ false);
-@@ -11486,29 +11400,27 @@ CodeGenerator::visitLoadUnboxedScalar(LL
+@@ -11523,29 +11437,27 @@ CodeGenerator::visitLoadUnboxedScalar(LL
  {
      Register elements = ToRegister(lir->elements());
      Register temp = lir->temp()->isBogusTemp() ? InvalidReg : ToRegister(lir->temp());
@@ -12499,7 +12499,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
  
  void
  CodeGenerator::visitLoadTypedArrayElementHole(LLoadTypedArrayElementHole* lir)
-@@ -11777,23 +11689,20 @@ CodeGenerator::visitLoadElementFromState
+@@ -11814,23 +11726,20 @@ CodeGenerator::visitLoadElementFromState
  
      addOutOfLineCode(jumpTable, lir->mir());
      masm.bind(&join);
@@ -12527,7 +12527,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
      }
  }
  
-@@ -11801,27 +11710,26 @@ void
+@@ -11838,27 +11747,26 @@ void
  CodeGenerator::visitStoreUnboxedScalar(LStoreUnboxedScalar* lir)
  {
      Register elements = ToRegister(lir->elements());
@@ -12891,7 +12891,7 @@ diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
 diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
 --- a/js/src/jit/IonBuilder.cpp
 +++ b/js/src/jit/IonBuilder.cpp
-@@ -7859,21 +7859,16 @@ IonBuilder::getElemTryTypedObject(bool* 
+@@ -7877,21 +7877,16 @@ IonBuilder::getElemTryTypedObject(bool* 
      if (elemPrediction.isUseless())
          return Ok();
  
@@ -12913,7 +12913,7 @@ diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
                                                    objPrediction,
                                                    elemPrediction,
                                                    elemSize);
-@@ -8921,21 +8916,16 @@ IonBuilder::setElemTryTypedObject(bool* 
+@@ -8939,21 +8934,16 @@ IonBuilder::setElemTryTypedObject(bool* 
      if (elemPrediction.isUseless())
          return Ok();
  
@@ -12935,7 +12935,7 @@ diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
          return setElemTryScalarElemOfTypedObject(emitted,
                                                   obj,
                                                   index,
-@@ -10553,20 +10543,16 @@ IonBuilder::getPropTryTypedObject(bool* 
+@@ -10571,20 +10561,16 @@ IonBuilder::getPropTryTypedObject(bool* 
  {
      TypedObjectPrediction fieldPrediction;
      size_t fieldOffset;
@@ -12956,7 +12956,7 @@ diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
                                                    fieldPrediction,
                                                    fieldIndex);
  
-@@ -11698,20 +11684,16 @@ IonBuilder::setPropTryTypedObject(bool* 
+@@ -11716,20 +11702,16 @@ IonBuilder::setPropTryTypedObject(bool* 
  {
      TypedObjectPrediction fieldPrediction;
      size_t fieldOffset;
@@ -16574,7 +16574,7 @@ diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
  // reference like `a.b.c` -- here, the `a.b` will create an ephemeral
  // derived type object that aliases the memory of `a` itself. The
  // specific nature of `a.b` is revealed by using
-@@ -10451,28 +9228,26 @@ enum MemoryBarrierRequirement
+@@ -10476,28 +9253,26 @@ enum MemoryBarrierRequirement
  
  // Load an unboxed scalar value from a typed array or other object.
  class MLoadUnboxedScalar
@@ -16603,7 +16603,7 @@ diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
          if (requiresBarrier_)
              setGuard();         // Not removable or movable
          else
-@@ -10482,23 +9257,16 @@ class MLoadUnboxedScalar
+@@ -10507,23 +9282,16 @@ class MLoadUnboxedScalar
          MOZ_ASSERT(storageType >= 0 && storageType < Scalar::MaxTypedArrayViewType);
      }
  
@@ -16627,7 +16627,7 @@ diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
          return storageType_;
      }
      bool fallible() const {
-@@ -10530,18 +9298,16 @@ class MLoadUnboxedScalar
+@@ -10555,18 +9323,16 @@ class MLoadUnboxedScalar
              return false;
          if (!ins->isLoadUnboxedScalar())
              return false;
@@ -16646,7 +16646,7 @@ diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
      }
  
  #ifdef JS_JITSPEW
-@@ -10609,17 +9375,17 @@ class MLoadTypedArrayElementHole
+@@ -10634,17 +9400,17 @@ class MLoadTypedArrayElementHole
  class StoreUnboxedScalarBase
  {
      Scalar::Type writeType_;
@@ -16665,7 +16665,7 @@ diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
      }
      Scalar::Type writeType() const {
          return writeType_;
-@@ -10635,19 +9401,16 @@ class StoreUnboxedScalarBase
+@@ -10660,19 +9426,16 @@ class StoreUnboxedScalarBase
                 writeType_ == Scalar::Uint16 ||
                 writeType_ == Scalar::Int32 ||
                 writeType_ == Scalar::Uint32;
@@ -16685,7 +16685,7 @@ diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
      public StoreUnboxedScalarBase,
      public StoreUnboxedScalarPolicy::Data
  {
-@@ -10660,52 +9423,42 @@ class MStoreUnboxedScalar
+@@ -10685,52 +9448,42 @@ class MStoreUnboxedScalar
    private:
      Scalar::Type storageType_;
  
@@ -16739,7 +16739,7 @@ diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
      }
      TruncateInputKind truncateInput() const {
          return truncateInput_;
-@@ -10743,18 +9496,16 @@ class MStoreTypedArrayElementHole
+@@ -10768,18 +9521,16 @@ class MStoreTypedArrayElementHole
      }
  
    public:
@@ -16758,7 +16758,7 @@ diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
      TruncateKind operandTruncateKind(size_t index) const override;
  
      bool canConsumeFloat32(MUse* use) const override {
-@@ -14506,17 +13257,16 @@ class MAsmJSMemoryAccess
+@@ -14531,17 +13282,16 @@ class MAsmJSMemoryAccess
  
    public:
      explicit MAsmJSMemoryAccess(Scalar::Type accessType)
@@ -16776,7 +16776,7 @@ diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
      unsigned byteSize() const { return TypedArrayElemSize(accessType()); }
      bool needsBoundsCheck() const { return needsBoundsCheck_; }
  
-@@ -14816,17 +13566,17 @@ class MWasmLoadGlobalVar
+@@ -14841,17 +13591,17 @@ class MWasmLoadGlobalVar
  {
      MWasmLoadGlobalVar(MIRType type, unsigned globalDataOffset, bool isConstant, bool isIndirect,
                         MDefinition* tlsPtr)
@@ -17077,7 +17077,7 @@ diff --git a/js/src/jit/MacroAssembler.cpp b/js/src/jit/MacroAssembler.cpp
  {
      switch (arrayType) {
        case Scalar::Int8:
-@@ -3393,51 +3308,16 @@ void
+@@ -3444,51 +3359,16 @@ void
  MacroAssembler::branchIfInlineTypedObject(Register obj, Register scratch, Label* label)
  {
      loadObjClassUnsafe(obj, scratch);
@@ -17171,7 +17171,7 @@ diff --git a/js/src/jit/MacroAssembler.h b/js/src/jit/MacroAssembler.h
      inline void storeUncanonicalizedDouble(FloatRegister src, const BaseIndex& dest)
          DEFINED_ON(x86_shared, arm, arm64, mips32, mips64);
      inline void storeUncanonicalizedDouble(FloatRegister src, const Operand& dest)
-@@ -2138,17 +2133,17 @@ class MacroAssembler : public MacroAssem
+@@ -2145,17 +2140,17 @@ class MacroAssembler : public MacroAssem
          call(preBarrier);
          Pop(PreBarrierReg);
  
@@ -17190,7 +17190,7 @@ diff --git a/js/src/jit/MacroAssembler.h b/js/src/jit/MacroAssembler.h
      template<typename S, typename T>
      void storeToTypedIntArray(Scalar::Type arrayType, const S& value, const T& dest) {
          switch (arrayType) {
-@@ -2165,20 +2160,18 @@ class MacroAssembler : public MacroAssem
+@@ -2172,20 +2167,18 @@ class MacroAssembler : public MacroAssem
            case Scalar::Uint32:
              store32(value, dest);
              break;
@@ -22537,7 +22537,7 @@ diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
 diff --git a/js/src/jsfriendapi.h b/js/src/jsfriendapi.h
 --- a/js/src/jsfriendapi.h
 +++ b/js/src/jsfriendapi.h
-@@ -1610,20 +1610,16 @@ enum Type {
+@@ -1609,20 +1609,16 @@ enum Type {
      Uint8Clamped,
  
      /**
@@ -22558,7 +22558,7 @@ diff --git a/js/src/jsfriendapi.h b/js/src/jsfriendapi.h
      switch (atype) {
        case Int8:
        case Uint8:
-@@ -1634,101 +1630,42 @@ byteSize(Type atype)
+@@ -1633,101 +1629,42 @@ byteSize(Type atype)
          return 2;
        case Int32:
        case Uint32:
@@ -22663,7 +22663,7 @@ diff --git a/js/src/jsfriendapi.h b/js/src/jsfriendapi.h
 diff --git a/js/src/moz.build b/js/src/moz.build
 --- a/js/src/moz.build
 +++ b/js/src/moz.build
-@@ -190,17 +190,16 @@ UNIFIED_SOURCES += [
+@@ -191,17 +191,16 @@ UNIFIED_SOURCES += [
      'builtin/JSON.cpp',
      'builtin/MapObject.cpp',
      'builtin/ModuleObject.cpp',
@@ -22681,7 +22681,7 @@ diff --git a/js/src/moz.build b/js/src/moz.build
      'builtin/WeakMapObject.cpp',
      'builtin/WeakSetObject.cpp',
      'devtools/sharkctl.cpp',
-@@ -263,17 +262,16 @@ UNIFIED_SOURCES += [
+@@ -264,17 +263,16 @@ UNIFIED_SOURCES += [
      'jit/BytecodeAnalysis.cpp',
      'jit/C1Spewer.cpp',
      'jit/CacheIR.cpp',
@@ -22699,7 +22699,7 @@ diff --git a/js/src/moz.build b/js/src/moz.build
      'jit/Ion.cpp',
      'jit/IonAnalysis.cpp',
      'jit/IonBuilder.cpp',
-@@ -698,17 +696,16 @@ ReservedWordsGenerated.inputs += [
+@@ -699,17 +697,16 @@ ReservedWordsGenerated.inputs += [
  DIRS += [
      'build',
  ]
@@ -30603,7 +30603,7 @@ diff --git a/js/src/wasm/AsmJS.cpp b/js/src/wasm/AsmJS.cpp
  
  static const unsigned VALIDATION_LIFO_DEFAULT_CHUNK_SIZE = 4 * 1024;
  
-@@ -1469,19 +1239,17 @@ class MOZ_STACK_CLASS ModuleValidator
+@@ -1469,19 +1239,17 @@ class MOZ_STACK_CLASS JS_HAZ_ROOTED Modu
              ConstantLiteral,
              ConstantImport,
              Function,
@@ -30624,7 +30624,7 @@ diff --git a/js/src/wasm/AsmJS.cpp b/js/src/wasm/AsmJS.cpp
              struct VarOrConst {
                  Type::Which type_;
                  unsigned index_;
-@@ -1510,21 +1278,16 @@ class MOZ_STACK_CLASS ModuleValidator
+@@ -1510,21 +1278,16 @@ class MOZ_STACK_CLASS JS_HAZ_ROOTED Modu
                  }
              } varOrConst;
              uint32_t funcDefIndex_;
@@ -30646,7 +30646,7 @@ diff --git a/js/src/wasm/AsmJS.cpp b/js/src/wasm/AsmJS.cpp
              U() : funcDefIndex_(0) {}
              MOZ_POP_DISABLE_NONTRIVIAL_UNION_WARNINGS
          } u;
-@@ -1581,34 +1344,16 @@ class MOZ_STACK_CLASS ModuleValidator
+@@ -1581,34 +1344,16 @@ class MOZ_STACK_CLASS JS_HAZ_ROOTED Modu
          }
          bool isAtomicsFunction() const {
              return which_ == AtomicsBuiltinFunction;
@@ -30681,7 +30681,7 @@ diff --git a/js/src/wasm/AsmJS.cpp b/js/src/wasm/AsmJS.cpp
          Kind kind;
  
          union {
-@@ -1688,41 +1433,38 @@ class MOZ_STACK_CLASS ModuleValidator
+@@ -1688,41 +1433,38 @@ class MOZ_STACK_CLASS JS_HAZ_ROOTED Modu
          }
      };
  
@@ -30723,7 +30723,7 @@ diff --git a/js/src/wasm/AsmJS.cpp b/js/src/wasm/AsmJS.cpp
      // Error reporting:
      UniqueChars           errorString_;
      uint32_t              errorOffset_;
-@@ -1744,22 +1486,16 @@ class MOZ_STACK_CLASS ModuleValidator
+@@ -1744,22 +1486,16 @@ class MOZ_STACK_CLASS JS_HAZ_ROOTED Modu
          return standardLibraryMathNames_.putNew(atom->asPropertyName(), builtin);
      }
      bool addStandardLibraryAtomicsName(const char* name, AsmJSAtomicsBuiltinFunction func) {
@@ -30746,7 +30746,7 @@ diff --git a/js/src/wasm/AsmJS.cpp b/js/src/wasm/AsmJS.cpp
          return env_.types.append(std::move(sig));
      }
      bool declareSig(FuncType&& sig, uint32_t* sigIndex) {
-@@ -1780,27 +1516,25 @@ class MOZ_STACK_CLASS ModuleValidator
+@@ -1780,27 +1516,25 @@ class MOZ_STACK_CLASS JS_HAZ_ROOTED Modu
          parser_(parser),
          moduleFunctionNode_(moduleFunctionNode),
          moduleFunctionName_(FunctionName(moduleFunctionNode)),
@@ -30774,7 +30774,7 @@ diff --git a/js/src/wasm/AsmJS.cpp b/js/src/wasm/AsmJS.cpp
          errorString_(nullptr),
          errorOffset_(UINT32_MAX),
          errorOverRecursed_(false)
-@@ -1903,24 +1637,16 @@ class MOZ_STACK_CLASS ModuleValidator
+@@ -1903,24 +1637,16 @@ class MOZ_STACK_CLASS JS_HAZ_ROOTED Modu
              !addStandardLibraryAtomicsName("and", AsmJSAtomicsBuiltin_and) ||
              !addStandardLibraryAtomicsName("or", AsmJSAtomicsBuiltin_or) ||
              !addStandardLibraryAtomicsName("xor", AsmJSAtomicsBuiltin_xor) ||
@@ -30799,7 +30799,7 @@ diff --git a/js/src/wasm/AsmJS.cpp b/js/src/wasm/AsmJS.cpp
              return false;
  
          return true;
-@@ -1937,17 +1663,16 @@ class MOZ_STACK_CLASS ModuleValidator
+@@ -1937,17 +1663,16 @@ class MOZ_STACK_CLASS JS_HAZ_ROOTED Modu
  
      auto tokenStream() const
        -> decltype(parser_.tokenStream)&
@@ -30817,7 +30817,7 @@ diff --git a/js/src/wasm/AsmJS.cpp b/js/src/wasm/AsmJS.cpp
          moduleFunctionName_ = name;
      }
      MOZ_MUST_USE bool initGlobalArgumentName(PropertyName* n) {
-@@ -2127,53 +1852,16 @@ class MOZ_STACK_CLASS ModuleValidator
+@@ -2127,53 +1852,16 @@ class MOZ_STACK_CLASS JS_HAZ_ROOTED Modu
          new (&global->u.atomicsBuiltinFunc_) AsmJSAtomicsBuiltinFunction(func);
          if (!globalMap_.putNew(var, global))
              return false;
@@ -30871,7 +30871,7 @@ diff --git a/js/src/wasm/AsmJS.cpp b/js/src/wasm/AsmJS.cpp
          Global* global = validationLifo_.new_<Global>(Global::ArrayViewCtor);
          if (!global)
              return false;
-@@ -2433,23 +2121,16 @@ class MOZ_STACK_CLASS ModuleValidator
+@@ -2433,23 +2121,16 @@ class MOZ_STACK_CLASS JS_HAZ_ROOTED Modu
      }
      bool lookupStandardLibraryAtomicsName(PropertyName* name, AsmJSAtomicsBuiltinFunction* atomicsBuiltin) const {
          if (AtomicsNameMap::Ptr p = standardLibraryAtomicsNames_.lookup(name)) {
@@ -30895,7 +30895,7 @@ diff --git a/js/src/wasm/AsmJS.cpp b/js/src/wasm/AsmJS.cpp
              env_.memoryUsage = MemoryUsage::None;
          return true;
      }
-@@ -2466,18 +2147,16 @@ class MOZ_STACK_CLASS ModuleValidator
+@@ -2466,18 +2147,16 @@ class MOZ_STACK_CLASS JS_HAZ_ROOTED Modu
              uint32_t funcIndex = funcImportMap_.count() + func.funcDefIndex();
              MOZ_ASSERT(!env_.funcTypes[funcIndex]);
              env_.funcTypes[funcIndex] = &env_.types[func.sigIndex()].funcType();
@@ -33318,7 +33318,7 @@ diff --git a/js/src/wasm/WasmBinaryConstants.h b/js/src/wasm/WasmBinaryConstants
 diff --git a/js/src/wasm/WasmBuiltins.cpp b/js/src/wasm/WasmBuiltins.cpp
 --- a/js/src/wasm/WasmBuiltins.cpp
 +++ b/js/src/wasm/WasmBuiltins.cpp
-@@ -252,18 +252,16 @@ WasmHandleTrap()
+@@ -256,18 +256,16 @@ WasmHandleTrap()
        case Trap::InvalidConversionToInteger:
          return ReportError(cx, JSMSG_WASM_INVALID_CONVERSION);
        case Trap::IntegerDivideByZero:
@@ -34874,7 +34874,7 @@ diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
  }
  
  // ============================================================================
-@@ -2168,17 +2156,16 @@ WasmGlobalObject::trace(JSTracer* trc, J
+@@ -2166,17 +2154,16 @@ WasmGlobalObject::trace(JSTracer* trc, J
          if (global->cell()->ptr)
              TraceManuallyBarrieredEdge(trc, &global->cell()->ptr, "wasm anyref global");
          break;
@@ -34892,7 +34892,7 @@ diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
  /* static */ void
  WasmGlobalObject::finalize(FreeOp*, JSObject* obj)
  {
-@@ -2224,17 +2211,16 @@ WasmGlobalObject::create(JSContext* cx, 
+@@ -2222,17 +2209,16 @@ WasmGlobalObject::create(JSContext* cx, 
          cell->f64 = val.f64();
          break;
        case ValType::AnyRef:
@@ -34910,7 +34910,7 @@ diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
      obj->initReservedSlot(MUTABLE_SLOT, JS::BooleanValue(isMutable));
      obj->initReservedSlot(CELL_SLOT, PrivateValue(cell));
  
-@@ -2308,17 +2294,16 @@ WasmGlobalObject::construct(JSContext* c
+@@ -2306,17 +2292,16 @@ WasmGlobalObject::construct(JSContext* c
              return false;
      } else {
          switch (globalType.code()) {
@@ -34928,7 +34928,7 @@ diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
      if (!global)
          return false;
  
-@@ -2340,17 +2325,16 @@ WasmGlobalObject::valueGetterImpl(JSCont
+@@ -2338,17 +2323,16 @@ WasmGlobalObject::valueGetterImpl(JSCont
        case ValType::F32:
        case ValType::F64:
        case ValType::AnyRef:
@@ -34946,7 +34946,7 @@ diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
  
  /* static */ bool
  WasmGlobalObject::valueGetter(JSContext* cx, unsigned argc, Value* vp)
-@@ -2391,17 +2375,16 @@ WasmGlobalObject::valueSetterImpl(JSCont
+@@ -2389,17 +2373,16 @@ WasmGlobalObject::valueSetterImpl(JSCont
        case ValType::AnyRef: {
          JSObject* prevPtr = cell->ptr;
          JSObject::writeBarrierPre(prevPtr);
@@ -34964,7 +34964,7 @@ diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
  
      args.rval().setUndefined();
      return true;
-@@ -2447,17 +2430,16 @@ WasmGlobalObject::val(MutableHandleVal o
+@@ -2445,17 +2428,16 @@ WasmGlobalObject::val(MutableHandleVal o
  {
      Cell* cell = this->cell();
      switch (type().code()) {
@@ -36045,7 +36045,7 @@ diff --git a/js/src/wasm/WasmStubs.cpp b/js/src/wasm/WasmStubs.cpp
 diff --git a/js/src/wasm/WasmTypes.cpp b/js/src/wasm/WasmTypes.cpp
 --- a/js/src/wasm/WasmTypes.cpp
 +++ b/js/src/wasm/WasmTypes.cpp
-@@ -62,23 +62,16 @@ static_assert((MaxMemoryAccessSize & (Ma
+@@ -63,23 +63,16 @@ static_assert((MaxMemoryAccessSize & (Ma
  Val::Val(const LitVal& val)
  {
      type_ = val.type();
@@ -36069,7 +36069,7 @@ diff --git a/js/src/wasm/WasmTypes.cpp b/js/src/wasm/WasmTypes.cpp
  
  void
  Val::writePayload(uint8_t* dst) const
-@@ -87,25 +80,16 @@ Val::writePayload(uint8_t* dst) const
+@@ -88,25 +81,16 @@ Val::writePayload(uint8_t* dst) const
        case ValType::I32:
        case ValType::F32:
          memcpy(dst, &u.i32_, sizeof(u.i32_));
@@ -36095,7 +36095,7 @@ diff --git a/js/src/wasm/WasmTypes.cpp b/js/src/wasm/WasmTypes.cpp
          // WasmInstanceObject, or the Cell of a WasmGlobalObject:
          // - WasmInstanceObjects are always tenured and u.ptr_ may point to a
          // nursery object, so we need a post-barrier since the global data of
-@@ -231,23 +215,16 @@ IsImmediateType(ValType vt)
+@@ -232,23 +216,16 @@ IsImmediateType(ValType vt)
  {
      switch (vt.code()) {
        case ValType::I32:
@@ -36119,7 +36119,7 @@ diff --git a/js/src/wasm/WasmTypes.cpp b/js/src/wasm/WasmTypes.cpp
  
  static unsigned
  EncodeImmediateType(ValType vt)
-@@ -259,23 +236,16 @@ EncodeImmediateType(ValType vt)
+@@ -260,23 +237,16 @@ EncodeImmediateType(ValType vt)
        case ValType::I64:
          return 1;
        case ValType::F32:

frg/work-js/mozilla-release/patches/1424809-59a1.patch

@@ -0,0 +1,174 @@
+# HG changeset patch
+# User Andrea Marchesini <amarchesini@mozilla.com>
+# Date 1513080077 21600
+# Node ID e63b2060c206907e81c32a9f4ff79a25b2eb87b7
+# Parent  db447092bc9623c6dc5d2ce7ec3665cdadd0062f
+Bug 1424809 - Get rid of NS_NewPostDataStream, r=valentin
+
+diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
+--- a/docshell/base/nsDocShell.cpp
++++ b/docshell/base/nsDocShell.cpp
+@@ -95,16 +95,17 @@
+ #include "nsIDocShellTreeItem.h"
+ #include "nsIChannel.h"
+ #include "IHistory.h"
+ #include "nsViewSourceHandler.h"
+ #include "nsWhitespaceTokenizer.h"
+ #include "nsICookieService.h"
+ #include "nsIConsoleReportCollector.h"
+ #include "nsObjectLoadingContent.h"
++#include "nsStringStream.h"
+ 
+ // we want to explore making the document own the load group
+ // so we can associate the document URI with the load group.
+ // until this point, we have an evil hack:
+ #include "nsIHttpChannelInternal.h"
+ #include "nsPILoadGroupInternal.h"
+ 
+ // Local Includes
+@@ -610,18 +611,18 @@ SendPing(void* aClosure, nsIContent* aCo
+   nsCOMPtr<nsIUploadChannel2> uploadChan = do_QueryInterface(httpChan);
+   if (!uploadChan) {
+     return;
+   }
+ 
+   NS_NAMED_LITERAL_CSTRING(uploadData, "PING");
+ 
+   nsCOMPtr<nsIInputStream> uploadStream;
+-  NS_NewPostDataStream(getter_AddRefs(uploadStream), false, uploadData);
+-  if (!uploadStream) {
++  rv = NS_NewCStringInputStream(getter_AddRefs(uploadStream), uploadData);
++  if (NS_WARN_IF(NS_FAILED(rv))) {
+     return;
+   }
+ 
+   uploadChan->ExplicitSetUploadStream(uploadStream,
+                                       NS_LITERAL_CSTRING("text/ping"),
+                                       uploadData.Length(),
+                                       NS_LITERAL_CSTRING("POST"), false);
+ 
+diff --git a/netwerk/base/nsNetUtil.cpp b/netwerk/base/nsNetUtil.cpp
+--- a/netwerk/base/nsNetUtil.cpp
++++ b/netwerk/base/nsNetUtil.cpp
+@@ -1355,53 +1355,16 @@ NS_NewBufferedInputStream(nsIInputStream
+         rv = in->Init(inputStream, aBufferSize);
+         if (NS_SUCCEEDED(rv)) {
+             in.forget(aResult);
+         }
+     }
+     return rv;
+ }
+ 
+-nsresult
+-NS_NewPostDataStream(nsIInputStream  **result,
+-                     bool              isFile,
+-                     const nsACString &data)
+-{
+-    nsresult rv;
+-
+-    if (isFile) {
+-        nsCOMPtr<nsIFile> file;
+-        nsCOMPtr<nsIInputStream> fileStream;
+-
+-        rv = NS_NewNativeLocalFile(data, false, getter_AddRefs(file));
+-        if (NS_SUCCEEDED(rv)) {
+-            rv = NS_NewLocalFileInputStream(getter_AddRefs(fileStream), file);
+-            if (NS_SUCCEEDED(rv)) {
+-                // wrap the file stream with a buffered input stream
+-                rv = NS_NewBufferedInputStream(result, fileStream.forget(),
+-                                               8192);
+-            }
+-        }
+-        return rv;
+-    }
+-
+-    // otherwise, create a string stream for the data (copies)
+-    nsCOMPtr<nsIStringInputStream> stream
+-        (do_CreateInstance("@mozilla.org/io/string-input-stream;1", &rv));
+-    if (NS_FAILED(rv))
+-        return rv;
+-
+-    rv = stream->SetData(data.BeginReading(), data.Length());
+-    if (NS_FAILED(rv))
+-        return rv;
+-
+-    stream.forget(result);
+-    return NS_OK;
+-}
+-
+ namespace {
+ 
+ #define BUFFER_SIZE 4096
+ 
+ class BufferWriter final : public Runnable
+                          , public nsIInputStreamCallback
+ {
+ public:
+diff --git a/netwerk/base/nsNetUtil.h b/netwerk/base/nsNetUtil.h
+--- a/netwerk/base/nsNetUtil.h
++++ b/netwerk/base/nsNetUtil.h
+@@ -505,21 +505,16 @@ NS_NewBufferedInputStream(nsIInputStream
+                           uint32_t aBufferSize);
+ 
+ // note: the resulting stream can be QI'ed to nsISafeOutputStream iff the
+ // provided stream supports it.
+ nsresult NS_NewBufferedOutputStream(nsIOutputStream** aResult,
+                                     already_AddRefed<nsIOutputStream> aOutputStream,
+                                     uint32_t aBufferSize);
+ 
+-// returns an input stream compatible with nsIUploadChannel::SetUploadStream()
+-nsresult NS_NewPostDataStream(nsIInputStream  **result,
+-                              bool              isFile,
+-                              const nsACString &data);
+-
+ /**
+  * This function reads an inputStream and stores its content into a buffer. In
+  * general, you should avoid using this function because, it blocks the current
+  * thread until the operation is done.
+  * If the inputStream is async, the reading happens on an I/O thread.
+  *
+  * @param aInputStream the inputStream.
+  * @param aDest the destination buffer. if *aDest is null, it will be allocated
+diff --git a/security/manager/ssl/nsNSSCallbacks.cpp b/security/manager/ssl/nsNSSCallbacks.cpp
+--- a/security/manager/ssl/nsNSSCallbacks.cpp
++++ b/security/manager/ssl/nsNSSCallbacks.cpp
+@@ -25,16 +25,17 @@
+ #include "nsIUploadChannel.h"
+ #include "nsIWebProgressListener.h"
+ #include "nsNSSCertificate.h"
+ #include "nsNSSComponent.h"
+ #include "nsNSSIOLayer.h"
+ #include "nsNetUtil.h"
+ #include "nsProtectedAuthThread.h"
+ #include "nsProxyRelease.h"
++#include "nsStringStream.h"
+ #include "mozpkix/pkixtypes.h"
+ #include "ssl.h"
+ #include "sslproto.h"
+ 
+ #include "TrustOverrideUtils.h"
+ #include "TrustOverride-SymantecData.inc"
+ #include "TrustOverride-AppleGoogleDigiCertData.inc"
+ #include "TrustOverride-TestImminentDistrustData.inc"
+@@ -135,19 +136,18 @@ nsHTTPDownloadEvent::Run()
+   // Create a loadgroup for this new channel.  This way if the channel
+   // is redirected, we'll have a way to cancel the resulting channel.
+   nsCOMPtr<nsILoadGroup> lg = do_CreateInstance(NS_LOADGROUP_CONTRACTID);
+   chan->SetLoadGroup(lg);
+ 
+   if (mRequestSession->mHasPostData)
+   {
+     nsCOMPtr<nsIInputStream> uploadStream;
+-    rv = NS_NewPostDataStream(getter_AddRefs(uploadStream),
+-                              false,
+-                              mRequestSession->mPostData);
++    rv = NS_NewCStringInputStream(getter_AddRefs(uploadStream),
++                                  mRequestSession->mPostData);
+     NS_ENSURE_SUCCESS(rv, rv);
+ 
+     nsCOMPtr<nsIUploadChannel> uploadChannel(do_QueryInterface(chan));
+     NS_ENSURE_STATE(uploadChannel);
+ 
+     rv = uploadChannel->SetUploadStream(uploadStream,
+                                         mRequestSession->mPostContentType,
+                                         -1);

frg/work-js/mozilla-release/patches/1425975-07no08-59a1.patch

@@ -2,31 +2,31 @@
 # User Ben Kelly <ben@wanderview.com>
 # Date 1515172221 18000
 # Node ID 841e106b28101d1762d8c41740f433d19e7def92
-# Parent  679687cc3e08a1afd166dc8083f6d0e6c982a662
+# Parent  f398e4bb59ac916d7b7788b5598c03b3457e0161
 Bug 1425975 P7 Use the mControlledClients list to drive controller start and stop logic. r=asuth
 
 diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
 --- a/docshell/base/nsDocShell.cpp
 +++ b/docshell/base/nsDocShell.cpp
-@@ -148,16 +148,17 @@
- #include "nsIStructuredCloneContainer.h"
- #include "nsISupportsPrimitives.h"
- #ifdef MOZ_PLACES
- #include "nsIFaviconService.h"
- #include "mozIPlacesPendingOperation.h"
- #include "mozIAsyncFavicons.h"
- #endif
- #include "nsINetworkPredictor.h"
+@@ -113,16 +113,17 @@
+ #include "nsIScriptObjectPrincipal.h"
+ #include "nsIScriptSecurityManager.h"
+ #include "nsIScrollableFrame.h"
+ #include "nsIScrollObserver.h"
+ #include "nsISecureBrowserUI.h"
+ #include "nsISecurityUITelemetry.h"
+ #include "nsISeekableStream.h"
+ #include "nsISelectionDisplay.h"
 +#include "nsIServiceWorkerManager.h"
- 
- // Editor-related
- #include "nsIEditingSession.h"
- 
- #include "nsPIDOMWindow.h"
- #include "nsGlobalWindow.h"
- #include "nsPIWindowRoot.h"
- #include "nsICachingChannel.h"
-@@ -3442,23 +3443,37 @@ nsDocShell::MaybeCreateInitialClientSour
+ #include "nsISHContainer.h"
+ #include "nsISHEntry.h"
+ #include "nsISHistory.h"
+ #include "nsISHistoryInternal.h"
+ #include "nsISiteSecurityService.h"
+ #include "nsISocketProvider.h"
+ #include "nsIStringBundle.h"
+ #include "nsIStructuredCloneContainer.h"
+@@ -2823,23 +2824,37 @@ nsDocShell::MaybeCreateInitialClientSour
      return;
    }
  

frg/work-js/mozilla-release/patches/1425975-16-59a1.patch

@@ -2,13 +2,13 @@
 # User Ben Kelly <ben@wanderview.com>
 # Date 1515172222 18000
 # Node ID 5b1109ca1c1f887a793748f1e115152a42122151
-# Parent  54b5f539a81dc4b0824b1b2ab4539fedf06766c3
+# Parent  dd20e44e6d198aa67cebdd773ece5614e001b978
 Bug 1425975 P16 Make nsDocShell check for session cookie lifetime policy before allowing service worker intercept. r=asuth
 
 diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
 --- a/docshell/base/nsDocShell.cpp
 +++ b/docshell/base/nsDocShell.cpp
-@@ -3438,21 +3438,20 @@ nsDocShell::MaybeCreateInitialClientSour
+@@ -2819,21 +2819,20 @@ nsDocShell::MaybeCreateInitialClientSour
    nsCOMPtr<nsIDocShell> parent = GetParentDocshell();
    nsPIDOMWindowOuter* parentOuter = parent ? parent->GetWindow() : nullptr;
    nsPIDOMWindowInner* parentInner =
@@ -33,7 +33,7 @@ diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
      return;
    }
  
-@@ -14888,16 +14887,64 @@ nsDocShell::CanSetOriginAttributes()
+@@ -13991,16 +13990,64 @@ nsDocShell::CanSetOriginAttributes()
          return false;
        }
      }
@@ -98,7 +98,7 @@ diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
    }
  
    AssertOriginAttributesMatchPrivateBrowsing();
-@@ -15090,73 +15137,49 @@ nsDocShell::MaybeNotifyKeywordSearchLoad
+@@ -14193,73 +14240,49 @@ nsDocShell::MaybeNotifyKeywordSearchLoad
  #endif
  }
  
@@ -193,15 +193,15 @@ diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
 diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
 --- a/docshell/base/nsDocShell.h
 +++ b/docshell/base/nsDocShell.h
-@@ -357,16 +357,27 @@ public:
+@@ -344,16 +344,27 @@ public:
+    *
+    * This method steals the data from the passed-in array.
+    */
    void SetAncestorOuterWindowIDs(nsTArray<uint64_t>&& aAncestorOuterWindowIDs)
    {
      mAncestorOuterWindowIDs = mozilla::Move(aAncestorOuterWindowIDs);
    }
  
- private:
-   bool CanSetOriginAttributes();
- 
 +  // Determine if a service worker is allowed to control a window in this
 +  // docshell with the given URL.  If there are any reasons it should not,
 +  // this will return false.  If true is returned then the window *may* be
@@ -213,14 +213,14 @@ diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
 +  // trigger 3rd party iframe checks.
 +  bool ServiceWorkerAllowedToControlWindow(nsIURI* aURI);
 +
- public:
-   const mozilla::OriginAttributes&
-   GetOriginAttributes()
+   const mozilla::OriginAttributes& GetOriginAttributes()
    {
      return mOriginAttributes;
    }
  
-   nsresult SetOriginAttributes(const mozilla::OriginAttributes& aAttrs);
+   // Determine whether this docshell corresponds to the given history entry,
+   // via having a pointer to it in mOSHE or mLSHE.
+   bool HasHistoryEntry(nsISHEntry* aEntry) const
 diff --git a/dom/base/nsContentUtils.h b/dom/base/nsContentUtils.h
 --- a/dom/base/nsContentUtils.h
 +++ b/dom/base/nsContentUtils.h

frg/work-js/mozilla-release/patches/1425975-19-59a1.patch

@@ -2,21 +2,21 @@
 # User Sebastian Hengst <archaeopteryx@coole-files.de>
 # Date 1515196306 -7200
 # Node ID 9099a6ed993f0113c47c0d9e800bf0ff6e1a1dc1
-# Parent  ac43086e18c70dfce9591a4f06ecfa00ae429e8e
+# Parent  7648ef62b73fe2cce04830d81bea072ae1587641
 Bug 1425975 - Follow-up: Move method to correct position. r=merge-fix a=merge-fix
 
 diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
 --- a/docshell/base/nsDocShell.h
 +++ b/docshell/base/nsDocShell.h
-@@ -357,27 +357,16 @@ public:
+@@ -344,27 +344,16 @@ public:
+    *
+    * This method steals the data from the passed-in array.
+    */
    void SetAncestorOuterWindowIDs(nsTArray<uint64_t>&& aAncestorOuterWindowIDs)
    {
      mAncestorOuterWindowIDs = mozilla::Move(aAncestorOuterWindowIDs);
    }
  
- private:
-   bool CanSetOriginAttributes();
- 
 -  // Determine if a service worker is allowed to control a window in this
 -  // docshell with the given URL.  If there are any reasons it should not,
 -  // this will return false.  If true is returned then the window *may* be
@@ -28,15 +28,15 @@ diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
 -  // trigger 3rd party iframe checks.
 -  bool ServiceWorkerAllowedToControlWindow(nsIURI* aURI);
 -
- public:
-   const mozilla::OriginAttributes&
-   GetOriginAttributes()
+   const mozilla::OriginAttributes& GetOriginAttributes()
    {
      return mOriginAttributes;
    }
  
-   nsresult SetOriginAttributes(const mozilla::OriginAttributes& aAttrs);
-@@ -845,16 +834,27 @@ protected:
+   // Determine whether this docshell corresponds to the given history entry,
+   // via having a pointer to it in mOSHE or mLSHE.
+   bool HasHistoryEntry(nsISHEntry* aEntry) const
+@@ -790,16 +779,27 @@ private: // member functions
    // the principal is not provided we will attempt to inherit it when we
    // are sure it will match what the real about:blank window principal
    // would have been.  There are some corner cases where we cannot easily
@@ -62,5 +62,5 @@ diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
    // even if GetExtantDoc() returns nullptr.
    mozilla::Maybe<mozilla::dom::ClientInfo> GetInitialClientInfo() const;
  
- protected:
-   nsresult GetCurScrollPos(int32_t aScrollOrientation, int32_t* aCurPos);
+   /**
+    * Initializes mTiming if it isn't yet.

frg/work-js/mozilla-release/patches/1426501-4-59a1.patch

@@ -2,7 +2,7 @@
 # User Valentin Gosu <valentin.gosu@gmail.com>
 # Date 1515421235 -3600
 # Node ID 0ca777d3a396f1130efe477fa376407fe7836228
-# Parent  1586183375bb345888bce40dc73bd45b69ed3f8f
+# Parent  3b7a116b8ba327d67e703a0814b3dc8d579722de
 Bug 1426501 - Change C++ code to use NS_MutateURI when changing URI r=mayhemer
 
 MozReview-Commit-ID: 4VzZlhWrtSJ
@@ -10,25 +10,25 @@ MozReview-Commit-ID: 4VzZlhWrtSJ
 diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
 --- a/docshell/base/nsDocShell.cpp
 +++ b/docshell/base/nsDocShell.cpp
-@@ -209,16 +209,17 @@
- #include "nsIOService.h"
- #include "nsISHContainer.h"
- #include "nsISHistory.h"
- #include "nsISecureBrowserUI.h"
- #include "nsISocketProvider.h"
- #include "nsIStringBundle.h"
+@@ -131,16 +131,17 @@
+ #include "nsITabChild.h"
+ #include "nsITextToSubURI.h"
+ #include "nsITimedChannel.h"
+ #include "nsITimer.h"
+ #include "nsITransportSecurityInfo.h"
+ #include "nsIUploadChannel.h"
  #include "nsIURIFixup.h"
  #include "nsIURILoader.h"
 +#include "nsIURIMutator.h"
  #include "nsIURL.h"
+ #include "nsIViewSourceChannel.h"
+ #include "nsIWebBrowserChrome.h"
+ #include "nsIWebBrowserChrome3.h"
+ #include "nsIWebBrowserChromeFocus.h"
  #include "nsIWebBrowserFind.h"
+ #include "nsIWebProgress.h"
  #include "nsIWidget.h"
- #include "mozilla/dom/PerformanceNavigation.h"
- #include "mozilla/dom/ScriptSettings.h"
- #include "mozilla/Encoding.h"
- #include "nsJSEnvironment.h"
- 
-@@ -1647,23 +1648,21 @@ nsDocShell::LoadStream(nsIInputStream* a
+@@ -1042,23 +1043,21 @@ nsDocShell::LoadStream(nsIInputStream* a
  
    // if the caller doesn't pass in a URI we need to create a dummy URI. necko
    // currently requires a URI in various places during the load. Some consumers
@@ -76,7 +76,7 @@ diff --git a/layout/generic/nsImageFrame.cpp b/layout/generic/nsImageFrame.cpp
  #include "nsCSSFrameConstructor.h"
  #include "nsIDOMRange.h"
  
-@@ -2125,17 +2126,19 @@ nsImageFrame::HandleEvent(nsPresContext*
+@@ -2127,17 +2128,19 @@ nsImageFrame::HandleEvent(nsPresContext*
            if (p.x < 0) p.x = 0;
            if (p.y < 0) p.y = 0;
  

frg/work-js/mozilla-release/patches/1435939-1-60a1.patch

@@ -2,7 +2,7 @@
 # User Emilio Cobos Alvarez <emilio@crisal.io>
 # Date 1517917892 -3600
 # Node ID 12ca97022384d5461f597088f6941c85c213197d
-# Parent  ea678fa933a3f58d03b60a162ec15ef6723913fd
+# Parent  1e8494a7ccbdb7102e1a35f70872a0211c08de85
 Bug 1435939: Make media feature changes always async. r=bz
 
 Much in the spirit of bug 1434474.
@@ -22,14 +22,14 @@ diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
 --- a/docshell/base/nsDocShell.cpp
 +++ b/docshell/base/nsDocShell.cpp
 @@ -20,16 +20,17 @@
- #include "mozilla/dom/ProfileTimelineMarkerBinding.h"
- #include "mozilla/dom/ScreenOrientation.h"
- #include "mozilla/dom/ToJSValue.h"
- #include "mozilla/dom/PermissionMessageUtils.h"
- #include "mozilla/dom/workers/ServiceWorkerManager.h"
+ #include "mozilla/AutoRestore.h"
+ #include "mozilla/BasePrincipal.h"
+ #include "mozilla/Casting.h"
+ #include "mozilla/Encoding.h"
  #include "mozilla/EventStateManager.h"
- #include "mozilla/LoadInfo.h"
  #include "mozilla/HTMLEditor.h"
+ #include "mozilla/LoadInfo.h"
+ #include "mozilla/Logging.h"
 +#include "mozilla/MediaFeatureChange.h"
  #include "mozilla/Preferences.h"
  #include "mozilla/ResultExtensions.h"
@@ -37,9 +37,9 @@ diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
  #include "mozilla/StartupTimeline.h"
  #include "mozilla/Telemetry.h"
  #include "mozilla/Unused.h"
- #include "Navigator.h"
- #include "URIUtils.h"
-@@ -4640,17 +4641,18 @@ nsDocShell::GetWindow()
+ 
+ #include "mozilla/dom/ClientChannelHelper.h"
+@@ -4149,17 +4150,18 @@ nsDocShell::GetWindow()
  NS_IMETHODIMP
  nsDocShell::SetDeviceSizeIsPageSize(bool aValue)
  {
@@ -59,7 +59,7 @@ diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
  NS_IMETHODIMP
  nsDocShell::GetDeviceSizeIsPageSize(bool* aValue)
  {
-@@ -15193,14 +15195,15 @@ nsDocShell::SetDisplayMode(uint32_t aDis
+@@ -14461,14 +14463,15 @@ nsDocShell::SetDisplayMode(uint32_t aDis
      return NS_ERROR_INVALID_ARG;
    }
  

frg/work-js/mozilla-release/patches/1453795-41-62a1.patch

@@ -3,7 +3,7 @@
 # Date 1529759656 -10800
 #      Sat Jun 23 16:14:16 2018 +0300
 # Node ID 6a76baf321797f3831aeffaab4eb852e9383f213
-# Parent  64ba408163f2f1ab0a97e8d35827cf820fcb950b
+# Parent  ee788b0d73a3bc9fdf9e83150cacbb7a7b79be65
 Bug 1453795 - JS - Initialize member fields in classes/ structures. r=waldoo
 
 diff --git a/js/src/ds/OrderedHashTable.h b/js/src/ds/OrderedHashTable.h
@@ -317,7 +317,7 @@ diff --git a/js/src/jsapi-tests/tests.h b/js/src/jsapi-tests/tests.h
 diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
 --- a/js/src/jsapi.cpp
 +++ b/js/src/jsapi.cpp
-@@ -6869,17 +6869,20 @@ JS::AutoSaveExceptionState::~AutoSaveExc
+@@ -6823,17 +6823,20 @@ JS::AutoSaveExceptionState::~AutoSaveExc
              context->overRecursed_ = wasOverRecursed;
              context->throwing = true;
              context->unwrappedException() = exceptionValue;
@@ -342,7 +342,7 @@ diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
 diff --git a/js/src/jsfriendapi.h b/js/src/jsfriendapi.h
 --- a/js/src/jsfriendapi.h
 +++ b/js/src/jsfriendapi.h
-@@ -1426,17 +1426,17 @@ class MOZ_STACK_CLASS JS_FRIEND_API(Auto
+@@ -1420,17 +1420,17 @@ class MOZ_STACK_CLASS JS_FRIEND_API(Auto
       * When copying string char, use this many bytes of inline storage.  This is
       * chosen to allow the inline string types to be copied without allocating.
       * This is asserted in AutoStableStringChars::allocOwnChars.
@@ -435,7 +435,7 @@ diff --git a/js/src/vm/Compression.cpp b/js/src/vm/Compression.cpp
 diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
 --- a/js/src/vm/Debugger.cpp
 +++ b/js/src/vm/Debugger.cpp
-@@ -4227,19 +4227,23 @@ class MOZ_STACK_CLASS Debugger::ScriptQu
+@@ -4225,19 +4225,23 @@ class MOZ_STACK_CLASS Debugger::ScriptQu
          cx(cx),
          debugger(dbg),
          iterMarker(&cx->runtime()->gc),
@@ -460,7 +460,7 @@ diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
       */
      bool init() {
          if (!realms.init() ||
-@@ -5461,17 +5465,20 @@ DebuggerScript_getStartLine(JSContext* c
+@@ -5458,17 +5462,20 @@ DebuggerScript_getStartLine(JSContext* c
      return true;
  }
  
@@ -482,7 +482,7 @@ diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
      }
      ReturnType match(Handle<WasmInstanceObject*> wasmInstance) {
          uint32_t result;
-@@ -6685,17 +6692,21 @@ DebuggerScript_clearAllBreakpoints(JSCon
+@@ -6682,17 +6689,21 @@ DebuggerScript_clearAllBreakpoints(JSCon
  
  class DebuggerScriptIsInCatchScopeMatcher
  {
@@ -508,7 +508,7 @@ diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
 diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
 --- a/js/src/vm/JSScript.cpp
 +++ b/js/src/vm/JSScript.cpp
-@@ -1611,17 +1611,19 @@ ScriptSource::chunkChars(JSContext* cx, 
+@@ -1612,17 +1612,19 @@ ScriptSource::chunkChars(JSContext* cx, 
          return nullptr;
      }
      return ret;
@@ -774,7 +774,7 @@ diff --git a/js/src/wasm/AsmJS.cpp b/js/src/wasm/AsmJS.cpp
      const AsmJSExport& lookupAsmJSExport(uint32_t funcIndex) const {
          // The AsmJSExportVector isn't stored in sorted order so do a linear
          // search. This is for the super-cold and already-expensive toString()
-@@ -1519,17 +1520,17 @@ class MOZ_STACK_CLASS ModuleValidator
+@@ -1519,17 +1520,17 @@ class MOZ_STACK_CLASS JS_HAZ_ROOTED Modu
                  SimdType type_;
                  SimdOperation which_;
              } simdOp;
@@ -793,7 +793,7 @@ diff --git a/js/src/wasm/AsmJS.cpp b/js/src/wasm/AsmJS.cpp
  
          explicit Global(Which which) : which_(which) {}
  
-@@ -1610,17 +1611,17 @@ class MOZ_STACK_CLASS ModuleValidator
+@@ -1610,17 +1611,17 @@ class MOZ_STACK_CLASS JS_HAZ_ROOTED Modu
          enum Kind { Function, Constant };
          Kind kind;
  
@@ -860,7 +860,7 @@ diff --git a/js/src/wasm/WasmFrameIter.cpp b/js/src/wasm/WasmFrameIter.cpp
 diff --git a/js/src/wasm/WasmFrameIter.h b/js/src/wasm/WasmFrameIter.h
 --- a/js/src/wasm/WasmFrameIter.h
 +++ b/js/src/wasm/WasmFrameIter.h
-@@ -93,32 +93,35 @@ class WasmFrameIter
+@@ -94,32 +94,35 @@ class WasmFrameIter
  enum class SymbolicAddress;
  
  // An ExitReason describes the possible reasons for leaving compiled wasm
@@ -946,7 +946,7 @@ diff --git a/js/src/wasm/WasmOpIter.h b/js/src/wasm/WasmOpIter.h
 diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
 --- a/js/src/wasm/WasmTextToBinary.cpp
 +++ b/js/src/wasm/WasmTextToBinary.cpp
-@@ -162,17 +162,18 @@ class WasmToken
+@@ -164,17 +164,18 @@ class WasmToken
        : kind_(Kind::Invalid),
          begin_(nullptr),
          end_(nullptr),
@@ -966,7 +966,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
      explicit WasmToken(uint32_t index, const char16_t* begin, const char16_t* end)
        : kind_(Index),
          begin_(begin),
-@@ -245,17 +246,18 @@ class WasmToken
+@@ -247,17 +248,18 @@ class WasmToken
          MOZ_ASSERT(begin != end);
          MOZ_ASSERT(kind_ == AtomicCmpXchg || kind_ == AtomicLoad || kind_ == AtomicRMW ||
                     kind_ == AtomicStore || kind_ == Wait || kind_ == Wake);
@@ -989,7 +989,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
 diff --git a/js/src/wasm/WasmTypes.h b/js/src/wasm/WasmTypes.h
 --- a/js/src/wasm/WasmTypes.h
 +++ b/js/src/wasm/WasmTypes.h
-@@ -768,17 +768,17 @@ class InitExpr
+@@ -792,17 +792,17 @@ class InitExpr
    private:
      Kind kind_;
      union U {
@@ -1008,7 +1008,7 @@ diff --git a/js/src/wasm/WasmTypes.h b/js/src/wasm/WasmTypes.h
      explicit InitExpr(Val val) : kind_(Kind::Constant) {
          u.val_ = val;
      }
-@@ -891,17 +891,17 @@ class GlobalDesc
+@@ -915,17 +915,17 @@ class GlobalDesc
      union V {
          struct {
              union U {
@@ -1027,7 +1027,7 @@ diff --git a/js/src/wasm/WasmTypes.h b/js/src/wasm/WasmTypes.h
          } var;
          Val cst_;
          V() {}
-@@ -1474,17 +1474,20 @@ class CallSiteDesc
+@@ -1595,17 +1595,20 @@ class CallSiteDesc
      enum Kind {
          Func,       // pc-relative call to a specific function
          Dynamic,    // dynamic callee called via register
@@ -1049,7 +1049,7 @@ diff --git a/js/src/wasm/WasmTypes.h b/js/src/wasm/WasmTypes.h
      CallSiteDesc(uint32_t lineOrBytecode, Kind kind)
        : lineOrBytecode_(lineOrBytecode), kind_(kind)
      {
-@@ -1495,17 +1498,17 @@ class CallSiteDesc
+@@ -1616,17 +1619,17 @@ class CallSiteDesc
      Kind kind() const { return Kind(kind_); }
  };
  
@@ -1068,7 +1068,7 @@ diff --git a/js/src/wasm/WasmTypes.h b/js/src/wasm/WasmTypes.h
  
      void offsetBy(int32_t delta) { returnAddressOffset_ += delta; }
      uint32_t returnAddressOffset() const { return returnAddressOffset_; }
-@@ -1873,17 +1876,17 @@ class CalleeDesc
+@@ -1994,17 +1997,17 @@ class CalleeDesc
          // Like Builtin, but automatically passes Instance* as first argument.
          BuiltinInstanceMethod
      };

frg/work-js/mozilla-release/patches/1465585-3-std-62a1.patch

@@ -1,9 +1,8 @@
 # HG changeset patch
 # User Emilio Cobos Alvarez <emilio@crisal.io>
 # Date 1527707735 -7200
-#      Wed May 30 21:15:35 2018 +0200
 # Node ID b54db66223586b4e04f5cb926fccdacf8a176b91
-# Parent  212905ef07ce8d8b6ff377aba93247eece3bc39d
+# Parent  56199acb8e1360b8d5a48bf4e7bfe429b8bf43b1
 Bug 1465585: Switch from mozilla::Move to std::move. r=froydnj
 
 This was done automatically replacing:
@@ -1281,7 +1280,7 @@ diff --git a/devtools/shared/heapsnapshot/tests/gtest/DevTools.h b/devtools/shar
 diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
 --- a/docshell/base/nsDocShell.cpp
 +++ b/docshell/base/nsDocShell.cpp
-@@ -3482,17 +3482,17 @@ nsDocShell::MaybeCreateInitialClientSour
+@@ -2863,17 +2863,17 @@ nsDocShell::MaybeCreateInitialClientSour
  }
  
  Maybe<ClientInfo>
@@ -1300,7 +1299,7 @@ diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
  
    if (!doc || !doc->IsInitialDocument()) {
      return Maybe<ClientInfo>();
-@@ -5680,17 +5680,17 @@ nsDocShell::Reload(uint32_t aReloadFlags
+@@ -5061,17 +5061,17 @@ nsDocShell::Reload(uint32_t aReloadFlags
      // Stack variables to ensure changes to the member variables don't affect to
      // the call.
      nsCOMPtr<nsIURI> currentURI = mCurrentURI;
@@ -1319,7 +1318,7 @@ diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
                        referrerURI,
                        referrerPolicy,
                        triggeringPrincipal,
-@@ -11789,17 +11789,17 @@ nsDocShell::DoChannelLoad(nsIChannel* aC
+@@ -11170,17 +11170,17 @@ nsDocShell::DoChannelLoad(nsIChannel* aC
  
    // Since we are loading a document we need to make sure the proper reserved
    // and initial client data is stored on the nsILoadInfo.  The
@@ -1338,8 +1337,8 @@ diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
    NS_ENSURE_SUCCESS(rv, rv);
  
    // We're about to load a new page and it may take time before necko
-@@ -12973,17 +12973,17 @@ nsDocShell::LoadHistoryEntry(nsISHEntry*
-     triggeringPrincipal = nsContentUtils::GetSystemPrincipal();
+@@ -12356,17 +12356,17 @@ nsDocShell::LoadHistoryEntry(nsISHEntry*
+     return NS_ERROR_FAILURE;
    }
  
    // Passing nullptr as aSourceDocShell gives the same behaviour as before
@@ -1357,7 +1356,7 @@ diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
                      referrerURI,
                      referrerPolicy,
                      triggeringPrincipal,
-@@ -15076,17 +15076,17 @@ nsDocShell::NotifyJSRunToCompletionStart
+@@ -14179,17 +14179,17 @@ nsDocShell::NotifyJSRunToCompletionStart
                                           const uint32_t aLineNumber,
                                           JS::Handle<JS::Value> aAsyncStack,
                                           const char* aAsyncCause)
@@ -1376,7 +1375,7 @@ diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
  
    mJSRunToCompletionDepth++;
  }
-@@ -15229,17 +15229,17 @@ nsDocShell::InFrameSwap()
+@@ -14332,17 +14332,17 @@ nsDocShell::InFrameSwap()
      shell = shell->GetParentDocshell();
    } while (shell);
    return false;
@@ -1398,7 +1397,7 @@ diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
 diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
 --- a/docshell/base/nsDocShell.h
 +++ b/docshell/base/nsDocShell.h
-@@ -329,17 +329,17 @@ public:
+@@ -319,17 +319,17 @@ public:
     * docshell is added to the docshell tree, which can affect what the ancestor
     * principals should look like.
     *
@@ -1417,7 +1416,7 @@ diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
     * above.   For each ancestor principal, we store the parent window ID.
     */
    const nsTArray<uint64_t>& AncestorOuterWindowIDs() const
-@@ -351,17 +351,17 @@ public:
+@@ -341,17 +341,17 @@ public:
     * Set the list of ancestor outer window IDs for this docshell.  We call this
     * from frameloader as well in order to keep the array matched with the
     * ancestor principals.
@@ -1430,12 +1429,12 @@ diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
 +    mAncestorOuterWindowIDs = std::move(aAncestorOuterWindowIDs);
    }
  
- private:
-   bool CanSetOriginAttributes();
+   const mozilla::OriginAttributes& GetOriginAttributes()
+   {
+     return mOriginAttributes;
+   }
  
- public:
-   const mozilla::OriginAttributes&
-   GetOriginAttributes()
+   // Determine whether this docshell corresponds to the given history entry,
 diff --git a/docshell/base/nsDocShellLoadInfo.cpp b/docshell/base/nsDocShellLoadInfo.cpp
 --- a/docshell/base/nsDocShellLoadInfo.cpp
 +++ b/docshell/base/nsDocShellLoadInfo.cpp
@@ -51931,7 +51930,7 @@ diff --git a/xpcom/ds/IncrementalTokenizer.cpp b/xpcom/ds/IncrementalTokenizer.c
 diff --git a/xpcom/ds/PLDHashTable.cpp b/xpcom/ds/PLDHashTable.cpp
 --- a/xpcom/ds/PLDHashTable.cpp
 +++ b/xpcom/ds/PLDHashTable.cpp
-@@ -232,22 +232,22 @@ PLDHashTable::operator=(PLDHashTable&& a
+@@ -231,22 +231,22 @@ PLDHashTable::operator=(PLDHashTable&& a
    MOZ_RELEASE_ASSERT(mOps == aOther.mOps);
    MOZ_RELEASE_ASSERT(mEntrySize == aOther.mEntrySize);
  

frg/work-js/mozilla-release/patches/mozilla-central-push_423155.patch → frg/work-js/mozilla-release/patches/1468406-4-62a1.patch

@@ -3,13 +3,13 @@
 # Date 1529485442 -7200
 #      Wed Jun 20 11:04:02 2018 +0200
 # Node ID 77b8ddea1fbd524f0917844f43c21c186262de5b
-# Parent  ee6d7b68769f8a889b9217c82f932683aa707f1e
+# Parent  30a5529ee1b13810092b176df28649e6993d8878
 Bug 1468406 part 4 - Remove remaining JSObject::realm() calls. r=luke
 
 diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctions.cpp
 --- a/js/src/builtin/TestingFunctions.cpp
 +++ b/js/src/builtin/TestingFunctions.cpp
-@@ -1355,17 +1355,17 @@ CaptureFirstSubsumedFrame(JSContext* cx,
+@@ -1356,17 +1356,17 @@ CaptureFirstSubsumedFrame(JSContext* cx,
  
      RootedObject obj(cx, &args[0].toObject());
      obj = CheckedUnwrap(obj);
@@ -158,7 +158,26 @@ diff --git a/js/src/jsapi-tests/testUbiNode.cpp b/js/src/jsapi-tests/testUbiNode
 diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
 --- a/js/src/jsapi.cpp
 +++ b/js/src/jsapi.cpp
-@@ -880,17 +880,17 @@ JS_TransplantObject(JSContext* cx, Handl
+@@ -732,17 +732,17 @@ JS_PUBLIC_API(JSString*)
+ JS::StringOfAddonId(JSAddonId* id)
+ {
+     return id;
+ }
+ 
+ JS_PUBLIC_API(JSAddonId*)
+ JS::AddonIdOfObject(JSObject* obj)
+ {
+-    return obj->realm()->creationOptions().addonIdOrNull();
++    return obj->nonCCWRealm()->creationOptions().addonIdOrNull();
+ }
+ 
+ JS_PUBLIC_API(void)
+ JS_SetZoneUserData(JS::Zone* zone, void* data)
+ {
+     zone->data = data;
+ }
+ 
+@@ -864,17 +864,17 @@ JS_TransplantObject(JSContext* cx, Handl
  
      JS::Compartment* destination = target->compartment();
  
@@ -177,7 +196,7 @@ diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
          // the new compartment. If there is, we use its identity and swap
          // in the contents of |target|.
          newIdentity = &p->value().get().toObject();
-@@ -914,17 +914,17 @@ JS_TransplantObject(JSContext* cx, Handl
+@@ -898,17 +898,17 @@ JS_TransplantObject(JSContext* cx, Handl
      // `newIdentity == origobj`, because this process also clears out any
      // cached wrapper state.
      if (!RemapAllWrappersForObject(cx, origobj, newIdentity))
@@ -196,6 +215,28 @@ diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
          if (!origobj->compartment()->putWrapper(cx, CrossCompartmentKey(newIdentity), origv))
              MOZ_CRASH();
      }
+diff --git a/js/src/jsexn.cpp b/js/src/jsexn.cpp
+--- a/js/src/jsexn.cpp
++++ b/js/src/jsexn.cpp
+@@ -794,17 +794,17 @@ ErrorReport::ReportAddonExceptionToTelem
+ 
+     // Let's ignore TOP level exceptions. For regular add-ons those will not be reported anyway,
+     // for SDK based once it should not be a valid case either.
+     // At this point the frame stack is unwound but the exception object stored the stack so let's
+     // use that for getting the function name.
+     if (!stack)
+         return;
+ 
+-    JS::Realm* sr = stack->realm();
++    JS::Realm* sr = stack->nonCCWRealm();
+     JSAddonId* addonId = sr->creationOptions().addonIdOrNull();
+ 
+     // We only want to send the report if the scope that just have thrown belongs to an add-on.
+     // Let's check the compartment of the youngest function on the stack, to determine that.
+     if (!addonId)
+         return;
+ 
+     RootedString funnameString(cx);
 diff --git a/js/src/proxy/CrossCompartmentWrapper.cpp b/js/src/proxy/CrossCompartmentWrapper.cpp
 --- a/js/src/proxy/CrossCompartmentWrapper.cpp
 +++ b/js/src/proxy/CrossCompartmentWrapper.cpp
@@ -431,7 +472,7 @@ diff --git a/js/src/vm/EnvironmentObject.cpp b/js/src/vm/EnvironmentObject.cpp
 diff --git a/js/src/vm/JSContext-inl.h b/js/src/vm/JSContext-inl.h
 --- a/js/src/vm/JSContext-inl.h
 +++ b/js/src/vm/JSContext-inl.h
-@@ -473,19 +473,32 @@ JSContext::enterAtomsZone(const js::Auto
+@@ -448,19 +448,32 @@ JSContext::enterAtomsZone(const js::Auto
      // Only one thread can be in the atoms zone at a time.
      MOZ_ASSERT(runtime_->currentThreadHasExclusiveAccess());
  

frg/work-js/mozilla-release/patches/1468792-62a1.patch

@@ -1,14 +1,15 @@
 # HG changeset patch
 # User Jon Coppeard <jcoppeard@mozilla.com>
 # Date 1529482958 -3600
+#      Wed Jun 20 09:22:38 2018 +0100
 # Node ID 7aaaed1a9ef133175a7f18054302e890e451f9eb
-# Parent  a4eaa08820524cf318dd4437c02c36d10f8f40c5
+# Parent  07a62b4e792399774c6c056140f1a6bf9102b164
 Bug 1468792 - Purge dota caches at the same time as deferred atom cache purge r=sfink
 
 diff --git a/js/src/gc/Zone.cpp b/js/src/gc/Zone.cpp
 --- a/js/src/gc/Zone.cpp
 +++ b/js/src/gc/Zone.cpp
-@@ -424,30 +424,44 @@ Zone::ownedByCurrentHelperThread()
+@@ -426,30 +426,44 @@ Zone::ownedByCurrentHelperThread()
  
  void Zone::releaseAtoms()
  {
@@ -57,7 +58,7 @@ diff --git a/js/src/gc/Zone.cpp b/js/src/gc/Zone.cpp
 diff --git a/js/src/gc/Zone.h b/js/src/gc/Zone.h
 --- a/js/src/gc/Zone.h
 +++ b/js/src/gc/Zone.h
-@@ -517,16 +517,17 @@ struct Zone : public JS::shadow::Zone,
+@@ -519,16 +519,17 @@ class Zone : public JS::shadow::Zone,
  
    public:
      js::SparseBitmap& markedAtoms() { return markedAtoms_.ref(); }

frg/work-js/mozilla-release/patches/mozilla-central-push_423535.patch → frg/work-js/mozilla-release/patches/1469640-62a1.patch

@@ -3,7 +3,7 @@
 # Date 1529929752 -3600
 #      Mon Jun 25 13:29:12 2018 +0100
 # Node ID 6867578ac52d03ec520f819903736aef5b5d8282
-# Parent  98323ed2610ba27091e63a7ad1f6e9e36e159db3
+# Parent  d68249a1bb8b7d26129bf886662ec7f459228e88
 Bug 1469640 - Make background sweeping a parallel task and remove GCHelperState r=sfink
 
 diff --git a/js/src/gc/Allocator.cpp b/js/src/gc/Allocator.cpp
@@ -31,7 +31,7 @@ diff --git a/js/src/gc/Allocator.cpp b/js/src/gc/Allocator.cpp
 diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
 --- a/js/src/gc/GC.cpp
 +++ b/js/src/gc/GC.cpp
-@@ -932,19 +932,17 @@ Chunk::updateChunkListAfterFree(JSRuntim
+@@ -935,19 +935,17 @@ Chunk::updateChunkListAfterFree(JSRuntim
          rt->gc.recycleChunk(this, lock);
      }
  }
@@ -52,7 +52,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
      atomsZone(nullptr),
      stats_(rt),
      marker(rt),
-@@ -999,18 +997,18 @@ GCRuntime::GCRuntime(JSRuntime* rt) :
+@@ -1003,18 +1001,18 @@ GCRuntime::GCRuntime(JSRuntime* rt) :
      fullCompartmentChecks(false),
      gcCallbackDepth(0),
      alwaysPreserveCode(false),
@@ -72,7 +72,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
  }
  
  #ifdef JS_GC_ZEAL
-@@ -1320,17 +1318,17 @@ GCRuntime::finish()
+@@ -1326,17 +1324,17 @@ GCRuntime::finish()
          nursery().disable();
      }
  
@@ -91,7 +91,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
      finishVerifier();
  #endif
  
-@@ -2742,17 +2740,17 @@ UpdatePointersTask::getArenasToUpdate()
+@@ -2780,17 +2778,17 @@ UpdatePointersTask::getArenasToUpdate()
  void
  UpdatePointersTask::updateArenas()
  {
@@ -110,7 +110,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
      while (getArenasToUpdate())
          updateArenas();
  }
-@@ -2995,17 +2993,20 @@ GCRuntime::updateRuntimePointersToReloca
+@@ -3045,17 +3043,20 @@ GCRuntime::updateRuntimePointersToReloca
  
      // Sweep everything to fix up weak pointers.
      Debugger::sweepAll(rt->defaultFreeOp());
@@ -132,7 +132,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
  void
  GCRuntime::protectAndHoldArenas(Arena* arenaList)
  {
-@@ -3514,17 +3515,17 @@ void
+@@ -3571,17 +3572,17 @@ void
  js::gc::BackgroundDecommitTask::setChunksToScan(ChunkVector &chunks)
  {
      MOZ_ASSERT(CurrentThreadCanAccessRuntime(runtime()));
@@ -151,7 +151,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
  
          // The arena list is not doubly-linked, so we have to work in the free
          // list order and not in the natural order.
-@@ -3579,207 +3580,167 @@ GCRuntime::sweepBackgroundThings(ZoneLis
+@@ -3636,207 +3637,167 @@ GCRuntime::sweepBackgroundThings(ZoneLis
          // Release any arenas that are now empty, dropping and reaquiring the GC
          // lock every so often to avoid blocking the main thread from
          // allocating chunks.
@@ -454,7 +454,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
  #ifdef JS_GC_ZEAL
      if (zealModeBits != 0)
          releaseTypes = true;
-@@ -5867,20 +5828,20 @@ GCRuntime::endSweepingSweepGroup(FreeOp*
+@@ -5924,20 +5885,20 @@ GCRuntime::endSweepingSweepGroup(FreeOp*
          if (zone->isAtomsZone())
              sweepAtomsZone = true;
          else
@@ -479,7 +479,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
  GCRuntime::beginSweepPhase(JS::gcreason::Reason reason, AutoGCSession& session)
  {
      /*
-@@ -6916,17 +6877,20 @@ GCRuntime::resetIncrementalGC(gc::AbortR
+@@ -6989,17 +6950,20 @@ GCRuntime::resetIncrementalGC(gc::AbortR
              ResetGrayList(c);
  
          for (GCZonesIter zone(rt); !zone.done(); zone.next()) {
@@ -501,7 +501,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
          break;
        }
  
-@@ -7210,17 +7174,16 @@ GCRuntime::incrementalCollectSlice(Slice
+@@ -7283,17 +7247,16 @@ GCRuntime::incrementalCollectSlice(Slice
  
        case State::Finalize:
          {
@@ -705,7 +705,7 @@ diff --git a/js/src/gc/GCRuntime.h b/js/src/gc/GCRuntime.h
      GCLockData<ChunkPool&> chunkPool_;
  
      const bool enabled_;
-@@ -309,27 +326,25 @@ class GCRuntime
+@@ -310,27 +327,25 @@ class GCRuntime
      }
  #endif
  
@@ -738,7 +738,7 @@ diff --git a/js/src/gc/GCRuntime.h b/js/src/gc/GCRuntime.h
          lock.unlock();
      }
  
-@@ -608,16 +623,17 @@ class GCRuntime
+@@ -609,16 +624,17 @@ class GCRuntime
                                            AllocKind kind);
      IncrementalProgress sweepShapeTree(FreeOp* fop, SliceBudget& budget, Zone* zone);
      void endSweepPhase(bool lastGC);
@@ -756,7 +756,7 @@ diff --git a/js/src/gc/GCRuntime.h b/js/src/gc/GCRuntime.h
                                       AutoGCSession& session);
      void endCompactPhase();
      void sweepTypesAfterCompacting(Zone* zone);
-@@ -813,25 +829,24 @@ class GCRuntime
+@@ -814,25 +830,24 @@ class GCRuntime
  
      /* Whether any sweeping will take place in the separate GC helper thread. */
      MainThreadData<bool> sweepOnBackgroundThread;
@@ -784,7 +784,7 @@ diff --git a/js/src/gc/GCRuntime.h b/js/src/gc/GCRuntime.h
       */
  
      MainThreadData<JS::Zone*> sweepGroups;
-@@ -946,21 +961,22 @@ class GCRuntime
+@@ -954,21 +969,22 @@ class GCRuntime
      MainThreadData<bool> arenasEmptyAtShutdown;
  #endif
  
@@ -809,7 +809,7 @@ diff --git a/js/src/gc/GCRuntime.h b/js/src/gc/GCRuntime.h
  
    private:
      MainThreadData<Nursery> nursery_;
-@@ -985,17 +1001,16 @@ class GCRuntime
+@@ -993,17 +1009,16 @@ class GCRuntime
  
      void minorGC(JS::gcreason::Reason reason,
                   gcstats::PhaseKind phase = gcstats::PhaseKind::MINOR_GC) JS_HAZ_GC_CALL;
@@ -875,7 +875,7 @@ diff --git a/js/src/threading/ProtectedData.cpp b/js/src/threading/ProtectedData
 diff --git a/js/src/vm/HelperThreads.cpp b/js/src/vm/HelperThreads.cpp
 --- a/js/src/vm/HelperThreads.cpp
 +++ b/js/src/vm/HelperThreads.cpp
-@@ -1208,17 +1208,16 @@ GlobalHelperThreadState::addSizeOfInclud
+@@ -1159,17 +1159,16 @@ GlobalHelperThreadState::addSizeOfInclud
          wasmTier2GeneratorWorklist_.sizeOfExcludingThis(mallocSizeOf) +
          promiseHelperTasks_.sizeOfExcludingThis(mallocSizeOf) +
          parseWorklist_.sizeOfExcludingThis(mallocSizeOf) +
@@ -893,7 +893,7 @@ diff --git a/js/src/vm/HelperThreads.cpp b/js/src/vm/HelperThreads.cpp
      for (auto task : parseFinishedList_)
          htStats.parseTask += task->sizeOfIncludingThis(mallocSizeOf);
      for (auto task : parseWaitingOnGC_)
-@@ -1295,24 +1294,16 @@ GlobalHelperThreadState::maxCompressionT
+@@ -1246,24 +1245,16 @@ GlobalHelperThreadState::maxCompressionT
          return 1;
  
      // Compression is triggered on major GCs to compress ScriptSources. It is
@@ -918,7 +918,7 @@ diff --git a/js/src/vm/HelperThreads.cpp b/js/src/vm/HelperThreads.cpp
  }
  
  bool
-@@ -1484,23 +1475,16 @@ GlobalHelperThreadState::scheduleCompres
+@@ -1435,23 +1426,16 @@ GlobalHelperThreadState::scheduleCompres
              // and deleted.
              Unused << worklist.append(std::move(pending[i]));
              remove(pending, &i);
@@ -942,7 +942,7 @@ diff --git a/js/src/vm/HelperThreads.cpp b/js/src/vm/HelperThreads.cpp
  
  js::GCParallelTask::~GCParallelTask()
  {
-@@ -2303,36 +2287,16 @@ GlobalHelperThreadState::trace(JSTracer*
+@@ -2217,36 +2201,16 @@ GlobalHelperThreadState::trace(JSTracer*
          parseTask->trace(trc);
      for (auto parseTask : parseFinishedList_)
          parseTask->trace(trc);
@@ -979,7 +979,7 @@ diff --git a/js/src/vm/HelperThreads.cpp b/js/src/vm/HelperThreads.cpp
      helperThread_ = thread;
  
      if (helperThread_)
-@@ -2344,21 +2308,16 @@ JSContext::setHelperThread(HelperThread*
+@@ -2258,21 +2222,16 @@ JSContext::setHelperThread(HelperThread*
  // Priority is determined by the order they're listed here.
  const HelperThread::TaskSpec HelperThread::taskSpecs[] = {
      {
@@ -1004,7 +1004,7 @@ diff --git a/js/src/vm/HelperThreads.cpp b/js/src/vm/HelperThreads.cpp
 diff --git a/js/src/vm/HelperThreads.h b/js/src/vm/HelperThreads.h
 --- a/js/src/vm/HelperThreads.h
 +++ b/js/src/vm/HelperThreads.h
-@@ -91,17 +91,16 @@ class GlobalHelperThreadState
+@@ -90,17 +90,16 @@ class GlobalHelperThreadState
  
      // Number of threads to create. May be accessed without locking.
      size_t threadCount;
@@ -1021,8 +1021,8 @@ diff --git a/js/src/vm/HelperThreads.h b/js/src/vm/HelperThreads.h
      using HelperThreadVector = Vector<HelperThread, 0, SystemAllocPolicy>;
      UniquePtr<HelperThreadVector> threads;
  
-     WriteOnceData<JS::RegisterThreadCallback> registerThread;
-@@ -136,36 +135,32 @@ class GlobalHelperThreadState
+   private:
+@@ -132,36 +131,32 @@ class GlobalHelperThreadState
      SourceCompressionTaskVector compressionPendingList_;
  
      // Source compression worklist of tasks that can start.
@@ -1059,7 +1059,7 @@ diff --git a/js/src/vm/HelperThreads.h b/js/src/vm/HelperThreads.h
      void finish();
      void finishThreads();
  
-@@ -258,35 +253,30 @@ class GlobalHelperThreadState
+@@ -254,35 +249,30 @@ class GlobalHelperThreadState
      SourceCompressionTaskVector& compressionWorklist(const AutoLockHelperThreadState&) {
          return compressionWorklist_;
      }
@@ -1095,7 +1095,7 @@ diff --git a/js/src/vm/HelperThreads.h b/js/src/vm/HelperThreads.h
    private:
      void scheduleCompressionTasks(const AutoLockHelperThreadState&);
  
-@@ -359,17 +349,16 @@ HelperThreadState()
+@@ -351,17 +341,16 @@ HelperThreadState()
  }
  
  typedef mozilla::Variant<jit::IonBuilder*,
@@ -1113,7 +1113,7 @@ diff --git a/js/src/vm/HelperThreads.h b/js/src/vm/HelperThreads.h
      mozilla::Maybe<Thread> thread;
  
      /*
-@@ -410,21 +399,16 @@ struct HelperThread
+@@ -396,21 +385,16 @@ struct HelperThread
          return maybeCurrentTaskAs<ParseTask*>();
      }
  
@@ -1135,7 +1135,7 @@ diff --git a/js/src/vm/HelperThreads.h b/js/src/vm/HelperThreads.h
      void destroy();
  
      static void ThreadMain(void* arg);
-@@ -461,17 +445,16 @@ struct HelperThread
+@@ -444,17 +428,16 @@ struct HelperThread
      void handleWasmTier1Workload(AutoLockHelperThreadState& locked);
      void handleWasmTier2Workload(AutoLockHelperThreadState& locked);
      void handleWasmTier2GeneratorWorkload(AutoLockHelperThreadState& locked);

frg/work-js/mozilla-release/patches/1470250-1-63a1.patch

@@ -2,7 +2,7 @@
 # User Jan de Mooij <jdemooij@mozilla.com>
 # Date 1529998925 -7200
 # Node ID 2f70bd2a3a9b4ee46613b08533bb106e9a73cd20
-# Parent  1cfb06673d7e226ff603e787d0d538a4919237ce
+# Parent  f9b662ab7520d0b146682673d434c29194771d8e
 Bug 1470250 part 1 - Use correct realm in ObjectGroupRealm::makeGroup. r=luke
 
 diff --git a/js/src/builtin/MapObject.cpp b/js/src/builtin/MapObject.cpp
@@ -76,7 +76,7 @@ diff --git a/js/src/vm/EnvironmentObject.cpp b/js/src/vm/EnvironmentObject.cpp
 diff --git a/js/src/vm/Iteration.cpp b/js/src/vm/Iteration.cpp
 --- a/js/src/vm/Iteration.cpp
 +++ b/js/src/vm/Iteration.cpp
-@@ -974,17 +974,18 @@ Realm::getOrCreateIterResultTemplateObje
+@@ -975,17 +975,18 @@ Realm::getOrCreateIterResultTemplateObje
  
      // Create template plain object
      RootedNativeObject templateObject(cx, NewBuiltinClassInstance<PlainObject>(cx, TenuredObject));
@@ -122,7 +122,7 @@ diff --git a/js/src/vm/JSObject-inl.h b/js/src/vm/JSObject-inl.h
 diff --git a/js/src/vm/JSObject.cpp b/js/src/vm/JSObject.cpp
 --- a/js/src/vm/JSObject.cpp
 +++ b/js/src/vm/JSObject.cpp
-@@ -2104,17 +2104,17 @@ SetClassAndProto(JSContext* cx, HandleOb
+@@ -2105,17 +2105,17 @@ SetClassAndProto(JSContext* cx, HandleOb
      RootedObjectGroup oldGroup(cx, obj->group());
  
      ObjectGroup* newGroup;
@@ -141,7 +141,7 @@ diff --git a/js/src/vm/JSObject.cpp b/js/src/vm/JSObject.cpp
          if (!newGroup)
              return false;
      }
-@@ -2140,18 +2140,17 @@ SetClassAndProto(JSContext* cx, HandleOb
+@@ -2141,18 +2141,17 @@ SetClassAndProto(JSContext* cx, HandleOb
  
  /* static */ bool
  JSObject::changeToSingleton(JSContext* cx, HandleObject obj)

frg/work-js/mozilla-release/patches/1470522-63a1.patch

@@ -2,7 +2,7 @@
 # User Ted Campbell <tcampbell@mozilla.com>
 # Date 1529102325 14400
 # Node ID 22123be00ffb183377048bcc7d8ace84f2a352a4
-# Parent  e9a8f9b1b705b81aa7e31254e4b97e7f3a0de35c
+# Parent  2ccdce4c8564c3685700a69b3801fc3356589719
 Bug 1470522 - Enable JS dump functions under JS_JITSPEW. r=jandem
 
 MozReview-Commit-ID: 5WWncxovx2M
@@ -10,7 +10,7 @@ MozReview-Commit-ID: 5WWncxovx2M
 diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctions.cpp
 --- a/js/src/builtin/TestingFunctions.cpp
 +++ b/js/src/builtin/TestingFunctions.cpp
-@@ -3262,17 +3262,17 @@ DisableTraceLogger(JSContext* cx, unsign
+@@ -3268,17 +3268,17 @@ DisableTraceLogger(JSContext* cx, unsign
      CallArgs args = CallArgsFromVp(argc, vp);
      TraceLoggerThread* logger = TraceLoggerForCurrentThread(cx);
      args.rval().setBoolean(TraceLoggerDisable(logger));
@@ -29,7 +29,7 @@ diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctio
      if (!obj)
          return false;
  
-@@ -5749,17 +5749,17 @@ gc::ZealModeHelpText),
+@@ -5801,17 +5801,17 @@ gc::ZealModeHelpText),
  
      JS_FN_HELP("shortestPaths", ShortestPaths, 3, 0,
  "shortestPaths(start, targets, maxNumPaths)",
@@ -196,7 +196,7 @@ diff --git a/js/src/jsfriendapi.h b/js/src/jsfriendapi.h
 diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
 --- a/js/src/shell/js.cpp
 +++ b/js/src/shell/js.cpp
-@@ -2603,17 +2603,17 @@ PCToLine(JSContext* cx, unsigned argc, V
+@@ -2611,17 +2611,17 @@ PCToLine(JSContext* cx, unsigned argc, V
          return false;
      lineno = PCToLineNumber(script, script->offsetToPC(i));
      if (!lineno)
@@ -215,7 +215,7 @@ diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
      jsbytecode* pc;
      JSOp op;
      ptrdiff_t jmplen;
-@@ -2716,26 +2716,26 @@ SrcNotes(JSContext* cx, HandleScript scr
+@@ -2724,26 +2724,26 @@ SrcNotes(JSContext* cx, HandleScript scr
  
            case SRC_WHILE:
            case SRC_NEXTCASE:
@@ -244,7 +244,7 @@ diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
                      return false;
              }
              UpdateSwitchTableBounds(cx, script, offset,
-@@ -3207,17 +3207,17 @@ DisassWithSrc(JSContext* cx, unsigned ar
+@@ -3215,17 +3215,17 @@ DisassWithSrc(JSContext* cx, unsigned ar
  
          fprintf(gOutFile->fp, "%s\n", sprinter.string());
      }
@@ -263,7 +263,7 @@ diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
      return true;
  }
  
-@@ -4092,17 +4092,17 @@ ClearLastWarning(JSContext* cx, unsigned
+@@ -4100,17 +4100,17 @@ ClearLastWarning(JSContext* cx, unsigned
      }
  
      sc->lastWarning.setNull();
@@ -282,7 +282,7 @@ diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
      if (!gOutFile->isOpen()) {
          JS_ReportErrorASCII(cx, "output file is closed");
          return false;
-@@ -6686,17 +6686,17 @@ static const JSFunctionSpecWithHelp shel
+@@ -6699,17 +6699,17 @@ static const JSFunctionSpecWithHelp shel
      JS_FN_HELP("stopTimingMutator", StopTimingMutator, 0, 0,
  "stopTimingMutator()",
  "  Stop accounting time to mutator vs GC and dump the results."),
@@ -713,7 +713,7 @@ diff --git a/js/src/vm/BytecodeUtil.h b/js/src/vm/BytecodeUtil.h
 diff --git a/js/src/vm/JSObject.cpp b/js/src/vm/JSObject.cpp
 --- a/js/src/vm/JSObject.cpp
 +++ b/js/src/vm/JSObject.cpp
-@@ -3394,17 +3394,17 @@ GetObjectSlotNameFunctor::operator()(JS:
+@@ -3368,17 +3368,17 @@ GetObjectSlotNameFunctor::operator()(JS:
          } else {
              snprintf(buf, bufsize, "**FINALIZED ATOM KEY**");
          }
@@ -732,7 +732,7 @@ diff --git a/js/src/vm/JSObject.cpp b/js/src/vm/JSObject.cpp
   */
  
  static void
-@@ -3445,25 +3445,23 @@ dumpValue(const Value& v, js::GenericPri
+@@ -3419,25 +3419,23 @@ dumpValue(const Value& v, js::GenericPri
                  (void*) obj);
      } else if (v.isBoolean()) {
          if (v.toBoolean())
@@ -758,7 +758,7 @@ diff --git a/js/src/vm/JSObject.cpp b/js/src/vm/JSObject.cpp
  
  namespace js {
  
-@@ -3738,17 +3736,17 @@ js::DumpInterpreterFrame(JSContext* cx, 
+@@ -3717,17 +3715,17 @@ js::DumpInterpreterFrame(JSContext* cx, 
          out.putChar('\n');
  
          out.printf("  envChain: (JSObject*) %p\n", (void*) i.environmentChain(cx));
@@ -780,7 +780,7 @@ diff --git a/js/src/vm/JSObject.cpp b/js/src/vm/JSObject.cpp
 diff --git a/js/src/vm/JSObject.h b/js/src/vm/JSObject.h
 --- a/js/src/vm/JSObject.h
 +++ b/js/src/vm/JSObject.h
-@@ -528,17 +528,17 @@ class JSObject : public js::gc::Cell
+@@ -531,17 +531,17 @@ class JSObject : public js::gc::Cell
      }
  
      template <class T>

frg/work-js/mozilla-release/patches/1471134-3-63a1.patch

@@ -3,7 +3,7 @@
 # Date 1531073580 -10800
 #      Sun Jul 08 21:13:00 2018 +0300
 # Node ID f0328b9f1a4d2f9f565c1f20af9559c07bf3e6fa
-# Parent  b5419a2c66e02d9cd10eb416de67a428eed4bae3
+# Parent  5e6512c5eaf61f6df1a6681249864dd9ea0f2d30
 bug 1471134 - Part 3: Make arithmetic operand arguments mutable. r=jandem
 
 Follow the example of AddOperation, which uses MutableHandleValue for
@@ -13,7 +13,7 @@ be converted using ToNumeric instead of ToNumber.
 diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
 --- a/js/src/jit/BaselineIC.cpp
 +++ b/js/src/jit/BaselineIC.cpp
-@@ -4558,20 +4558,23 @@ DoUnaryArithFallback(JSContext* cx, Base
+@@ -4551,20 +4551,23 @@ DoUnaryArithFallback(JSContext* cx, Base
      switch (op) {
        case JSOP_BITNOT: {
          int32_t result;
@@ -72,7 +72,7 @@ diff --git a/js/src/vm/Interpreter-inl.h b/js/src/vm/Interpreter-inl.h
 --- a/js/src/vm/Interpreter-inl.h
 +++ b/js/src/vm/Interpreter-inl.h
 @@ -442,17 +442,17 @@ DefVarOperation(JSContext* cx, HandleObj
-         if (!varobj->realm()->addToVarNames(cx, dn))
+         if (!varobj->as<GlobalObject>().realm()->addToVarNames(cx, dn))
              return false;
      }
  
@@ -145,7 +145,7 @@ diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
          res.setInt32(mod);
          return true;
      }
-@@ -2606,50 +2606,50 @@ CASE(JSOP_ADD)
+@@ -2597,50 +2597,50 @@ CASE(JSOP_ADD)
  }
  END_CASE(JSOP_ADD)
  
@@ -200,7 +200,7 @@ diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
  CASE(JSOP_POW)
  {
      ReservedRooted<Value> lval(&rootValue0, REGS.sp[-2]);
-@@ -2678,17 +2678,17 @@ CASE(JSOP_BITNOT)
+@@ -2669,17 +2669,17 @@ CASE(JSOP_BITNOT)
      REGS.sp[-1].setInt32(i);
  }
  END_CASE(JSOP_BITNOT)

frg/work-js/mozilla-release/patches/1480819-6-63a1.patch

@@ -3,13 +3,13 @@
 # Date 1533916228 25200
 #      Fri Aug 10 08:50:28 2018 -0700
 # Node ID 411fa809129a533f492136cb8ac58a4ef7e1119e
-# Parent  d7a869dc10e28cdf087fc1c2e9284c13b48e9ab6
+# Parent  7c2955ada3c27d2def1493b456b4a7e95af98b61
 Bug 1480819 - Part 6: Add helper methods to MacroAssembler to work with CharEncoding and reduce code duplication. r=mgaudet
 
 diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
 --- a/js/src/jit/CodeGenerator.cpp
 +++ b/js/src/jit/CodeGenerator.cpp
-@@ -1474,24 +1474,23 @@ PrepareAndExecuteRegExp(JSContext* cx, M
+@@ -1472,24 +1472,23 @@ PrepareAndExecuteRegExp(JSContext* cx, M
          // <> floor(x / 1024) * 1024 = SurrogateMin
          // <> (x >>> 10) << 10 = SurrogateMin
          // <> x & ~(2^10 - 1) = SurrogateMin
@@ -36,7 +36,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
          masm.subPtr(Imm32(1), lastIndex);
  
          masm.bind(&done);
-@@ -1638,17 +1637,17 @@ PrepareAndExecuteRegExp(JSContext* cx, M
+@@ -1636,17 +1635,17 @@ PrepareAndExecuteRegExp(JSContext* cx, M
          masm.load32(endIndexAddress, temp3);
      }
  
@@ -55,7 +55,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
      Register temp1_;
      Register temp2_;
      Label* failure_;
-@@ -1686,17 +1685,32 @@ void
+@@ -1684,17 +1683,32 @@ void
  CreateDependentString::generate(MacroAssembler& masm, const JSAtomState& names,
                                  CompileRuntime* runtime, Register base,
                                  BaseIndex startIndexAddress, BaseIndex limitIndexAddress,
@@ -89,7 +89,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
  
      Label done, nonEmpty;
  
-@@ -1704,97 +1718,80 @@ CreateDependentString::generate(MacroAss
+@@ -1702,97 +1716,80 @@ CreateDependentString::generate(MacroAss
      masm.branchTest32(Assembler::NonZero, temp1_, temp1_, &nonEmpty);
      masm.movePtr(ImmGCPtr(names.empty), string_);
      masm.jump(&done);
@@ -212,7 +212,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
          // Watch for undepended strings, which have a base pointer but don't
          // actually share their characters with it.
          Label noBase;
-@@ -2601,29 +2598,37 @@ CodeGenerator::visitOutOfLineRegExpInsta
+@@ -2599,29 +2596,37 @@ CodeGenerator::visitOutOfLineRegExpInsta
      masm.storeCallBoolResult(output);
  
      restoreVolatile(output);
@@ -259,7 +259,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
  
      masm.bind(&done);
  }
-@@ -2645,24 +2650,22 @@ CodeGenerator::visitGetFirstDollarIndex(
+@@ -2643,24 +2648,22 @@ CodeGenerator::visitGetFirstDollarIndex(
                                     StoreRegisterTo(output));
  
      masm.branchIfRope(str, ool->entry());
@@ -286,7 +286,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
  typedef JSString* (*StringReplaceFn)(JSContext*, HandleString, HandleString, HandleString);
  static const VMFunction StringFlatReplaceInfo =
      FunctionInfo<StringReplaceFn>(js::str_flat_replace_string, "str_flat_replace_string");
-@@ -8197,149 +8200,144 @@ CodeGenerator::visitConcat(LConcat* lir)
+@@ -8125,149 +8128,144 @@ CodeGenerator::visitConcat(LConcat* lir)
      MOZ_ASSERT(ToRegister(lir->temp5()) == CallTempReg4);
      MOZ_ASSERT(output == CallTempReg5);
  
@@ -479,7 +479,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
  static const VMFunction SubstringKernelInfo =
      FunctionInfo<SubstringKernelFn>(SubstringKernel, "SubstringKernel");
  
-@@ -8382,79 +8380,69 @@ CodeGenerator::visitSubstr(LSubstr* lir)
+@@ -8310,79 +8308,69 @@ CodeGenerator::visitSubstr(LSubstr* lir)
      masm.bind(&nonZero);
      masm.branchIfRopeOrExternal(string, temp, slowPath);
  
@@ -591,7 +591,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
  JitCode*
  JitRealm::generateStringConcatStub(JSContext* cx)
  {
-@@ -8533,21 +8521,21 @@ JitRealm::generateStringConcatStub(JSCon
+@@ -8461,21 +8449,21 @@ JitRealm::generateStringConcatStub(JSCon
      masm.ret();
  
      masm.bind(&rightEmpty);
@@ -618,7 +618,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
 diff --git a/js/src/jit/MacroAssembler.cpp b/js/src/jit/MacroAssembler.cpp
 --- a/js/src/jit/MacroAssembler.cpp
 +++ b/js/src/jit/MacroAssembler.cpp
-@@ -1744,26 +1744,16 @@ MacroAssembler::loadDependentStringBase(
+@@ -1659,26 +1659,16 @@ MacroAssembler::loadDependentStringBase(
                        Address(str, JSString::offsetOfFlags()), Imm32(JSString::HAS_BASE_BIT),
                        dest, str);
      }
@@ -645,7 +645,7 @@ diff --git a/js/src/jit/MacroAssembler.cpp b/js/src/jit/MacroAssembler.cpp
  void
  MacroAssembler::loadStringChar(Register str, Register index, Register output, Register scratch,
                                 Label* fail)
-@@ -1790,22 +1780,22 @@ MacroAssembler::loadStringChar(Register 
+@@ -1705,22 +1695,22 @@ MacroAssembler::loadStringChar(Register 
  
      bind(&notRope);
  
@@ -670,7 +670,7 @@ diff --git a/js/src/jit/MacroAssembler.cpp b/js/src/jit/MacroAssembler.cpp
  MacroAssembler::loadStringIndexValue(Register str, Register dest, Label* fail)
  {
      MOZ_ASSERT(str != dest);
-@@ -1815,16 +1805,37 @@ MacroAssembler::loadStringIndexValue(Reg
+@@ -1730,16 +1720,37 @@ MacroAssembler::loadStringIndexValue(Reg
      // Does not have a cached index value.
      branchTest32(Assembler::Zero, dest, Imm32(JSString::INDEX_VALUE_BIT), fail);
  
@@ -711,7 +711,7 @@ diff --git a/js/src/jit/MacroAssembler.cpp b/js/src/jit/MacroAssembler.cpp
 diff --git a/js/src/jit/MacroAssembler.h b/js/src/jit/MacroAssembler.h
 --- a/js/src/jit/MacroAssembler.h
 +++ b/js/src/jit/MacroAssembler.h
-@@ -2002,20 +2002,53 @@ class MacroAssembler : public MacroAssem
+@@ -1999,20 +1999,53 @@ class MacroAssembler : public MacroAssem
      void loadStringChar(Register str, Register index, Register output, Register scratch,
                          Label* fail);
  
@@ -759,10 +759,10 @@ diff --git a/js/src/jit/MacroAssembler.h b/js/src/jit/MacroAssembler.h
 +    void addToCharPtr(Register chars, Register index, CharEncoding encoding);
 +
      void loadJSContext(Register dest);
-     void loadJitActivation(Register dest) {
-         loadJSContext(dest);
-         loadPtr(Address(dest, offsetof(JSContext, activation_)), dest);
-     }
  
-     void guardGroupHasUnanalyzedNewScript(Register group, Register scratch, Label* fail);
+     void switchToRealm(Register realm);
+     void switchToRealm(const void* realm, Register scratch);
+     void switchToObjectRealm(Register obj, Register scratch);
+     void switchToBaselineFrameRealm(Register scratch);
+     void debugAssertContextRealm(const void* realm, Register scratch);
  

frg/work-js/mozilla-release/patches/1486577-8-63a1.patch

@@ -3,7 +3,7 @@
 # Date 1535169109 18000
 #      Fri Aug 24 22:51:49 2018 -0500
 # Node ID 48921866b394212e0dddd0ba72c183081bc6805f
-# Parent  4d9b2ff1071590facd282e1bf7cf7f3541da78fa
+# Parent  8a5a405b2091d84433d2081f8ff4297a41539403
 Bug 1486577 - Don't #include "js/CompilationAndEvaluation.h" in jsapi.h, minimizing the scope of that header and reducing translation-unit size of anything that needs JSAPI but doesn't need to compile/evaluate JavaScript.  r=jandem
 
 diff --git a/dom/base/nsFrameMessageManager.cpp b/dom/base/nsFrameMessageManager.cpp
@@ -517,12 +517,12 @@ diff --git a/js/src/jsapi-tests/testPreserveJitCode.cpp b/js/src/jsapi-tests/tes
 +#include "js/CompilationAndEvaluation.h"
  #include "jsapi-tests/tests.h"
  
+ #include "vm/JSObject-inl.h"
+ 
  using namespace JS;
  
  static void
  ScriptCallback(JSRuntime* rt, void* data, JSScript* script, const JS::AutoRequireNoGC& nogc)
- {
-     unsigned& count = *static_cast<unsigned*>(data);
 diff --git a/js/src/jsapi-tests/testPrivateGCThingValue.cpp b/js/src/jsapi-tests/testPrivateGCThingValue.cpp
 --- a/js/src/jsapi-tests/testPrivateGCThingValue.cpp
 +++ b/js/src/jsapi-tests/testPrivateGCThingValue.cpp

frg/work-js/mozilla-release/patches/1489698-2-65a1.patch

@@ -3,7 +3,7 @@
 # Date 1536360464 14400
 #      Fri Sep 07 18:47:44 2018 -0400
 # Node ID 6a27ee7d892bbc85ce8b2223724929ce783c5a76
-# Parent  6d3b3bcc2f2ebbb9c95f6d1f94c108123d264e0b
+# Parent  8bb0d578b0035b20c14a9fc411898e3f3576bca3
 Bug 1489698 - Move js/src/moz.build defines to own file. r=froydnj
 
 MozReview-Commit-ID: ImcZFI3YlVo
@@ -91,9 +91,9 @@ diff --git a/js/src/moz.build b/js/src/moz.build
  component_intl   = ('Core', 'JavaScript: Internationalization API')
  component_jit    = ('Core', 'JavaScript Engine: JIT')
  component_stl    = ('Core', 'JavaScript: Standard Library')
+ component_wasm   = ('Core', 'Javascript: Web Assembly')
  
- FILES_PER_UNIFIED_FILE = 6
-@@ -699,42 +701,16 @@ ReservedWordsGenerated.inputs += [
+@@ -708,42 +710,16 @@ ReservedWordsGenerated.inputs += [
  ]
  
  DIRS += [
@@ -136,7 +136,7 @@ diff --git a/js/src/moz.build b/js/src/moz.build
      # C4661 ("no suitable definition provided for explicit template
      # instantiation request") is emitted for all Parser methods that
      # have a Parser<FullParseHandler> definition but no
-@@ -790,19 +766,16 @@ selfhosted.inputs = [
+@@ -799,19 +775,16 @@ selfhosted.inputs = [
      'builtin/TypedObject.js',
      'builtin/WeakMap.js',
      'builtin/WeakSet.js'

frg/work-js/mozilla-release/patches/1489698-3-65a1.patch

@@ -3,7 +3,7 @@
 # Date 1536360878 14400
 #      Fri Sep 07 18:54:38 2018 -0400
 # Node ID 56d5a9b4eb9d6eeb01aeb2c2370d509a8799d0e8
-# Parent  d131d6081d151092f4618b209d66bdf4e50248e9
+# Parent  78c333fa32d017df750fca431d5bb7d0427c1e39
 Bug 1489698 - Move js/src/moz.build CXXFLAGS to own file. r=froydnj
 
 MozReview-Commit-ID: 3A0GNZ1hHeZ
@@ -65,8 +65,8 @@ diff --git a/js/src/moz.build b/js/src/moz.build
  component_intl   = ('Core', 'JavaScript: Internationalization API')
  component_jit    = ('Core', 'JavaScript Engine: JIT')
  component_stl    = ('Core', 'JavaScript: Standard Library')
- 
-@@ -689,34 +690,16 @@ ReservedWordsGenerated.inputs += [
+ component_wasm   = ('Core', 'Javascript: Web Assembly')
+@@ -710,34 +711,16 @@ ReservedWordsGenerated.inputs += [
  ]
  
  DIRS += [
@@ -101,7 +101,7 @@ diff --git a/js/src/moz.build b/js/src/moz.build
      'js.msg',
      'builtin/TypedObjectConstants.h',
      'builtin/SelfHostingDefines.h',
-@@ -755,22 +738,16 @@ selfhosted.inputs = [
+@@ -776,22 +759,16 @@ selfhosted.inputs = [
      'builtin/WeakMap.js',
      'builtin/WeakSet.js'
  ]

frg/work-js/mozilla-release/patches/1814899-1029.patch

@@ -2,7 +2,7 @@
 # User Iain Ireland <iireland@mozilla.com>
 # Date 1676313190 0
 # Node ID 207a0ca14a754cccfed04e5ce55c513afb3d25a6
-# Parent  ef5bdd218bc87fe6da40c501fdeed4b4c23c9dec
+# Parent  35dde21fc23e070df5a931f6f01fedc890f912cd
 Bug 1814899: Ensure more OsiSpace r=jandem, a=dmeehan
 
 Differential Revision: https://phabricator.services.mozilla.com/D169274
@@ -10,7 +10,7 @@ Differential Revision: https://phabricator.services.mozilla.com/D169274
 diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
 --- a/js/src/jit/CodeGenerator.cpp
 +++ b/js/src/jit/CodeGenerator.cpp
-@@ -2555,16 +2555,17 @@ CodeGenerator::emitSharedStub(ICStub::Ki
+@@ -2835,16 +2835,17 @@ CodeGenerator::emitSharedStub(ICStub::Ki
      IonICEntry entry(script->pcToOffset(pc), ICEntry::Kind_Op, script);
      EmitCallIC(&patchOffset, masm);
      entry.setReturnOffset(CodeOffset(masm.currentOffset()));
@@ -28,7 +28,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
  #endif
      markSafepointAt(callOffset, lir);
  }
-@@ -4083,16 +4084,17 @@ CodeGenerator::visitCallNative(LCallNati
+@@ -4375,16 +4376,17 @@ CodeGenerator::visitCallNative(LCallNati
      masm.passABIArg(argUintNReg);
      masm.passABIArg(argVpReg);
      JSNative native = target->native();
@@ -46,7 +46,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
      // Test for failure.
      masm.branchIfFalseBool(ReturnReg, masm.failureLabel());
  
-@@ -4226,16 +4228,17 @@ CodeGenerator::visitCallDOMNative(LCallD
+@@ -4520,16 +4522,17 @@ CodeGenerator::visitCallDOMNative(LCallD
  
      // Construct and execute call.
      masm.setupUnalignedABICall(argJSContext);
@@ -64,7 +64,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
                         JSReturnOperand);
      } else {
          // Test for failure.
-@@ -4344,16 +4347,17 @@ CodeGenerator::visitCallGeneric(LCallGen
+@@ -4652,16 +4655,17 @@ CodeGenerator::visitCallGeneric(LCallGen
      masm.bind(&thunk);
      {
          TrampolinePtr argumentsRectifier = gen->jitRuntime()->getArgumentsRectifier();
@@ -77,12 +77,12 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
      uint32_t callOffset = masm.callJit(objreg);
      markSafepointAt(callOffset, call);
  
-     // Increment to remove IonFramePrefix; decrement to fill FrameSizeClass.
-     // The return address has already been removed from the Ion frame.
-     int prefixGarbage = sizeof(JitFrameLayout) - sizeof(void*);
-     masm.adjustStack(prefixGarbage - unusedStack);
-     masm.jump(&end);
-@@ -4440,16 +4444,17 @@ CodeGenerator::visitCallKnown(LCallKnown
+     if (call->mir()->maybeCrossRealm()) {
+         static_assert(!JSReturnOperand.aliases(ReturnReg),
+                       "ReturnReg available as scratch after scripted calls");
+         masm.switchToRealm(gen->realm->realmPtr(), ReturnReg);
+     }
+@@ -4757,16 +4761,17 @@ CodeGenerator::visitCallKnown(LCallKnown
      // Construct the IonFramePrefix.
      uint32_t descriptor = MakeFrameDescriptor(masm.framePushed(), JitFrame_IonJS,
                                                JitFrameLayout::Size());
@@ -95,12 +95,12 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
      uint32_t callOffset = masm.callJit(objreg);
      markSafepointAt(callOffset, call);
  
-     // Increment to remove IonFramePrefix; decrement to fill FrameSizeClass.
-     // The return address has already been removed from the Ion frame.
-     int prefixGarbage = sizeof(JitFrameLayout) - sizeof(void*);
-     masm.adjustStack(prefixGarbage - unusedStack);
- 
-@@ -4774,16 +4779,17 @@ CodeGenerator::emitApplyGeneric(T* apply
+     if (call->mir()->maybeCrossRealm()) {
+         static_assert(!JSReturnOperand.aliases(ReturnReg),
+                       "ReturnReg available as scratch after scripted calls");
+         masm.switchToRealm(gen->realm->realmPtr(), ReturnReg);
+     }
+@@ -5100,16 +5105,17 @@ CodeGenerator::emitApplyGeneric(T* apply
              // Hardcode the address of the argumentsRectifier code.
              TrampolinePtr argumentsRectifier = gen->jitRuntime()->getArgumentsRectifier();
              masm.movePtr(argumentsRectifier, objreg);
@@ -113,12 +113,12 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
          uint32_t callOffset = masm.callJit(objreg);
          markSafepointAt(callOffset, apply);
  
-         // Recover the number of arguments from the frame descriptor.
-         masm.loadPtr(Address(masm.getStackPointer(), 0), stackSpace);
-         masm.rshiftPtr(Imm32(FRAMESIZE_SHIFT), stackSpace);
-         masm.subPtr(Imm32(pushed), stackSpace);
- 
-@@ -11811,16 +11817,17 @@ CodeGenerator::visitGetDOMProperty(LGetD
+         if (apply->mir()->maybeCrossRealm()) {
+             static_assert(!JSReturnOperand.aliases(ReturnReg),
+                           "ReturnReg available as scratch after scripted calls");
+             masm.switchToRealm(gen->realm->realmPtr(), ReturnReg);
+         }
+@@ -12228,16 +12234,17 @@ CodeGenerator::visitGetDOMProperty(LGetD
      markSafepointAt(safepointOffset, ins);
  
      masm.setupUnalignedABICall(JSContextReg);
@@ -136,7 +136,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
                         JSReturnOperand);
      } else {
          masm.branchIfFalseBool(ReturnReg, masm.exceptionLabel());
-@@ -11910,16 +11917,17 @@ CodeGenerator::visitSetDOMProperty(LSetD
+@@ -12333,16 +12340,17 @@ CodeGenerator::visitSetDOMProperty(LSetD
      markSafepointAt(safepointOffset, ins);
  
      masm.setupUnalignedABICall(JSContextReg);
@@ -200,7 +200,7 @@ new file mode 100644
 diff --git a/js/src/jit/shared/CodeGenerator-shared.cpp b/js/src/jit/shared/CodeGenerator-shared.cpp
 --- a/js/src/jit/shared/CodeGenerator-shared.cpp
 +++ b/js/src/jit/shared/CodeGenerator-shared.cpp
-@@ -1111,28 +1111,28 @@ CodeGeneratorShared::ensureOsiSpace()
+@@ -1112,28 +1112,28 @@ CodeGeneratorShared::ensureOsiSpace()
      if (masm.currentOffset() - lastOsiPointOffset_ < Assembler::PatchWrite_NearCallSize()) {
          int32_t paddingSize = Assembler::PatchWrite_NearCallSize();
          paddingSize -= masm.currentOffset() - lastOsiPointOffset_;

frg/work-js/mozilla-release/patches/NOBUG-killtelemetry-docshell-25317.patch

@@ -1,16 +1,16 @@
 # HG changeset patch
 # User Frank-Rainer Grahl <frgrahl@gmx.net>
 # Date 1684967687 -7200
-# Parent  3c29745cbd51079e3dfab2860bf310f1736e4ff6
+# Parent  362aa4fb5e1f3640e5a5cba91af07ab36b636b3c
 No Bug - Kill telemetry code in docshell. r=me a=me
 
 diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
 --- a/docshell/base/nsDocShell.cpp
 +++ b/docshell/base/nsDocShell.cpp
 @@ -25,17 +25,16 @@
- #include "mozilla/EventStateManager.h"
- #include "mozilla/LoadInfo.h"
  #include "mozilla/HTMLEditor.h"
+ #include "mozilla/LoadInfo.h"
+ #include "mozilla/Logging.h"
  #include "mozilla/MediaFeatureChange.h"
  #include "mozilla/Preferences.h"
  #include "mozilla/ResultExtensions.h"
@@ -18,32 +18,32 @@ diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
  #include "mozilla/StartupTimeline.h"
 -#include "mozilla/Telemetry.h"
  #include "mozilla/Unused.h"
- #include "Navigator.h"
- #include "URIUtils.h"
- #include "mozilla/dom/DocGroup.h"
- #include "mozilla/dom/TabGroup.h"
- 
- #include "nsIContent.h"
- #include "nsIContentInlines.h"
-@@ -191,17 +190,16 @@
- #endif
  
- #include "nsContentUtils.h"
- #include "nsIContentSecurityPolicy.h"
- #include "nsILoadInfo.h"
- #include "nsSandboxFlags.h"
- #include "nsXULAppAPI.h"
- #include "nsDOMNavigationTiming.h"
+ #include "mozilla/dom/ClientChannelHelper.h"
+ #include "mozilla/dom/ClientHandle.h"
+ #include "mozilla/dom/ClientInfo.h"
+ #include "mozilla/dom/ClientManager.h"
+ #include "mozilla/dom/ClientSource.h"
+ #include "mozilla/dom/ContentChild.h"
+@@ -111,17 +110,16 @@
+ #include "nsIReflowObserver.h"
+ #include "nsIScriptChannel.h"
+ #include "nsIScriptError.h"
+ #include "nsIScriptObjectPrincipal.h"
+ #include "nsIScriptSecurityManager.h"
+ #include "nsIScrollableFrame.h"
+ #include "nsIScrollObserver.h"
+ #include "nsISecureBrowserUI.h"
 -#include "nsISecurityUITelemetry.h"
- #include "nsDSURIContentListener.h"
- #include "nsDocShellLoadTypes.h"
- #include "nsDocShellTransferableHooks.h"
- #include "nsICommandManager.h"
- #include "nsIDOMNode.h"
- #include "nsIClassOfService.h"
- #include "nsIDocShellTreeOwner.h"
- #include "nsIHttpChannel.h"
-@@ -2079,87 +2077,16 @@ nsDocShell::GetCharset(nsACString& aChar
+ #include "nsISeekableStream.h"
+ #include "nsISelectionDisplay.h"
+ #include "nsIServiceWorkerManager.h"
+ #include "nsISHContainer.h"
+ #include "nsISHEntry.h"
+ #include "nsISHistory.h"
+ #include "nsISHistoryInternal.h"
+ #include "nsISiteSecurityService.h"
+@@ -1470,87 +1468,16 @@ nsDocShell::GetCharset(nsACString& aChar
    NS_ENSURE_TRUE(presShell, NS_ERROR_FAILURE);
    nsIDocument* doc = presShell->GetDocument();
    NS_ENSURE_TRUE(doc, NS_ERROR_FAILURE);
@@ -131,7 +131,7 @@ diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
  
  NS_IMETHODIMP
  nsDocShell::SetForcedCharset(const nsACString& aCharset)
-@@ -5114,38 +5041,25 @@ nsDocShell::DisplayLoadError(nsresult aE
+@@ -4627,38 +4554,25 @@ nsDocShell::DisplayLoadError(nsresult aE
          // HSTS/pinning takes precedence over the expert bad cert pref. We
          // never want to show the "Add Exception" button for these sites.
          // In the future we should differentiate between an HSTS host and a
@@ -170,7 +170,7 @@ diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
               NS_ERROR_MALWARE_URI == aError ||
               NS_ERROR_UNWANTED_URI == aError ||
               NS_ERROR_HARMFUL_URI == aError) {
-@@ -7669,18 +7583,16 @@ nsDocShell::EndPageLoad(nsIWebProgress* 
+@@ -7195,18 +7109,16 @@ nsDocShell::EndPageLoad(nsIWebProgress* 
      return rv;
    }
  
@@ -192,7 +192,7 @@ diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
 diff --git a/docshell/base/nsIDocShell.idl b/docshell/base/nsIDocShell.idl
 --- a/docshell/base/nsIDocShell.idl
 +++ b/docshell/base/nsIDocShell.idl
-@@ -701,23 +701,16 @@ interface nsIDocShell : nsIDocShellTreeI
+@@ -709,23 +709,16 @@ interface nsIDocShell : nsIDocShellTreeI
     * Upon getting, returns the canonical encoding label of the document
     * currently loaded into this docshell.
     *

frg/work-js/mozilla-release/patches/TOP-NOBUG-PLASTER-25319.patch

@@ -4,8 +4,6 @@
 # Parent  6b84642351de0cf9e131c24a919a943fe00e57d6
 No bug - JS plaster for missing bugs. r=me a=me
 
-  - Do not require Bug 1468406 part 4 nonCCWRealm.
-
 diff --git a/js/public/AutoByteString.h b/js/public/AutoByteString.h
 --- a/js/public/AutoByteString.h
 +++ b/js/public/AutoByteString.h
@@ -74,25 +72,3 @@ diff --git a/js/src/jsexn.cpp b/js/src/jsexn.cpp
  #include "vm/JSContext.h"
  #include "vm/JSFunction.h"
  #include "vm/JSObject.h"
-diff --git a/js/src/vm/ObjectGroup.cpp b/js/src/vm/ObjectGroup.cpp
---- a/js/src/vm/ObjectGroup.cpp
-+++ b/js/src/vm/ObjectGroup.cpp
-@@ -319,17 +319,17 @@ JSObject::makeLazyGroup(JSContext* cx, H
- 
-     if (obj->isNative() && obj->as<NativeObject>().isIndexed())
-         initialFlags |= OBJECT_FLAG_SPARSE_INDEXES;
- 
-     if (obj->is<ArrayObject>() && obj->as<ArrayObject>().length() > INT32_MAX)
-         initialFlags |= OBJECT_FLAG_LENGTH_OVERFLOW;
- 
-     Rooted<TaggedProto> proto(cx, obj->taggedProto());
--    ObjectGroup* group = ObjectGroupRealm::makeGroup(cx, obj->nonCCWRealm(), obj->getClass(),
-+    ObjectGroup* group = ObjectGroupRealm::makeGroup(cx, obj->realm(), obj->getClass(),
-                                                      proto, initialFlags);
-     if (!group)
-         return nullptr;
- 
-     AutoEnterAnalysis enter(cx);
- 
-     /* Fill in the type according to the state of this object. */
- 

frg/work-js/mozilla-release/patches/TOP-NOBUG-REGEXP-04-1539690-68a1-25318.patch

@@ -1,7 +1,7 @@
 # HG changeset patch
 # User Dmitry Butskoy <buc@buc.me>
 # Date 1690629350 -7200
-# Parent  3e7b290a0844572a883cfd39a209f3e6b579d8ce
+# Parent  cfde5167fa857825d9c54b4351c2a65addd0f035
 No Bug - Import new regexp V8 engine. r=frg a=frg
 
 diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp

frg/work-js/mozilla-release/patches/mozilla-central-push_422976.patch

@@ -1,160 +0,0 @@
-# HG changeset patch
-# User Richard Pospesel <richard@torproject.org>
-# Date 1529416858 21600
-#      Tue Jun 19 08:00:58 2018 -0600
-# Node ID e8d4a24e47a943db327206a4680fb75c156f9086
-# Parent  45a968a577b741e70c5122e3ee118352a754425f
-Bug 859782 - Firefox cannot start without /proc (chroot). r=sfink,evilpie,jld
-
-Firefox uses the current stack frame address and the stack size
-as a sort of heuristic for various things in the javascript
-engine.  The js::GetNativeStackBaseImpl() function is used to
-get the base stack address (ie the address from which the stack
-grows, so this can be either the first or last memory address of
-the stack memory space depending on the CPU architecture).
-
-On Linux, this function is implemented using the pthreads APIs.
-For non-main threads, the queried thread info is stored in
-memory.  The main thread does not have this information on hand,
-so it gets the stack memory range via the /proc/self/maps file
-( see glibc's pthread_get_attr_np.c ).
-
-Fortunately (per discussions with the firefox devs in #jsapi)
-the base address only needs to be approximation.  In reality,
-environment variables, args, and other things are stored in space
-between the end/beginning of the mapped stack memory and the 'top'
-of the stack space used by stack frames.
-
-We can get the top of this usable stack from __libc_stack_end,
-which is a void* set by glibc during program initialization.
-Non-main threads still get their stack-base through the usual
-pthreads APIs.
-
-diff --git a/js/src/util/NativeStack.cpp b/js/src/util/NativeStack.cpp
---- a/js/src/util/NativeStack.cpp
-+++ b/js/src/util/NativeStack.cpp
-@@ -8,20 +8,34 @@
- 
- #ifdef XP_WIN
- # include "util/Windows.h"
- #elif defined(XP_DARWIN) || defined(DARWIN) || defined(XP_UNIX)
- # include <pthread.h>
- # if defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__DragonFly__)
- #  include <pthread_np.h>
- # endif
-+# if defined(SOLARIS) || defined(AIX)
-+#  include <ucontext.h>
-+# endif
- # if defined(ANDROID) && !defined(__aarch64__)
- #  include <sys/types.h>
- #  include <unistd.h>
- # endif
-+# if defined(XP_LINUX) && !defined(ANDROID) && defined(__GLIBC__)
-+#  include <dlfcn.h>
-+#  include <sys/syscall.h>
-+#  include <sys/types.h>
-+#  include <unistd.h>
-+static pid_t
-+gettid()
-+{
-+    return syscall(__NR_gettid);
-+}
-+# endif
- #else
- # error "Unsupported platform"
- #endif
- 
- #include "jsfriendapi.h"
- 
- #if defined(XP_WIN)
- 
-@@ -29,43 +43,85 @@ void*
- js::GetNativeStackBaseImpl()
- {
-     PNT_TIB pTib = reinterpret_cast<PNT_TIB>(NtCurrentTeb());
-     return static_cast<void*>(pTib->StackBase);
- }
- 
- #elif defined(SOLARIS)
- 
--#include <ucontext.h>
--
- JS_STATIC_ASSERT(JS_STACK_GROWTH_DIRECTION < 0);
- 
- void*
- js::GetNativeStackBaseImpl()
- {
-     stack_t st;
-     stack_getbounds(&st);
-     return static_cast<char*>(st.ss_sp) + st.ss_size;
- }
- 
- #elif defined(AIX)
- 
--#include <ucontext.h>
--
- JS_STATIC_ASSERT(JS_STACK_GROWTH_DIRECTION < 0);
- 
- void*
- js::GetNativeStackBaseImpl()
- {
-     ucontext_t context;
-     getcontext(&context);
-     return static_cast<char*>(context.uc_stack.ss_sp) +
-         context.uc_stack.ss_size;
- }
- 
-+#elif defined(XP_LINUX) && !defined(ANDROID) && defined(__GLIBC__)
-+void*
-+js::GetNativeStackBaseImpl()
-+{
-+
-+    // On the main thread, get stack base from glibc's __libc_stack_end rather than pthread APIs
-+    // to avoid filesystem calls /proc/self/maps.  Non-main threads spawned with pthreads can read
-+    // this information directly from their pthread struct, but the main thread must go parse
-+    // /proc/self/maps to figure the mapped stack address space ranges.  We want to avoid reading
-+    // from /proc/ so that firefox can run in sandboxed environments where /proc may not be mounted
-+    if (gettid() == getpid()) {
-+        void** pLibcStackEnd = (void**)dlsym(RTLD_DEFAULT, "__libc_stack_end");
-+
-+        // If __libc_stack_end is not found, architecture specific frame pointer hopping will need
-+        // to be implemented.
-+        MOZ_RELEASE_ASSERT(pLibcStackEnd, "__libc_stack_end unavailable, unable to setup stack range for JS");
-+        void* stackBase = *pLibcStackEnd;
-+        MOZ_RELEASE_ASSERT(stackBase, "invalid stack base, unable to setup stack range for JS");
-+
-+        // We don't need to fix stackBase, as it already roughly points to beginning of the stack
-+        return stackBase;
-+    }
-+
-+    // Non-main threads have the required info stored in memory, so no filesystem calls are made.
-+    pthread_t thread = pthread_self();
-+    pthread_attr_t sattr;
-+    pthread_attr_init(&sattr);
-+    pthread_getattr_np(thread, &sattr);
-+
-+    // stackBase will be the *lowest* address on all architectures.
-+    void* stackBase = nullptr;
-+    size_t stackSize = 0;
-+    int rc = pthread_attr_getstack(&sattr, &stackBase, &stackSize);
-+    if (rc) {
-+        MOZ_CRASH("call to pthread_attr_getstack failed, unable to setup stack range for JS");
-+    }
-+    MOZ_RELEASE_ASSERT(stackBase, "invalid stack base, unable to setup stack range for JS");
-+    pthread_attr_destroy(&sattr);
-+
-+# if JS_STACK_GROWTH_DIRECTION > 0
-+    return stackBase;
-+# else
-+    return static_cast<char*>(stackBase) + stackSize;
-+# endif
-+}
-+
- #else /* XP_UNIX */
- 
- void*
- js::GetNativeStackBaseImpl()
- {
-     pthread_t thread = pthread_self();
- # if defined(XP_DARWIN) || defined(DARWIN)
-     return pthread_get_stackaddr_np(thread);

frg/work-js/mozilla-release/patches/mozilla-central-push_423135.patch

@@ -1,101 +0,0 @@
-# HG changeset patch
-# User Jon Coppeard <jcoppeard@mozilla.com>
-# Date 1529482958 -3600
-#      Wed Jun 20 09:22:38 2018 +0100
-# Node ID 7aaaed1a9ef133175a7f18054302e890e451f9eb
-# Parent  07a62b4e792399774c6c056140f1a6bf9102b164
-Bug 1468792 - Purge dota caches at the same time as deferred atom cache purge r=sfink
-
-diff --git a/js/src/gc/Zone.cpp b/js/src/gc/Zone.cpp
---- a/js/src/gc/Zone.cpp
-+++ b/js/src/gc/Zone.cpp
-@@ -426,30 +426,44 @@ Zone::ownedByCurrentHelperThread()
- 
- void Zone::releaseAtoms()
- {
-     MOZ_ASSERT(hasKeptAtoms());
- 
-     keepAtomsCount--;
- 
-     if (!hasKeptAtoms() && purgeAtomsDeferred) {
--        atomCache().clearAndShrink();
-         purgeAtomsDeferred = false;
-+        purgeAtomCache();
-     }
- }
- 
- void
- Zone::purgeAtomCacheOrDefer()
- {
-     if (hasKeptAtoms()) {
-         purgeAtomsDeferred = true;
-         return;
-     }
- 
-+    purgeAtomCache();
-+}
-+
-+void
-+Zone::purgeAtomCache()
-+{
-+    MOZ_ASSERT(!hasKeptAtoms());
-+    MOZ_ASSERT(!purgeAtomsDeferred);
-+
-     atomCache().clearAndShrink();
-+
-+    // Also purge the dtoa caches so that subsequent lookups populate atom
-+    // cache too.
-+    for (RealmsInZoneIter r(this); !r.done(); r.next())
-+        r->dtoaCache.purge();
- }
- 
- void
- Zone::traceAtomCache(JSTracer* trc)
- {
-     MOZ_ASSERT(hasKeptAtoms());
-     for (auto r = atomCache().all(); !r.empty(); r.popFront()) {
-         JSAtom* atom = r.front().asPtrUnbarriered();
-diff --git a/js/src/gc/Zone.h b/js/src/gc/Zone.h
---- a/js/src/gc/Zone.h
-+++ b/js/src/gc/Zone.h
-@@ -519,16 +519,17 @@ class Zone : public JS::shadow::Zone,
- 
-   public:
-     js::SparseBitmap& markedAtoms() { return markedAtoms_.ref(); }
- 
-     js::AtomSet& atomCache() { return atomCache_.ref(); }
- 
-     void traceAtomCache(JSTracer* trc);
-     void purgeAtomCacheOrDefer();
-+    void purgeAtomCache();
- 
-     js::ExternalStringCache& externalStringCache() { return externalStringCache_.ref(); };
- 
-     js::FunctionToStringCache& functionToStringCache() { return functionToStringCache_.ref(); }
- 
-     // Track heap usage under this Zone.
-     js::gc::HeapUsage usage;
- 
-diff --git a/js/src/jit-test/tests/gc/bug-1468792.js b/js/src/jit-test/tests/gc/bug-1468792.js
-new file mode 100644
---- /dev/null
-+++ b/js/src/jit-test/tests/gc/bug-1468792.js
-@@ -0,0 +1,18 @@
-+// |jit-test| error: ReferenceError
-+
-+loadFile(`
-+  gczeal(2,9);
-+  evaluate(\`
-+    reportCompare(expect, actual, summary);
-+  \`);
-+`);
-+function loadFile(lfVarx) {
-+    try {
-+        evaluate(lfVarx);
-+    } catch (lfVare) {}
-+}
-+eval("(function(){({6953421313:0})})")();
-+function f() {
-+    x[6953421313] = "a";
-+}
-+f();

frg/work-js/mozilla-release/patches/mozilla-central-push_423178.patch

@@ -1,1450 +0,0 @@
-# HG changeset patch
-# User Andi-Bogdan Postelnicu <bpostelnicu@mozilla.com>
-# Date 1529007971 -10800
-#      Thu Jun 14 23:26:11 2018 +0300
-# Node ID aa34ca78ad4d508e4e1c7a8ba0f278a5f83658bc
-# Parent  72106854c71e6f19bf109ea967a0017662bd561b
-Bug 1453795 - JS/JIT - Initialize member fields in classes/ structures. r=jandem
-
-diff --git a/js/src/jit/BaselineFrameInfo.h b/js/src/jit/BaselineFrameInfo.h
---- a/js/src/jit/BaselineFrameInfo.h
-+++ b/js/src/jit/BaselineFrameInfo.h
-@@ -60,32 +60,32 @@ class StackValue
-         EvalNewTargetSlot
- #ifdef DEBUG
-         // In debug builds, assert Kind is initialized.
-         , Uninitialized
- #endif
-     };
- 
-   private:
--    Kind kind_;
-+    MOZ_INIT_OUTSIDE_CTOR Kind kind_;
- 
--    union Data {
-+    MOZ_INIT_OUTSIDE_CTOR union Data {
-         JS::Value constant;
-         ValueOperand reg;
-         uint32_t localSlot;
-         uint32_t argSlot;
- 
-         // |constant| has a non-trivial constructor and therefore MUST be
-         // placement-new'd into existence.
-         MOZ_PUSH_DISABLE_NONTRIVIAL_UNION_WARNINGS
-         Data() {}
-         MOZ_POP_DISABLE_NONTRIVIAL_UNION_WARNINGS
-     } data;
- 
--    JSValueType knownType_;
-+    MOZ_INIT_OUTSIDE_CTOR JSValueType knownType_;
- 
-   public:
-     StackValue() {
-         reset();
-     }
- 
-     Kind kind() const {
-         return kind_;
-diff --git a/js/src/jit/BaselineJIT.cpp b/js/src/jit/BaselineJIT.cpp
---- a/js/src/jit/BaselineJIT.cpp
-+++ b/js/src/jit/BaselineJIT.cpp
-@@ -74,16 +74,26 @@ BaselineScript::BaselineScript(uint32_t 
- # ifdef DEBUG
-     traceLoggerScriptsEnabled_(false),
-     traceLoggerEngineEnabled_(false),
- # endif
-     traceLoggerScriptEvent_(),
- #endif
-     postDebugPrologueOffset_(postDebugPrologueOffset),
-     flags_(0),
-+    icEntriesOffset_(0),
-+    icEntries_(0),
-+    pcMappingIndexOffset_(0),
-+    pcMappingIndexEntries_(0),
-+    pcMappingOffset_(0),
-+    pcMappingSize_(0),
-+    bytecodeTypeMapOffset_(0),
-+    yieldEntriesOffset_(0),
-+    traceLoggerToggleOffsetsOffset_(0),
-+    numTraceLoggerToggleOffsets_(0),
-     inlinedBytecodeLength_(0),
-     maxInliningDepth_(UINT8_MAX),
-     pendingBuilder_(nullptr),
-     controlFlowGraph_(nullptr)
- { }
- 
- static bool
- CheckFrame(InterpreterFrame* fp)
-diff --git a/js/src/jit/BytecodeAnalysis.cpp b/js/src/jit/BytecodeAnalysis.cpp
---- a/js/src/jit/BytecodeAnalysis.cpp
-+++ b/js/src/jit/BytecodeAnalysis.cpp
-@@ -13,17 +13,18 @@
- #include "vm/JSScript-inl.h"
- 
- using namespace js;
- using namespace js::jit;
- 
- BytecodeAnalysis::BytecodeAnalysis(TempAllocator& alloc, JSScript* script)
-   : script_(script),
-     infos_(alloc),
--    usesEnvironmentChain_(false)
-+    usesEnvironmentChain_(false),
-+    hasTryFinally_(false)
- {
- }
- 
- // Bytecode range containing only catch or finally code.
- struct CatchFinallyRange
- {
-     uint32_t start; // Inclusive.
-     uint32_t end;   // Exclusive.
-diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
---- a/js/src/jit/CodeGenerator.cpp
-+++ b/js/src/jit/CodeGenerator.cpp
-@@ -661,19 +661,17 @@ class OutOfLineTestObject : public OutOf
-     Label* ifDoesntEmulateUndefined_;
- 
- #ifdef DEBUG
-     bool initialized() { return ifEmulatesUndefined_ != nullptr; }
- #endif
- 
-   public:
-     OutOfLineTestObject()
--#ifdef DEBUG
-       : ifEmulatesUndefined_(nullptr), ifDoesntEmulateUndefined_(nullptr)
--#endif
-     { }
- 
-     void accept(CodeGenerator* codegen) final {
-         MOZ_ASSERT(initialized());
-         codegen->emitOOLTestObject(objreg_, ifEmulatesUndefined_, ifDoesntEmulateUndefined_,
-                                    scratch_);
-     }
- 
-@@ -3420,22 +3418,22 @@ CodeGenerator::visitStoreSlotT(LStoreSlo
-     if (lir->mir()->needsBarrier())
-         emitPreBarrier(dest);
- 
-     MIRType valueType = lir->mir()->value()->type();
- 
-     if (valueType == MIRType::ObjectOrNull) {
-         masm.storeObjectOrNull(ToRegister(lir->value()), dest);
-     } else {
--        ConstantOrRegister value;
-+        mozilla::Maybe<ConstantOrRegister> value;
-         if (lir->value()->isConstant())
--            value = ConstantOrRegister(lir->value()->toConstant()->toJSValue());
-+            value.emplace(ConstantOrRegister(lir->value()->toConstant()->toJSValue()));
-         else
--            value = TypedOrValueRegister(valueType, ToAnyRegister(lir->value()));
--        masm.storeUnboxedValue(value, valueType, dest, lir->mir()->slotType());
-+            value.emplace(TypedOrValueRegister(valueType, ToAnyRegister(lir->value())));
-+        masm.storeUnboxedValue(value.ref(), valueType, dest, lir->mir()->slotType());
-     }
- }
- 
- void
- CodeGenerator::visitStoreSlotV(LStoreSlotV* lir)
- {
-     Register base = ToRegister(lir->slots());
-     int32_t offset = lir->mir()->slot() * sizeof(Value);
-@@ -3623,23 +3621,23 @@ CodeGenerator::visitSetPropertyPolymorph
- 
- void
- CodeGenerator::visitSetPropertyPolymorphicT(LSetPropertyPolymorphicT* ins)
- {
-     Register obj = ToRegister(ins->obj());
-     Register temp1 = ToRegister(ins->temp1());
-     Register temp2 = ToRegister(ins->temp2());
- 
--    ConstantOrRegister value;
-+    mozilla::Maybe<ConstantOrRegister> value;
-     if (ins->mir()->value()->isConstant())
--        value = ConstantOrRegister(ins->mir()->value()->toConstant()->toJSValue());
-+        value.emplace(ConstantOrRegister(ins->mir()->value()->toConstant()->toJSValue()));
-     else
--        value = TypedOrValueRegister(ins->mir()->value()->type(), ToAnyRegister(ins->value()));
--
--    emitSetPropertyPolymorphic(ins, obj, temp1, temp2, value);
-+        value.emplace(TypedOrValueRegister(ins->mir()->value()->type(), ToAnyRegister(ins->value())));
-+
-+    emitSetPropertyPolymorphic(ins, obj, temp1, temp2, value.ref());
- }
- 
- void
- CodeGenerator::visitElements(LElements* lir)
- {
-     Address elements(ToRegister(lir->object()), NativeObject::offsetOfElements());
-     masm.loadPtr(elements, ToRegister(lir->output()));
- }
-@@ -9383,56 +9381,56 @@ static const VMFunction SetDenseElementI
- 
- void
- CodeGenerator::visitOutOfLineStoreElementHole(OutOfLineStoreElementHole* ool)
- {
-     Register object, elements;
-     LInstruction* ins = ool->ins();
-     const LAllocation* index;
-     MIRType valueType;
--    ConstantOrRegister value;
-+    mozilla::Maybe<ConstantOrRegister> value;
-     Register spectreTemp;
- 
-     if (ins->isStoreElementHoleV()) {
-         LStoreElementHoleV* store = ins->toStoreElementHoleV();
-         object = ToRegister(store->object());
-         elements = ToRegister(store->elements());
-         index = store->index();
-         valueType = store->mir()->value()->type();
--        value = TypedOrValueRegister(ToValue(store, LStoreElementHoleV::Value));
-+        value.emplace(TypedOrValueRegister(ToValue(store, LStoreElementHoleV::Value)));
-         spectreTemp = ToTempRegisterOrInvalid(store->spectreTemp());
-     } else if (ins->isFallibleStoreElementV()) {
-         LFallibleStoreElementV* store = ins->toFallibleStoreElementV();
-         object = ToRegister(store->object());
-         elements = ToRegister(store->elements());
-         index = store->index();
-         valueType = store->mir()->value()->type();
--        value = TypedOrValueRegister(ToValue(store, LFallibleStoreElementV::Value));
-+        value.emplace(TypedOrValueRegister(ToValue(store, LFallibleStoreElementV::Value)));
-         spectreTemp = ToTempRegisterOrInvalid(store->spectreTemp());
-     } else if (ins->isStoreElementHoleT()) {
-         LStoreElementHoleT* store = ins->toStoreElementHoleT();
-         object = ToRegister(store->object());
-         elements = ToRegister(store->elements());
-         index = store->index();
-         valueType = store->mir()->value()->type();
-         if (store->value()->isConstant())
--            value = ConstantOrRegister(store->value()->toConstant()->toJSValue());
-+            value.emplace(ConstantOrRegister(store->value()->toConstant()->toJSValue()));
-         else
--            value = TypedOrValueRegister(valueType, ToAnyRegister(store->value()));
-+            value.emplace(TypedOrValueRegister(valueType, ToAnyRegister(store->value())));
-         spectreTemp = ToTempRegisterOrInvalid(store->spectreTemp());
-     } else { // ins->isFallibleStoreElementT()
-         LFallibleStoreElementT* store = ins->toFallibleStoreElementT();
-         object = ToRegister(store->object());
-         elements = ToRegister(store->elements());
-         index = store->index();
-         valueType = store->mir()->value()->type();
-         if (store->value()->isConstant())
--            value = ConstantOrRegister(store->value()->toConstant()->toJSValue());
-+            value.emplace(ConstantOrRegister(store->value()->toConstant()->toJSValue()));
-         else
--            value = TypedOrValueRegister(valueType, ToAnyRegister(store->value()));
-+            value.emplace(TypedOrValueRegister(valueType, ToAnyRegister(store->value())));
-         spectreTemp = ToTempRegisterOrInvalid(store->spectreTemp());
-     }
- 
-     Register indexReg = ToRegister(index);
- 
-     // If index == initializedLength, try to bump the initialized length inline.
-     // If index > initializedLength, call a stub. Note that this relies on the
-     // condition flags sticking from the incoming branch.
-@@ -9483,17 +9481,17 @@ CodeGenerator::visitOutOfLineStoreElemen
-         // Jump to the inline path where we will store the value.
-         masm.jump(ool->rejoinStore());
-     }
- 
-     masm.bind(ool->callStub());
-     saveLive(ins);
- 
-     pushArg(Imm32(ool->strict()));
--    pushArg(value);
-+    pushArg(value.ref());
-     if (index->isConstant())
-         pushArg(Imm32(ToInt32(index)));
-     else
-         pushArg(ToRegister(index));
-     pushArg(object);
-     callVM(SetDenseElementInfo, ins);
- 
-     restoreLive(ins);
-@@ -9732,23 +9730,23 @@ CodeGenerator::visitArrayPushV(LArrayPus
- }
- 
- void
- CodeGenerator::visitArrayPushT(LArrayPushT* lir)
- {
-     Register obj = ToRegister(lir->object());
-     Register elementsTemp = ToRegister(lir->temp());
-     Register length = ToRegister(lir->output());
--    ConstantOrRegister value;
-+    mozilla::Maybe<ConstantOrRegister> value;
-     if (lir->value()->isConstant())
--        value = ConstantOrRegister(lir->value()->toConstant()->toJSValue());
-+        value.emplace(ConstantOrRegister(lir->value()->toConstant()->toJSValue()));
-     else
--        value = TypedOrValueRegister(lir->mir()->value()->type(), ToAnyRegister(lir->value()));
-+        value.emplace(TypedOrValueRegister(lir->mir()->value()->type(), ToAnyRegister(lir->value())));
-     Register spectreTemp = ToTempRegisterOrInvalid(lir->spectreTemp());
--    emitArrayPush(lir, obj, value, elementsTemp, length, spectreTemp);
-+    emitArrayPush(lir, obj, value.ref(), elementsTemp, length, spectreTemp);
- }
- 
- typedef JSObject* (*ArraySliceDenseFn)(JSContext*, HandleObject, int32_t, int32_t, HandleObject);
- static const VMFunction ArraySliceDenseInfo =
-     FunctionInfo<ArraySliceDenseFn>(array_slice_dense, "array_slice_dense");
- 
- void
- CodeGenerator::visitArraySlice(LArraySlice* lir)
-@@ -11714,92 +11712,91 @@ CodeGenerator::visitLoadElementFromState
-         // Add table entries if the table is inlined.
-         for (size_t i = 0, e = array->numElements(); i < e; i++)
-             jumpTable->addTableEntry(masm);
-     }
- 
-     // Add inlined code for loading arguments from where they are allocated.
-     for (size_t i = 0, e = array->numElements(); i < e; i++) {
-         MDefinition* elem = array->getElement(i);
--        ConstantOrRegister input;
-+        mozilla::Maybe<ConstantOrRegister> input;
- 
-         jumpTable->addCodeEntry(masm);
-         Register typeReg = Register::Invalid();
-         const LAllocation* a = lir->getOperand(1 + BOX_PIECES * i);
-         if (a->isBogus()) {
-             if (elem->type() == MIRType::Null) {
--                input = NullValue();
-+                input.emplace(NullValue());
-             } else if (elem->type() == MIRType::Undefined) {
--                input = UndefinedValue();
-+                input.emplace(UndefinedValue());
-             } else if (elem->isConstant() && elem->isEmittedAtUses()) {
--                input = elem->toConstant()->toJSValue();
-+                input.emplace(elem->toConstant()->toJSValue());
-             } else {
-                 MOZ_CRASH("Unsupported element constant allocation.");
-             }
-         } else if (a->isMemory()) {
-             if (elem->type() == MIRType::Double) {
-                 masm.loadDouble(ToAddress(a), tempD);
--                input = TypedOrValueRegister(elem->type(), AnyRegister(tempD));
-+                input.emplace(TypedOrValueRegister(elem->type(), AnyRegister(tempD)));
-             } else if (elem->type() == MIRType::Value) {
-                 typeReg = temp0;
-                 masm.loadPtr(ToAddress(a), temp0);
- #ifdef JS_PUNBOX64
--                input = TypedOrValueRegister(ValueOperand(temp0));
-+                input.emplace(TypedOrValueRegister(ValueOperand(temp0)));
- #endif
-             } else {
-                 typeReg = temp0;
-                 size_t width = StackSlotAllocator::width(LDefinition::TypeFrom(elem->type()));
-                 if (width == 4)
-                     masm.load32(ToAddress(a), temp0);
-                 else if (width == 8)
-                     masm.loadPtr(ToAddress(a), temp0);
-                 else
-                     MOZ_CRASH("Unsupported load size");
--                input = TypedOrValueRegister(elem->type(), AnyRegister(typeReg));
-+                input.emplace(TypedOrValueRegister(elem->type(), AnyRegister(typeReg)));
-             }
-         } else if (a->isGeneralReg()) {
-             typeReg = ToRegister(a);
--            input = TypedOrValueRegister(elem->type(), AnyRegister(typeReg));
- #ifdef JS_PUNBOX64
-             if (elem->type() != MIRType::Value)
--                input = TypedOrValueRegister(elem->type(), AnyRegister(typeReg));
-+                input.emplace(TypedOrValueRegister(elem->type(), AnyRegister(typeReg)));
-             else
--                input = TypedOrValueRegister(ValueOperand(typeReg));
-+                input.emplace(TypedOrValueRegister(ValueOperand(typeReg)));
- #else
-             if (elem->type() != MIRType::Value)
--                input = TypedOrValueRegister(elem->type(), AnyRegister(typeReg));
-+                input.emplace(TypedOrValueRegister(elem->type(), AnyRegister(typeReg)));
- #endif
-         } else if (a->isFloatReg()) {
--            input = TypedOrValueRegister(elem->type(), AnyRegister(ToFloatRegister(a)));
-+            input.emplace(TypedOrValueRegister(elem->type(), AnyRegister(ToFloatRegister(a))));
-         } else if (a->isConstantValue()) {
--            input = a->toConstant()->toJSValue();
-+            input.emplace(a->toConstant()->toJSValue());
-         } else {
-             MOZ_CRASH("Unsupported element allocation.");
-         }
- 
- #ifdef JS_NUNBOX32
-         if (elem->type() == MIRType::Value) {
-             static_assert(TYPE_INDEX == 0, "Unexpected type allocation index");
-             static_assert(PAYLOAD_INDEX == 1, "Unexpected payload allocation index");
-             const LAllocation* a1 = lir->getOperand(1 + BOX_PIECES * i + 1);
-             MOZ_ASSERT(!a1->isBogus());
-             MOZ_ASSERT(typeReg != Register::Invalid());
-             if (a1->isMemory()) {
-                 masm.loadPtr(ToAddress(a1), temp1);
--                input = TypedOrValueRegister(ValueOperand(typeReg, temp1));
-+                input.emplace(TypedOrValueRegister(ValueOperand(typeReg, temp1)));
-             } else if (a1->isGeneralReg()) {
--                input = TypedOrValueRegister(ValueOperand(typeReg, ToRegister(a1)));
-+                input.emplace(TypedOrValueRegister(ValueOperand(typeReg, ToRegister(a1))));
-             } else {
-                 MOZ_CRASH("Unsupported Value allocation.");
-             }
-         } else {
-             MOZ_ASSERT(lir->getOperand(1 + BOX_PIECES * i + 1)->isBogus());
-         }
- #endif
--        masm.moveValue(input, out);
-+        masm.moveValue(input.ref(), out);
- 
-         // For the last entry, fall-through.
-         if (i + 1 < e)
-             masm.jump(&join);
-     }
- 
-     addOutOfLineCode(jumpTable, lir->mir());
-     masm.bind(&join);
-diff --git a/js/src/jit/CompileInfo.h b/js/src/jit/CompileInfo.h
---- a/js/src/jit/CompileInfo.h
-+++ b/js/src/jit/CompileInfo.h
-@@ -247,17 +247,17 @@ class CompileInfo
-         // If the script uses an environment in body, the environment chain
-         // will need to be observable.
-         needsBodyEnvironmentObject_ = script->needsBodyEnvironment();
-         funNeedsSomeEnvironmentObject_ = fun ? fun->needsSomeEnvironmentObject() : false;
-     }
- 
-     explicit CompileInfo(unsigned nlocals)
-       : script_(nullptr), fun_(nullptr), osrPc_(nullptr),
--        analysisMode_(Analysis_None), scriptNeedsArgsObj_(false),
-+        analysisMode_(Analysis_None), scriptNeedsArgsObj_(false), hadOverflowBailout_(false),
-         mayReadFrameArgsDirectly_(false), inlineScriptTree_(nullptr),
-         needsBodyEnvironmentObject_(false), funNeedsSomeEnvironmentObject_(false)
-     {
-         nimplicit_ = 0;
-         nargs_ = 0;
-         nlocals_ = nlocals;
-         nstack_ = 1;  /* For FunctionCompiler::pushPhiInput/popPhiOutput */
-         nslots_ = nlocals_ + nstack_;
-diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
---- a/js/src/jit/Ion.cpp
-+++ b/js/src/jit/Ion.cpp
-@@ -386,17 +386,18 @@ JSContext::allocateOsrTempData(size_t si
- void
- JSContext::freeOsrTempData()
- {
-     js_free(osrTempData_);
-     osrTempData_ = nullptr;
- }
- 
- JitRealm::JitRealm()
--  : stubCodes_(nullptr)
-+  : stubCodes_(nullptr),
-+    stringsCanBeInNursery(false)
- {
- }
- 
- JitRealm::~JitRealm()
- {
-     js_delete(stubCodes_);
- }
- 
-@@ -839,28 +840,34 @@ IonScript::IonScript(IonCompilationId co
-     runtimeSize_(0),
-     icIndex_(0),
-     icEntries_(0),
-     safepointIndexOffset_(0),
-     safepointIndexEntries_(0),
-     safepointsStart_(0),
-     safepointsSize_(0),
-     frameSlots_(0),
-+    argumentSlots_(0),
-     frameSize_(0),
-     bailoutTable_(0),
-     bailoutEntries_(0),
-     osiIndexOffset_(0),
-     osiIndexEntries_(0),
-     snapshots_(0),
-     snapshotsListSize_(0),
-     snapshotsRVATableSize_(0),
-+    recovers_(0),
-+    recoversSize_(0),
-     constantTable_(0),
-     constantEntries_(0),
-+    sharedStubList_(0),
-+    sharedStubEntries_(0),
-     invalidationCount_(0),
-     compilationId_(compilationId),
-+    optimizationLevel_(OptimizationLevel::Normal),
-     osrPcMismatchCounter_(0),
-     fallbackStubSpace_()
- {
- }
- 
- IonScript*
- IonScript::New(JSContext* cx, IonCompilationId compilationId,
-                uint32_t frameSlots, uint32_t argumentSlots, uint32_t frameSize,
-diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
---- a/js/src/jit/IonBuilder.cpp
-+++ b/js/src/jit/IonBuilder.cpp
-@@ -131,16 +131,17 @@ IonBuilder::IonBuilder(JSContext* analys
-     analysisContext(analysisContext),
-     baselineFrame_(baselineFrame),
-     constraints_(constraints),
-     thisTypes(nullptr),
-     argTypes(nullptr),
-     typeArray(nullptr),
-     typeArrayHint(0),
-     bytecodeTypeMap(nullptr),
-+    current(nullptr),
-     loopDepth_(loopDepth),
-     blockWorklist(*temp),
-     cfgCurrent(nullptr),
-     cfg(nullptr),
-     trackedOptimizationSites_(*temp),
-     lexicalCheck_(nullptr),
-     callerResumePoint_(nullptr),
-     callerBuilder_(nullptr),
-diff --git a/js/src/jit/IonCode.h b/js/src/jit/IonCode.h
---- a/js/src/jit/IonCode.h
-+++ b/js/src/jit/IonCode.h
-@@ -63,20 +63,17 @@ class JitCode : public gc::TenuredCell
-     uint32_t dataRelocTableBytes_;    // Size of the data relocation table.
-     uint8_t headerSize_ : 5;          // Number of bytes allocated before codeStart.
-     uint8_t kind_ : 3;                // jit::CodeKind, for the memory reporters.
-     bool invalidated_ : 1;            // Whether the code object has been invalidated.
-                                       // This is necessary to prevent GC tracing.
-     bool hasBytecodeMap_ : 1;         // Whether the code object has been registered with
-                                       // native=>bytecode mapping tables.
- 
--    JitCode()
--      : code_(nullptr),
--        pool_(nullptr)
--    { }
-+    JitCode() = delete;
-     JitCode(uint8_t* code, uint32_t bufferSize, uint32_t headerSize, ExecutablePool* pool,
-             CodeKind kind)
-       : code_(code),
-         pool_(pool),
-         bufferSize_(bufferSize),
-         insnSize_(0),
-         dataSize_(0),
-         jumpRelocTableBytes_(0),
-diff --git a/js/src/jit/IonControlFlow.cpp b/js/src/jit/IonControlFlow.cpp
---- a/js/src/jit/IonControlFlow.cpp
-+++ b/js/src/jit/IonControlFlow.cpp
-@@ -10,16 +10,17 @@
- 
- using namespace js;
- using namespace js::jit;
- using mozilla::DebugOnly;
- 
- ControlFlowGenerator::ControlFlowGenerator(TempAllocator& temp, JSScript* script)
-   : script(script),
-     current(nullptr),
-+    pc(nullptr),
-     alloc_(temp),
-     blocks_(temp),
-     cfgStack_(temp),
-     loops_(temp),
-     switches_(temp),
-     labels_(temp),
-     aborted_(false),
-     checkedTryFinally_(false)
-diff --git a/js/src/jit/IonOptimizationLevels.h b/js/src/jit/IonOptimizationLevels.h
---- a/js/src/jit/IonOptimizationLevels.h
-+++ b/js/src/jit/IonOptimizationLevels.h
-@@ -144,17 +144,46 @@ class OptimizationInfo
-     // are inlined, as a fraction of compilerWarmUpThreshold.
-     double inliningWarmUpThresholdFactor_;
- 
-     // How many invocations or loop iterations are needed before a function
-     // is hot enough to recompile the outerScript to inline that function,
-     // as a multiplication of inliningWarmUpThreshold.
-     uint32_t inliningRecompileThresholdFactor_;
- 
--    OptimizationInfo()
-+    constexpr OptimizationInfo()
-+      : level_(OptimizationLevel::Normal),
-+        eaa_(false),
-+        ama_(false),
-+        edgeCaseAnalysis_(false),
-+        eliminateRedundantChecks_(false),
-+        inlineInterpreted_(false),
-+        inlineNative_(false),
-+        eagerSimdUnbox_(false),
-+        gvn_(false),
-+        licm_(false),
-+        rangeAnalysis_(false),
-+        loopUnrolling_(false),
-+        reordering_(false),
-+        autoTruncate_(false),
-+        sincos_(false),
-+        sink_(false),
-+        registerAllocator_(RegisterAllocator_Backtracking),
-+        inlineMaxBytecodePerCallSiteHelperThread_(0),
-+        inlineMaxBytecodePerCallSiteMainThread_(0),
-+        inlineMaxCalleeInlinedBytecodeLength_(0),
-+        inlineMaxTotalBytecodeLength_(0),
-+        inliningMaxCallerBytecodeLength_(0),
-+        maxInlineDepth_(0),
-+        scalarReplacement_(false),
-+        smallFunctionMaxInlineDepth_(0),
-+        compilerWarmUpThreshold_(0),
-+        compilerSmallFunctionWarmUpThreshold_(0),
-+        inliningWarmUpThresholdFactor_(0.0),
-+        inliningRecompileThresholdFactor_(0)
-     { }
- 
-     void initNormalOptimizationInfo();
-     void initWasmOptimizationInfo();
- 
-     OptimizationLevel level() const {
-         return level_;
-     }
-diff --git a/js/src/jit/JitAllocPolicy.h b/js/src/jit/JitAllocPolicy.h
---- a/js/src/jit/JitAllocPolicy.h
-+++ b/js/src/jit/JitAllocPolicy.h
-@@ -7,16 +7,18 @@
- #ifndef jit_JitAllocPolicy_h
- #define jit_JitAllocPolicy_h
- 
- #include "mozilla/Attributes.h"
- #include "mozilla/GuardObjects.h"
- #include "mozilla/OperatorNewExtensions.h"
- #include "mozilla/TypeTraits.h"
- 
-+#include <utility>
-+
- #include "ds/LifoAlloc.h"
- #include "jit/InlineList.h"
- #include "jit/Ion.h"
- #include "vm/JSContext.h"
- 
- namespace js {
- namespace jit {
- 
-@@ -184,21 +186,23 @@ class TempObjectPool
-   public:
-     TempObjectPool()
-       : alloc_(nullptr)
-     {}
-     void setAllocator(TempAllocator& alloc) {
-         MOZ_ASSERT(freed_.empty());
-         alloc_ = &alloc;
-     }
--    T* allocate() {
-+    template <typename... Args>
-+    T* allocate(Args&&... args) {
-         MOZ_ASSERT(alloc_);
-         if (freed_.empty())
--            return new(alloc_->fallible()) T();
--        return freed_.popFront();
-+            return new (alloc_->fallible()) T(std::forward<Args>(args)...);
-+        T* res = freed_.popFront();
-+        return new (res) T(std::forward<Args>(args)...);
-     }
-     void free(T* obj) {
-         freed_.pushFront(obj);
-     }
-     void clear() {
-         freed_.clear();
-     }
- };
-diff --git a/js/src/jit/JitFrames.cpp b/js/src/jit/JitFrames.cpp
---- a/js/src/jit/JitFrames.cpp
-+++ b/js/src/jit/JitFrames.cpp
-@@ -1536,16 +1536,17 @@ SnapshotIterator::SnapshotIterator(const
-     instructionResults_(nullptr)
- {
- }
- 
- SnapshotIterator::SnapshotIterator()
-   : snapshot_(nullptr, 0, 0, 0),
-     recover_(snapshot_, nullptr, 0),
-     fp_(nullptr),
-+    machine_(nullptr),
-     ionScript_(nullptr),
-     instructionResults_(nullptr)
- {
- }
- 
- int32_t
- SnapshotIterator::readOuterNumActualArgs() const
- {
-@@ -2049,28 +2050,32 @@ SnapshotIterator::maybeReadAllocByIndex(
-         skip();
- 
-     return s;
- }
- 
- InlineFrameIterator::InlineFrameIterator(JSContext* cx, const JSJitFrameIter* iter)
-   : calleeTemplate_(cx),
-     calleeRVA_(),
--    script_(cx)
-+    script_(cx),
-+    pc_(nullptr),
-+    numActualArgs_(0)
- {
-     resetOn(iter);
- }
- 
- InlineFrameIterator::InlineFrameIterator(JSContext* cx, const InlineFrameIterator* iter)
-   : frame_(iter ? iter->frame_ : nullptr),
-     framesRead_(0),
-     frameCount_(iter ? iter->frameCount_ : UINT32_MAX),
-     calleeTemplate_(cx),
-     calleeRVA_(),
--    script_(cx)
-+    script_(cx),
-+    pc_(nullptr),
-+    numActualArgs_(0)
- {
-     if (frame_) {
-         machine_ = iter->machine_;
-         start_ = SnapshotIterator(*frame_, &machine_);
- 
-         // findNextFrame will iterate to the next frame and init. everything.
-         // Therefore to settle on the same frame, we report one frame less readed.
-         framesRead_ = iter->framesRead_ - 1;
-diff --git a/js/src/jit/JitFrames.h b/js/src/jit/JitFrames.h
---- a/js/src/jit/JitFrames.h
-+++ b/js/src/jit/JitFrames.h
-@@ -225,18 +225,17 @@ static const uint32_t NO_FRAME_SIZE_CLAS
- class FrameSizeClass
- {
-     uint32_t class_;
- 
-     explicit FrameSizeClass(uint32_t class_) : class_(class_)
-     { }
- 
-   public:
--    FrameSizeClass()
--    { }
-+    FrameSizeClass() = delete;
- 
-     static FrameSizeClass None() {
-         return FrameSizeClass(NO_FRAME_SIZE_CLASS_ID);
-     }
-     static FrameSizeClass FromClass(uint32_t class_) {
-         return FrameSizeClass(class_);
-     }
- 
-diff --git a/js/src/jit/JitRealm.h b/js/src/jit/JitRealm.h
---- a/js/src/jit/JitRealm.h
-+++ b/js/src/jit/JitRealm.h
-@@ -27,18 +27,26 @@
- namespace js {
- namespace jit {
- 
- class FrameSizeClass;
- 
- struct EnterJitData
- {
-     explicit EnterJitData(JSContext* cx)
--      : envChain(cx),
--        result(cx)
-+      : jitcode(nullptr),
-+        osrFrame(nullptr),
-+        calleeToken(nullptr),
-+        maxArgv(nullptr),
-+        maxArgc(0),
-+        numActualArgs(0),
-+        osrNumStackValues(0),
-+        envChain(cx),
-+        result(cx),
-+        constructing(false)
-     {}
- 
-     uint8_t* jitcode;
-     InterpreterFrame* osrFrame;
- 
-     void* calleeToken;
- 
-     Value* maxArgv;
-diff --git a/js/src/jit/LIR.h b/js/src/jit/LIR.h
---- a/js/src/jit/LIR.h
-+++ b/js/src/jit/LIR.h
-@@ -1459,31 +1459,31 @@ class LSnapshot : public TempObject
- 
- struct SafepointSlotEntry {
-     // Flag indicating whether this is a slot in the stack or argument space.
-     uint32_t stack:1;
- 
-     // Byte offset of the slot, as in LStackSlot or LArgument.
-     uint32_t slot:31;
- 
--    SafepointSlotEntry() { }
-+    SafepointSlotEntry() : stack(0), slot(0) { }
-     SafepointSlotEntry(bool stack, uint32_t slot)
-       : stack(stack), slot(slot)
-     { }
-     explicit SafepointSlotEntry(const LAllocation* a)
-       : stack(a->isStackSlot()), slot(a->memorySlot())
-     { }
- };
- 
- struct SafepointNunboxEntry {
-     uint32_t typeVreg;
-     LAllocation type;
-     LAllocation payload;
- 
--    SafepointNunboxEntry() { }
-+    SafepointNunboxEntry() : typeVreg(0) { }
-     SafepointNunboxEntry(uint32_t typeVreg, LAllocation type, LAllocation payload)
-       : typeVreg(typeVreg), type(type), payload(payload)
-     { }
- };
- 
- class LSafepoint : public TempObject
- {
-     typedef SafepointSlotEntry SlotEntry;
-diff --git a/js/src/jit/MIRGraph.cpp b/js/src/jit/MIRGraph.cpp
---- a/js/src/jit/MIRGraph.cpp
-+++ b/js/src/jit/MIRGraph.cpp
-@@ -484,16 +484,18 @@ MBasicBlock::New(MIRGraph& graph, const 
- 
- MBasicBlock::MBasicBlock(MIRGraph& graph, const CompileInfo& info, BytecodeSite* site, Kind kind)
-   : unreachable_(false),
-     specialized_(false),
-     graph_(graph),
-     info_(info),
-     predecessors_(graph.alloc()),
-     stackPosition_(info_.firstStackSlot()),
-+    id_(0),
-+    domIndex_(0),
-     numDominated_(0),
-     pc_(site->pc()),
-     lir_(nullptr),
-     callerResumePoint_(nullptr),
-     entryResumePoint_(nullptr),
-     outerResumePoint_(nullptr),
-     successorWithPhis_(nullptr),
-     positionInPhiSuccessor_(0),
-diff --git a/js/src/jit/MacroAssembler.cpp b/js/src/jit/MacroAssembler.cpp
---- a/js/src/jit/MacroAssembler.cpp
-+++ b/js/src/jit/MacroAssembler.cpp
-@@ -2803,16 +2803,17 @@ MacroAssembler::alignJitStackBasedOnNArg
- 
- // ===============================================================
- 
- MacroAssembler::MacroAssembler(JSContext* cx)
-   : framePushed_(0),
- #ifdef DEBUG
-     inCall_(false),
- #endif
-+    dynamicAlignment_(false),
-     emitProfilingInstrumentation_(false)
- {
-     jitContext_.emplace(cx, (js::jit::TempAllocator*)nullptr);
-     alloc_.emplace(cx);
-     moveResolver_.setAllocator(*jitContext_->temp);
- #if defined(JS_CODEGEN_ARM)
-     initWithAllocator();
-     m_buffer.id = GetJitContext()->getNextAssemblerId();
-@@ -2822,16 +2823,17 @@ MacroAssembler::MacroAssembler(JSContext
- #endif
- }
- 
- MacroAssembler::MacroAssembler()
-   : framePushed_(0),
- #ifdef DEBUG
-     inCall_(false),
- #endif
-+    dynamicAlignment_(false),
-     emitProfilingInstrumentation_(false)
- {
-     JitContext* jcx = GetJitContext();
- 
-     if (!jcx->temp) {
-         JSContext* cx = jcx->cx;
-         MOZ_ASSERT(cx);
-         alloc_.emplace(cx);
-@@ -2848,16 +2850,17 @@ MacroAssembler::MacroAssembler()
- #endif
- }
- 
- MacroAssembler::MacroAssembler(WasmToken, TempAllocator& alloc)
-   : framePushed_(0),
- #ifdef DEBUG
-     inCall_(false),
- #endif
-+    dynamicAlignment_(false),
-     emitProfilingInstrumentation_(false)
- {
-     moveResolver_.setAllocator(alloc);
- 
- #if defined(JS_CODEGEN_ARM)
-     initWithAllocator();
-     m_buffer.id = 0;
- #elif defined(JS_CODEGEN_ARM64)
-diff --git a/js/src/jit/MoveResolver.cpp b/js/src/jit/MoveResolver.cpp
---- a/js/src/jit/MoveResolver.cpp
-+++ b/js/src/jit/MoveResolver.cpp
-@@ -11,16 +11,17 @@
- 
- #include "jit/MacroAssembler.h"
- #include "jit/RegisterSets.h"
- 
- using namespace js;
- using namespace js::jit;
- 
- MoveOperand::MoveOperand(MacroAssembler& masm, const ABIArg& arg)
-+  : disp_(0)
- {
-     switch (arg.kind()) {
-       case ABIArg::GPR:
-         kind_ = REG;
-         code_ = arg.gpr().code();
-         break;
- #ifdef JS_CODEGEN_REGISTER_PAIR
-       case ABIArg::GPR_PAIR:
-@@ -59,20 +60,19 @@ MoveResolver::resetState()
-     curCycles_ = 0;
- }
- 
- bool
- MoveResolver::addMove(const MoveOperand& from, const MoveOperand& to, MoveOp::Type type)
- {
-     // Assert that we're not doing no-op moves.
-     MOZ_ASSERT(!(from == to));
--    PendingMove* pm = movePool_.allocate();
-+    PendingMove* pm = movePool_.allocate(from, to, type);
-     if (!pm)
-         return false;
--    new (pm) PendingMove(from, to, type);
-     pending_.pushBack(pm);
-     return true;
- }
- 
- // Given move (A -> B), this function attempts to find any move (B -> *) in the
- // pending move list, and returns the first one.
- MoveResolver::PendingMove*
- MoveResolver::findBlockingMove(const PendingMove* last)
-@@ -200,24 +200,24 @@ MoveResolver::resolve()
-     // This logic is only applicable because ARM only uses registers d0-d15,
-     // all of which alias s0-s31. Double registers d16-d31 are unused.
-     // Therefore there is never a double move that cannot be split.
-     // If this changes in the future, the algorithm will have to be fixed.
-     for (auto iter = pending_.begin(); iter != pending_.end(); ++iter) {
-         PendingMove* pm = *iter;
- 
-         if (isDoubleAliasedAsSingle(pm->from()) || isDoubleAliasedAsSingle(pm->to())) {
--            PendingMove* lower = movePool_.allocate();
-+            MoveOperand fromLower = SplitIntoLowerHalf(pm->from());
-+            MoveOperand toLower = SplitIntoLowerHalf(pm->to());
-+
-+            PendingMove* lower = movePool_.allocate(fromLower, toLower, MoveOp::FLOAT32);
-             if (!lower)
-                 return false;
- 
-             // Insert the new node before the current position to not affect iteration.
--            MoveOperand fromLower = SplitIntoLowerHalf(pm->from());
--            MoveOperand toLower = SplitIntoLowerHalf(pm->to());
--            new (lower) PendingMove(fromLower, toLower, MoveOp::FLOAT32);
-             pending_.insertBefore(pm, lower);
- 
-             // Overwrite pm in place for the upper move. Iteration proceeds as normal.
-             MoveOperand fromUpper = SplitIntoUpperHalf(pm->from());
-             MoveOperand toUpper = SplitIntoUpperHalf(pm->to());
-             pm->overwrite(fromUpper, toUpper, MoveOp::FLOAT32);
-         }
-     }
-diff --git a/js/src/jit/MoveResolver.h b/js/src/jit/MoveResolver.h
---- a/js/src/jit/MoveResolver.h
-+++ b/js/src/jit/MoveResolver.h
-@@ -40,21 +40,20 @@ class MoveOperand
-     };
- 
-   private:
-     Kind kind_;
-     uint32_t code_;
-     int32_t disp_;
- 
-   public:
--    MoveOperand()
-+    MoveOperand() = delete;
-+    explicit MoveOperand(Register reg) : kind_(REG), code_(reg.code()), disp_(0)
-     { }
--    explicit MoveOperand(Register reg) : kind_(REG), code_(reg.code())
--    { }
--    explicit MoveOperand(FloatRegister reg) : kind_(FLOAT_REG), code_(reg.code())
-+    explicit MoveOperand(FloatRegister reg) : kind_(FLOAT_REG), code_(reg.code()), disp_(0)
-     { }
-     MoveOperand(Register reg, int32_t disp, Kind kind = MEMORY)
-         : kind_(kind),
-         code_(reg.code()),
-         disp_(disp)
-     {
-         MOZ_ASSERT(isMemoryOrEffectiveAddress());
- 
-@@ -202,18 +201,17 @@ class MoveOp
-     // of the cycle. For example, given these moves:
-     //       INT32 move a -> b
-     //     GENERAL move b -> a
-     // the move resolver starts by copying b into a temporary location, so that
-     // the last move can read it. This copy needs to use use type GENERAL.
-     Type endCycleType_;
- 
-   public:
--    MoveOp()
--    { }
-+    MoveOp() = delete;
-     MoveOp(const MoveOperand& from, const MoveOperand& to, Type type)
-       : from_(from),
-         to_(to),
-         cycleBegin_(false),
-         cycleEnd_(false),
-         cycleBeginSlot_(-1),
-         cycleEndSlot_(-1),
-         type_(type),
-@@ -265,18 +263,18 @@ class MoveOp
- class MoveResolver
- {
-   private:
-     struct PendingMove
-       : public MoveOp,
-         public TempObject,
-         public InlineListNode<PendingMove>
-     {
--        PendingMove()
--        { }
-+        PendingMove() = delete;
-+
-         PendingMove(const MoveOperand& from, const MoveOperand& to, Type type)
-           : MoveOp(from, to, type)
-         { }
- 
-         void setCycleBegin(Type endCycleType, int cycleSlot) {
-             MOZ_ASSERT(!cycleBegin_);
-             cycleBegin_ = true;
-             cycleBeginSlot_ = cycleSlot;
-diff --git a/js/src/jit/OptimizationTracking.h b/js/src/jit/OptimizationTracking.h
---- a/js/src/jit/OptimizationTracking.h
-+++ b/js/src/jit/OptimizationTracking.h
-@@ -449,17 +449,19 @@ struct IonTrackedTypeWithAddendum
-             JSScript* script;
-             uint32_t offset;
-         };
-         JSFunction* constructor;
-     };
- 
-     explicit IonTrackedTypeWithAddendum(TypeSet::Type type)
-       : type(type),
--        hasAddendum(HasNothing)
-+        hasAddendum(HasNothing),
-+        script(nullptr),
-+        offset(0)
-     { }
- 
-     IonTrackedTypeWithAddendum(TypeSet::Type type, JSScript* script, uint32_t offset)
-       : type(type),
-         hasAddendum(HasAllocationSite),
-         script(script),
-         offset(offset)
-     { }
-diff --git a/js/src/jit/RangeAnalysis.h b/js/src/jit/RangeAnalysis.h
---- a/js/src/jit/RangeAnalysis.h
-+++ b/js/src/jit/RangeAnalysis.h
-@@ -190,25 +190,25 @@ class Range : public TempObject {
-     // 2) hasInt32UpperBound_ == false implies upper_ == JSVAL_INT_MAX
-     //
-     // As a second and less precise range analysis, we represent the maximal
-     // exponent taken by a value. The exponent is calculated by taking the
-     // absolute value and looking at the position of the highest bit.  All
-     // exponent computation have to be over-estimations of the actual result. On
-     // the Int32 this over approximation is rectified.
- 
--    int32_t lower_;
--    int32_t upper_;
-+    MOZ_INIT_OUTSIDE_CTOR int32_t lower_;
-+    MOZ_INIT_OUTSIDE_CTOR int32_t upper_;
- 
--    bool hasInt32LowerBound_;
--    bool hasInt32UpperBound_;
-+    MOZ_INIT_OUTSIDE_CTOR bool hasInt32LowerBound_;
-+    MOZ_INIT_OUTSIDE_CTOR bool hasInt32UpperBound_;
- 
--    FractionalPartFlag canHaveFractionalPart_ : 1;
--    NegativeZeroFlag canBeNegativeZero_ : 1;
--    uint16_t max_exponent_;
-+    MOZ_INIT_OUTSIDE_CTOR FractionalPartFlag canHaveFractionalPart_ : 1;
-+    MOZ_INIT_OUTSIDE_CTOR NegativeZeroFlag canBeNegativeZero_ : 1;
-+    MOZ_INIT_OUTSIDE_CTOR uint16_t max_exponent_;
- 
-     // Any symbolic lower or upper bound computed for this term.
-     const SymbolicBound* symbolicLower_;
-     const SymbolicBound* symbolicUpper_;
- 
-     // This function simply makes several MOZ_ASSERTs to verify the internal
-     // consistency of this range.
-     void assertInvariants() const {
-diff --git a/js/src/jit/RegisterSets.h b/js/src/jit/RegisterSets.h
---- a/js/src/jit/RegisterSets.h
-+++ b/js/src/jit/RegisterSets.h
-@@ -241,18 +241,17 @@ class ConstantOrRegister
-         // placement-new'd into existence.
-         MOZ_PUSH_DISABLE_NONTRIVIAL_UNION_WARNINGS
-         U() {}
-         MOZ_POP_DISABLE_NONTRIVIAL_UNION_WARNINGS
-     } data;
- 
-   public:
- 
--    ConstantOrRegister()
--    {}
-+    ConstantOrRegister() = delete;
- 
-     MOZ_IMPLICIT ConstantOrRegister(const Value& value)
-       : constant_(true)
-     {
-         MOZ_ASSERT(constant());
-         new (&data.constant) Value(value);
-     }
- 
-diff --git a/js/src/jit/RematerializedFrame.cpp b/js/src/jit/RematerializedFrame.cpp
---- a/js/src/jit/RematerializedFrame.cpp
-+++ b/js/src/jit/RematerializedFrame.cpp
-@@ -31,23 +31,26 @@ struct CopyValueToRematerializedFrame
-         *slots++ = v;
-     }
- };
- 
- RematerializedFrame::RematerializedFrame(JSContext* cx, uint8_t* top, unsigned numActualArgs,
-                                          InlineFrameIterator& iter, MaybeReadFallback& fallback)
-   : prevUpToDate_(false),
-     isDebuggee_(iter.script()->isDebuggee()),
-+    hasInitialEnv_(false),
-     isConstructing_(iter.isConstructing()),
-     hasCachedSavedFrame_(false),
-     top_(top),
-     pc_(iter.pc()),
-     frameNo_(iter.frameNo()),
-     numActualArgs_(numActualArgs),
--    script_(iter.script())
-+    script_(iter.script()),
-+    envChain_(nullptr),
-+    argsObj_(nullptr)
- {
-     if (iter.isFunctionFrame())
-         callee_ = iter.callee(fallback);
-     else
-         callee_ = nullptr;
- 
-     CopyValueToRematerializedFrame op(slots_);
-     iter.readFrameArgsAndLocals(cx, op, op, &envChain_, &hasInitialEnv_, &returnValue_,
-diff --git a/js/src/jit/Safepoints.cpp b/js/src/jit/Safepoints.cpp
---- a/js/src/jit/Safepoints.cpp
-+++ b/js/src/jit/Safepoints.cpp
-@@ -390,17 +390,19 @@ SafepointWriter::endEntry()
- {
-     JitSpew(JitSpew_Safepoints, "    -- entry ended at %d", uint32_t(stream_.length()));
- }
- 
- SafepointReader::SafepointReader(IonScript* script, const SafepointIndex* si)
-   : stream_(script->safepoints() + si->safepointOffset(),
-             script->safepoints() + script->safepointsSize()),
-     frameSlots_((script->frameSlots() / sizeof(intptr_t)) + 1), // Stack slot counts are inclusive.
--    argumentSlots_(script->argumentSlots() / sizeof(intptr_t))
-+    argumentSlots_(script->argumentSlots() / sizeof(intptr_t)),
-+    nunboxSlotsRemaining_(0),
-+    slotsOrElementsSlotsRemaining_(0)
- {
-     osiCallPointOffset_ = stream_.readUnsigned();
- 
-     // gcSpills is a subset of allGprSpills.
-     allGprSpills_ = GeneralRegisterSet(ReadRegisterMask(stream_));
-     if (allGprSpills_.empty()) {
-         gcSpills_ = allGprSpills_;
-         valueSpills_ = allGprSpills_;
-diff --git a/js/src/jit/ScalarReplacement.cpp b/js/src/jit/ScalarReplacement.cpp
---- a/js/src/jit/ScalarReplacement.cpp
-+++ b/js/src/jit/ScalarReplacement.cpp
-@@ -369,16 +369,17 @@ class ObjectMemoryView : public MDefinit
-     void loadOffset(MInstruction* ins, size_t offset);
-     void visitObjectGuard(MInstruction* ins, MDefinition* operand);
- };
- 
- const char* ObjectMemoryView::phaseName = "Scalar Replacement of Object";
- 
- ObjectMemoryView::ObjectMemoryView(TempAllocator& alloc, MInstruction* obj)
-   : alloc_(alloc),
-+    undefinedVal_(nullptr),
-     obj_(obj),
-     startBlock_(obj->block()),
-     state_(nullptr),
-     lastResumePoint_(nullptr),
-     oom_(false)
- {
-     // Annotate snapshots RValue such that we recover the store first.
-     obj_->setIncompleteObject();
-diff --git a/js/src/jit/StupidAllocator.h b/js/src/jit/StupidAllocator.h
---- a/js/src/jit/StupidAllocator.h
-+++ b/js/src/jit/StupidAllocator.h
-@@ -48,17 +48,18 @@ class StupidAllocator : public RegisterA
-     // Type indicating an index into registers.
-     typedef uint32_t RegisterIndex;
- 
-     // Information about each virtual register.
-     Vector<LDefinition*, 0, SystemAllocPolicy> virtualRegisters;
- 
-   public:
-     StupidAllocator(MIRGenerator* mir, LIRGenerator* lir, LIRGraph& graph)
--      : RegisterAllocator(mir, lir, graph)
-+      : RegisterAllocator(mir, lir, graph),
-+        registerCount(0)
-     {
-     }
- 
-     MOZ_MUST_USE bool go();
- 
-   private:
-     MOZ_MUST_USE bool init();
- 
-diff --git a/js/src/jit/TypedObjectPrediction.h b/js/src/jit/TypedObjectPrediction.h
---- a/js/src/jit/TypedObjectPrediction.h
-+++ b/js/src/jit/TypedObjectPrediction.h
-@@ -113,17 +113,18 @@ class TypedObjectPrediction {
-                              size_t* index) const;
- 
-   public:
- 
-     ///////////////////////////////////////////////////////////////////////////
-     // Constructing a prediction. Generally, you start with an empty
-     // prediction and invoke addDescr() repeatedly.
- 
--    TypedObjectPrediction() {
-+    TypedObjectPrediction()
-+      : data_() {
-         kind_ = Empty;
-     }
- 
-     explicit TypedObjectPrediction(const TypeDescr& descr) {
-         setDescr(descr);
-     }
- 
-     TypedObjectPrediction(const StructTypeDescr& descr, size_t fields) {
-diff --git a/js/src/jit/arm/Trampoline-arm.cpp b/js/src/jit/arm/Trampoline-arm.cpp
---- a/js/src/jit/arm/Trampoline-arm.cpp
-+++ b/js/src/jit/arm/Trampoline-arm.cpp
-@@ -794,17 +794,16 @@ JitRuntime::generateVMWrapper(JSContext*
- 
-     masm.setupUnalignedABICall(regs.getAny());
-     masm.passABIArg(cxreg);
- 
-     size_t argDisp = 0;
- 
-     // Copy any arguments.
-     for (uint32_t explicitArg = 0; explicitArg < f.explicitArgs; explicitArg++) {
--        MoveOperand from;
-         switch (f.argProperties(explicitArg)) {
-           case VMFunction::WordByValue:
-             masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::GENERAL);
-             argDisp += sizeof(void*);
-             break;
-           case VMFunction::DoubleByValue:
-             // Values should be passed by reference, not by value, so we assert
-             // that the argument is a double-precision float.
-diff --git a/js/src/jit/arm64/Trampoline-arm64.cpp b/js/src/jit/arm64/Trampoline-arm64.cpp
---- a/js/src/jit/arm64/Trampoline-arm64.cpp
-+++ b/js/src/jit/arm64/Trampoline-arm64.cpp
-@@ -610,17 +610,16 @@ JitRuntime::generateVMWrapper(JSContext*
- 
-     masm.setupUnalignedABICall(regs.getAny());
-     masm.passABIArg(reg_cx);
- 
-     size_t argDisp = 0;
- 
-     // Copy arguments.
-     for (uint32_t explicitArg = 0; explicitArg < f.explicitArgs; explicitArg++) {
--        MoveOperand from;
-         switch (f.argProperties(explicitArg)) {
-           case VMFunction::WordByValue:
-             masm.passABIArg(MoveOperand(argsBase, argDisp),
-                             (f.argPassedInFloatReg(explicitArg) ? MoveOp::DOUBLE : MoveOp::GENERAL));
-             argDisp += sizeof(void*);
-             break;
- 
-           case VMFunction::WordByRef:
-diff --git a/js/src/jit/shared/CodeGenerator-shared.cpp b/js/src/jit/shared/CodeGenerator-shared.cpp
---- a/js/src/jit/shared/CodeGenerator-shared.cpp
-+++ b/js/src/jit/shared/CodeGenerator-shared.cpp
-@@ -70,17 +70,18 @@ CodeGeneratorShared::CodeGeneratorShared
-     trackedOptimizationsTypesTableOffset_(0),
-     trackedOptimizationsAttemptsTableOffset_(0),
-     osrEntryOffset_(0),
-     skipArgCheckEntryOffset_(0),
- #ifdef CHECK_OSIPOINT_REGISTERS
-     checkOsiPointRegisters(JitOptions.checkOsiPointRegisters),
- #endif
-     frameDepth_(graph->paddedLocalSlotsSize() + graph->argumentsSize()),
--    frameInitialAdjustment_(0)
-+    frameInitialAdjustment_(0),
-+    frameClass_(FrameSizeClass::None())
- {
-     if (gen->isProfilerInstrumentationEnabled())
-         masm.enableProfilingInstrumentation();
- 
-     if (gen->compilingWasm()) {
-         // Since wasm uses the system ABI which does not necessarily use a
-         // regular array where all slots are sizeof(Value), it maintains the max
-         // argument stack depth separately.
-@@ -102,17 +103,17 @@ CodeGeneratorShared::CodeGeneratorShared
-             // instead relies on the a priori stack adjustment. This must be the
-             // last adjustment of frameDepth_.
-             frameDepth_ += ComputeByteAlignment(sizeof(wasm::Frame) + frameDepth_,
-                                                 WasmStackAlignment);
-         }
- 
-         // FrameSizeClass is only used for bailing, which cannot happen in
-         // wasm code.
--        frameClass_ = FrameSizeClass::None();
-+        MOZ_ASSERT(frameClass_ == FrameSizeClass::None());
-     } else {
-         frameClass_ = FrameSizeClass::FromDepth(frameDepth_);
-     }
- }
- 
- bool
- CodeGeneratorShared::generatePrologue()
- {
-diff --git a/js/src/jit/shared/IonAssemblerBufferWithConstantPools.h b/js/src/jit/shared/IonAssemblerBufferWithConstantPools.h
---- a/js/src/jit/shared/IonAssemblerBufferWithConstantPools.h
-+++ b/js/src/jit/shared/IonAssemblerBufferWithConstantPools.h
-@@ -238,16 +238,17 @@ class BranchDeadlineSet
-             earliest_ = deadline;
-             earliestRange_ = rangeIdx;
-         }
-         return true;
-     }
- 
-   public:
-     explicit BranchDeadlineSet(LifoAlloc& alloc)
-+      : earliestRange_(0)
-     {
-         // Manually construct vectors in the uninitialized aligned storage.
-         // This is because C++ arrays can otherwise only be constructed with
-         // the default constructor.
-         for (unsigned r = 0; r < NumRanges; r++)
-             new (&vectorForRange(r)) RangeVector(alloc);
-     }
- 
-diff --git a/js/src/jit/shared/Lowering-shared.h b/js/src/jit/shared/Lowering-shared.h
---- a/js/src/jit/shared/Lowering-shared.h
-+++ b/js/src/jit/shared/Lowering-shared.h
-@@ -32,16 +32,17 @@ class LIRGeneratorShared
-     MResumePoint* lastResumePoint_;
-     LRecoverInfo* cachedRecoverInfo_;
-     LOsiPoint* osiPoint_;
- 
-     LIRGeneratorShared(MIRGenerator* gen, MIRGraph& graph, LIRGraph& lirGraph)
-       : gen(gen),
-         graph(graph),
-         lirGraph_(lirGraph),
-+        current(nullptr),
-         lastResumePoint_(nullptr),
-         cachedRecoverInfo_(nullptr),
-         osiPoint_(nullptr)
-     { }
- 
-     MIRGenerator* mir() {
-         return gen;
-     }
-diff --git a/js/src/jit/x64/Assembler-x64.cpp b/js/src/jit/x64/Assembler-x64.cpp
---- a/js/src/jit/x64/Assembler-x64.cpp
-+++ b/js/src/jit/x64/Assembler-x64.cpp
-@@ -257,17 +257,19 @@ class RelocationIterator
- {
-     CompactBufferReader reader_;
-     uint32_t tableStart_;
-     uint32_t offset_;
-     uint32_t extOffset_;
- 
-   public:
-     explicit RelocationIterator(CompactBufferReader& reader)
--      : reader_(reader)
-+      : reader_(reader),
-+        offset_(0),
-+        extOffset_(0)
-     {
-         tableStart_ = reader_.readFixedUint32_t();
-     }
- 
-     bool read() {
-         if (!reader_.more())
-             return false;
-         offset_ = reader_.readUnsigned();
-diff --git a/js/src/jit/x64/Bailouts-x64.cpp b/js/src/jit/x64/Bailouts-x64.cpp
---- a/js/src/jit/x64/Bailouts-x64.cpp
-+++ b/js/src/jit/x64/Bailouts-x64.cpp
-@@ -42,32 +42,34 @@ class BailoutStack
- } // namespace js
- 
- #if defined(_WIN32)
- # pragma pack(pop)
- #endif
- 
- BailoutFrameInfo::BailoutFrameInfo(const JitActivationIterator& activations,
-                                    BailoutStack* bailout)
--  : machine_(bailout->machineState())
-+  : machine_(bailout->machineState()),
-+    activation_(nullptr)
- {
-     uint8_t* sp = bailout->parentStackPointer();
-     framePointer_ = sp + bailout->frameSize();
-     topFrameSize_ = framePointer_ - sp;
- 
-     JSScript* script = ScriptFromCalleeToken(((JitFrameLayout*) framePointer_)->calleeToken());
-     topIonScript_ = script->ionScript();
- 
-     attachOnJitActivation(activations);
-     snapshotOffset_ = bailout->snapshotOffset();
- }
- 
- BailoutFrameInfo::BailoutFrameInfo(const JitActivationIterator& activations,
-                                    InvalidationBailoutStack* bailout)
--  : machine_(bailout->machine())
-+  : machine_(bailout->machine()),
-+    activation_(nullptr)
- {
-     framePointer_ = (uint8_t*) bailout->fp();
-     topFrameSize_ = framePointer_ - bailout->sp();
-     topIonScript_ = bailout->ionScript();
-     attachOnJitActivation(activations);
- 
-     uint8_t* returnAddressToFp_ = bailout->osiPointReturnAddress();
-     const OsiIndex* osiIndex = topIonScript_->getOsiIndex(returnAddressToFp_);
-diff --git a/js/src/jit/x64/Trampoline-x64.cpp b/js/src/jit/x64/Trampoline-x64.cpp
---- a/js/src/jit/x64/Trampoline-x64.cpp
-+++ b/js/src/jit/x64/Trampoline-x64.cpp
-@@ -681,17 +681,16 @@ JitRuntime::generateVMWrapper(JSContext*
- 
-     masm.setupUnalignedABICall(regs.getAny());
-     masm.passABIArg(cxreg);
- 
-     size_t argDisp = 0;
- 
-     // Copy arguments.
-     for (uint32_t explicitArg = 0; explicitArg < f.explicitArgs; explicitArg++) {
--        MoveOperand from;
-         switch (f.argProperties(explicitArg)) {
-           case VMFunction::WordByValue:
-             if (f.argPassedInFloatReg(explicitArg))
-                 masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::DOUBLE);
-             else
-                 masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::GENERAL);
-             argDisp += sizeof(void*);
-             break;
-diff --git a/js/src/jit/x86/Trampoline-x86.cpp b/js/src/jit/x86/Trampoline-x86.cpp
---- a/js/src/jit/x86/Trampoline-x86.cpp
-+++ b/js/src/jit/x86/Trampoline-x86.cpp
-@@ -695,17 +695,16 @@ JitRuntime::generateVMWrapper(JSContext*
- 
-     masm.setupUnalignedABICall(regs.getAny());
-     masm.passABIArg(cxreg);
- 
-     size_t argDisp = 0;
- 
-     // Copy arguments.
-     for (uint32_t explicitArg = 0; explicitArg < f.explicitArgs; explicitArg++) {
--        MoveOperand from;
-         switch (f.argProperties(explicitArg)) {
-           case VMFunction::WordByValue:
-             masm.passABIArg(MoveOperand(argsBase, argDisp), MoveOp::GENERAL);
-             argDisp += sizeof(void*);
-             break;
-           case VMFunction::DoubleByValue:
-             // We don't pass doubles in float registers on x86, so no need
-             // to check for argPassedInFloatReg.

frg/work-js/mozilla-release/patches/mozilla-central-push_423385.patch

@@ -1,33 +0,0 @@
-# HG changeset patch
-# User Nathan Froyd <froydnj@mozilla.com>
-# Date 1529687737 14400
-#      Fri Jun 22 13:15:37 2018 -0400
-# Node ID 20ca7307d1bb3dfab8f93ab482db89cae54ef1e2
-# Parent  766e3010cdaa80a1795de90881b821565324301e
-Bug 1470452 - always use lib for LD_LIBRARY_PATH with clang; r=sfink
-
-diff --git a/js/src/devtools/automation/autospider.py b/js/src/devtools/automation/autospider.py
---- a/js/src/devtools/automation/autospider.py
-+++ b/js/src/devtools/automation/autospider.py
-@@ -237,17 +237,20 @@ info("using compiler '{}'".format(compil
- 
- cxx = {'clang': 'clang++', 'gcc': 'g++', 'cl': 'cl'}.get(compiler)
- 
- compiler_dir = env.get('GCCDIR', os.path.join(DIR.tooltool, compiler))
- info("looking for compiler under {}/".format(compiler_dir))
- if os.path.exists(os.path.join(compiler_dir, 'bin', compiler)):
-     env.setdefault('CC', os.path.join(compiler_dir, 'bin', compiler))
-     env.setdefault('CXX', os.path.join(compiler_dir, 'bin', cxx))
--    platlib = 'lib64' if word_bits == 64 else 'lib'
-+    if compiler == 'clang':
-+        platlib = 'lib'
-+    else:
-+        platlib = 'lib64' if word_bits == 64 else 'lib'
-     env.setdefault('LD_LIBRARY_PATH', os.path.join(compiler_dir, platlib))
- else:
-     env.setdefault('CC', compiler)
-     env.setdefault('CXX', cxx)
- 
- bindir = os.path.join(OBJDIR, 'dist', 'bin')
- env['LD_LIBRARY_PATH'] = ':'.join(
-     p for p in (bindir, env.get('LD_LIBRARY_PATH')) if p)

frg/work-js/mozilla-release/patches/mozilla-central-push_423440.patch

@@ -1,1177 +0,0 @@
-# HG changeset patch
-# User Andi-Bogdan Postelnicu <bpostelnicu@mozilla.com>
-# Date 1529759656 -10800
-#      Sat Jun 23 16:14:16 2018 +0300
-# Node ID 6a76baf321797f3831aeffaab4eb852e9383f213
-# Parent  8df7321c21e104eca20e2efa472e4ce82cf28442
-Bug 1453795 - JS - Initialize member fields in classes/ structures. r=waldoo
-
-diff --git a/js/src/ds/OrderedHashTable.h b/js/src/ds/OrderedHashTable.h
---- a/js/src/ds/OrderedHashTable.h
-+++ b/js/src/ds/OrderedHashTable.h
-@@ -97,16 +97,19 @@ class OrderedHashTable
-         }
-     }
- 
-   public:
-     OrderedHashTable(AllocPolicy& ap, mozilla::HashCodeScrambler hcs)
-       : hashTable(nullptr),
-         data(nullptr),
-         dataLength(0),
-+        dataCapacity(0),
-+        liveCount(0),
-+        hashShift(0),
-         ranges(nullptr),
-         nurseryRanges(nullptr),
-         alloc(ap),
-         hcs(hcs)
-     {}
- 
-     MOZ_MUST_USE bool init() {
-         MOZ_ASSERT(!hashTable, "init must be called at most once");
-diff --git a/js/src/frontend/BinSource.h b/js/src/frontend/BinSource.h
---- a/js/src/frontend/BinSource.h
-+++ b/js/src/frontend/BinSource.h
-@@ -103,16 +103,17 @@ class BinASTParser : public BinASTParser
-     using AutoTuple = typename Tokenizer::AutoTuple;
-     using BinFields = typename Tokenizer::BinFields;
-     using Chars = typename Tokenizer::Chars;
- 
-   public:
-     BinASTParser(JSContext* cx, LifoAlloc& alloc, UsedNameTracker& usedNames, const JS::ReadOnlyCompileOptions& options)
-         : BinASTParserBase(cx, alloc, usedNames)
-         , options_(options)
-+        , variableDeclarationKind_(VariableDeclarationKind::Var)
-     {
-     }
-     ~BinASTParser()
-     {
-     }
- 
-     /**
-      * Parse a buffer, returning a node (which may be nullptr) in case of success
-diff --git a/js/src/frontend/BinTokenReaderBase.h b/js/src/frontend/BinTokenReaderBase.h
---- a/js/src/frontend/BinTokenReaderBase.h
-+++ b/js/src/frontend/BinTokenReaderBase.h
-@@ -70,16 +70,17 @@ class MOZ_STACK_CLASS BinTokenReaderBase
-     MOZ_MUST_USE ErrorResult<JS::Error&> raiseInvalidNumberOfFields(
-         const BinKind kind, const uint32_t expected, const uint32_t got);
-     MOZ_MUST_USE ErrorResult<JS::Error&> raiseInvalidField(const char* kind,
-         const BinField field);
- 
-   protected:
-     BinTokenReaderBase(JSContext* cx, const uint8_t* start, const size_t length)
-         : cx_(cx)
-+        , poisoned_(false)
-         , start_(start)
-         , current_(start)
-         , stop_(start + length)
-         , latestKnownGoodPos_(0)
-     { }
- 
-     /**
-      * Read a single byte.
-diff --git a/js/src/frontend/BinTokenReaderMultipart.cpp b/js/src/frontend/BinTokenReaderMultipart.cpp
---- a/js/src/frontend/BinTokenReaderMultipart.cpp
-+++ b/js/src/frontend/BinTokenReaderMultipart.cpp
-@@ -339,17 +339,18 @@ BinTokenReaderMultipart::enterList(uint3
- 
- void
- BinTokenReaderMultipart::AutoBase::init()
- {
-     initialized_ = true;
- }
- 
- BinTokenReaderMultipart::AutoBase::AutoBase(BinTokenReaderMultipart& reader)
--    : reader_(reader)
-+    : initialized_(false)
-+    , reader_(reader)
- { }
- 
- BinTokenReaderMultipart::AutoBase::~AutoBase()
- {
-     // By now, the `AutoBase` must have been deinitialized by calling `done()`.
-     // The only case in which we can accept not calling `done()` is if we have
-     // bailed out because of an error.
-     MOZ_ASSERT_IF(initialized_, reader_.cx_->isExceptionPending());
-diff --git a/js/src/frontend/BinTokenReaderTester.cpp b/js/src/frontend/BinTokenReaderTester.cpp
---- a/js/src/frontend/BinTokenReaderTester.cpp
-+++ b/js/src/frontend/BinTokenReaderTester.cpp
-@@ -350,17 +350,18 @@ BinTokenReaderTester::enterList(uint32_t
- 
- void
- BinTokenReaderTester::AutoBase::init()
- {
-     initialized_ = true;
- }
- 
- BinTokenReaderTester::AutoBase::AutoBase(BinTokenReaderTester& reader)
--    : reader_(reader)
-+    : initialized_(false)
-+    , reader_(reader)
- { }
- 
- BinTokenReaderTester::AutoBase::~AutoBase()
- {
-     // By now, the `AutoBase` must have been deinitialized by calling `done()`.
-     // The only case in which we can accept not calling `done()` is if we have
-     // bailed out because of an error.
-     MOZ_ASSERT_IF(initialized_, reader_.cx_->isExceptionPending());
-diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
---- a/js/src/frontend/BytecodeEmitter.cpp
-+++ b/js/src/frontend/BytecodeEmitter.cpp
-@@ -1691,17 +1691,18 @@ class MOZ_STACK_CLASS TryEmitter
- 
-   public:
-     TryEmitter(BytecodeEmitter* bce, Kind kind, ControlKind controlKind)
-       : bce_(bce),
-         kind_(kind),
-         controlKind_(controlKind),
-         depth_(0),
-         noteIndex_(0),
--        tryStart_(0)
-+        tryStart_(0),
-+        tryEnd_{}
- #ifdef DEBUG
-       , state_(State::Start)
- #endif
-     {
-         if (controlKind_ == ControlKind::Syntactic)
-             controlInfo_.emplace(bce_, hasFinally() ? StatementKind::Finally : StatementKind::Try);
-         finallyStart_.offset = 0;
-     }
-@@ -2506,16 +2507,17 @@ BytecodeEmitter::BytecodeEmitter(Bytecod
-   : sc(sc),
-     cx(sc->context),
-     parent(parent),
-     script(cx, script),
-     lazyScript(cx, lazyScript),
-     prologue(cx, lineNum),
-     main(cx, lineNum),
-     current(&main),
-+    parser(nullptr),
-     atomIndices(cx->frontendCollectionPool()),
-     firstLine(lineNum),
-     maxFixedSlots(0),
-     maxStackDepth(0),
-     stackDepth(0),
-     emitLevel(0),
-     bodyScopeIndex(UINT32_MAX),
-     varEmitterScope(nullptr),
-diff --git a/js/src/frontend/NameCollections.h b/js/src/frontend/NameCollections.h
---- a/js/src/frontend/NameCollections.h
-+++ b/js/src/frontend/NameCollections.h
-@@ -108,17 +108,19 @@ struct RecyclableAtomMapValueWrapper
-         uint64_t dummy;
-     };
- 
-     static void assertInvariant() {
-         static_assert(sizeof(Wrapped) <= sizeof(uint64_t),
-                       "Can only recycle atom maps with values smaller than uint64");
-     }
- 
--    RecyclableAtomMapValueWrapper() {
-+    RecyclableAtomMapValueWrapper()
-+      : dummy(0)
-+    {
-         assertInvariant();
-     }
- 
-     MOZ_IMPLICIT RecyclableAtomMapValueWrapper(Wrapped w)
-       : wrapped(w)
-     {
-         assertInvariant();
-     }
-diff --git a/js/src/frontend/TokenStream.h b/js/src/frontend/TokenStream.h
---- a/js/src/frontend/TokenStream.h
-+++ b/js/src/frontend/TokenStream.h
-@@ -191,17 +191,20 @@ struct KeywordInfo;
- 
- namespace js {
- namespace frontend {
- 
- struct TokenPos {
-     uint32_t    begin;  // Offset of the token's first char.
-     uint32_t    end;    // Offset of 1 past the token's last char.
- 
--    TokenPos() {}
-+    TokenPos()
-+      : begin(0),
-+        end(0)
-+    {}
-     TokenPos(uint32_t begin, uint32_t end) : begin(begin), end(end) {}
- 
-     // Return a TokenPos that covers left, right, and anything in between.
-     static TokenPos box(const TokenPos& left, const TokenPos& right) {
-         MOZ_ASSERT(left.begin <= left.end);
-         MOZ_ASSERT(left.end <= right.begin);
-         MOZ_ASSERT(right.begin <= right.end);
-         return TokenPos(left.begin, right.end);
-diff --git a/js/src/gc/Nursery.h b/js/src/gc/Nursery.h
---- a/js/src/gc/Nursery.h
-+++ b/js/src/gc/Nursery.h
-@@ -428,26 +428,22 @@ class Nursery
-         mozilla::EnumeratedArray<ProfileKey, ProfileKey::KeyCount, mozilla::TimeStamp>;
-     using ProfileDurations =
-         mozilla::EnumeratedArray<ProfileKey, ProfileKey::KeyCount, mozilla::TimeDuration>;
- 
-     ProfileTimes startTimes_;
-     ProfileDurations profileDurations_;
-     ProfileDurations totalDurations_;
- 
--    /*
--     * This data is initialised only if the nursery is enabled and after at
--     * least one call to Nursery::collect()
--     */
-     struct {
--        JS::gcreason::Reason reason;
--        size_t nurseryCapacity;
--        size_t nurseryLazyCapacity;
--        size_t nurseryUsedBytes;
--        size_t tenuredBytes;
-+        JS::gcreason::Reason reason = JS::gcreason::NO_REASON;
-+        size_t nurseryCapacity = 0;
-+        size_t nurseryLazyCapacity = 0;
-+        size_t nurseryUsedBytes = 0;
-+        size_t tenuredBytes = 0;
-     } previousGC;
- 
-     /*
-      * Calculate the promotion rate of the most recent minor GC.
-      * The valid_for_tenuring parameter is used to return whether this
-      * promotion rate is accurate enough (the nursery was full enough) to be
-      * used for tenuring and other decisions.
-      *
-diff --git a/js/src/gc/Rooting.h b/js/src/gc/Rooting.h
---- a/js/src/gc/Rooting.h
-+++ b/js/src/gc/Rooting.h
-@@ -129,17 +129,19 @@ class FakeMutableHandle : public js::Mut
-         *ptr = v;
-     }
- 
-     DECLARE_POINTER_CONSTREF_OPS(T);
-     DECLARE_NONPOINTER_ACCESSOR_METHODS(*ptr);
-     DECLARE_NONPOINTER_MUTABLE_ACCESSOR_METHODS(*ptr);
- 
-   private:
--    FakeMutableHandle() {}
-+    FakeMutableHandle()
-+      : ptr(nullptr)
-+    {}
-     DELETE_ASSIGNMENT_OPS(FakeMutableHandle, T);
- 
-     T* ptr;
- };
- 
- template <typename T> class MaybeRooted<T, NoGC>
- {
-   public:
-diff --git a/js/src/gc/Statistics.cpp b/js/src/gc/Statistics.cpp
---- a/js/src/gc/Statistics.cpp
-+++ b/js/src/gc/Statistics.cpp
-@@ -739,16 +739,19 @@ Statistics::Statistics(JSRuntime* rt)
-   : runtime(rt),
-     gcTimerFile(nullptr),
-     gcDebugFile(nullptr),
-     nonincrementalReason_(gc::AbortReason::None),
-     preBytes(0),
-     thresholdTriggered(false),
-     triggerAmount(0.0),
-     triggerThreshold(0.0),
-+    startingMinorGCNumber(0),
-+    startingMajorGCNumber(0),
-+    startingSliceNumber(0),
-     maxPauseInInterval(0),
-     sliceCallback(nullptr),
-     nurseryCollectionCallback(nullptr),
-     aborted(false),
-     enableProfiling_(false),
-     sliceCount_(0)
- {
-     for (auto& count : counts)
-diff --git a/js/src/gc/Statistics.h b/js/src/gc/Statistics.h
---- a/js/src/gc/Statistics.h
-+++ b/js/src/gc/Statistics.h
-@@ -216,17 +216,18 @@ struct Statistics
-     struct SliceData {
-         SliceData(SliceBudget budget, JS::gcreason::Reason reason,
-                   TimeStamp start, size_t startFaults, gc::State initialState)
-           : budget(budget), reason(reason),
-             initialState(initialState),
-             finalState(gc::State::NotActive),
-             resetReason(gc::AbortReason::None),
-             start(start),
--            startFaults(startFaults)
-+            startFaults(startFaults),
-+            endFaults(0)
-         {}
- 
-         SliceBudget budget;
-         JS::gcreason::Reason reason;
-         gc::State initialState, finalState;
-         gc::AbortReason resetReason;
-         TimeStamp start, end;
-         size_t startFaults, endFaults;
-diff --git a/js/src/irregexp/RegExpEngine.cpp b/js/src/irregexp/RegExpEngine.cpp
---- a/js/src/irregexp/RegExpEngine.cpp
-+++ b/js/src/irregexp/RegExpEngine.cpp
-@@ -1647,16 +1647,17 @@ IsLatin1Equivalent(char16_t c, RegExpCom
- }
- 
- // Attempts to compile the regexp using an Irregexp code generator.  Returns
- // a fixed array or a null handle depending on whether it succeeded.
- RegExpCompiler::RegExpCompiler(JSContext* cx, LifoAlloc* alloc, int capture_count,
-                                bool ignore_case, bool latin1, bool match_only, bool unicode)
-   : next_register_(2 * (capture_count + 1)),
-     recursion_depth_(0),
-+    macro_assembler_(nullptr),
-     ignore_case_(ignore_case),
-     latin1_(latin1),
-     match_only_(match_only),
-     unicode_(unicode),
-     reg_exp_too_big_(false),
-     current_expansion_factor_(1),
-     frequency_collator_(),
-     cx_(cx),
-diff --git a/js/src/irregexp/RegExpEngine.h b/js/src/irregexp/RegExpEngine.h
---- a/js/src/irregexp/RegExpEngine.h
-+++ b/js/src/irregexp/RegExpEngine.h
-@@ -681,16 +681,17 @@ class ActionNode : public SeqRegExpNode
-         BEGIN_SUBMATCH,
-         POSITIVE_SUBMATCH_SUCCESS,
-         EMPTY_MATCH_CHECK,
-         CLEAR_CAPTURES
-     };
- 
-     ActionNode(ActionType action_type, RegExpNode* on_success)
-       : SeqRegExpNode(on_success),
-+        data_{},
-         action_type_(action_type)
-     {}
- 
-     static ActionNode* SetRegister(int reg, int val, RegExpNode* on_success);
-     static ActionNode* IncrementRegister(int reg, RegExpNode* on_success);
-     static ActionNode* StorePosition(int reg,
-                                      bool is_capture,
-                                      RegExpNode* on_success);
-diff --git a/js/src/jsapi-tests/testPrivateGCThingValue.cpp b/js/src/jsapi-tests/testPrivateGCThingValue.cpp
---- a/js/src/jsapi-tests/testPrivateGCThingValue.cpp
-+++ b/js/src/jsapi-tests/testPrivateGCThingValue.cpp
-@@ -19,16 +19,18 @@ class TestTracer : public JS::CallbackTr
- 
-   public:
-     js::gc::Cell* expectedCell;
-     JS::TraceKind expectedKind;
-     bool found;
- 
-     explicit TestTracer(JSContext* cx)
-       : JS::CallbackTracer(cx),
-+        expectedCell(nullptr),
-+        expectedKind(static_cast<JS::TraceKind>(0)),
-         found(false)
-     { }
- };
- 
- static const JSClass TestClass = {
-     "TestClass",
-     JSCLASS_HAS_RESERVED_SLOTS(1)
- };
-diff --git a/js/src/jsapi-tests/tests.h b/js/src/jsapi-tests/tests.h
---- a/js/src/jsapi-tests/tests.h
-+++ b/js/src/jsapi-tests/tests.h
-@@ -474,17 +474,21 @@ class ExternalData {
-  */
- class AutoLeaveZeal
- {
-     JSContext* cx_;
-     uint32_t zealBits_;
-     uint32_t frequency_;
- 
-   public:
--    explicit AutoLeaveZeal(JSContext* cx) : cx_(cx) {
-+    explicit AutoLeaveZeal(JSContext* cx)
-+      : cx_(cx),
-+        zealBits_(0),
-+        frequency_(0)
-+    {
-         uint32_t dummy;
-         JS_GetGCZealBits(cx_, &zealBits_, &frequency_, &dummy);
-         JS_SetGCZeal(cx_, 0, 0);
-         JS::PrepareForFullGC(cx_);
-         JS::NonIncrementalGC(cx_, GC_SHRINK, JS::gcreason::DEBUG_GC);
-     }
-     ~AutoLeaveZeal() {
-         JS_SetGCZeal(cx_, 0, 0);
-diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
---- a/js/src/jsapi.cpp
-+++ b/js/src/jsapi.cpp
-@@ -6864,17 +6864,20 @@ JS::AutoSaveExceptionState::~AutoSaveExc
-             context->overRecursed_ = wasOverRecursed;
-             context->throwing = true;
-             context->unwrappedException() = exceptionValue;
-         }
-     }
- }
- 
- struct JSExceptionState {
--    explicit JSExceptionState(JSContext* cx) : exception(cx) {}
-+    explicit JSExceptionState(JSContext* cx)
-+      : throwing(false),
-+        exception(cx)
-+    {}
-     bool throwing;
-     PersistentRootedValue exception;
- };
- 
- JS_PUBLIC_API(JSExceptionState*)
- JS_SaveExceptionState(JSContext* cx)
- {
-     JSExceptionState* state;
-diff --git a/js/src/jsfriendapi.h b/js/src/jsfriendapi.h
---- a/js/src/jsfriendapi.h
-+++ b/js/src/jsfriendapi.h
-@@ -1419,17 +1419,17 @@ class MOZ_STACK_CLASS JS_FRIEND_API(Auto
-      * When copying string char, use this many bytes of inline storage.  This is
-      * chosen to allow the inline string types to be copied without allocating.
-      * This is asserted in AutoStableStringChars::allocOwnChars.
-      */
-     static const size_t InlineCapacity = 24;
- 
-     /* Ensure the string is kept alive while we're using its chars. */
-     JS::RootedString s_;
--    union {
-+    MOZ_INIT_OUTSIDE_CTOR union {
-         const char16_t* twoByteChars_;
-         const JS::Latin1Char* latin1Chars_;
-     };
-     mozilla::Maybe<Vector<uint8_t, InlineCapacity>> ownChars_;
-     enum State { Uninitialized, Latin1, TwoByte };
-     State state_;
- 
-   public:
-diff --git a/js/src/vm/BytecodeUtil.h b/js/src/vm/BytecodeUtil.h
---- a/js/src/vm/BytecodeUtil.h
-+++ b/js/src/vm/BytecodeUtil.h
-@@ -468,17 +468,17 @@ class SrcNoteLineScanner
-      * Is the current op the first one after a line change directive? Note that
-      * multiple ops may be "first" if a line directive is used to return to a
-      * previous line (eg, with a for loop increment expression.)
-      */
-     bool lineHeader;
- 
-   public:
-     SrcNoteLineScanner(jssrcnote* sn, uint32_t lineno)
--        : offset(0), sn(sn), lineno(lineno)
-+        : offset(0), sn(sn), lineno(lineno), lineHeader(false)
-     {
-     }
- 
-     /*
-      * This is called repeatedly with always-advancing relpc values. The src
-      * notes are tuples of <PC offset from prev src note, type, args>. Scan
-      * through, updating the lineno, until the next src note is for a later
-      * bytecode.
-diff --git a/js/src/vm/Caches.h b/js/src/vm/Caches.h
---- a/js/src/vm/Caches.h
-+++ b/js/src/vm/Caches.h
-@@ -78,17 +78,17 @@ struct EvalCacheEntry
-     }
- };
- 
- struct EvalCacheLookup
- {
-     explicit EvalCacheLookup(JSContext* cx) : str(cx), callerScript(cx) {}
-     RootedLinearString str;
-     RootedScript callerScript;
--    jsbytecode* pc;
-+    MOZ_INIT_OUTSIDE_CTOR jsbytecode* pc;
- };
- 
- struct EvalCacheHashPolicy
- {
-     typedef EvalCacheLookup Lookup;
- 
-     static HashNumber hash(const Lookup& l);
-     static bool match(const EvalCacheEntry& entry, const EvalCacheLookup& l);
-diff --git a/js/src/vm/Compression.cpp b/js/src/vm/Compression.cpp
---- a/js/src/vm/Compression.cpp
-+++ b/js/src/vm/Compression.cpp
-@@ -40,16 +40,23 @@ Compressor::Compressor(const unsigned ch
-     MOZ_ASSERT(inplen > 0);
-     zs.opaque = nullptr;
-     zs.next_in = (Bytef*)inp;
-     zs.avail_in = 0;
-     zs.next_out = nullptr;
-     zs.avail_out = 0;
-     zs.zalloc = zlib_alloc;
-     zs.zfree = zlib_free;
-+    zs.total_in = 0;
-+    zs.total_out = 0;
-+    zs.msg = nullptr;
-+    zs.state = nullptr;
-+    zs.data_type = 0;
-+    zs.adler = 0;
-+    zs.reserved = 0;
- 
-     // Reserve space for the CompressedDataHeader.
-     outbytes = sizeof(CompressedDataHeader);
- }
- 
- Compressor::~Compressor()
- {
-     if (initialized) {
-diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
---- a/js/src/vm/Debugger.cpp
-+++ b/js/src/vm/Debugger.cpp
-@@ -4225,19 +4225,23 @@ class MOZ_STACK_CLASS Debugger::ScriptQu
-         cx(cx),
-         debugger(dbg),
-         iterMarker(&cx->runtime()->gc),
-         realms(cx->zone()),
-         url(cx),
-         displayURLString(cx),
-         hasSource(false),
-         source(cx, AsVariant(static_cast<ScriptSourceObject*>(nullptr))),
-+        hasLine(false),
-+        line(0),
-+        innermost(false),
-         innermostForRealm(cx->zone()),
-         vector(cx, ScriptVector(cx)),
--        wasmInstanceVector(cx, WasmInstanceObjectVector(cx))
-+        wasmInstanceVector(cx, WasmInstanceObjectVector(cx)),
-+        oom(false)
-     {}
- 
-     /*
-      * Initialize this ScriptQuery. Raise an error and return false if we
-      * haven't enough memory.
-      */
-     bool init() {
-         if (!realms.init() ||
-@@ -5458,17 +5462,20 @@ DebuggerScript_getStartLine(JSContext* c
-     return true;
- }
- 
- struct DebuggerScriptGetLineCountMatcher
- {
-     JSContext* cx_;
-     double totalLines;
- 
--    explicit DebuggerScriptGetLineCountMatcher(JSContext* cx) : cx_(cx) {}
-+    explicit DebuggerScriptGetLineCountMatcher(JSContext* cx)
-+      : cx_(cx),
-+        totalLines(0.0)
-+    {}
-     using ReturnType = bool;
- 
-     ReturnType match(HandleScript script) {
-         totalLines = double(GetScriptLineExtent(script));
-         return true;
-     }
-     ReturnType match(Handle<WasmInstanceObject*> wasmInstance) {
-         uint32_t result;
-@@ -6682,17 +6689,21 @@ DebuggerScript_clearAllBreakpoints(JSCon
- 
- class DebuggerScriptIsInCatchScopeMatcher
- {
-     JSContext* cx_;
-     size_t offset_;
-     bool isInCatch_;
- 
-   public:
--    explicit DebuggerScriptIsInCatchScopeMatcher(JSContext* cx, size_t offset) : cx_(cx), offset_(offset) { }
-+    explicit DebuggerScriptIsInCatchScopeMatcher(JSContext* cx, size_t offset)
-+      : cx_(cx),
-+        offset_(offset),
-+        isInCatch_(false)
-+    { }
-     using ReturnType = bool;
- 
-     inline bool isInCatch() const { return isInCatch_; }
- 
-     ReturnType match(HandleScript script) {
-         if (!EnsureScriptOffsetIsValid(cx_, script, offset_))
-             return false;
- 
-diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
---- a/js/src/vm/JSScript.cpp
-+++ b/js/src/vm/JSScript.cpp
-@@ -1613,17 +1613,19 @@ ScriptSource::chunkChars(JSContext* cx, 
-         return nullptr;
-     }
-     return ret;
- }
- 
- ScriptSource::PinnedChars::PinnedChars(JSContext* cx, ScriptSource* source,
-                                        UncompressedSourceCache::AutoHoldEntry& holder,
-                                        size_t begin, size_t len)
--  : source_(source)
-+  : stack_(nullptr),
-+    prev_(nullptr),
-+    source_(source)
- {
-     chars_ = source->chars(cx, holder, begin, len);
-     if (chars_) {
-         stack_ = &source->pinnedCharsStack_;
-         prev_ = *stack_;
-         *stack_ = this;
-     }
- }
-diff --git a/js/src/vm/JSScript.h b/js/src/vm/JSScript.h
---- a/js/src/vm/JSScript.h
-+++ b/js/src/vm/JSScript.h
-@@ -2094,16 +2094,17 @@ class JSScript : public js::gc::TenuredC
-     {
-         JS::RootedScript script_;
-         JSContext* cx_;
-         bool oldDoNotRelazify_;
-       public:
-         explicit AutoDelazify(JSContext* cx, JS::HandleFunction fun = nullptr)
-             : script_(cx)
-             , cx_(cx)
-+            , oldDoNotRelazify_(false)
-         {
-             holdScript(fun);
-         }
- 
-         ~AutoDelazify()
-         {
-             dropScript();
-         }
-diff --git a/js/src/vm/ObjectGroup.h b/js/src/vm/ObjectGroup.h
---- a/js/src/vm/ObjectGroup.h
-+++ b/js/src/vm/ObjectGroup.h
-@@ -623,17 +623,21 @@ class ObjectGroupRealm
- 
-     // This cache is purged on GC.
-     class DefaultNewGroupCache
-     {
-         ObjectGroup* group_;
-         JSObject* associated_;
- 
-       public:
--        DefaultNewGroupCache() { purge(); }
-+        DefaultNewGroupCache()
-+          : associated_(nullptr)
-+        {
-+            purge();
-+        }
- 
-         void purge() {
-             group_ = nullptr;
-         }
-         void put(ObjectGroup* group, JSObject* associated) {
-             group_ = group;
-             associated_ = associated;
-         }
-diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
---- a/js/src/vm/RegExpShared.h
-+++ b/js/src/vm/RegExpShared.h
-@@ -229,17 +229,19 @@ class RegExpShared : public gc::TenuredC
- };
- 
- class RegExpZone
- {
-     struct Key {
-         JSAtom* atom;
-         uint16_t flag;
- 
--        Key() {}
-+        Key()
-+          : atom(nullptr), flag(0)
-+        { }
-         Key(JSAtom* atom, RegExpFlag flag)
-           : atom(atom), flag(flag)
-         { }
-         MOZ_IMPLICIT Key(const ReadBarriered<RegExpShared*>& shared)
-           : atom(shared.unbarrieredGet()->getSource()),
-             flag(shared.unbarrieredGet()->getFlags())
-         { }
- 
-diff --git a/js/src/vm/Shape.h b/js/src/vm/Shape.h
---- a/js/src/vm/Shape.h
-+++ b/js/src/vm/Shape.h
-@@ -1519,17 +1519,18 @@ class MutableWrappedPtrOperations<StackS
- 
- inline
- Shape::Shape(const StackShape& other, uint32_t nfixed)
-   : base_(other.base),
-     propid_(other.propid),
-     immutableFlags(other.immutableFlags),
-     attrs(other.attrs),
-     mutableFlags(other.mutableFlags),
--    parent(nullptr)
-+    parent(nullptr),
-+    listp(nullptr)
- {
-     setNumFixedSlots(nfixed);
- 
- #ifdef DEBUG
-     gc::AllocKind allocKind = getAllocKind();
-     MOZ_ASSERT_IF(other.isAccessorShape(), allocKind == gc::AllocKind::ACCESSOR_SHAPE);
-     MOZ_ASSERT_IF(allocKind == gc::AllocKind::SHAPE, !other.isAccessorShape());
- #endif
-@@ -1553,17 +1554,18 @@ class NurseryShapesRef : public gc::Buff
- 
- inline
- Shape::Shape(UnownedBaseShape* base, uint32_t nfixed)
-   : base_(base),
-     propid_(JSID_EMPTY),
-     immutableFlags(SHAPE_INVALID_SLOT | (nfixed << FIXED_SLOTS_SHIFT)),
-     attrs(0),
-     mutableFlags(0),
--    parent(nullptr)
-+    parent(nullptr),
-+    listp(nullptr)
- {
-     MOZ_ASSERT(base);
-     kids.setNull();
- }
- 
- inline GetterOp
- Shape::getter() const
- {
-diff --git a/js/src/vm/Stack.h b/js/src/vm/Stack.h
---- a/js/src/vm/Stack.h
-+++ b/js/src/vm/Stack.h
-@@ -1666,17 +1666,17 @@ class JitActivation : public Activation
-     mozilla::Maybe<wasm::TrapData> wasmTrapData_;
- 
-     void clearRematerializedFrames();
- 
- #ifdef CHECK_OSIPOINT_REGISTERS
-   protected:
-     // Used to verify that live registers don't change between a VM call and
-     // the OsiPoint that follows it. Protected to silence Clang warning.
--    uint32_t checkRegs_;
-+    uint32_t checkRegs_ = 0;
-     RegisterDump regs_;
- #endif
- 
-   public:
-     explicit JitActivation(JSContext* cx);
-     ~JitActivation();
- 
-     bool isProfiling() const {
-diff --git a/js/src/vm/TraceLogging.h b/js/src/vm/TraceLogging.h
---- a/js/src/vm/TraceLogging.h
-+++ b/js/src/vm/TraceLogging.h
-@@ -570,32 +570,34 @@ class MOZ_RAII AutoTraceLog
-     bool executed;
-     AutoTraceLog* prev;
- 
-   public:
-     AutoTraceLog(TraceLoggerThread* logger,
-                  const TraceLoggerEvent& event MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
-       : logger(logger),
-         isEvent(true),
--        executed(false)
-+        executed(false),
-+        prev(nullptr)
-     {
-         MOZ_GUARD_OBJECT_NOTIFIER_INIT;
-         payload.event = &event;
-         if (logger) {
-             logger->startEvent(event);
- 
-             prev = logger->top;
-             logger->top = this;
-         }
-     }
- 
-     AutoTraceLog(TraceLoggerThread* logger, TraceLoggerTextId id MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
-       : logger(logger),
-         isEvent(false),
--        executed(false)
-+        executed(false),
-+        prev(nullptr)
-     {
-         MOZ_GUARD_OBJECT_NOTIFIER_INIT;
-         payload.id = id;
-         if (logger) {
-             logger->startEvent(id);
- 
-             prev = logger->top;
-             logger->top = this;
-diff --git a/js/src/vm/TraceLoggingGraph.h b/js/src/vm/TraceLoggingGraph.h
---- a/js/src/vm/TraceLoggingGraph.h
-+++ b/js/src/vm/TraceLoggingGraph.h
-@@ -125,16 +125,20 @@ class TraceLoggerGraph
-         {
-             start_ = start;
-             stop_ = stop;
-             u.s.textId_ = textId;
-             u.s.hasChildren_ = hasChildren;
-             nextId_ = nextId;
-         }
-         TreeEntry()
-+          : start_(0),
-+            stop_(0),
-+            u{},
-+            nextId_(0)
-         { }
-         uint64_t start() {
-             return start_;
-         }
-         uint64_t stop() {
-             return stop_;
-         }
-         uint32_t textId() {
-diff --git a/js/src/vm/TraceLoggingTypes.h b/js/src/vm/TraceLoggingTypes.h
---- a/js/src/vm/TraceLoggingTypes.h
-+++ b/js/src/vm/TraceLoggingTypes.h
-@@ -157,17 +157,19 @@ class ContinuousSpace {
-     uint32_t size_;
-     uint32_t capacity_;
- 
-     // The maximum number of bytes of RAM a continuous space structure can take.
-     static const uint32_t LIMIT = 200 * 1024 * 1024;
- 
-   public:
-     ContinuousSpace ()
--     : data_(nullptr)
-+     : data_(nullptr),
-+       size_(0),
-+       capacity_(0)
-     { }
- 
-     bool init() {
-         capacity_ = 64;
-         size_ = 0;
-         data_ = (T*) js_malloc(capacity_ * sizeof(T));
-         if (!data_)
-             return false;
-diff --git a/js/src/wasm/AsmJS.cpp b/js/src/wasm/AsmJS.cpp
---- a/js/src/wasm/AsmJS.cpp
-+++ b/js/src/wasm/AsmJS.cpp
-@@ -333,16 +333,17 @@ struct js::AsmJSMetadata : Metadata, Asm
-     }
-     uint32_t srcEndAfterCurly() const {
-         return srcStart + srcLengthWithRightBrace;
-     }
- 
-     AsmJSMetadata()
-       : Metadata(ModuleKind::AsmJS),
-         cacheResult(CacheResult::Miss),
-+        toStringStart(0),
-         srcStart(0),
-         strict(false)
-     {}
-     ~AsmJSMetadata() override {}
- 
-     const AsmJSExport& lookupAsmJSExport(uint32_t funcIndex) const {
-         // The AsmJSExportVector isn't stored in sorted order so do a linear
-         // search. This is for the super-cold and already-expensive toString()
-@@ -1519,17 +1520,17 @@ class MOZ_STACK_CLASS JS_HAZ_ROOTED Modu
-                 SimdType type_;
-                 SimdOperation which_;
-             } simdOp;
- 
-             // |varOrConst|, through |varOrConst.literalValue_|, has a
-             // non-trivial constructor and therefore MUST be placement-new'd
-             // into existence.
-             MOZ_PUSH_DISABLE_NONTRIVIAL_UNION_WARNINGS
--            U() {}
-+            U() : funcDefIndex_(0) {}
-             MOZ_POP_DISABLE_NONTRIVIAL_UNION_WARNINGS
-         } u;
- 
-         friend class ModuleValidator;
-         friend class js::LifoAlloc;
- 
-         explicit Global(Which which) : which_(which) {}
- 
-@@ -1610,17 +1611,17 @@ class MOZ_STACK_CLASS JS_HAZ_ROOTED Modu
-         enum Kind { Function, Constant };
-         Kind kind;
- 
-         union {
-             double cst;
-             AsmJSMathBuiltinFunction func;
-         } u;
- 
--        MathBuiltin() : kind(Kind(-1)) {}
-+        MathBuiltin() : kind(Kind(-1)), u{} {}
-         explicit MathBuiltin(double cst) : kind(Constant) {
-             u.cst = cst;
-         }
-         explicit MathBuiltin(AsmJSMathBuiltinFunction func) : kind(Function) {
-             u.func = func;
-         }
-     };
- 
-diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompile.cpp
---- a/js/src/wasm/WasmBaselineCompile.cpp
-+++ b/js/src/wasm/WasmBaselineCompile.cpp
-@@ -1005,16 +1005,18 @@ using ScratchI8 = ScratchI32;
- BaseLocalIter::BaseLocalIter(const ValTypeVector& locals, size_t argsLength, bool debugEnabled)
-   : locals_(locals),
-     argsLength_(argsLength),
-     argsRange_(locals.begin(), argsLength),
-     argsIter_(argsRange_),
-     index_(0),
-     localSize_(debugEnabled ? DebugFrame::offsetOfFrame() : 0),
-     reservedSize_(localSize_),
-+    frameOffset_(0),
-+    mirType_(MIRType::Undefined),
-     done_(false)
- {
-     MOZ_ASSERT(argsLength <= locals.length());
-     settle();
- }
- 
- int32_t
- BaseLocalIter::pushLocal(size_t nbytes)
-diff --git a/js/src/wasm/WasmFrameIter.cpp b/js/src/wasm/WasmFrameIter.cpp
---- a/js/src/wasm/WasmFrameIter.cpp
-+++ b/js/src/wasm/WasmFrameIter.cpp
-@@ -35,17 +35,18 @@ using mozilla::Maybe;
- 
- WasmFrameIter::WasmFrameIter(JitActivation* activation, wasm::Frame* fp)
-   : activation_(activation),
-     code_(nullptr),
-     codeRange_(nullptr),
-     lineOrBytecode_(0),
-     fp_(fp ? fp : activation->wasmExitFP()),
-     unwoundIonCallerFP_(nullptr),
--    unwind_(Unwind::False)
-+    unwind_(Unwind::False),
-+    unwoundAddressOfReturnAddress_(nullptr)
- {
-     MOZ_ASSERT(fp_);
- 
-     // When the stack is captured during a trap (viz., to create the .stack
-     // for an Error object), use the pc/bytecode information captured by the
-     // signal handler in the runtime.
- 
-     if (activation->isWasmTrapping()) {
-diff --git a/js/src/wasm/WasmFrameIter.h b/js/src/wasm/WasmFrameIter.h
---- a/js/src/wasm/WasmFrameIter.h
-+++ b/js/src/wasm/WasmFrameIter.h
-@@ -94,32 +94,35 @@ class WasmFrameIter
- enum class SymbolicAddress;
- 
- // An ExitReason describes the possible reasons for leaving compiled wasm
- // code or the state of not having left compiled wasm code
- // (ExitReason::None). It is either a known reason, or a enumeration to a native
- // function that is used for better display in the profiler.
- class ExitReason
- {
--    uint32_t payload_;
--
--    ExitReason() {}
--
-   public:
-     enum class Fixed : uint32_t
-     {
-         None,            // default state, the pc is in wasm code
-         FakeInterpEntry, // slow-path entry call from C++ WasmCall()
-         ImportJit,       // fast-path call directly into JIT code
-         ImportInterp,    // slow-path call into C++ Invoke()
-         BuiltinNative,   // fast-path call directly into native C++ code
-         Trap,            // call to trap handler
-         DebugTrap        // call to debug trap handler
-     };
- 
-+  private:
-+    uint32_t payload_;
-+
-+    ExitReason() : ExitReason(Fixed::None) {}
-+
-+  public:
-+
-     MOZ_IMPLICIT ExitReason(Fixed exitReason)
-       : payload_(0x0 | (uint32_t(exitReason) << 1))
-     {
-         MOZ_ASSERT(isFixed());
-         MOZ_ASSERT_IF(isNone(), payload_ == 0);
-     }
- 
-     explicit ExitReason(SymbolicAddress sym)
-diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
---- a/js/src/wasm/WasmJS.cpp
-+++ b/js/src/wasm/WasmJS.cpp
-@@ -2887,16 +2887,17 @@ class CompileStreamTask : public Promise
-     CompileStreamTask(JSContext* cx, Handle<PromiseObject*> promise,
-                       CompileArgs& compileArgs, bool instantiate,
-                       HandleObject importObj)
-       : PromiseHelperTask(cx, promise),
-         compileArgs_(&compileArgs),
-         instantiate_(instantiate),
-         importObj_(cx, importObj),
-         streamState_(mutexid::WasmStreamStatus, Env),
-+        codeSection_{},
-         codeStreamEnd_(nullptr),
-         exclusiveCodeStreamEnd_(mutexid::WasmCodeStreamEnd, nullptr),
-         exclusiveTailBytes_(mutexid::WasmTailBytesPtr, nullptr),
-         streamFailed_(false)
-     {
-         MOZ_ASSERT_IF(importObj_, instantiate_);
-     }
- };
-diff --git a/js/src/wasm/WasmOpIter.h b/js/src/wasm/WasmOpIter.h
---- a/js/src/wasm/WasmOpIter.h
-+++ b/js/src/wasm/WasmOpIter.h
-@@ -233,16 +233,18 @@ Classify(OpBytes op);
- template <typename Value>
- struct LinearMemoryAddress
- {
-     Value base;
-     uint32_t offset;
-     uint32_t align;
- 
-     LinearMemoryAddress()
-+      : offset(0),
-+        align(0)
-     {}
-     LinearMemoryAddress(Value base, uint32_t offset, uint32_t align)
-       : base(base), offset(offset), align(align)
-     {}
- };
- 
- template <typename ControlItem>
- class ControlStackEntry
-diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
---- a/js/src/wasm/WasmTextToBinary.cpp
-+++ b/js/src/wasm/WasmTextToBinary.cpp
-@@ -164,17 +164,18 @@ class WasmToken
-       : kind_(Kind::Invalid),
-         begin_(nullptr),
-         end_(nullptr),
-         u()
-     { }
-     WasmToken(Kind kind, const char16_t* begin, const char16_t* end)
-       : kind_(kind),
-         begin_(begin),
--        end_(end)
-+        end_(end),
-+        u{}
-     {
-         MOZ_ASSERT(kind_ != Error);
-         MOZ_ASSERT(kind_ != Invalid);
-         MOZ_ASSERT((kind == EndOfFile) == (begin == end));
-     }
-     explicit WasmToken(uint32_t index, const char16_t* begin, const char16_t* end)
-       : kind_(Index),
-         begin_(begin),
-@@ -247,17 +248,18 @@ class WasmToken
-         MOZ_ASSERT(begin != end);
-         MOZ_ASSERT(kind_ == AtomicCmpXchg || kind_ == AtomicLoad || kind_ == AtomicRMW ||
-                    kind_ == AtomicStore || kind_ == Wait || kind_ == Wake);
-         u.threadOp_ = op;
-     }
-     explicit WasmToken(const char16_t* begin)
-       : kind_(Error),
-         begin_(begin),
--        end_(begin)
-+        end_(begin),
-+        u{}
-     {}
-     Kind kind() const {
-         MOZ_ASSERT(kind_ != Kind::Invalid);
-         return kind_;
-     }
-     const char16_t* begin() const {
-         return begin_;
-     }
-diff --git a/js/src/wasm/WasmTypes.h b/js/src/wasm/WasmTypes.h
---- a/js/src/wasm/WasmTypes.h
-+++ b/js/src/wasm/WasmTypes.h
-@@ -792,17 +792,17 @@ class InitExpr
-   private:
-     Kind kind_;
-     union U {
-         Val val_;
-         struct {
-             uint32_t index_;
-             ValType type_;
-         } global;
--        U() {}
-+        U() : global{} {}
-     } u;
- 
-   public:
-     InitExpr() = default;
- 
-     explicit InitExpr(Val val) : kind_(Kind::Constant) {
-         u.val_ = val;
-     }
-@@ -915,17 +915,17 @@ class GlobalDesc
-     union V {
-         struct {
-             union U {
-                 InitExpr initial_;
-                 struct {
-                     ValType type_;
-                     uint32_t index_;
-                 } import;
--                U() {}
-+                U() : import{} {}
-             } val;
-             unsigned offset_;
-             bool isMutable_;
-             bool isWasm_;
-             bool isExport_;
-         } var;
-         Val cst_;
-         V() {}
-@@ -1595,17 +1595,20 @@ class CallSiteDesc
-     enum Kind {
-         Func,       // pc-relative call to a specific function
-         Dynamic,    // dynamic callee called via register
-         Symbolic,   // call to a single symbolic callee
-         EnterFrame, // call to a enter frame handler
-         LeaveFrame, // call to a leave frame handler
-         Breakpoint  // call to instruction breakpoint
-     };
--    CallSiteDesc() {}
-+    CallSiteDesc()
-+      : lineOrBytecode_(0),
-+        kind_(0)
-+    {}
-     explicit CallSiteDesc(Kind kind)
-       : lineOrBytecode_(0), kind_(kind)
-     {
-         MOZ_ASSERT(kind == Kind(kind_));
-     }
-     CallSiteDesc(uint32_t lineOrBytecode, Kind kind)
-       : lineOrBytecode_(lineOrBytecode), kind_(kind)
-     {
-@@ -1616,17 +1619,17 @@ class CallSiteDesc
-     Kind kind() const { return Kind(kind_); }
- };
- 
- class CallSite : public CallSiteDesc
- {
-     uint32_t returnAddressOffset_;
- 
-   public:
--    CallSite() {}
-+    CallSite() : returnAddressOffset_(0) {}
- 
-     CallSite(CallSiteDesc desc, uint32_t returnAddressOffset)
-       : CallSiteDesc(desc),
-         returnAddressOffset_(returnAddressOffset)
-     { }
- 
-     void offsetBy(int32_t delta) { returnAddressOffset_ += delta; }
-     uint32_t returnAddressOffset() const { return returnAddressOffset_; }
-@@ -1994,17 +1997,17 @@ class CalleeDesc
-         // Like Builtin, but automatically passes Instance* as first argument.
-         BuiltinInstanceMethod
-     };
- 
-   private:
-     // which_ shall be initialized in the static constructors
-     MOZ_INIT_OUTSIDE_CTOR Which which_;
-     union U {
--        U() {}
-+        U() : funcIndex_(0) {}
-         uint32_t funcIndex_;
-         struct {
-             uint32_t globalDataOffset_;
-         } import;
-         struct {
-             uint32_t globalDataOffset_;
-             uint32_t minLength_;
-             bool external_;

frg/work-js/mozilla-release/patches/mozilla-central-push_423543.patch

@@ -1,166 +0,0 @@
-# HG changeset patch
-# User Benjamin Bouvier <benj@benj.me>
-# Date 1529584347 -7200
-#      Thu Jun 21 14:32:27 2018 +0200
-# Node ID d5a1643bd46e0e9da278a0ba7aeb2457ac59878e
-# Parent  c451084c1e34d82d1f6529171f8be7dfac8b4743
-Bug 1450261: Make To{WebAssembly,JS}Value private and inline GetGlobalExport; r=lth
-
-diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
---- a/js/src/wasm/WasmJS.cpp
-+++ b/js/src/wasm/WasmJS.cpp
-@@ -104,18 +104,18 @@ HasAvailableCompilerTier(JSContext* cx)
- bool
- wasm::HasSupport(JSContext* cx)
- {
-     return cx->options().wasm() &&
-            HasCompilerSupport(cx) &&
-            HasAvailableCompilerTier(cx);
- }
- 
--bool
--wasm::ToWebAssemblyValue(JSContext* cx, ValType targetType, HandleValue v, Val* val)
-+static bool
-+ToWebAssemblyValue(JSContext* cx, ValType targetType, HandleValue v, Val* val)
- {
-     switch (targetType.code()) {
-       case ValType::I32: {
-         int32_t i32;
-         if (!ToInt32(cx, v, &i32))
-             return false;
-         *val = Val(uint32_t(i32));
-         return true;
-@@ -135,18 +135,18 @@ wasm::ToWebAssemblyValue(JSContext* cx, 
-         return true;
-       }
-       default: {
-         MOZ_CRASH("unexpected import value type, caller must guard");
-       }
-     }
- }
- 
--Value
--wasm::ToJSValue(const Val& val)
-+static Value
-+ToJSValue(const Val& val)
- {
-     switch (val.type().code()) {
-       case ValType::I32:
-         return Int32Value(val.i32());
-       case ValType::F32:
-         return DoubleValue(JS::CanonicalizeNaN(double(val.f32())));
-       case ValType::F64:
-         return DoubleValue(JS::CanonicalizeNaN(val.f64()));
-diff --git a/js/src/wasm/WasmJS.h b/js/src/wasm/WasmJS.h
---- a/js/src/wasm/WasmJS.h
-+++ b/js/src/wasm/WasmJS.h
-@@ -39,25 +39,16 @@ namespace wasm {
- bool
- HasCompilerSupport(JSContext* cx);
- 
- // Return whether WebAssembly is enabled on this platform.
- 
- bool
- HasSupport(JSContext* cx);
- 
--// ToWebAssemblyValue and ToJSValue are conversion functions defined in
--// the Wasm JS API spec.
--
--bool
--ToWebAssemblyValue(JSContext* cx, ValType targetType, HandleValue v, Val* val);
--
--Value
--ToJSValue(const Val& val);
--
- // Compiles the given binary wasm module given the ArrayBufferObject
- // and links the module's imports with the given import object.
- 
- MOZ_MUST_USE bool
- Eval(JSContext* cx, Handle<TypedArrayObject*> code, HandleObject importObj,
-      MutableHandleWasmInstanceObject instanceObj);
- 
- // These accessors can be used to probe JS values for being an exported wasm
-diff --git a/js/src/wasm/WasmModule.cpp b/js/src/wasm/WasmModule.cpp
---- a/js/src/wasm/WasmModule.cpp
-+++ b/js/src/wasm/WasmModule.cpp
-@@ -1115,34 +1115,21 @@ GetFunctionExport(JSContext* cx,
-     if (!instanceObj->getExportedFunction(cx, instanceObj, exp.funcIndex(), &fun))
-         return false;
- 
-     val.setObject(*fun);
-     return true;
- }
- 
- static bool
--GetGlobalExport(JSContext* cx,
--                const GlobalDescVector& globals,
--                uint32_t globalIndex,
--                const ValVector& globalImportValues,
--                const WasmGlobalObjectVector& globalObjs,
--                MutableHandleValue jsval)
--{
--    jsval.setObject(*globalObjs[globalIndex]);
--    return true;
--}
--
--static bool
- CreateExportObject(JSContext* cx,
-                    HandleWasmInstanceObject instanceObj,
-                    Handle<FunctionVector> funcImports,
-                    HandleWasmTableObject tableObj,
-                    HandleWasmMemoryObject memoryObj,
--                   const ValVector& globalImportValues,
-                    const WasmGlobalObjectVector& globalObjs,
-                    const ExportVector& exports)
- {
-     const Instance& instance = instanceObj->instance();
-     const Metadata& metadata = instance.metadata();
- 
-     if (metadata.isAsmJS() && exports.length() == 1 && strlen(exports[0].fieldName()) == 0) {
-         RootedValue val(cx);
-@@ -1174,21 +1161,17 @@ CreateExportObject(JSContext* cx,
-             break;
-           case DefinitionKind::Table:
-             val = ObjectValue(*tableObj);
-             break;
-           case DefinitionKind::Memory:
-             val = ObjectValue(*memoryObj);
-             break;
-           case DefinitionKind::Global:
--            if (!GetGlobalExport(cx, metadata.globals, exp.globalIndex(), globalImportValues,
--                                 globalObjs, &val))
--            {
--                return false;
--            }
-+            val.setObject(*globalObjs[exp.globalIndex()]);
-             break;
-         }
- 
-         if (!JS_DefinePropertyById(cx, exportObj, id, val, JSPROP_ENUMERATE))
-             return false;
-     }
- 
-     if (!metadata.isAsmJS()) {
-@@ -1301,21 +1284,18 @@ Module::instantiate(JSContext* cx,
-                                             funcImports,
-                                             metadata().globals,
-                                             globalImportValues,
-                                             globalObjs,
-                                             instanceProto));
-     if (!instance)
-         return false;
- 
--    if (!CreateExportObject(cx, instance, funcImports, table, memory, globalImportValues,
--                            globalObjs, exports_))
--    {
-+    if (!CreateExportObject(cx, instance, funcImports, table, memory, globalObjs, exports_))
-         return false;
--    }
- 
-     // Register the instance with the Realm so that it can find out about global
-     // events like profiling being enabled in the realm. Registration does not
-     // require a fully-initialized instance and must precede initSegments as the
-     // final pre-requisite for a live instance.
- 
-     if (!cx->realm()->wasm.registerInstance(cx, instance))
-         return false;

frg/work-js/mozilla-release/patches/mozilla-central-push_423644.patch

@@ -1,85 +0,0 @@
-# HG changeset patch
-# User Tom Schuster <evilpies@gmail.com>
-# Date 1529788847 -7200
-#      Sat Jun 23 23:20:47 2018 +0200
-# Node ID 7c907970edec7e9891f3d82f121a3427e39c194e
-# Parent  3e50b1960713a9c828cc640ceab32506bb1c2733
-Bug 1398839 - DataView getters should throw when the buffer is detached in release/beta. r=anba
-
-diff --git a/js/src/builtin/DataViewObject.cpp b/js/src/builtin/DataViewObject.cpp
---- a/js/src/builtin/DataViewObject.cpp
-+++ b/js/src/builtin/DataViewObject.cpp
-@@ -848,23 +848,21 @@ DataViewObject::bufferGetter(JSContext* 
-     return CallNonGenericMethod<is, bufferGetterImpl>(cx, args);
- }
- 
- bool
- DataViewObject::byteLengthGetterImpl(JSContext* cx, const CallArgs& args)
- {
-     Rooted<DataViewObject*> thisView(cx, &args.thisv().toObject().as<DataViewObject>());
- 
--#ifdef NIGHTLY_BUILD
--    // Step 6,
-+    // Step 6.
-     if (thisView->arrayBufferEither().isDetached()) {
-         JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_TYPED_ARRAY_DETACHED);
-         return false;
-     }
--#endif
- 
-     // Step 7.
-     args.rval().set(DataViewObject::byteLengthValue(thisView));
-     return true;
- }
- 
- bool
- DataViewObject::byteLengthGetter(JSContext* cx, unsigned argc, Value* vp)
-@@ -873,23 +871,21 @@ DataViewObject::byteLengthGetter(JSConte
-     return CallNonGenericMethod<is, byteLengthGetterImpl>(cx, args);
- }
- 
- bool
- DataViewObject::byteOffsetGetterImpl(JSContext* cx, const CallArgs& args)
- {
-     Rooted<DataViewObject*> thisView(cx, &args.thisv().toObject().as<DataViewObject>());
- 
--#ifdef NIGHTLY_BUILD
--    // Step 6,
-+    // Step 6.
-     if (thisView->arrayBufferEither().isDetached()) {
-         JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_TYPED_ARRAY_DETACHED);
-         return false;
-     }
--#endif
- 
-     // Step 7.
-     args.rval().set(DataViewObject::byteOffsetValue(thisView));
-     return true;
- }
- 
- bool
- DataViewObject::byteOffsetGetter(JSContext* cx, unsigned argc, Value* vp)
-diff --git a/js/src/tests/jstests.list b/js/src/tests/jstests.list
---- a/js/src/tests/jstests.list
-+++ b/js/src/tests/jstests.list
-@@ -275,20 +275,16 @@ skip script test262/built-ins/TypedArray
- skip script test262/built-ins/TypedArrayConstructors/ctors/typedarray-arg/proto-from-ctor-realm.js
- skip script test262/built-ins/TypedArrayConstructors/ctors/typedarray-arg/same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js
- skip script test262/built-ins/WeakMap/proto-from-ctor-realm.js
- skip script test262/built-ins/WeakSet/proto-from-ctor-realm.js
- 
- # https://bugzilla.mozilla.org/show_bug.cgi?id=1317395
- skip script test262/built-ins/ArrayBuffer/prototype/byteLength/detached-buffer.js
- 
--# https://bugzilla.mozilla.org/show_bug.cgi?id=1317394
--skip-if(release_or_beta) script test262/built-ins/DataView/prototype/byteOffset/detached-buffer.js
--skip-if(release_or_beta) script test262/built-ins/DataView/prototype/byteLength/detached-buffer.js
--
- # https://bugzilla.mozilla.org/show_bug.cgi?id=1317378
- skip script test262/language/statements/do-while/cptn-abrupt-empty.js
- skip script test262/language/statements/do-while/cptn-normal.js
- skip script test262/language/statements/for-in/cptn-decl-abrupt-empty.js
- skip script test262/language/statements/for-in/cptn-decl-itr.js
- skip script test262/language/statements/for-in/cptn-decl-skip-itr.js
- skip script test262/language/statements/for-in/cptn-decl-zero-itr.js
- skip script test262/language/statements/for-in/cptn-expr-abrupt-empty.js

frg/work-js/mozilla-release/patches/mozilla-central-push_423672.patch

@@ -1,530 +0,0 @@
-# HG changeset patch
-# User Jan de Mooij <jdemooij@mozilla.com>
-# Date 1529998925 -7200
-#      Tue Jun 26 09:42:05 2018 +0200
-# Node ID 2f70bd2a3a9b4ee46613b08533bb106e9a73cd20
-# Parent  748ba658c02b66030b99ce7576c85c57c95225b7
-Bug 1470250 part 1 - Use correct realm in ObjectGroupRealm::makeGroup. r=luke
-
-diff --git a/js/src/builtin/MapObject.cpp b/js/src/builtin/MapObject.cpp
---- a/js/src/builtin/MapObject.cpp
-+++ b/js/src/builtin/MapObject.cpp
-@@ -371,17 +371,18 @@ MapIteratorObject::next(Handle<MapIterat
- /* static */ JSObject*
- MapIteratorObject::createResultPair(JSContext* cx)
- {
-     RootedArrayObject resultPairObj(cx, NewDenseFullyAllocatedArray(cx, 2, nullptr, TenuredObject));
-     if (!resultPairObj)
-         return nullptr;
- 
-     Rooted<TaggedProto> proto(cx, resultPairObj->taggedProto());
--    ObjectGroup* group = ObjectGroupRealm::makeGroup(cx, resultPairObj->getClass(), proto);
-+    ObjectGroup* group = ObjectGroupRealm::makeGroup(cx, resultPairObj->realm(),
-+                                                     resultPairObj->getClass(), proto);
-     if (!group)
-         return nullptr;
-     resultPairObj->setGroup(group);
- 
-     resultPairObj->setDenseInitializedLength(2);
-     resultPairObj->initDenseElement(0, NullValue());
-     resultPairObj->initDenseElement(1, NullValue());
- 
-@@ -1202,17 +1203,18 @@ SetIteratorObject::next(Handle<SetIterat
- /* static */ JSObject*
- SetIteratorObject::createResult(JSContext* cx)
- {
-     RootedArrayObject resultObj(cx, NewDenseFullyAllocatedArray(cx, 1, nullptr, TenuredObject));
-     if (!resultObj)
-         return nullptr;
- 
-     Rooted<TaggedProto> proto(cx, resultObj->taggedProto());
--    ObjectGroup* group = ObjectGroupRealm::makeGroup(cx, resultObj->getClass(), proto);
-+    ObjectGroup* group = ObjectGroupRealm::makeGroup(cx, resultObj->realm(),
-+                                                     resultObj->getClass(), proto);
-     if (!group)
-         return nullptr;
-     resultObj->setGroup(group);
- 
-     resultObj->setDenseInitializedLength(1);
-     resultObj->initDenseElement(0, NullValue());
- 
-     // See comments in SetIteratorObject::next.
-diff --git a/js/src/vm/EnvironmentObject.cpp b/js/src/vm/EnvironmentObject.cpp
---- a/js/src/vm/EnvironmentObject.cpp
-+++ b/js/src/vm/EnvironmentObject.cpp
-@@ -140,19 +140,18 @@ CallObject::create(JSContext* cx, Handle
- 
- CallObject*
- CallObject::createSingleton(JSContext* cx, HandleShape shape)
- {
-     gc::AllocKind kind = gc::GetGCObjectKind(shape->numFixedSlots());
-     MOZ_ASSERT(CanBeFinalizedInBackground(kind, &CallObject::class_));
-     kind = gc::GetBackgroundAllocKind(kind);
- 
--    ObjectGroupRealm& realm = ObjectGroupRealm::getForNewObject(cx);
--    RootedObjectGroup group(cx, ObjectGroup::lazySingletonGroup(cx, realm, &class_,
--                                                                TaggedProto(nullptr)));
-+    RootedObjectGroup group(cx, ObjectGroup::lazySingletonGroup(cx, /* oldGroup = */ nullptr,
-+                                                                &class_, TaggedProto(nullptr)));
-     if (!group)
-         return nullptr;
- 
-     JSObject* obj;
-     JS_TRY_VAR_OR_RETURN_NULL(cx, obj, NativeObject::create(cx, kind, gc::TenuredHeap, shape, group));
- 
-     MOZ_ASSERT(obj->isSingleton(),
-                "group created inline above must be a singleton");
-diff --git a/js/src/vm/Iteration.cpp b/js/src/vm/Iteration.cpp
---- a/js/src/vm/Iteration.cpp
-+++ b/js/src/vm/Iteration.cpp
-@@ -975,17 +975,18 @@ Realm::getOrCreateIterResultTemplateObje
- 
-     // Create template plain object
-     RootedNativeObject templateObject(cx, NewBuiltinClassInstance<PlainObject>(cx, TenuredObject));
-     if (!templateObject)
-         return iterResultTemplate_; // = nullptr
- 
-     // Create a new group for the template.
-     Rooted<TaggedProto> proto(cx, templateObject->taggedProto());
--    RootedObjectGroup group(cx, ObjectGroupRealm::makeGroup(cx, templateObject->getClass(),
-+    RootedObjectGroup group(cx, ObjectGroupRealm::makeGroup(cx, templateObject->realm(),
-+                                                            templateObject->getClass(),
-                                                             proto));
-     if (!group)
-         return iterResultTemplate_; // = nullptr
-     templateObject->setGroup(group);
- 
-     // Set dummy `value` property
-     if (!NativeDefineDataProperty(cx, templateObject, cx->names().value, UndefinedHandleValue,
-                                   JSPROP_ENUMERATE))
-diff --git a/js/src/vm/JSObject-inl.h b/js/src/vm/JSObject-inl.h
---- a/js/src/vm/JSObject-inl.h
-+++ b/js/src/vm/JSObject-inl.h
-@@ -153,18 +153,17 @@ js::NativeObject::updateDictionaryListPo
-         shape()->listp = shapePtr();
- }
- 
- /* static */ inline bool
- JSObject::setSingleton(JSContext* cx, js::HandleObject obj)
- {
-     MOZ_ASSERT(!IsInsideNursery(obj));
- 
--    js::ObjectGroupRealm& realm = js::ObjectGroupRealm::get(obj->group_);
--    js::ObjectGroup* group = js::ObjectGroup::lazySingletonGroup(cx, realm, obj->getClass(),
-+    js::ObjectGroup* group = js::ObjectGroup::lazySingletonGroup(cx, obj->group_, obj->getClass(),
-                                                                  obj->taggedProto());
-     if (!group)
-         return false;
- 
-     obj->group_ = group;
-     return true;
- }
- 
-diff --git a/js/src/vm/JSObject.cpp b/js/src/vm/JSObject.cpp
---- a/js/src/vm/JSObject.cpp
-+++ b/js/src/vm/JSObject.cpp
-@@ -2104,17 +2104,17 @@ SetClassAndProto(JSContext* cx, HandleOb
-     RootedObjectGroup oldGroup(cx, obj->group());
- 
-     ObjectGroup* newGroup;
-     if (oldGroup->maybeInterpretedFunction()) {
-         // We're changing the group/proto of a scripted function. Create a new
-         // group so we can keep track of the interpreted function for Ion
-         // inlining.
-         MOZ_ASSERT(obj->is<JSFunction>());
--        newGroup = ObjectGroupRealm::makeGroup(cx, &JSFunction::class_, proto);
-+        newGroup = ObjectGroupRealm::makeGroup(cx, oldGroup->realm(), &JSFunction::class_, proto);
-         if (!newGroup)
-             return false;
-         newGroup->setInterpretedFunction(oldGroup->maybeInterpretedFunction());
-     } else {
-         newGroup = ObjectGroup::defaultNewGroup(cx, clasp, proto);
-         if (!newGroup)
-             return false;
-     }
-@@ -2140,18 +2140,17 @@ SetClassAndProto(JSContext* cx, HandleOb
- 
- /* static */ bool
- JSObject::changeToSingleton(JSContext* cx, HandleObject obj)
- {
-     MOZ_ASSERT(!obj->isSingleton());
- 
-     MarkObjectGroupUnknownProperties(cx, obj->group());
- 
--    ObjectGroupRealm& realm = ObjectGroupRealm::get(obj->group());
--    ObjectGroup* group = ObjectGroup::lazySingletonGroup(cx, realm, obj->getClass(),
-+    ObjectGroup* group = ObjectGroup::lazySingletonGroup(cx, obj->group(), obj->getClass(),
-                                                          obj->taggedProto());
-     if (!group)
-         return false;
- 
-     obj->group_ = group;
-     return true;
- }
- 
-diff --git a/js/src/vm/ObjectGroup.cpp b/js/src/vm/ObjectGroup.cpp
---- a/js/src/vm/ObjectGroup.cpp
-+++ b/js/src/vm/ObjectGroup.cpp
-@@ -319,18 +319,18 @@ JSObject::makeLazyGroup(JSContext* cx, H
- 
-     if (obj->isNative() && obj->as<NativeObject>().isIndexed())
-         initialFlags |= OBJECT_FLAG_SPARSE_INDEXES;
- 
-     if (obj->is<ArrayObject>() && obj->as<ArrayObject>().length() > INT32_MAX)
-         initialFlags |= OBJECT_FLAG_LENGTH_OVERFLOW;
- 
-     Rooted<TaggedProto> proto(cx, obj->taggedProto());
--    ObjectGroup* group = ObjectGroupRealm::makeGroup(cx, obj->getClass(), proto,
--                                                     initialFlags);
-+    ObjectGroup* group = ObjectGroupRealm::makeGroup(cx, obj->nonCCWRealm(), obj->getClass(),
-+                                                     proto, initialFlags);
-     if (!group)
-         return nullptr;
- 
-     AutoEnterAnalysis enter(cx);
- 
-     /* Fill in the type according to the state of this object. */
- 
-     if (obj->is<JSFunction>() && obj->as<JSFunction>().isInterpreted())
-@@ -575,17 +575,18 @@ ObjectGroup::defaultNewGroup(JSContext* 
-         return group;
-     }
- 
-     ObjectGroupFlags initialFlags = 0;
-     if (proto.isDynamic() || (proto.isObject() && proto.toObject()->isNewGroupUnknown()))
-         initialFlags = OBJECT_FLAG_DYNAMIC_MASK;
- 
-     Rooted<TaggedProto> protoRoot(cx, proto);
--    ObjectGroup* group = ObjectGroupRealm::makeGroup(cx, clasp ? clasp : &PlainObject::class_,
-+    ObjectGroup* group = ObjectGroupRealm::makeGroup(cx, cx->realm(),
-+                                                     clasp ? clasp : &PlainObject::class_,
-                                                      protoRoot, initialFlags);
-     if (!group)
-         return nullptr;
- 
-     if (!table->add(p, ObjectGroupRealm::NewEntry(group, associated))) {
-         ReportOutOfMemory(cx);
-         return nullptr;
-     }
-@@ -618,19 +619,23 @@ ObjectGroup::defaultNewGroup(JSContext* 
-         AddTypePropertyId(cx, group, nullptr, NameToId(names.columnNumber), TypeSet::Int32Type());
-     }
- 
-     groups.defaultNewGroupCache.put(group, associated);
-     return group;
- }
- 
- /* static */ ObjectGroup*
--ObjectGroup::lazySingletonGroup(JSContext* cx, ObjectGroupRealm& realm, const Class* clasp,
-+ObjectGroup::lazySingletonGroup(JSContext* cx, ObjectGroup* oldGroup, const Class* clasp,
-                                 TaggedProto proto)
- {
-+    ObjectGroupRealm& realm = oldGroup
-+                              ? ObjectGroupRealm::get(oldGroup)
-+                              : ObjectGroupRealm::getForNewObject(cx);
-+
-     MOZ_ASSERT_IF(proto.isObject(), cx->compartment() == proto.toObject()->compartment());
- 
-     ObjectGroupRealm::NewTable*& table = realm.lazyTable;
- 
-     if (!table) {
-         table = cx->new_<ObjectGroupRealm::NewTable>(cx->zone());
-         if (!table)
-             return nullptr;
-@@ -651,17 +656,19 @@ ObjectGroup::lazySingletonGroup(JSContex
- 
-         return group;
-     }
- 
-     AutoEnterAnalysis enter(cx);
- 
-     Rooted<TaggedProto> protoRoot(cx, proto);
-     ObjectGroup* group =
--        ObjectGroupRealm::makeGroup(cx, clasp, protoRoot,
-+        ObjectGroupRealm::makeGroup(cx,
-+                                    oldGroup ? oldGroup->realm() : cx->realm(),
-+                                    clasp, protoRoot,
-                                     OBJECT_FLAG_SINGLETON | OBJECT_FLAG_LAZY_SINGLETON);
-     if (!group)
-         return nullptr;
- 
-     if (!table->add(p, ObjectGroupRealm::NewEntry(group, nullptr))) {
-         ReportOutOfMemory(cx);
-         return nullptr;
-     }
-@@ -878,17 +885,17 @@ ObjectGroup::newArrayObject(JSContext* c
-     RootedObjectGroup group(cx);
-     if (p) {
-         group = p->value();
-     } else {
-         JSObject* proto = GlobalObject::getOrCreateArrayPrototype(cx, cx->global());
-         if (!proto)
-             return nullptr;
-         Rooted<TaggedProto> taggedProto(cx, TaggedProto(proto));
--        group = ObjectGroupRealm::makeGroup(cx, &ArrayObject::class_, taggedProto);
-+        group = ObjectGroupRealm::makeGroup(cx, cx->realm(), &ArrayObject::class_, taggedProto);
-         if (!group)
-             return nullptr;
- 
-         AddTypePropertyId(cx, group, nullptr, JSID_VOID, elementType);
- 
-         if (!p.add(cx, *table, ObjectGroupRealm::ArrayObjectKey(elementType), group))
-             return nullptr;
-     }
-@@ -1205,17 +1212,18 @@ ObjectGroup::newPlainObject(JSContext* c
-         if (!CanShareObjectGroup(properties, nproperties))
-             return NewPlainObjectWithProperties(cx, properties, nproperties, newKind);
- 
-         JSObject* proto = GlobalObject::getOrCreatePrototype(cx, JSProto_Object);
-         if (!proto)
-             return nullptr;
- 
-         Rooted<TaggedProto> tagged(cx, TaggedProto(proto));
--        RootedObjectGroup group(cx, ObjectGroupRealm::makeGroup(cx, &PlainObject::class_,
-+        RootedObjectGroup group(cx, ObjectGroupRealm::makeGroup(cx, cx->realm(),
-+                                                                &PlainObject::class_,
-                                                                 tagged));
-         if (!group)
-             return nullptr;
- 
-         gc::AllocKind allocKind = gc::GetGCObjectKind(nproperties);
-         RootedPlainObject obj(cx, NewObjectWithGroup<PlainObject>(cx, group,
-                                                                   allocKind, TenuredObject));
-         if (!obj || !AddPlainObjectProperties(cx, obj, properties, nproperties))
-@@ -1480,17 +1488,18 @@ ObjectGroup::allocationSiteGroup(JSConte
- 
-     ObjectGroupRealm::AllocationSiteTable::AddPtr p = table->lookupForAdd(key);
-     if (p)
-         return p->value();
- 
-     AutoEnterAnalysis enter(cx);
- 
-     Rooted<TaggedProto> tagged(cx, TaggedProto(proto));
--    ObjectGroup* res = ObjectGroupRealm::makeGroup(cx, GetClassForProtoKey(kind), tagged,
-+    ObjectGroup* res = ObjectGroupRealm::makeGroup(cx, script->realm(),
-+                                                   GetClassForProtoKey(kind), tagged,
-                                                    OBJECT_FLAG_FROM_ALLOCATION_SITE);
-     if (!res)
-         return nullptr;
- 
-     if (JSOp(*pc) == JSOP_NEWOBJECT) {
-         // Keep track of the preliminary objects with this group, so we can try
-         // to use an unboxed layout for the object once some are allocated.
-         Shape* shape = script->getObject(pc)->as<PlainObject>().lastProperty();
-@@ -1684,26 +1693,26 @@ ObjectGroupRealm::replaceDefaultNewGroup
-         AutoEnterOOMUnsafeRegion oomUnsafe;
-         if (!defaultNewTable->putNew(lookup, NewEntry(group, associated)))
-             oomUnsafe.crash("Inconsistent object table");
-     }
- }
- 
- /* static */
- ObjectGroup*
--ObjectGroupRealm::makeGroup(JSContext* cx, const Class* clasp,
-+ObjectGroupRealm::makeGroup(JSContext* cx, Realm* realm, const Class* clasp,
-                             Handle<TaggedProto> proto,
-                             ObjectGroupFlags initialFlags /* = 0 */)
- {
-     MOZ_ASSERT_IF(proto.isObject(), cx->isInsideCurrentCompartment(proto.toObject()));
- 
-     ObjectGroup* group = Allocate<ObjectGroup>(cx);
-     if (!group)
-         return nullptr;
--    new(group) ObjectGroup(clasp, proto, cx->realm(), initialFlags);
-+    new(group) ObjectGroup(clasp, proto, realm, initialFlags);
- 
-     return group;
- }
- 
- /* static */
- ObjectGroup*
- ObjectGroupRealm::getStringSplitStringGroup(JSContext* cx)
- {
-@@ -1719,17 +1728,17 @@ ObjectGroupRealm::getStringSplitStringGr
- 
-     const Class* clasp = GetClassForProtoKey(JSProto_Array);
- 
-     JSObject* proto = GlobalObject::getOrCreateArrayPrototype(cx, cx->global());
-     if (!proto)
-         return nullptr;
-     Rooted<TaggedProto> tagged(cx, TaggedProto(proto));
- 
--    group = makeGroup(cx, clasp, tagged, /* initialFlags = */ 0);
-+    group = makeGroup(cx, cx->realm(), clasp, tagged, /* initialFlags = */ 0);
-     if (!group)
-         return nullptr;
- 
-     groups.stringSplitStringGroup.set(group);
-     return group;
- }
- 
- void
-diff --git a/js/src/vm/ObjectGroup.h b/js/src/vm/ObjectGroup.h
---- a/js/src/vm/ObjectGroup.h
-+++ b/js/src/vm/ObjectGroup.h
-@@ -528,17 +528,17 @@ class ObjectGroup : public gc::TenuredCe
-     static bool useSingletonForAllocationSite(JSScript* script, jsbytecode* pc,
-                                               const Class* clasp);
- 
-     // Static accessors for ObjectGroupRealm NewTable.
- 
-     static ObjectGroup* defaultNewGroup(JSContext* cx, const Class* clasp,
-                                         TaggedProto proto,
-                                         JSObject* associated = nullptr);
--    static ObjectGroup* lazySingletonGroup(JSContext* cx, ObjectGroupRealm& realm,
-+    static ObjectGroup* lazySingletonGroup(JSContext* cx, ObjectGroup* oldGroup,
-                                            const Class* clasp, TaggedProto proto);
- 
-     static void setDefaultNewGroupUnknown(JSContext* cx, ObjectGroupRealm& realm,
-                                           const js::Class* clasp, JS::HandleObject obj);
- 
- #ifdef DEBUG
-     static bool hasDefaultNewGroup(JSObject* proto, const Class* clasp, ObjectGroup* group);
- #endif
-@@ -694,17 +694,17 @@ class ObjectGroupRealm
- 
-     void replaceAllocationSiteGroup(JSScript* script, jsbytecode* pc,
-                                     JSProtoKey kind, ObjectGroup* group);
- 
-     void removeDefaultNewGroup(const Class* clasp, TaggedProto proto, JSObject* associated);
-     void replaceDefaultNewGroup(const Class* clasp, TaggedProto proto, JSObject* associated,
-                                 ObjectGroup* group);
- 
--    static ObjectGroup* makeGroup(JSContext* cx, const Class* clasp,
-+    static ObjectGroup* makeGroup(JSContext* cx, JS::Realm* realm, const Class* clasp,
-                                   Handle<TaggedProto> proto,
-                                   ObjectGroupFlags initialFlags = 0);
- 
-     static ObjectGroup* getStringSplitStringGroup(JSContext* cx);
- 
-     void addSizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf,
-                                 size_t* allocationSiteTables,
-                                 size_t* arrayGroupTables,
-diff --git a/js/src/vm/RegExpObject.cpp b/js/src/vm/RegExpObject.cpp
---- a/js/src/vm/RegExpObject.cpp
-+++ b/js/src/vm/RegExpObject.cpp
-@@ -1224,17 +1224,18 @@ RegExpRealm::createMatchResultTemplateOb
-     /* Create template array object */
-     RootedArrayObject templateObject(cx, NewDenseUnallocatedArray(cx, RegExpObject::MaxPairCount,
-                                                                   nullptr, TenuredObject));
-     if (!templateObject)
-         return matchResultTemplateObject_; // = nullptr
- 
-     // Create a new group for the template.
-     Rooted<TaggedProto> proto(cx, templateObject->taggedProto());
--    ObjectGroup* group = ObjectGroupRealm::makeGroup(cx, templateObject->getClass(), proto);
-+    ObjectGroup* group = ObjectGroupRealm::makeGroup(cx, templateObject->realm(),
-+                                                     templateObject->getClass(), proto);
-     if (!group)
-         return matchResultTemplateObject_; // = nullptr
-     templateObject->setGroup(group);
- 
-     /* Set dummy index property */
-     RootedValue index(cx, Int32Value(0));
-     if (!NativeDefineDataProperty(cx, templateObject, cx->names().index, index, JSPROP_ENUMERATE))
-         return matchResultTemplateObject_; // = nullptr
-diff --git a/js/src/vm/TypeInference.cpp b/js/src/vm/TypeInference.cpp
---- a/js/src/vm/TypeInference.cpp
-+++ b/js/src/vm/TypeInference.cpp
-@@ -3471,17 +3471,17 @@ JSFunction::setTypeForScriptedFunction(J
-                                        bool singleton /* = false */)
- {
-     if (singleton) {
-         if (!setSingleton(cx, fun))
-             return false;
-     } else {
-         RootedObject funProto(cx, fun->staticPrototype());
-         Rooted<TaggedProto> taggedProto(cx, TaggedProto(funProto));
--        ObjectGroup* group = ObjectGroupRealm::makeGroup(cx, &JSFunction::class_,
-+        ObjectGroup* group = ObjectGroupRealm::makeGroup(cx, fun->realm(), &JSFunction::class_,
-                                                          taggedProto);
-         if (!group)
-             return false;
- 
-         fun->setGroup(group);
-         group->setInterpretedFunction(fun);
-     }
- 
-@@ -3990,18 +3990,18 @@ TypeNewScript::maybeAnalyze(JSContext* c
-     // existing group to represent fully initialized objects with all
-     // definite properties in the prefix shape, and make a new group to
-     // represent partially initialized objects.
-     MOZ_ASSERT(prefixShape->slotSpan() > templateObject()->slotSpan());
- 
-     ObjectGroupFlags initialFlags = group->flags(sweep) & OBJECT_FLAG_DYNAMIC_MASK;
- 
-     Rooted<TaggedProto> protoRoot(cx, group->proto());
--    ObjectGroup* initialGroup = ObjectGroupRealm::makeGroup(cx, group->clasp(), protoRoot,
--                                                            initialFlags);
-+    ObjectGroup* initialGroup = ObjectGroupRealm::makeGroup(cx, group->realm(), group->clasp(),
-+                                                            protoRoot, initialFlags);
-     if (!initialGroup)
-         return false;
- 
-     initialGroup->addDefiniteProperties(cx, templateObject()->lastProperty());
-     group->addDefiniteProperties(cx, prefixShape);
- 
-     ObjectGroupRealm& realm = ObjectGroupRealm::get(group);
-     realm.replaceDefaultNewGroup(nullptr, group->proto(), function(), initialGroup);
-diff --git a/js/src/vm/UnboxedObject.cpp b/js/src/vm/UnboxedObject.cpp
---- a/js/src/vm/UnboxedObject.cpp
-+++ b/js/src/vm/UnboxedObject.cpp
-@@ -567,17 +567,18 @@ UnboxedLayout::makeNativeGroup(JSContext
- 
-     // Immediately clear any new script on the group. This is done by replacing
-     // the existing new script with one for a replacement default new group.
-     // This is done so that the size of the replacment group's objects is the
-     // same as that for the unboxed group, so that we do not see polymorphic
-     // slot accesses later on for sites that see converted objects from this
-     // group and objects that were allocated using the replacement new group.
-     if (layout.newScript()) {
--        replacementGroup = ObjectGroupRealm::makeGroup(cx, &PlainObject::class_, proto);
-+        replacementGroup = ObjectGroupRealm::makeGroup(cx, group->realm(), &PlainObject::class_,
-+                                                       proto);
-         if (!replacementGroup)
-             return false;
- 
-         PlainObject* templateObject = MakeReplacementTemplateObject(cx, replacementGroup, layout);
-         if (!templateObject)
-             return false;
- 
-         TypeNewScript* replacementNewScript =
-@@ -592,17 +593,18 @@ UnboxedLayout::makeNativeGroup(JSContext
-     }
- 
-     // Similarly, if this group is keyed to an allocation site, replace its
-     // entry with a new group that has no unboxed layout.
-     if (layout.allocationScript()) {
-         RootedScript script(cx, layout.allocationScript());
-         jsbytecode* pc = layout.allocationPc();
- 
--        replacementGroup = ObjectGroupRealm::makeGroup(cx, &PlainObject::class_, proto);
-+        replacementGroup = ObjectGroupRealm::makeGroup(cx, group->realm(), &PlainObject::class_,
-+                                                       proto);
-         if (!replacementGroup)
-             return false;
- 
-         PlainObject* templateObject = &script->getObject(pc)->as<PlainObject>();
-         replacementGroup->addDefiniteProperties(cx, templateObject->lastProperty());
- 
-         ObjectGroupRealm& realm = ObjectGroupRealm::get(group);
-         realm.replaceAllocationSiteGroup(script, pc, JSProto_Object, replacementGroup);
-@@ -633,17 +635,17 @@ UnboxedLayout::makeNativeGroup(JSContext
-         Rooted<StackShape> child(cx, StackShape(shape->base()->unowned(), NameToId(property.name),
-                                                 i, JSPROP_ENUMERATE));
-         shape = cx->zone()->propertyTree().getChild(cx, shape, child);
-         if (!shape)
-             return false;
-     }
- 
-     ObjectGroup* nativeGroup =
--        ObjectGroupRealm::makeGroup(cx, &PlainObject::class_, proto,
-+        ObjectGroupRealm::makeGroup(cx, group->realm(), &PlainObject::class_, proto,
-                                     group->flags(sweep) & OBJECT_FLAG_DYNAMIC_MASK);
-     if (!nativeGroup)
-         return false;
- 
-     // No sense propagating if we don't know what we started with.
-     AutoSweepObjectGroup sweepNative(nativeGroup);
-     if (!group->unknownProperties(sweep)) {
-         for (size_t i = 0; i < layout.properties().length(); i++) {

frg/work-js/mozilla-release/patches/mozilla-central-push_423808.patch

@@ -1,1175 +0,0 @@
-# HG changeset patch
-# User Ted Campbell <tcampbell@mozilla.com>
-# Date 1529102325 14400
-#      Fri Jun 15 18:38:45 2018 -0400
-# Node ID 22123be00ffb183377048bcc7d8ace84f2a352a4
-# Parent  85d78bc8bcd3de68944bc8f1c8fcfe552618dab2
-Bug 1470522 - Enable JS dump functions under JS_JITSPEW. r=jandem
-
-MozReview-Commit-ID: 5WWncxovx2M
-
-diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctions.cpp
---- a/js/src/builtin/TestingFunctions.cpp
-+++ b/js/src/builtin/TestingFunctions.cpp
-@@ -3267,17 +3267,17 @@ DisableTraceLogger(JSContext* cx, unsign
-     CallArgs args = CallArgsFromVp(argc, vp);
-     TraceLoggerThread* logger = TraceLoggerForCurrentThread(cx);
-     args.rval().setBoolean(TraceLoggerDisable(logger));
- 
-     return true;
- }
- #endif
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
- static bool
- DumpObject(JSContext* cx, unsigned argc, Value* vp)
- {
-     CallArgs args = CallArgsFromVp(argc, vp);
-     RootedObject obj(cx, ToObject(cx, args.get(0)));
-     if (!obj)
-         return false;
- 
-@@ -5827,17 +5827,17 @@ gc::ZealModeHelpText),
- 
-     JS_FN_HELP("shortestPaths", ShortestPaths, 3, 0,
- "shortestPaths(start, targets, maxNumPaths)",
- "  Return an array of arrays of shortest retaining paths. There is an array of\n"
- "  shortest retaining paths for each object in |targets|. The maximum number of\n"
- "  paths in each of those arrays is bounded by |maxNumPaths|. Each element in a\n"
- "  path is of the form |{ predecessor, edge }|."),
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
-     JS_FN_HELP("dumpObject", DumpObject, 1, 0,
- "dumpObject()",
- "  Dump an internal representation of an object."),
- #endif
- 
-     JS_FN_HELP("sharedMemoryEnabled", SharedMemoryEnabled, 0, 0,
- "sharedMemoryEnabled()",
- "  Return true if SharedArrayBuffer and Atomics are enabled"),
-diff --git a/js/src/jit/JSJitFrameIter.cpp b/js/src/jit/JSJitFrameIter.cpp
---- a/js/src/jit/JSJitFrameIter.cpp
-+++ b/js/src/jit/JSJitFrameIter.cpp
-@@ -300,17 +300,17 @@ JSJitFrameIter::numActualArgs() const
- void
- JSJitFrameIter::dumpBaseline() const
- {
-     MOZ_ASSERT(isBaselineJS());
- 
-     fprintf(stderr, " JS Baseline frame\n");
-     if (isFunctionFrame()) {
-         fprintf(stderr, "  callee fun: ");
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
-         DumpObject(callee());
- #else
-         fprintf(stderr, "?\n");
- #endif
-     } else {
-         fprintf(stderr, "  global frame, no callee\n");
-     }
- 
-@@ -326,17 +326,17 @@ JSJitFrameIter::dumpBaseline() const
-     fprintf(stderr, "  current op: %s\n", CodeName[*pc]);
- 
-     fprintf(stderr, "  actual args: %d\n", numActualArgs());
- 
-     BaselineFrame* frame = baselineFrame();
- 
-     for (unsigned i = 0; i < frame->numValueSlots(); i++) {
-         fprintf(stderr, "  slot %u: ", i);
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
-         Value* v = frame->valueSlot(i);
-         DumpValue(*v);
- #else
-         fprintf(stderr, "?\n");
- #endif
-     }
- }
- 
-diff --git a/js/src/jit/JitFrames.cpp b/js/src/jit/JitFrames.cpp
---- a/js/src/jit/JitFrames.cpp
-+++ b/js/src/jit/JitFrames.cpp
-@@ -2320,17 +2320,17 @@ SnapshotIterator::warnUnreadableAllocati
- }
- 
- struct DumpOp {
-     explicit DumpOp(unsigned int i) : i_(i) {}
- 
-     unsigned int i_;
-     void operator()(const Value& v) {
-         fprintf(stderr, "  actual (arg %d): ", i_);
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
-         DumpValue(v);
- #else
-         fprintf(stderr, "?\n");
- #endif
-         i_++;
-     }
- };
- 
-@@ -2343,17 +2343,17 @@ InlineFrameIterator::dump() const
-         fprintf(stderr, " JS frame (inlined)\n");
-     else
-         fprintf(stderr, " JS frame\n");
- 
-     bool isFunction = false;
-     if (isFunctionFrame()) {
-         isFunction = true;
-         fprintf(stderr, "  callee fun: ");
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
-         DumpObject(callee(fallback));
- #else
-         fprintf(stderr, "?\n");
- #endif
-     } else {
-         fprintf(stderr, "  global frame, no callee\n");
-     }
- 
-@@ -2382,17 +2382,17 @@ InlineFrameIterator::dump() const
-                     DumpOp d(calleeTemplate()->nargs());
-                     unaliasedForEachActual(TlsContext.get(), d, ReadFrame_Overflown, fallback);
-                 }
- 
-                 fprintf(stderr, "  slot %d: ", int(i - 2 - calleeTemplate()->nargs()));
-             }
-         } else
-             fprintf(stderr, "  slot %u: ", i);
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
-         DumpValue(si.maybeRead(fallback));
- #else
-         fprintf(stderr, "?\n");
- #endif
-     }
- 
-     fputc('\n', stderr);
- }
-diff --git a/js/src/jsfriendapi.cpp b/js/src/jsfriendapi.cpp
---- a/js/src/jsfriendapi.cpp
-+++ b/js/src/jsfriendapi.cpp
-@@ -664,17 +664,17 @@ JS_FRIEND_API(JSObject*)
- JS_CloneObject(JSContext* cx, HandleObject obj, HandleObject protoArg)
- {
-     // |obj| might be in a different compartment.
-     assertSameCompartment(cx, protoArg);
-     Rooted<TaggedProto> proto(cx, TaggedProto(protoArg.get()));
-     return CloneObject(cx, obj, proto);
- }
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
- 
- // We don't want jsfriendapi.h to depend on GenericPrinter,
- // so these functions are declared directly in the cpp.
- 
- namespace js {
- 
- extern JS_FRIEND_API(void)
- DumpString(JSString* str, js::GenericPrinter& out);
-diff --git a/js/src/jsfriendapi.h b/js/src/jsfriendapi.h
---- a/js/src/jsfriendapi.h
-+++ b/js/src/jsfriendapi.h
-@@ -234,17 +234,17 @@ JS_FRIEND_API(bool)
- AddRawValueRoot(JSContext* cx, JS::Value* vp, const char* name);
- 
- JS_FRIEND_API(void)
- RemoveRawValueRoot(JSContext* cx, JS::Value* vp);
- 
- JS_FRIEND_API(JSAtom*)
- GetPropertyNameFromPC(JSScript* script, jsbytecode* pc);
- 
--#ifdef JS_DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
- 
- /*
-  * Routines to print out values during debugging. These are FRIEND_API to help
-  * the debugger find them and to support temporarily hacking js::Dump* calls
-  * into other code. Note that there are overloads that do not require the FILE*
-  * parameter, which will default to stderr.
-  */
- 
-diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
---- a/js/src/shell/js.cpp
-+++ b/js/src/shell/js.cpp
-@@ -2643,17 +2643,17 @@ PCToLine(JSContext* cx, unsigned argc, V
-         return false;
-     lineno = PCToLineNumber(script, script->offsetToPC(i));
-     if (!lineno)
-         return false;
-     args.rval().setInt32(lineno);
-     return true;
- }
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
- 
- static void
- UpdateSwitchTableBounds(JSContext* cx, HandleScript script, unsigned offset,
-                         unsigned* start, unsigned* end)
- {
-     jsbytecode* pc;
-     JSOp op;
-     ptrdiff_t jmplen;
-@@ -2756,26 +2756,26 @@ SrcNotes(JSContext* cx, HandleScript scr
- 
-           case SRC_WHILE:
-           case SRC_NEXTCASE:
-             if (!sp->jsprintf(" offset %u", unsigned(GetSrcNoteOffset(sn, 0))))
-                 return false;
-             break;
- 
-           case SRC_TABLESWITCH: {
--            JSOp op = JSOp(script->code()[offset]);
-+            mozilla::DebugOnly<JSOp> op = JSOp(script->code()[offset]);
-             MOZ_ASSERT(op == JSOP_TABLESWITCH);
-             if (!sp->jsprintf(" length %u", unsigned(GetSrcNoteOffset(sn, 0))))
-                 return false;
-             UpdateSwitchTableBounds(cx, script, offset,
-                                     &switchTableStart, &switchTableEnd);
-             break;
-           }
-           case SRC_CONDSWITCH: {
--            JSOp op = JSOp(script->code()[offset]);
-+            mozilla::DebugOnly<JSOp> op = JSOp(script->code()[offset]);
-             MOZ_ASSERT(op == JSOP_CONDSWITCH);
-             if (!sp->jsprintf(" length %u", unsigned(GetSrcNoteOffset(sn, 0))))
-                 return false;
-             if (unsigned caseOff = (unsigned) GetSrcNoteOffset(sn, 1)) {
-                 if (!sp->jsprintf(" first case offset %u", caseOff))
-                     return false;
-             }
-             UpdateSwitchTableBounds(cx, script, offset,
-@@ -3247,17 +3247,17 @@ DisassWithSrc(JSContext* cx, unsigned ar
- 
-         fprintf(gOutFile->fp, "%s\n", sprinter.string());
-     }
- 
-     args.rval().setUndefined();
-     return true;
- }
- 
--#endif /* DEBUG */
-+#endif /* defined(DEBUG) || defined(JS_JITSPEW) */
- 
- /* Pretend we can always preserve wrappers for dummy DOM objects. */
- static bool
- DummyPreserveWrapperCallback(JSContext* cx, JSObject* obj)
- {
-     return true;
- }
- 
-@@ -4132,17 +4132,17 @@ ClearLastWarning(JSContext* cx, unsigned
-     }
- 
-     sc->lastWarning.setNull();
- 
-     args.rval().setUndefined();
-     return true;
- }
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
- static bool
- StackDump(JSContext* cx, unsigned argc, Value* vp)
- {
-     CallArgs args = CallArgsFromVp(argc, vp);
- 
-     if (!gOutFile->isOpen()) {
-         JS_ReportErrorASCII(cx, "output file is closed");
-         return false;
-@@ -6874,17 +6874,17 @@ static const JSFunctionSpecWithHelp shel
-     JS_FN_HELP("stopTimingMutator", StopTimingMutator, 0, 0,
- "stopTimingMutator()",
- "  Stop accounting time to mutator vs GC and dump the results."),
- 
-     JS_FN_HELP("throwError", ThrowError, 0, 0,
- "throwError()",
- "  Throw an error from JS_ReportError."),
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
-     JS_FN_HELP("disassemble", DisassembleToString, 1, 0,
- "disassemble([fun/code])",
- "  Return the disassembly for the given function or code.\n"
- "  All disassembly functions take these options as leading string arguments:\n"
- "    \"-r\" (disassemble recursively)\n"
- "    \"-l\" (show line numbers)\n"
- "    \"-S\" (omit source notes)"),
- 
-diff --git a/js/src/vm/BytecodeUtil.cpp b/js/src/vm/BytecodeUtil.cpp
---- a/js/src/vm/BytecodeUtil.cpp
-+++ b/js/src/vm/BytecodeUtil.cpp
-@@ -324,38 +324,38 @@ class BytecodeParser
-   private:
-     class Bytecode
-     {
-       public:
-         explicit Bytecode(const LifoAllocPolicy<Fallible>& alloc)
-           : parsed(false),
-             stackDepth(0),
-             offsetStack(nullptr)
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
-             ,
-             stackDepthAfter(0),
-             offsetStackAfter(nullptr),
-             jumpOrigins(alloc)
--#endif /* DEBUG */
-+#endif /* defined(DEBUG) || defined(JS_JITSPEW) */
-         {}
- 
-         // Whether this instruction has been analyzed to get its output defines
-         // and stack.
-         bool parsed : 1;
- 
-         // Stack depth before this opcode.
-         uint32_t stackDepth;
- 
-         // Pointer to array of |stackDepth| offsets.  An element at position N
-         // in the array is the offset of the opcode that defined the
-         // corresponding stack slot.  The top of the stack is at position
-         // |stackDepth - 1|.
-         OffsetAndDefIndex* offsetStack;
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
-         // stack depth after this opcode.
-         uint32_t stackDepthAfter;
- 
-         // Pointer to array of |stackDepthAfter| offsets.
-         OffsetAndDefIndex* offsetStackAfter;
- 
-         struct JumpInfo {
-             uint32_t from;
-@@ -365,48 +365,48 @@ class BytecodeParser
-               : from(from_),
-                 kind(kind_)
-             {}
-         };
- 
-         // A list of offsets of the bytecode that jumps to this bytecode,
-         // exclusing previous bytecode.
-         Vector<JumpInfo, 0, LifoAllocPolicy<Fallible>> jumpOrigins;
--#endif /* DEBUG */
-+#endif /* defined(DEBUG) || defined(JS_JITSPEW) */
- 
-         bool captureOffsetStack(LifoAlloc& alloc, const OffsetAndDefIndex* stack, uint32_t depth) {
-             stackDepth = depth;
-             offsetStack = alloc.newArray<OffsetAndDefIndex>(stackDepth);
-             if (!offsetStack)
-                 return false;
-             if (stackDepth) {
-                 for (uint32_t n = 0; n < stackDepth; n++)
-                     offsetStack[n] = stack[n];
-             }
-             return true;
-         }
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
-         bool captureOffsetStackAfter(LifoAlloc& alloc, const OffsetAndDefIndex* stack,
-                                      uint32_t depth) {
-             stackDepthAfter = depth;
-             offsetStackAfter = alloc.newArray<OffsetAndDefIndex>(stackDepthAfter);
-             if (!offsetStackAfter)
-                 return false;
-             if (stackDepthAfter) {
-                 for (uint32_t n = 0; n < stackDepthAfter; n++)
-                     offsetStackAfter[n] = stack[n];
-             }
-             return true;
-         }
- 
-         bool addJump(uint32_t from, JumpKind kind) {
-             return jumpOrigins.append(JumpInfo(from, kind));
-         }
--#endif /* DEBUG */
-+#endif /* defined(DEBUG) || defined(JS_JITSPEW) */
- 
-         // When control-flow merges, intersect the stacks, marking slots that
-         // are defined by different offsets and/or defIndices merged.
-         // This is sufficient for forward control-flow.  It doesn't grok loops
-         // -- for that you would have to iterate to a fixed point -- but there
-         // shouldn't be operands on the stack at a loop back-edge anyway.
-         void mergeOffsetStack(const OffsetAndDefIndex* stack, uint32_t depth) {
-             MOZ_ASSERT(depth == stackDepth);
-@@ -422,52 +422,52 @@ class BytecodeParser
-     };
- 
-     JSContext* cx_;
-     LifoAllocScope allocScope_;
-     RootedScript script_;
- 
-     Bytecode** codeArray_;
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
-     // Dedicated mode for stack dump.
-     // Capture stack after each opcode, and also enable special handling for
-     // some opcodes to make stack transition clearer.
-     bool isStackDump;
--#endif /* DEBUG */
-+#endif
- 
-   public:
-     BytecodeParser(JSContext* cx, JSScript* script)
-       : cx_(cx),
-         allocScope_(&cx->tempLifoAlloc()),
-         script_(cx, script),
-         codeArray_(nullptr)
- #ifdef DEBUG
-         ,
-         isStackDump(false)
--#endif /* DEBUG */
-+#endif
-     {}
- 
-     bool parse();
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
-     bool isReachable(const jsbytecode* pc) { return maybeCode(pc); }
--#endif /* DEBUG */
-+#endif
- 
-     uint32_t stackDepthAtPC(uint32_t offset) {
-         // Sometimes the code generator in debug mode asks about the stack depth
-         // of unreachable code (bug 932180 comment 22).  Assume that unreachable
-         // code has no operands on the stack.
-         return getCode(offset).stackDepth;
-     }
-     uint32_t stackDepthAtPC(const jsbytecode* pc) {
-         return stackDepthAtPC(script_->pcToOffset(pc));
-     }
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
-     uint32_t stackDepthAfterPC(uint32_t offset) {
-         return getCode(offset).stackDepthAfter;
-     }
-     uint32_t stackDepthAfterPC(const jsbytecode* pc) {
-         return stackDepthAfterPC(script_->pcToOffset(pc));
-     }
- #endif
- 
-@@ -484,17 +484,17 @@ class BytecodeParser
-         size_t offset = script_->pcToOffset(pc);
-         const OffsetAndDefIndex& offsetAndDefIndex = offsetForStackOperand(offset, operand);
-         if (offsetAndDefIndex.isSpecial())
-             return nullptr;
-         *defIndex = offsetAndDefIndex.defIndex();
-         return script_->offsetToPC(offsetAndDefIndex.offset());
-     }
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
-     const OffsetAndDefIndex& offsetForStackOperandAfterPC(uint32_t offset, int operand) {
-         Bytecode& code = getCode(offset);
-         if (operand < 0) {
-             operand += code.stackDepthAfter;
-             MOZ_ASSERT(operand >= 0);
-         }
-         MOZ_ASSERT(uint32_t(operand) < code.stackDepthAfter);
-         return code.offsetStackAfter[operand];
-@@ -510,17 +510,17 @@ class BytecodeParser
-         }
- 
-         return true;
-     }
- 
-     void setStackDump() {
-         isStackDump = true;
-     }
--#endif /* DEBUG */
-+#endif /* defined(DEBUG) || defined(JS_JITSPEW) */
- 
-   private:
-     LifoAlloc& alloc() {
-         return allocScope_.alloc();
-     }
- 
-     void reportOOM() {
-         allocScope_.releaseEarly();
-@@ -537,17 +537,17 @@ class BytecodeParser
-         return *codeArray_[offset];
-     }
- 
-     Bytecode* maybeCode(uint32_t offset) {
-         MOZ_ASSERT(offset < script_->length());
-         return codeArray_[offset];
-     }
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
-     Bytecode* maybeCode(const jsbytecode* pc) { return maybeCode(script_->pcToOffset(pc)); }
- #endif
- 
-     uint32_t simulateOp(JSOp op, uint32_t offset, OffsetAndDefIndex* offsetStack,
-                         uint32_t stackDepth);
- 
-     inline bool recordBytecode(uint32_t offset, const OffsetAndDefIndex* offsetStack,
-                                uint32_t stackDepth);
-@@ -966,17 +966,17 @@ BytecodeParser::parse()
-             if (!recordBytecode(successorOffset, offsetStack, stackDepth))
-                 return false;
-         }
-     }
- 
-     return true;
- }
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
- 
- bool
- js::ReconstructStackDepth(JSContext* cx, JSScript* script, jsbytecode* pc, uint32_t* depth, bool* reachablePC)
- {
-     BytecodeParser parser(cx, script);
-     if (!parser.parse())
-         return false;
- 
-@@ -1144,17 +1144,21 @@ ToDisassemblySource(JSContext* cx, Handl
-         if (!copy) {
-             ReportOutOfMemory(cx);
-             return false;
-         }
-         bytes->initBytes(std::move(copy));
-         return true;
-     }
- 
--    if (JS::RuntimeHeapIsBusy() || !cx->isAllocAllowed()) {
-+    if (JS::RuntimeHeapIsBusy()
-+#ifdef DEBUG
-+        || !cx->isAllocAllowed()
-+#endif
-+        ) {
-         UniqueChars source = JS_smprintf("<value>");
-         if (!source) {
-             ReportOutOfMemory(cx);
-             return false;
-         }
-         bytes->initBytes(std::move(source));
-         return true;
-     }
-@@ -1576,17 +1580,17 @@ Disassemble1(JSContext* cx, HandleScript
- 
- unsigned
- js::Disassemble1(JSContext* cx, JS::Handle<JSScript*> script, jsbytecode* pc, unsigned loc,
-                  bool lines, Sprinter* sp)
- {
-     return Disassemble1(cx, script, pc, loc, lines, nullptr, sp);
- }
- 
--#endif /* DEBUG */
-+#endif /* defined(DEBUG) || defined(JS_JITSPEW) */
- 
- namespace {
- /*
-  * The expression decompiler is invoked by error handling code to produce a
-  * string representation of the erroring expression. As it's only a debugging
-  * tool, it only supports basic expressions. For anything complicated, it simply
-  * puts "(intermediate value)" into the error result.
-  *
-@@ -1617,49 +1621,49 @@ namespace {
-  */
- struct ExpressionDecompiler
- {
-     JSContext* cx;
-     RootedScript script;
-     BytecodeParser parser;
-     Sprinter sprinter;
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
-     // Dedicated mode for stack dump.
-     // Generates an expression for stack dump, including internal state,
-     // and also disables special handling for self-hosted code.
-     bool isStackDump;
--#endif /* DEBUG */
-+#endif
- 
-     ExpressionDecompiler(JSContext* cx, JSScript* script)
-         : cx(cx),
-           script(cx, script),
-           parser(cx, script),
-           sprinter(cx)
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
-           ,
-           isStackDump(false)
--#endif /* DEBUG */
-+#endif
-     {}
-     bool init();
-     bool decompilePCForStackOperand(jsbytecode* pc, int i);
-     bool decompilePC(jsbytecode* pc, uint8_t defIndex);
-     bool decompilePC(const OffsetAndDefIndex& offsetAndDefIndex);
-     JSAtom* getArg(unsigned slot);
-     JSAtom* loadAtom(jsbytecode* pc);
-     bool quote(JSString* s, uint32_t quote);
-     bool write(const char* s);
-     bool write(JSString* str);
-     bool getOutput(char** out);
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
-     void setStackDump() {
-         isStackDump = true;
-         parser.setStackDump();
-     }
--#endif /* DEBUG */
-+#endif
- };
- 
- bool
- ExpressionDecompiler::decompilePCForStackOperand(jsbytecode* pc, int i)
- {
-     return decompilePC(parser.offsetForStackOperand(script->pcToOffset(pc), i));
- }
- 
-@@ -2165,17 +2169,17 @@ ExpressionDecompiler::getOutput(char** r
-         return false;
-     js_memcpy(*res, sprinter.stringAt(0), len);
-     (*res)[len] = 0;
-     return true;
- }
- 
- }  // anonymous namespace
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
- static bool
- DecompileAtPCForStackDump(JSContext* cx, HandleScript script,
-                           const OffsetAndDefIndex& offsetAndDefIndex, Sprinter* sp)
- {
-     ExpressionDecompiler ed(cx, script);
-     ed.setStackDump();
-     if (!ed.init())
-         return false;
-@@ -2186,17 +2190,17 @@ DecompileAtPCForStackDump(JSContext* cx,
-     char* result;
-     if (!ed.getOutput(&result))
-         return false;
- 
-     bool ok = sp->put(result);
-     js_free(result);
-     return ok;
- }
--#endif /* DEBUG */
-+#endif /* defined(DEBUG) || defined(JS_JITSPEW) */
- 
- static bool
- FindStartPC(JSContext* cx, const FrameIter& iter, int spindex, int skipStackHits, const Value& v,
-             jsbytecode** valuepc, uint8_t* defIndex)
- {
-     jsbytecode* current = *valuepc;
-     *valuepc = nullptr;
-     *defIndex = 0;
-diff --git a/js/src/vm/BytecodeUtil.h b/js/src/vm/BytecodeUtil.h
---- a/js/src/vm/BytecodeUtil.h
-+++ b/js/src/vm/BytecodeUtil.h
-@@ -556,17 +556,17 @@ StackUses(jsbytecode* pc)
- MOZ_ALWAYS_INLINE unsigned
- StackDefs(jsbytecode* pc)
- {
-     int ndefs = CodeSpec[*pc].ndefs;
-     MOZ_ASSERT(ndefs >= 0);
-     return ndefs;
- }
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
- /*
-  * Given bytecode address pc in script's main program code, compute the operand
-  * stack depth just before (JSOp) *pc executes.  If *pc is not reachable, return
-  * false.
-  */
- extern bool
- ReconstructStackDepth(JSContext* cx, JSScript* script, jsbytecode* pc, uint32_t* depth, bool* reachablePC);
- #endif
-@@ -907,17 +907,17 @@ class PCCounts
- };
- 
- static inline jsbytecode*
- GetNextPc(jsbytecode* pc)
- {
-     return pc + GetBytecodeLength(pc);
- }
- 
--#if defined(DEBUG)
-+#if defined(DEBUG) || defined(JS_JITSPEW)
- /*
-  * Disassemblers, for debugging only.
-  */
- extern MOZ_MUST_USE bool
- Disassemble(JSContext* cx, JS::Handle<JSScript*> script, bool lines, Sprinter* sp);
- 
- unsigned
- Disassemble1(JSContext* cx, JS::Handle<JSScript*> script, jsbytecode* pc, unsigned loc,
-diff --git a/js/src/vm/JSObject.cpp b/js/src/vm/JSObject.cpp
---- a/js/src/vm/JSObject.cpp
-+++ b/js/src/vm/JSObject.cpp
-@@ -3333,17 +3333,17 @@ GetObjectSlotNameFunctor::operator()(JS:
-         } else {
-             snprintf(buf, bufsize, "**FINALIZED ATOM KEY**");
-         }
-     }
- }
- 
- /*** Debugging routines **************************************************************************/
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
- 
- /*
-  * Routines to print out values during debugging.  These are FRIEND_API to help
-  * the debugger find them and to support temporarily hacking js::Dump* calls
-  * into other code.
-  */
- 
- static void
-@@ -3384,25 +3384,23 @@ dumpValue(const Value& v, js::GenericPri
-                 (void*) obj);
-     } else if (v.isBoolean()) {
-         if (v.toBoolean())
-             out.put("true");
-         else
-             out.put("false");
-     } else if (v.isMagic()) {
-         out.put("<invalid");
--#ifdef DEBUG
-         switch (v.whyMagic()) {
-           case JS_ELEMENTS_HOLE:     out.put(" elements hole");      break;
-           case JS_NO_ITER_VALUE:     out.put(" no iter value");      break;
-           case JS_GENERATOR_CLOSING: out.put(" generator closing");  break;
-           case JS_OPTIMIZED_OUT:     out.put(" optimized out");      break;
-           default:                   out.put(" ?!");                 break;
-         }
--#endif
-         out.putChar('>');
-     } else {
-         out.put("unexpected value");
-     }
- }
- 
- namespace js {
- 
-@@ -3682,17 +3680,17 @@ js::DumpInterpreterFrame(JSContext* cx, 
-         out.putChar('\n');
- 
-         out.printf("  envChain: (JSObject*) %p\n", (void*) i.environmentChain(cx));
- 
-         out.putChar('\n');
-     }
- }
- 
--#endif /* DEBUG */
-+#endif /* defined(DEBUG) || defined(JS_JITSPEW) */
- 
- namespace js {
- 
- // We don't want jsfriendapi.h to depend on GenericPrinter,
- // so these functions are declared directly in the cpp.
- 
- JS_FRIEND_API(void)
- DumpBacktrace(JSContext* cx, js::GenericPrinter& out);
-diff --git a/js/src/vm/JSObject.h b/js/src/vm/JSObject.h
---- a/js/src/vm/JSObject.h
-+++ b/js/src/vm/JSObject.h
-@@ -531,17 +531,17 @@ class JSObject : public js::gc::Cell
-     }
- 
-     template <class T>
-     const T& as() const {
-         MOZ_ASSERT(this->is<T>());
-         return *static_cast<const T*>(this);
-     }
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
-     void dump(js::GenericPrinter& fp) const;
-     void dump() const;
- #endif
- 
-     // Maximum size in bytes of a JSObject.
-     static const size_t MAX_BYTE_SIZE = 4 * sizeof(void*) + 16 * sizeof(JS::Value);
- 
-   protected:
-diff --git a/js/src/vm/StringType.cpp b/js/src/vm/StringType.cpp
---- a/js/src/vm/StringType.cpp
-+++ b/js/src/vm/StringType.cpp
-@@ -103,17 +103,17 @@ JS::ubi::Concrete<JSString>::size(mozill
- 
-     size += str.sizeOfExcludingThis(mallocSizeOf);
- 
-     return size;
- }
- 
- const char16_t JS::ubi::Concrete<JSString>::concreteTypeName[] = u"JSString";
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
- 
- template <typename CharT>
- /*static */ void
- JSString::dumpChars(const CharT* s, size_t n, js::GenericPrinter& out)
- {
-     if (n == SIZE_MAX) {
-         n = 0;
-         while (s[n])
-@@ -245,17 +245,17 @@ JSString::equals(const char* s)
-     if (!linear) {
-         // This is DEBUG-only code.
-         fprintf(stderr, "OOM in JSString::equals!\n");
-         return false;
-     }
- 
-     return StringEqualsAscii(linear, s);
- }
--#endif /* DEBUG */
-+#endif /* defined(DEBUG) || defined(JS_JITSPEW) */
- 
- template <typename CharT>
- static MOZ_ALWAYS_INLINE bool
- AllocChars(JSString* str, size_t length, CharT** chars, size_t* capacity)
- {
-     /*
-      * String length doesn't include the null char, so include it here before
-      * doubling. Adding the null char after doubling would interact poorly with
-@@ -392,17 +392,17 @@ JSRope::hash(uint32_t* outHash) const
-                 break;
-             str = nodeStack.popCopy();
-         }
-     }
- 
-     return true;
- }
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
- void
- JSRope::dumpRepresentation(js::GenericPrinter& out, int indent) const
- {
-     dumpRepresentationHeader(out, "JSRope");
-     indent += 2;
- 
-     out.printf("%*sleft:  ", indent, "");
-     leftChild()->dumpRepresentation(out, indent);
-@@ -815,17 +815,17 @@ JSFlatString*
- JSDependentString::undepend(JSContext* cx)
- {
-     MOZ_ASSERT(JSString::isDependent());
-     return hasLatin1Chars()
-            ? undependInternal<Latin1Char>(cx)
-            : undependInternal<char16_t>(cx);
- }
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
- void
- JSDependentString::dumpRepresentation(js::GenericPrinter& out, int indent) const
- {
-     dumpRepresentationHeader(out, "JSDependentString");
-     indent += 2;
- 
-     if (mozilla::Maybe<size_t> offset = baseOffset())
-         out.printf("%*soffset: %zu\n", indent, "", *offset);
-@@ -1384,17 +1384,17 @@ JSExternalString::ensureFlat(JSContext* 
-     // resulting string will still be in an AllocKind::EXTERNAL_STRING arena,
-     // but will no longer be an external string.
-     setNonInlineChars<char16_t>(s);
-     d.u1.flags = INIT_FLAT_FLAGS;
- 
-     return &this->asFlat();
- }
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
- void
- JSAtom::dump(js::GenericPrinter& out)
- {
-     out.printf("JSAtom* (%p) = ", (void*) this);
-     this->JSString::dump(out);
- }
- 
- void
-@@ -1408,17 +1408,17 @@ void
- JSExternalString::dumpRepresentation(js::GenericPrinter& out, int indent) const
- {
-     dumpRepresentationHeader(out, "JSExternalString");
-     indent += 2;
- 
-     out.printf("%*sfinalizer: ((JSStringFinalizer*) %p)\n", indent, "", externalFinalizer());
-     dumpRepresentationChars(out, indent);
- }
--#endif /* DEBUG */
-+#endif /* defined(DEBUG) || defined(JS_JITSPEW) */
- 
- JSLinearString*
- js::NewDependentString(JSContext* cx, JSString* baseArg, size_t start, size_t length)
- {
-     if (length == 0)
-         return cx->emptyString();
- 
-     JSLinearString* base = baseArg->ensureLinear(cx);
-@@ -1771,17 +1771,17 @@ NewMaybeExternalString(JSContext* cx, co
- 
-     *allocatedExternal = true;
-     cache.put(str);
-     return str;
- }
- 
- } /* namespace js */
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
- void
- JSExtensibleString::dumpRepresentation(js::GenericPrinter& out, int indent) const
- {
-     dumpRepresentationHeader(out, "JSExtensibleString");
-     indent += 2;
- 
-     out.printf("%*scapacity: %zu\n", indent, "", capacity());
-     dumpRepresentationChars(out, indent);
-diff --git a/js/src/vm/StringType.h b/js/src/vm/StringType.h
---- a/js/src/vm/StringType.h
-+++ b/js/src/vm/StringType.h
-@@ -598,17 +598,17 @@ class JSString : public js::gc::Cell
-             AllocKind tenuredKind = asTenured().getAllocKind();
-             MOZ_ASSERT(kind == tenuredKind ||
-                        (tenuredKind == AllocKind::EXTERNAL_STRING && kind == AllocKind::STRING));
-         }
- #endif
-         return kind;
-     }
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
-     void dump(); // Debugger-friendly stderr dump.
-     void dump(js::GenericPrinter& out);
-     void dumpNoNewline(js::GenericPrinter& out);
-     void dumpCharsNoNewline(js::GenericPrinter& out);
-     void dumpRepresentation(js::GenericPrinter& out, int indent) const;
-     void dumpRepresentationHeader(js::GenericPrinter& out, const char* subclass) const;
- 
-     template <typename CharT>
-@@ -713,17 +713,17 @@ class JSRope : public JSString
- 
-     JSString* rightChild() const {
-         MOZ_ASSERT(isRope());
-         return d.s.u3.right;
-     }
- 
-     void traceChildren(JSTracer* trc);
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
-     void dumpRepresentation(js::GenericPrinter& out, int indent) const;
- #endif
- 
-   private:
-     // To help avoid writing Spectre-unsafe code, we only allow MacroAssembler
-     // to call the methods below.
-     friend class js::jit::MacroAssembler;
- 
-@@ -809,17 +809,17 @@ class JSLinearString : public JSString
-     MOZ_ALWAYS_INLINE
-     char16_t latin1OrTwoByteChar(size_t index) const {
-         MOZ_ASSERT(JSString::isLinear());
-         MOZ_ASSERT(index < length());
-         JS::AutoCheckCannotGC nogc;
-         return hasLatin1Chars() ? latin1Chars(nogc)[index] : twoByteChars(nogc)[index];
-     }
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
-     void dumpRepresentationChars(js::GenericPrinter& out, int indent) const;
- #endif
- };
- 
- static_assert(sizeof(JSLinearString) == sizeof(JSString),
-               "string subclasses must be binary-compatible with JSString");
- 
- class JSDependentString : public JSLinearString
-@@ -851,17 +851,17 @@ class JSDependentString : public JSLinea
-         MOZ_ASSERT(offset < base()->length());
-         return mozilla::Some(offset);
-     }
- 
-   public:
-     static inline JSLinearString* new_(JSContext* cx, JSLinearString* base,
-                                        size_t start, size_t length);
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
-     void dumpRepresentation(js::GenericPrinter& out, int indent) const;
- #endif
- 
-   private:
-     // To help avoid writing Spectre-unsafe code, we only allow MacroAssembler
-     // to call the method below.
-     friend class js::jit::MacroAssembler;
- 
-@@ -945,17 +945,17 @@ class JSFlatString : public JSLinearStri
-      * Once a JSFlatString sub-class has been added to the atom state, this
-      * operation changes the string to the JSAtom type, in place.
-      */
-     MOZ_ALWAYS_INLINE JSAtom* morphAtomizedStringIntoAtom(js::HashNumber hash);
-     MOZ_ALWAYS_INLINE JSAtom* morphAtomizedStringIntoPermanentAtom(js::HashNumber hash);
- 
-     inline void finalize(js::FreeOp* fop);
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
-     void dumpRepresentation(js::GenericPrinter& out, int indent) const;
- #endif
- };
- 
- static_assert(sizeof(JSFlatString) == sizeof(JSString),
-               "string subclasses must be binary-compatible with JSString");
- 
- class JSExtensibleString : public JSFlatString
-@@ -966,17 +966,17 @@ class JSExtensibleString : public JSFlat
- 
-   public:
-     MOZ_ALWAYS_INLINE
-     size_t capacity() const {
-         MOZ_ASSERT(JSString::isExtensible());
-         return d.s.u3.capacity;
-     }
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
-     void dumpRepresentation(js::GenericPrinter& out, int indent) const;
- #endif
- };
- 
- static_assert(sizeof(JSExtensibleString) == sizeof(JSString),
-               "string subclasses must be binary-compatible with JSString");
- 
- class JSInlineString : public JSFlatString
-@@ -994,17 +994,17 @@ class JSInlineString : public JSFlatStri
-         MOZ_ASSERT(JSString::isInline());
-         MOZ_ASSERT(hasTwoByteChars());
-         return d.inlineStorageTwoByte;
-     }
- 
-     template<typename CharT>
-     static bool lengthFits(size_t length);
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
-     void dumpRepresentation(js::GenericPrinter& out, int indent) const;
- #endif
- 
-   private:
-     // To help avoid writing Spectre-unsafe code, we only allow MacroAssembler
-     // to call the method below.
-     friend class js::jit::MacroAssembler;
-     static size_t offsetOfInlineStorage() {
-@@ -1121,17 +1121,17 @@ class JSExternalString : public JSLinear
- 
-     /*
-      * Free the external chars and allocate a new buffer, converting this to a
-      * flat string (which still lives in an AllocKind::EXTERNAL_STRING
-      * arena).
-      */
-     JSFlatString* ensureFlat(JSContext* cx);
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
-     void dumpRepresentation(js::GenericPrinter& out, int indent) const;
- #endif
- };
- 
- static_assert(sizeof(JSExternalString) == sizeof(JSString),
-               "string subclasses must be binary-compatible with JSString");
- 
- class JSUndependedString : public JSFlatString
-@@ -1180,17 +1180,17 @@ class JSAtom : public JSFlatString
-         MOZ_ASSERT(static_cast<JSString*>(this)->isAtom());
-         MOZ_ASSERT(!isPinned());
-         d.u1.flags |= PINNED_ATOM_BIT;
-     }
- 
-     inline js::HashNumber hash() const;
-     inline void initHash(js::HashNumber hash);
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
-     void dump(js::GenericPrinter& out);
-     void dump();
- #endif
- };
- 
- static_assert(sizeof(JSAtom) == sizeof(JSString),
-               "string subclasses must be binary-compatible with JSString");
- 
-diff --git a/js/src/vm/SymbolType.cpp b/js/src/vm/SymbolType.cpp
---- a/js/src/vm/SymbolType.cpp
-+++ b/js/src/vm/SymbolType.cpp
-@@ -89,17 +89,17 @@ Symbol::for_(JSContext* cx, HandleString
-             ReportOutOfMemory(cx);
-             return nullptr;
-         }
-     }
-     cx->markAtom(sym);
-     return sym;
- }
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
- void
- Symbol::dump()
- {
-     js::Fprinter out(stderr);
-     dump(out);
- }
- 
- void
-@@ -119,17 +119,17 @@ Symbol::dump(js::GenericPrinter& out)
-         out.putChar(')');
- 
-         if (code_ == SymbolCode::UniqueSymbol)
-             out.printf("@%p", (void*) this);
-     } else {
-         out.printf("<Invalid Symbol code=%u>", unsigned(code_));
-     }
- }
--#endif  // DEBUG
-+#endif  // defined(DEBUG) || defined(JS_JITSPEW)
- 
- bool
- js::SymbolDescriptiveString(JSContext* cx, Symbol* sym, MutableHandleValue result)
- {
-     // steps 2-5
-     StringBuffer sb(cx);
-     if (!sb.append("Symbol("))
-         return false;
-diff --git a/js/src/vm/SymbolType.h b/js/src/vm/SymbolType.h
---- a/js/src/vm/SymbolType.h
-+++ b/js/src/vm/SymbolType.h
-@@ -92,17 +92,17 @@ class Symbol : public js::gc::TenuredCel
-         if (thing && !thing->isWellKnownSymbol())
-             thing->asTenured().writeBarrierPre(thing);
-     }
- 
-     size_t sizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf) const {
-         return mallocSizeOf(this);
-     }
- 
--#ifdef DEBUG
-+#if defined(DEBUG) || defined(JS_JITSPEW)
-     void dump(); // Debugger-friendly stderr dump.
-     void dump(js::GenericPrinter& out);
- #endif
- };
- 
- } /* namespace JS */
- 
- namespace js {

frg/work-js/mozilla-release/patches/mozilla-central-push_425385.patch

@@ -1,169 +0,0 @@
-# HG changeset patch
-# User Jon Coppeard <jcoppeard@mozilla.com>
-# Date 1530891121 -3600
-#      Fri Jul 06 16:32:01 2018 +0100
-# Node ID b8474706578ccc96abe77be1b95c0d1cc0df10fd
-# Parent  777029266bf7e79987abc307e3e0834181e9e3ff
-Bug 1473297 - Use inline data for stack allocated binding name vectors in the parser r=Waldo
-
-diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp
---- a/js/src/frontend/Parser.cpp
-+++ b/js/src/frontend/Parser.cpp
-@@ -64,16 +64,18 @@ using JS::AutoGCRooter;
- namespace js {
- namespace frontend {
- 
- using DeclaredNamePtr = ParseContext::Scope::DeclaredNamePtr;
- using AddDeclaredNamePtr = ParseContext::Scope::AddDeclaredNamePtr;
- using BindingIter = ParseContext::Scope::BindingIter;
- using UsedNamePtr = UsedNameTracker::UsedNameMap::Ptr;
- 
-+using BindingNameVector = Vector<BindingName, 6>;
-+
- // Read a token. Report an error and return null() if that token doesn't match
- // to the condition.  Do not use MUST_MATCH_TOKEN_INTERNAL directly.
- #define MUST_MATCH_TOKEN_INTERNAL(cond, modifier, errorReport)                              \
-     JS_BEGIN_MACRO                                                                          \
-         TokenKind token;                                                                    \
-         if (!tokenStream.getToken(&token, modifier))                                        \
-             return null();                                                                  \
-         if (!(cond)) {                                                                      \
-@@ -1768,27 +1770,27 @@ NewEmptyBindingData(JSContext* cx, LifoA
-     return bindings;
- }
- 
- /**
-  * Copy-construct |BindingName|s from |bindings| into |cursor|, then return
-  * the location one past the newly-constructed |BindingName|s.
-  */
- static MOZ_MUST_USE BindingName*
--FreshlyInitializeBindings(BindingName* cursor, const Vector<BindingName>& bindings)
-+FreshlyInitializeBindings(BindingName* cursor, const BindingNameVector& bindings)
- {
-     return std::uninitialized_copy(bindings.begin(), bindings.end(), cursor);
- }
- 
- Maybe<GlobalScope::Data*>
- NewGlobalScopeData(JSContext* context, ParseContext::Scope& scope, LifoAlloc& alloc, ParseContext* pc)
- {
--    Vector<BindingName> vars(context);
--    Vector<BindingName> lets(context);
--    Vector<BindingName> consts(context);
-+    BindingNameVector vars(context);
-+    BindingNameVector lets(context);
-+    BindingNameVector consts(context);
- 
-     bool allBindingsClosedOver = pc->sc()->allBindingsClosedOver();
-     for (BindingIter bi = scope.bindings(pc); bi; bi++) {
-         bool closedOver = allBindingsClosedOver || bi.closedOver();
- 
-         switch (bi.kind()) {
-           case BindingKind::Var: {
-             bool isTopLevelFunction = bi.declarationKind() == DeclarationKind::BodyLevelFunction;
-@@ -1844,20 +1846,20 @@ Maybe<GlobalScope::Data*>
- ParserBase::newGlobalScopeData(ParseContext::Scope& scope)
- {
-     return NewGlobalScopeData(context, scope, alloc, pc);
- }
- 
- Maybe<ModuleScope::Data*>
- NewModuleScopeData(JSContext* context, ParseContext::Scope& scope, LifoAlloc& alloc, ParseContext* pc)
- {
--    Vector<BindingName> imports(context);
--    Vector<BindingName> vars(context);
--    Vector<BindingName> lets(context);
--    Vector<BindingName> consts(context);
-+    BindingNameVector imports(context);
-+    BindingNameVector vars(context);
-+    BindingNameVector lets(context);
-+    BindingNameVector consts(context);
- 
-     bool allBindingsClosedOver = pc->sc()->allBindingsClosedOver();
-     for (BindingIter bi = scope.bindings(pc); bi; bi++) {
-         // Imports are indirect bindings and must not be given known slots.
-         BindingName binding(bi.name(), (allBindingsClosedOver || bi.closedOver()) &&
-                                        bi.kind() != BindingKind::Import);
-         switch (bi.kind()) {
-           case BindingKind::Import:
-@@ -1914,17 +1916,17 @@ Maybe<ModuleScope::Data*>
- ParserBase::newModuleScopeData(ParseContext::Scope& scope)
- {
-     return NewModuleScopeData(context, scope, alloc, pc);
- }
- 
- Maybe<EvalScope::Data*>
- NewEvalScopeData(JSContext* context, ParseContext::Scope& scope, LifoAlloc& alloc, ParseContext* pc)
- {
--    Vector<BindingName> vars(context);
-+    BindingNameVector vars(context);
- 
-     for (BindingIter bi = scope.bindings(pc); bi; bi++) {
-         // Eval scopes only contain 'var' bindings. Make all bindings aliased
-         // for now.
-         MOZ_ASSERT(bi.kind() == BindingKind::Var);
-         bool isTopLevelFunction = bi.declarationKind() == DeclarationKind::BodyLevelFunction;
-         BindingName binding(bi.name(), true, isTopLevelFunction);
-         if (!vars.append(binding))
-@@ -1954,19 +1956,19 @@ Maybe<EvalScope::Data*>
- ParserBase::newEvalScopeData(ParseContext::Scope& scope)
- {
-     return NewEvalScopeData(context, scope, alloc, pc);
- }
- 
- Maybe<FunctionScope::Data*>
- NewFunctionScopeData(JSContext* context, ParseContext::Scope& scope, bool hasParameterExprs, LifoAlloc& alloc, ParseContext* pc)
- {
--    Vector<BindingName> positionalFormals(context);
--    Vector<BindingName> formals(context);
--    Vector<BindingName> vars(context);
-+    BindingNameVector positionalFormals(context);
-+    BindingNameVector formals(context);
-+    BindingNameVector vars(context);
- 
-     bool allBindingsClosedOver = pc->sc()->allBindingsClosedOver();
-     bool hasDuplicateParams = pc->functionBox()->hasDuplicateParameters;
- 
-     // Positional parameter names must be added in order of appearance as they are
-     // referenced using argument slots.
-     for (size_t i = 0; i < pc->positionalFormalParameterNames().length(); i++) {
-         JSAtom* name = pc->positionalFormalParameterNames()[i];
-@@ -2053,17 +2055,17 @@ Maybe<FunctionScope::Data*>
- ParserBase::newFunctionScopeData(ParseContext::Scope& scope, bool hasParameterExprs)
- {
-     return NewFunctionScopeData(context, scope, hasParameterExprs, alloc, pc);
- }
- 
- Maybe<VarScope::Data*>
- NewVarScopeData(JSContext* context, ParseContext::Scope& scope, LifoAlloc& alloc, ParseContext* pc)
- {
--    Vector<BindingName> vars(context);
-+    BindingNameVector vars(context);
- 
-     bool allBindingsClosedOver = pc->sc()->allBindingsClosedOver();
- 
-     for (BindingIter bi = scope.bindings(pc); bi; bi++) {
-         if (bi.kind() == BindingKind::Var) {
-             BindingName binding(bi.name(), allBindingsClosedOver || bi.closedOver());
-             if (!vars.append(binding))
-                 return Nothing();
-@@ -2094,18 +2096,18 @@ Maybe<VarScope::Data*>
- ParserBase::newVarScopeData(ParseContext::Scope& scope)
- {
-     return NewVarScopeData(context, scope, alloc, pc);
- }
- 
- Maybe<LexicalScope::Data*>
- NewLexicalScopeData(JSContext* context, ParseContext::Scope& scope, LifoAlloc& alloc, ParseContext* pc)
- {
--    Vector<BindingName> lets(context);
--    Vector<BindingName> consts(context);
-+    BindingNameVector lets(context);
-+    BindingNameVector consts(context);
- 
-     // Unlike other scopes with bindings which are body-level, it is unknown
-     // if pc->sc()->allBindingsClosedOver() is correct at the time of
-     // finishing parsing a lexical scope.
-     //
-     // Instead, pc->sc()->allBindingsClosedOver() is checked in
-     // EmitterScope::enterLexical. Also see comment there.
-     for (BindingIter bi = scope.bindings(pc); bi; bi++) {

frg/work-js/mozilla-release/patches/mozilla-central-push_425615.patch

@@ -1,183 +0,0 @@
-# HG changeset patch
-# User Robin Templeton <robin@igalia.com>
-# Date 1531073520 -10800
-#      Sun Jul 08 21:12:00 2018 +0300
-# Node ID b1ebc15b5eec0e7bafa28dcb3bb2c192d90c1613
-# Parent  e89192032fe21bedf44aa4447f126abf6eba61ae
-bug 1471134 - Part 1: Define methods for basic BigInt arithmetic. r=Waldo
-
-diff --git a/js/src/js.msg b/js/src/js.msg
---- a/js/src/js.msg
-+++ b/js/src/js.msg
-@@ -647,13 +647,14 @@ MSG_DEF(JSMSG_BAD_RESPONSE_VALUE,       
- MSG_DEF(JSMSG_BAD_RESPONSE_MIME_TYPE,                    0, JSEXN_TYPEERR,  "Response has unsupported MIME type")
- MSG_DEF(JSMSG_BAD_RESPONSE_CORS_SAME_ORIGIN,             0, JSEXN_TYPEERR,  "Response.type must be 'basic', 'cors' or 'default'")
- MSG_DEF(JSMSG_BAD_RESPONSE_STATUS,                       0, JSEXN_TYPEERR,  "Response does not have ok status")
- MSG_DEF(JSMSG_RESPONSE_ALREADY_CONSUMED,                 0, JSEXN_TYPEERR,  "Response already consumed")
- 
- // BigInt
- MSG_DEF(JSMSG_BIGINT_TO_NUMBER, 0, JSEXN_TYPEERR, "can't convert BigInt to number")
- MSG_DEF(JSMSG_NUMBER_TO_BIGINT, 0, JSEXN_RANGEERR, "can't convert non-finite number to BigInt")
-+MSG_DEF(JSMSG_BIGINT_TOO_LARGE, 0, JSEXN_RANGEERR, "BigInt is too large to allocate")
- MSG_DEF(JSMSG_BIGINT_DIVISION_BY_ZERO, 0, JSEXN_RANGEERR, "BigInt division by zero")
- MSG_DEF(JSMSG_BIGINT_NEGATIVE_EXPONENT, 0, JSEXN_RANGEERR, "BigInt negative exponent")
- MSG_DEF(JSMSG_BIGINT_INVALID_SYNTAX, 0, JSEXN_SYNTAXERR, "invalid BigInt syntax")
- MSG_DEF(JSMSG_NOT_BIGINT, 0, JSEXN_TYPEERR, "not a BigInt")
- MSG_DEF(JSMSG_BIGINT_NOT_SERIALIZABLE, 0, JSEXN_TYPEERR, "BigInt value can't be serialized in JSON")
-diff --git a/js/src/vm/BigIntType.cpp b/js/src/vm/BigIntType.cpp
---- a/js/src/vm/BigIntType.cpp
-+++ b/js/src/vm/BigIntType.cpp
-@@ -166,16 +166,126 @@ BigInt::copy(JSContext* cx, HandleBigInt
- {
-     BigInt* bi = Allocate<BigInt>(cx);
-     if (!bi)
-         return nullptr;
-     mpz_init_set(bi->num_, x->num_);
-     return bi;
- }
- 
-+// BigInt proposal section 1.1.7
-+BigInt*
-+BigInt::add(JSContext* cx, HandleBigInt x, HandleBigInt y)
-+{
-+    BigInt* z = create(cx);
-+    if (!z)
-+        return nullptr;
-+    mpz_add(z->num_, x->num_, y->num_);
-+    return z;
-+}
-+
-+// BigInt proposal section 1.1.8
-+BigInt*
-+BigInt::sub(JSContext* cx, HandleBigInt x, HandleBigInt y)
-+{
-+    BigInt* z = create(cx);
-+    if (!z)
-+        return nullptr;
-+    mpz_sub(z->num_, x->num_, y->num_);
-+    return z;
-+}
-+
-+// BigInt proposal section 1.1.4
-+BigInt*
-+BigInt::mul(JSContext* cx, HandleBigInt x, HandleBigInt y)
-+{
-+    BigInt* z = create(cx);
-+    if (!z)
-+        return nullptr;
-+    mpz_mul(z->num_, x->num_, y->num_);
-+    return z;
-+}
-+
-+// BigInt proposal section 1.1.5
-+BigInt*
-+BigInt::div(JSContext* cx, HandleBigInt x, HandleBigInt y)
-+{
-+    // Step 1.
-+    if (mpz_size(y->num_) == 0) {
-+        JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
-+                                  JSMSG_BIGINT_DIVISION_BY_ZERO);
-+        return nullptr;
-+    }
-+
-+    // Steps 2-3.
-+    BigInt* z = create(cx);
-+    if (!z)
-+        return nullptr;
-+    mpz_tdiv_q(z->num_, x->num_, y->num_);
-+    return z;
-+}
-+
-+// BigInt proposal section 1.1.6
-+BigInt*
-+BigInt::mod(JSContext* cx, HandleBigInt x, HandleBigInt y)
-+{
-+    // Step 1.
-+    if (mpz_size(y->num_) == 0) {
-+        JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
-+                                  JSMSG_BIGINT_DIVISION_BY_ZERO);
-+        return nullptr;
-+    }
-+
-+    // Steps 2-4.
-+    BigInt* z = create(cx);
-+    if (!z)
-+        return nullptr;
-+    mpz_tdiv_r(z->num_, x->num_, y->num_);
-+    return z;
-+}
-+
-+// BigInt proposal section 1.1.3
-+BigInt*
-+BigInt::pow(JSContext* cx, HandleBigInt x, HandleBigInt y)
-+{
-+    // Step 1.
-+    if (mpz_sgn(y->num_) < 0) {
-+        JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
-+                                  JSMSG_BIGINT_NEGATIVE_EXPONENT);
-+        return nullptr;
-+    }
-+
-+    // Throw a RangeError if the exponent is too large.
-+    if (!mpz_fits_uint_p(y->num_)) {
-+        JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
-+                                  JSMSG_BIGINT_TOO_LARGE);
-+        return nullptr;
-+    }
-+    unsigned long int power = mpz_get_ui(y->num_);
-+
-+    // Steps 2-3.
-+    BigInt* z = create(cx);
-+    if (!z)
-+        return nullptr;
-+
-+    mpz_pow_ui(z->num_, x->num_, power);
-+    return z;
-+}
-+
-+// BigInt proposal section 1.1.1
-+BigInt*
-+BigInt::neg(JSContext* cx, HandleBigInt x)
-+{
-+    BigInt* res = create(cx);
-+    if (!res)
-+        return nullptr;
-+    mpz_neg(res->num_, x->num_);
-+    return res;
-+}
-+
- // BigInt proposal section 7.3
- BigInt*
- js::ToBigInt(JSContext* cx, HandleValue val)
- {
-     RootedValue v(cx, val);
- 
-     // Step 1.
-     if (!ToPrimitive(cx, JSTYPE_NUMBER, &v))
-diff --git a/js/src/vm/BigIntType.h b/js/src/vm/BigIntType.h
---- a/js/src/vm/BigIntType.h
-+++ b/js/src/vm/BigIntType.h
-@@ -68,16 +68,23 @@ class BigInt final : public js::gc::Tenu
-     size_t sizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf) const;
- 
-     bool toBoolean();
-     int8_t sign();
- 
-     static void init();
- 
-     static BigInt* copy(JSContext* cx, Handle<BigInt*> x);
-+    static BigInt* add(JSContext* cx, Handle<BigInt*> x, Handle<BigInt*> y);
-+    static BigInt* sub(JSContext* cx, Handle<BigInt*> x, Handle<BigInt*> y);
-+    static BigInt* mul(JSContext* cx, Handle<BigInt*> x, Handle<BigInt*> y);
-+    static BigInt* div(JSContext* cx, Handle<BigInt*> x, Handle<BigInt*> y);
-+    static BigInt* mod(JSContext* cx, Handle<BigInt*> x, Handle<BigInt*> y);
-+    static BigInt* pow(JSContext* cx, Handle<BigInt*> x, Handle<BigInt*> y);
-+    static BigInt* neg(JSContext* cx, Handle<BigInt*> x);
- 
-     static double numberValue(BigInt* x);
-     static JSLinearString* toString(JSContext* cx, BigInt* x, uint8_t radix);
- 
-     // Return the length in bytes of the representation used by
-     // writeBytes.
-     static size_t byteLength(BigInt* x);
- 

frg/work-js/mozilla-release/patches/mozilla-central-push_425616.patch

@@ -1,177 +0,0 @@
-# HG changeset patch
-# User Robin Templeton <robin@igalia.com>
-# Date 1531073580 -10800
-#      Sun Jul 08 21:13:00 2018 +0300
-# Node ID 1b449d788c942f8bb049423618be36fd3862e8ae
-# Parent  b1ebc15b5eec0e7bafa28dcb3bb2c192d90c1613
-bug 1471134 - Part 2: Add BigInt arithmetic methods that accept Value arguments. r=jandem
-
-diff --git a/js/src/vm/BigIntType.cpp b/js/src/vm/BigIntType.cpp
---- a/js/src/vm/BigIntType.cpp
-+++ b/js/src/vm/BigIntType.cpp
-@@ -276,16 +276,133 @@ BigInt::neg(JSContext* cx, HandleBigInt 
- {
-     BigInt* res = create(cx);
-     if (!res)
-         return nullptr;
-     mpz_neg(res->num_, x->num_);
-     return res;
- }
- 
-+static bool
-+ValidBigIntOperands(JSContext* cx, HandleValue lhs, HandleValue rhs)
-+{
-+    MOZ_ASSERT(lhs.isBigInt() || rhs.isBigInt());
-+
-+    if (!lhs.isBigInt() || !rhs.isBigInt()) {
-+        JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
-+                                  JSMSG_BIGINT_TO_NUMBER);
-+        return false;
-+    }
-+
-+    return true;
-+}
-+
-+bool
-+BigInt::add(JSContext* cx, HandleValue lhs, HandleValue rhs, MutableHandleValue res)
-+{
-+    if (!ValidBigIntOperands(cx, lhs, rhs))
-+        return false;
-+
-+    RootedBigInt lhsBigInt(cx, lhs.toBigInt());
-+    RootedBigInt rhsBigInt(cx, rhs.toBigInt());
-+    BigInt* resBigInt = BigInt::add(cx, lhsBigInt, rhsBigInt);
-+    if (!resBigInt)
-+        return false;
-+    res.setBigInt(resBigInt);
-+    return true;
-+}
-+
-+bool
-+BigInt::sub(JSContext* cx, HandleValue lhs, HandleValue rhs, MutableHandleValue res)
-+{
-+    if (!ValidBigIntOperands(cx, lhs, rhs))
-+        return false;
-+
-+    RootedBigInt lhsBigInt(cx, lhs.toBigInt());
-+    RootedBigInt rhsBigInt(cx, rhs.toBigInt());
-+    BigInt* resBigInt = BigInt::sub(cx, lhsBigInt, rhsBigInt);
-+    if (!resBigInt)
-+        return false;
-+    res.setBigInt(resBigInt);
-+    return true;
-+}
-+
-+bool
-+BigInt::mul(JSContext* cx, HandleValue lhs, HandleValue rhs, MutableHandleValue res)
-+{
-+    if (!ValidBigIntOperands(cx, lhs, rhs))
-+        return false;
-+
-+    RootedBigInt lhsBigInt(cx, lhs.toBigInt());
-+    RootedBigInt rhsBigInt(cx, rhs.toBigInt());
-+    BigInt* resBigInt = BigInt::mul(cx, lhsBigInt, rhsBigInt);
-+    if (!resBigInt)
-+        return false;
-+    res.setBigInt(resBigInt);
-+    return true;
-+}
-+
-+bool
-+BigInt::div(JSContext* cx, HandleValue lhs, HandleValue rhs, MutableHandleValue res)
-+{
-+    if (!ValidBigIntOperands(cx, lhs, rhs))
-+        return false;
-+
-+    RootedBigInt lhsBigInt(cx, lhs.toBigInt());
-+    RootedBigInt rhsBigInt(cx, rhs.toBigInt());
-+    BigInt* resBigInt = BigInt::div(cx, lhsBigInt, rhsBigInt);
-+    if (!resBigInt)
-+        return false;
-+    res.setBigInt(resBigInt);
-+    return true;
-+}
-+
-+bool
-+BigInt::mod(JSContext* cx, HandleValue lhs, HandleValue rhs, MutableHandleValue res)
-+{
-+    if (!ValidBigIntOperands(cx, lhs, rhs))
-+        return false;
-+
-+    RootedBigInt lhsBigInt(cx, lhs.toBigInt());
-+    RootedBigInt rhsBigInt(cx, rhs.toBigInt());
-+    BigInt* resBigInt = BigInt::mod(cx, lhsBigInt, rhsBigInt);
-+    if (!resBigInt)
-+        return false;
-+    res.setBigInt(resBigInt);
-+    return true;
-+}
-+
-+bool
-+BigInt::pow(JSContext* cx, HandleValue lhs, HandleValue rhs, MutableHandleValue res)
-+{
-+    if (!ValidBigIntOperands(cx, lhs, rhs))
-+        return false;
-+
-+    RootedBigInt lhsBigInt(cx, lhs.toBigInt());
-+    RootedBigInt rhsBigInt(cx, rhs.toBigInt());
-+    BigInt* resBigInt = BigInt::pow(cx, lhsBigInt, rhsBigInt);
-+    if (!resBigInt)
-+        return false;
-+    res.setBigInt(resBigInt);
-+    return true;
-+}
-+
-+bool
-+BigInt::neg(JSContext* cx, HandleValue operand, MutableHandleValue res)
-+{
-+    MOZ_ASSERT(operand.isBigInt());
-+
-+    RootedBigInt operandBigInt(cx, operand.toBigInt());
-+    BigInt* resBigInt = BigInt::neg(cx, operandBigInt);
-+    if (!resBigInt)
-+        return false;
-+    res.setBigInt(resBigInt);
-+    return true;
-+}
-+
- // BigInt proposal section 7.3
- BigInt*
- js::ToBigInt(JSContext* cx, HandleValue val)
- {
-     RootedValue v(cx, val);
- 
-     // Step 1.
-     if (!ToPrimitive(cx, JSTYPE_NUMBER, &v))
-diff --git a/js/src/vm/BigIntType.h b/js/src/vm/BigIntType.h
---- a/js/src/vm/BigIntType.h
-+++ b/js/src/vm/BigIntType.h
-@@ -76,16 +76,28 @@ class BigInt final : public js::gc::Tenu
-     static BigInt* add(JSContext* cx, Handle<BigInt*> x, Handle<BigInt*> y);
-     static BigInt* sub(JSContext* cx, Handle<BigInt*> x, Handle<BigInt*> y);
-     static BigInt* mul(JSContext* cx, Handle<BigInt*> x, Handle<BigInt*> y);
-     static BigInt* div(JSContext* cx, Handle<BigInt*> x, Handle<BigInt*> y);
-     static BigInt* mod(JSContext* cx, Handle<BigInt*> x, Handle<BigInt*> y);
-     static BigInt* pow(JSContext* cx, Handle<BigInt*> x, Handle<BigInt*> y);
-     static BigInt* neg(JSContext* cx, Handle<BigInt*> x);
- 
-+    // Type-checking versions of arithmetic operations. These methods
-+    // must be called with at least one BigInt operand. Binary
-+    // operations with throw a TypeError if one of the operands is not a
-+    // BigInt value.
-+    static bool add(JSContext* cx, Handle<Value> lhs, Handle<Value> rhs, MutableHandle<Value> res);
-+    static bool sub(JSContext* cx, Handle<Value> lhs, Handle<Value> rhs, MutableHandle<Value> res);
-+    static bool mul(JSContext* cx, Handle<Value> lhs, Handle<Value> rhs, MutableHandle<Value> res);
-+    static bool div(JSContext* cx, Handle<Value> lhs, Handle<Value> rhs, MutableHandle<Value> res);
-+    static bool mod(JSContext* cx, Handle<Value> lhs, Handle<Value> rhs, MutableHandle<Value> res);
-+    static bool pow(JSContext* cx, Handle<Value> lhs, Handle<Value> rhs, MutableHandle<Value> res);
-+    static bool neg(JSContext* cx, Handle<Value> operand, MutableHandle<Value> res);
-+
-     static double numberValue(BigInt* x);
-     static JSLinearString* toString(JSContext* cx, BigInt* x, uint8_t radix);
- 
-     // Return the length in bytes of the representation used by
-     // writeBytes.
-     static size_t byteLength(BigInt* x);
- 
-     // Write a little-endian representation of a BigInt's absolute value

frg/work-js/mozilla-release/patches/mozilla-central-push_425617.patch

@@ -1,221 +0,0 @@
-# HG changeset patch
-# User Robin Templeton <robin@igalia.com>
-# Date 1531073580 -10800
-#      Sun Jul 08 21:13:00 2018 +0300
-# Node ID f0328b9f1a4d2f9f565c1f20af9559c07bf3e6fa
-# Parent  1b449d788c942f8bb049423618be36fd3862e8ae
-bug 1471134 - Part 3: Make arithmetic operand arguments mutable. r=jandem
-
-Follow the example of AddOperation, which uses MutableHandleValue for
-arguments that will be passed to ToPrimitive. This allows parameters to
-be converted using ToNumeric instead of ToNumber.
-
-diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
---- a/js/src/jit/BaselineIC.cpp
-+++ b/js/src/jit/BaselineIC.cpp
-@@ -4865,20 +4865,23 @@ DoUnaryArithFallback(JSContext* cx, Base
-     switch (op) {
-       case JSOP_BITNOT: {
-         int32_t result;
-         if (!BitNot(cx, val, &result))
-             return false;
-         res.setInt32(result);
-         break;
-       }
--      case JSOP_NEG:
--        if (!NegOperation(cx, val, res))
-+      case JSOP_NEG: {
-+        // We copy val here because the original value is needed below.
-+        RootedValue valCopy(cx, val);
-+        if (!NegOperation(cx, &valCopy, res))
-             return false;
-         break;
-+      }
-       default:
-         MOZ_CRASH("Unexpected op");
-     }
- 
-     // Check if debug mode toggling made the stub invalid.
-     if (debug_stub.invalid())
-         return true;
- 
-diff --git a/js/src/jit/IonIC.cpp b/js/src/jit/IonIC.cpp
---- a/js/src/jit/IonIC.cpp
-+++ b/js/src/jit/IonIC.cpp
-@@ -515,20 +515,23 @@ IonUnaryArithIC::update(JSContext* cx, H
-     switch (op) {
-       case JSOP_BITNOT: {
-         int32_t result;
-         if (!BitNot(cx, val, &result))
-             return false;
-         res.setInt32(result);
-         break;
-       }
--      case JSOP_NEG:
--        if (!NegOperation(cx, val, res))
-+      case JSOP_NEG: {
-+        // We copy val here because the original value is needed below.
-+        RootedValue valCopy(cx, val);
-+        if (!NegOperation(cx, &valCopy, res))
-             return false;
-         break;
-+      }
-       default:
-         MOZ_CRASH("Unexpected op");
-     }
- 
-     if (ic->state().maybeTransition())
-         ic->discardStubs(cx->zone());
- 
-     if (ic->state().canAttachStub()) {
-diff --git a/js/src/vm/Interpreter-inl.h b/js/src/vm/Interpreter-inl.h
---- a/js/src/vm/Interpreter-inl.h
-+++ b/js/src/vm/Interpreter-inl.h
-@@ -442,17 +442,17 @@ DefVarOperation(JSContext* cx, HandleObj
-         if (!varobj->as<GlobalObject>().realm()->addToVarNames(cx, dn))
-             return false;
-     }
- 
-     return true;
- }
- 
- static MOZ_ALWAYS_INLINE bool
--NegOperation(JSContext* cx, HandleValue val, MutableHandleValue res)
-+NegOperation(JSContext* cx, MutableHandleValue val, MutableHandleValue res)
- {
-     /*
-      * When the operand is int jsval, INT32_FITS_IN_JSVAL(i) implies
-      * INT32_FITS_IN_JSVAL(-i) unless i is 0 or INT32_MIN when the
-      * results, -0.0 or INT32_MAX + 1, are double values.
-      */
-     int32_t i;
-     if (val.isInt32() && (i = val.toInt32()) != 0 && i != INT32_MIN) {
-diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
---- a/js/src/vm/Interpreter.cpp
-+++ b/js/src/vm/Interpreter.cpp
-@@ -1618,47 +1618,47 @@ AddOperation(JSContext* cx, MutableHandl
-             return false;
-         res.setNumber(l + r);
-     }
- 
-     return true;
- }
- 
- static MOZ_ALWAYS_INLINE bool
--SubOperation(JSContext* cx, HandleValue lhs, HandleValue rhs, MutableHandleValue res)
-+SubOperation(JSContext* cx, MutableHandleValue lhs, MutableHandleValue rhs, MutableHandleValue res)
- {
-     double d1, d2;
-     if (!ToNumber(cx, lhs, &d1) || !ToNumber(cx, rhs, &d2))
-         return false;
-     res.setNumber(d1 - d2);
-     return true;
- }
- 
- static MOZ_ALWAYS_INLINE bool
--MulOperation(JSContext* cx, HandleValue lhs, HandleValue rhs, MutableHandleValue res)
-+MulOperation(JSContext* cx, MutableHandleValue lhs, MutableHandleValue rhs, MutableHandleValue res)
- {
-     double d1, d2;
-     if (!ToNumber(cx, lhs, &d1) || !ToNumber(cx, rhs, &d2))
-         return false;
-     res.setNumber(d1 * d2);
-     return true;
- }
- 
- static MOZ_ALWAYS_INLINE bool
--DivOperation(JSContext* cx, HandleValue lhs, HandleValue rhs, MutableHandleValue res)
-+DivOperation(JSContext* cx, MutableHandleValue lhs, MutableHandleValue rhs, MutableHandleValue res)
- {
-     double d1, d2;
-     if (!ToNumber(cx, lhs, &d1) || !ToNumber(cx, rhs, &d2))
-         return false;
-     res.setNumber(NumberDiv(d1, d2));
-     return true;
- }
- 
- static MOZ_ALWAYS_INLINE bool
--ModOperation(JSContext* cx, HandleValue lhs, HandleValue rhs, MutableHandleValue res)
-+ModOperation(JSContext* cx, MutableHandleValue lhs, MutableHandleValue rhs, MutableHandleValue res)
- {
-     int32_t l, r;
-     if (lhs.isInt32() && rhs.isInt32() &&
-         (l = lhs.toInt32()) >= 0 && (r = rhs.toInt32()) > 0) {
-         int32_t mod = l % r;
-         res.setInt32(mod);
-         return true;
-     }
-@@ -2673,50 +2673,50 @@ CASE(JSOP_ADD)
- }
- END_CASE(JSOP_ADD)
- 
- CASE(JSOP_SUB)
- {
-     ReservedRooted<Value> lval(&rootValue0, REGS.sp[-2]);
-     ReservedRooted<Value> rval(&rootValue1, REGS.sp[-1]);
-     MutableHandleValue res = REGS.stackHandleAt(-2);
--    if (!SubOperation(cx, lval, rval, res))
-+    if (!SubOperation(cx, &lval, &rval, res))
-         goto error;
-     REGS.sp--;
- }
- END_CASE(JSOP_SUB)
- 
- CASE(JSOP_MUL)
- {
-     ReservedRooted<Value> lval(&rootValue0, REGS.sp[-2]);
-     ReservedRooted<Value> rval(&rootValue1, REGS.sp[-1]);
-     MutableHandleValue res = REGS.stackHandleAt(-2);
--    if (!MulOperation(cx, lval, rval, res))
-+    if (!MulOperation(cx, &lval, &rval, res))
-         goto error;
-     REGS.sp--;
- }
- END_CASE(JSOP_MUL)
- 
- CASE(JSOP_DIV)
- {
-     ReservedRooted<Value> lval(&rootValue0, REGS.sp[-2]);
-     ReservedRooted<Value> rval(&rootValue1, REGS.sp[-1]);
-     MutableHandleValue res = REGS.stackHandleAt(-2);
--    if (!DivOperation(cx, lval, rval, res))
-+    if (!DivOperation(cx, &lval, &rval, res))
-         goto error;
-     REGS.sp--;
- }
- END_CASE(JSOP_DIV)
- 
- CASE(JSOP_MOD)
- {
-     ReservedRooted<Value> lval(&rootValue0, REGS.sp[-2]);
-     ReservedRooted<Value> rval(&rootValue1, REGS.sp[-1]);
-     MutableHandleValue res = REGS.stackHandleAt(-2);
--    if (!ModOperation(cx, lval, rval, res))
-+    if (!ModOperation(cx, &lval, &rval, res))
-         goto error;
-     REGS.sp--;
- }
- END_CASE(JSOP_MOD)
- 
- CASE(JSOP_POW)
- {
-     ReservedRooted<Value> lval(&rootValue0, REGS.sp[-2]);
-@@ -2745,17 +2745,17 @@ CASE(JSOP_BITNOT)
-     REGS.sp[-1].setInt32(i);
- }
- END_CASE(JSOP_BITNOT)
- 
- CASE(JSOP_NEG)
- {
-     ReservedRooted<Value> val(&rootValue0, REGS.sp[-1]);
-     MutableHandleValue res = REGS.stackHandleAt(-1);
--    if (!NegOperation(cx, val, res))
-+    if (!NegOperation(cx, &val, res))
-         goto error;
- }
- END_CASE(JSOP_NEG)
- 
- CASE(JSOP_POS)
-     if (!ToNumber(cx, REGS.stackHandleAt(-1)))
-         goto error;
- END_CASE(JSOP_POS)

frg/work-js/mozilla-release/patches/mozilla-central-push_425618.patch

@@ -1,276 +0,0 @@
-# HG changeset patch
-# User Robin Templeton <robin@igalia.com>
-# Date 1531073580 -10800
-#      Sun Jul 08 21:13:00 2018 +0300
-# Node ID 22883fe0cf16befe28ce81deb8a012453cf80af7
-# Parent  f0328b9f1a4d2f9f565c1f20af9559c07bf3e6fa
-bug 1471134 - Part 4: Add PowValues/PowOperation for exponentiation. r=jandem
-
-Inline math_pow_handle into math_pow and PowValues, and replace other
-uses with calls to PowValues.
-
-diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
---- a/js/src/jit/CodeGenerator.cpp
-+++ b/js/src/jit/CodeGenerator.cpp
-@@ -7489,19 +7489,18 @@ CodeGenerator::visitPowD(LPowD* ins)
-     masm.setupUnalignedABICall(temp);
-     masm.passABIArg(value, MoveOp::DOUBLE);
-     masm.passABIArg(power, MoveOp::DOUBLE);
-     masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, ecmaPow), MoveOp::DOUBLE);
- 
-     MOZ_ASSERT(ToFloatRegister(ins->output()) == ReturnDoubleReg);
- }
- 
--using PowFn = bool (*)(JSContext*, HandleValue, HandleValue, MutableHandleValue);
--static const VMFunction PowInfo =
--    FunctionInfo<PowFn>(js::math_pow_handle, "math_pow_handle");
-+using PowFn = bool (*)(JSContext*, MutableHandleValue, MutableHandleValue, MutableHandleValue);
-+static const VMFunction PowInfo = FunctionInfo<PowFn>(js::PowValues, "PowValues");
- 
- void
- CodeGenerator::visitPowV(LPowV* ins)
- {
-     pushArg(ToValue(ins, LPowV::PowerInput));
-     pushArg(ToValue(ins, LPowV::ValueInput));
-     callVM(PowInfo, ins);
- }
-diff --git a/js/src/jit/Recover.cpp b/js/src/jit/Recover.cpp
---- a/js/src/jit/Recover.cpp
-+++ b/js/src/jit/Recover.cpp
-@@ -797,17 +797,17 @@ RPow::RPow(CompactBufferReader& reader)
- bool
- RPow::recover(JSContext* cx, SnapshotIterator& iter) const
- {
-     RootedValue base(cx, iter.read());
-     RootedValue power(cx, iter.read());
-     RootedValue result(cx);
- 
-     MOZ_ASSERT(base.isNumber() && power.isNumber());
--    if (!js::math_pow_handle(cx, base, power, &result))
-+    if (!js::PowValues(cx, &base, &power, &result))
-         return false;
- 
-     iter.storeInstructionResult(result);
-     return true;
- }
- 
- bool
- MPowHalf::writeRecoverData(CompactBufferWriter& writer) const
-@@ -824,17 +824,17 @@ bool
- RPowHalf::recover(JSContext* cx, SnapshotIterator& iter) const
- {
-     RootedValue base(cx, iter.read());
-     RootedValue power(cx);
-     RootedValue result(cx);
-     power.setNumber(0.5);
- 
-     MOZ_ASSERT(base.isNumber());
--    if (!js::math_pow_handle(cx, base, power, &result))
-+    if (!js::PowValues(cx, &base, &power, &result))
-         return false;
- 
-     iter.storeInstructionResult(result);
-     return true;
- }
- 
- bool
- MMinMax::writeRecoverData(CompactBufferWriter& writer) const
-diff --git a/js/src/jit/SharedIC.cpp b/js/src/jit/SharedIC.cpp
---- a/js/src/jit/SharedIC.cpp
-+++ b/js/src/jit/SharedIC.cpp
-@@ -714,17 +714,17 @@ DoBinaryArithFallback(JSContext* cx, voi
-         if (!DivValues(cx, &lhsCopy, &rhsCopy, ret))
-             return false;
-         break;
-       case JSOP_MOD:
-         if (!ModValues(cx, &lhsCopy, &rhsCopy, ret))
-             return false;
-         break;
-       case JSOP_POW:
--        if (!math_pow_handle(cx, lhsCopy, rhsCopy, ret))
-+        if (!PowValues(cx, &lhsCopy, &rhsCopy, ret))
-             return false;
-         break;
-       case JSOP_BITOR: {
-         int32_t result;
-         if (!BitOr(cx, lhs, rhs, &result))
-             return false;
-         ret.setInt32(result);
-         break;
-diff --git a/js/src/jsmath.cpp b/js/src/jsmath.cpp
---- a/js/src/jsmath.cpp
-+++ b/js/src/jsmath.cpp
-@@ -644,37 +644,31 @@ js::ecmaPow(double x, double y)
-             return sqrt(x);
-         if (y == -0.5)
-             return 1.0 / sqrt(x);
-     }
-     return pow(x, y);
- }
- 
- bool
--js::math_pow_handle(JSContext* cx, HandleValue base, HandleValue power, MutableHandleValue result)
--{
--    double x;
--    if (!ToNumber(cx, base, &x))
--        return false;
--
--    double y;
--    if (!ToNumber(cx, power, &y))
--        return false;
--
--    double z = ecmaPow(x, y);
--    result.setNumber(z);
--    return true;
--}
--
--bool
- js::math_pow(JSContext* cx, unsigned argc, Value* vp)
- {
-     CallArgs args = CallArgsFromVp(argc, vp);
- 
--    return math_pow_handle(cx, args.get(0), args.get(1), args.rval());
-+    double x;
-+    if (!ToNumber(cx, args.get(0), &x))
-+        return false;
-+
-+    double y;
-+    if (!ToNumber(cx, args.get(1), &y))
-+        return false;
-+
-+    double z = ecmaPow(x, y);
-+    args.rval().setNumber(z);
-+    return true;
- }
- 
- uint64_t
- js::GenerateRandomSeed()
- {
-     uint64_t seed = 0;
- 
- #if defined(XP_WIN)
-diff --git a/js/src/jsmath.h b/js/src/jsmath.h
---- a/js/src/jsmath.h
-+++ b/js/src/jsmath.h
-@@ -128,20 +128,16 @@ math_sqrt_impl(MathCache* cache, double 
- 
- extern bool
- math_sqrt_handle(JSContext* cx, js::HandleValue number, js::MutableHandleValue result);
- 
- extern bool
- math_sqrt(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern bool
--math_pow_handle(JSContext* cx, js::HandleValue base, js::HandleValue power,
--                js::MutableHandleValue result);
--
--extern bool
- math_pow(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern bool
- minmax_impl(JSContext* cx, bool max, js::HandleValue a, js::HandleValue b,
-             js::MutableHandleValue res);
- 
- extern void
- math_sincos_uncached(double x, double *sin, double *cos);
-diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
---- a/js/src/vm/Interpreter.cpp
-+++ b/js/src/vm/Interpreter.cpp
-@@ -1667,16 +1667,32 @@ ModOperation(JSContext* cx, MutableHandl
-     if (!ToNumber(cx, lhs, &d1) || !ToNumber(cx, rhs, &d2))
-         return false;
- 
-     res.setNumber(NumberMod(d1, d2));
-     return true;
- }
- 
- static MOZ_ALWAYS_INLINE bool
-+PowOperation(JSContext* cx, MutableHandleValue lhs, MutableHandleValue rhs, MutableHandleValue res)
-+{
-+    double x;
-+    if (!ToNumber(cx, lhs, &x))
-+        return false;
-+
-+    double y;
-+    if (!ToNumber(cx, rhs, &y))
-+        return false;
-+
-+    double z = ecmaPow(x, y);
-+    res.setNumber(z);
-+    return true;
-+}
-+
-+static MOZ_ALWAYS_INLINE bool
- SetObjectElementOperation(JSContext* cx, HandleObject obj, HandleId id, HandleValue value,
-                           HandleValue receiver, bool strict,
-                           JSScript* script = nullptr, jsbytecode* pc = nullptr)
- {
-     // receiver != obj happens only at super[expr], where we expect to find the property
-     // People probably aren't building hashtables with |super| anyway.
-     TypeScript::MonitorAssign(cx, obj, id);
- 
-@@ -2717,17 +2733,17 @@ CASE(JSOP_MOD)
- }
- END_CASE(JSOP_MOD)
- 
- CASE(JSOP_POW)
- {
-     ReservedRooted<Value> lval(&rootValue0, REGS.sp[-2]);
-     ReservedRooted<Value> rval(&rootValue1, REGS.sp[-1]);
-     MutableHandleValue res = REGS.stackHandleAt(-2);
--    if (!math_pow_handle(cx, lval, rval, res))
-+    if (!PowOperation(cx, &lval, &rval, res))
-         goto error;
-     REGS.sp--;
- }
- END_CASE(JSOP_POW)
- 
- CASE(JSOP_NOT)
- {
-     bool cond = ToBoolean(REGS.stackHandleAt(-1));
-@@ -4818,16 +4834,22 @@ js::DivValues(JSContext* cx, MutableHand
- 
- bool
- js::ModValues(JSContext* cx, MutableHandleValue lhs, MutableHandleValue rhs, MutableHandleValue res)
- {
-     return ModOperation(cx, lhs, rhs, res);
- }
- 
- bool
-+js::PowValues(JSContext* cx, MutableHandleValue lhs, MutableHandleValue rhs, MutableHandleValue res)
-+{
-+    return PowOperation(cx, lhs, rhs, res);
-+}
-+
-+bool
- js::UrshValues(JSContext* cx, MutableHandleValue lhs, MutableHandleValue rhs, MutableHandleValue res)
- {
-     return UrshOperation(cx, lhs, rhs, res);
- }
- 
- bool
- js::AtomicIsLockFree(JSContext* cx, HandleValue in, int* out)
- {
-diff --git a/js/src/vm/Interpreter.h b/js/src/vm/Interpreter.h
---- a/js/src/vm/Interpreter.h
-+++ b/js/src/vm/Interpreter.h
-@@ -464,16 +464,19 @@ MulValues(JSContext* cx, MutableHandleVa
- 
- bool
- DivValues(JSContext* cx, MutableHandleValue lhs, MutableHandleValue rhs, MutableHandleValue res);
- 
- bool
- ModValues(JSContext* cx, MutableHandleValue lhs, MutableHandleValue rhs, MutableHandleValue res);
- 
- bool
-+PowValues(JSContext* cx, MutableHandleValue lhs, MutableHandleValue rhs, MutableHandleValue res);
-+
-+bool
- UrshValues(JSContext* cx, MutableHandleValue lhs, MutableHandleValue rhs, MutableHandleValue res);
- 
- bool
- AtomicIsLockFree(JSContext* cx, HandleValue in, int* out);
- 
- template <bool strict>
- bool
- DeletePropertyJit(JSContext* ctx, HandleValue val, HandlePropertyName name, bool* bv);

frg/work-js/mozilla-release/patches/mozilla-central-push_425619.patch

@@ -1,190 +0,0 @@
-# HG changeset patch
-# User Robin Templeton <robin@igalia.com>
-# Date 1531073640 -10800
-#      Sun Jul 08 21:14:00 2018 +0300
-# Node ID 214a13e783acb9bceeb6cdaa4215f4e8b1ae109f
-# Parent  22883fe0cf16befe28ce81deb8a012453cf80af7
-bug 1471134 - Part 5: Support BigInt operands for basic arithmetic operators. r=jandem
-
-Operands are converted to primitive values using ToNumeric, which can
-result in either BigInt or Number values. If any operand is a BigInt,
-the corresponding BigInt method is called; otherwise, the existing
-behavior for Numbers is used.
-
-diff --git a/js/src/vm/Interpreter-inl.h b/js/src/vm/Interpreter-inl.h
---- a/js/src/vm/Interpreter-inl.h
-+++ b/js/src/vm/Interpreter-inl.h
-@@ -452,23 +452,28 @@ NegOperation(JSContext* cx, MutableHandl
-     /*
-      * When the operand is int jsval, INT32_FITS_IN_JSVAL(i) implies
-      * INT32_FITS_IN_JSVAL(-i) unless i is 0 or INT32_MIN when the
-      * results, -0.0 or INT32_MAX + 1, are double values.
-      */
-     int32_t i;
-     if (val.isInt32() && (i = val.toInt32()) != 0 && i != INT32_MIN) {
-         res.setInt32(-i);
--    } else {
--        double d;
--        if (!ToNumber(cx, val, &d))
--            return false;
--        res.setNumber(-d);
-+        return true;
-     }
- 
-+    if (!ToNumeric(cx, val))
-+        return false;
-+
-+#ifdef ENABLE_BIGINT
-+    if (val.isBigInt())
-+        return BigInt::neg(cx, val, res);
-+#endif
-+
-+    res.setNumber(-val.toNumber());
-     return true;
- }
- 
- static MOZ_ALWAYS_INLINE bool
- ToIdOperation(JSContext* cx, HandleValue idval, MutableHandleValue res)
- {
-     if (idval.isInt32()) {
-         res.set(idval);
-diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
---- a/js/src/vm/Interpreter.cpp
-+++ b/js/src/vm/Interpreter.cpp
-@@ -1607,88 +1607,111 @@ AddOperation(JSContext* cx, MutableHandl
-         JSString* str = ConcatStrings<NoGC>(cx, lstr, rstr);
-         if (!str) {
-             RootedString nlstr(cx, lstr), nrstr(cx, rstr);
-             str = ConcatStrings<CanGC>(cx, nlstr, nrstr);
-             if (!str)
-                 return false;
-         }
-         res.setString(str);
--    } else {
--        double l, r;
--        if (!ToNumber(cx, lhs, &l) || !ToNumber(cx, rhs, &r))
--            return false;
--        res.setNumber(l + r);
-+        return true;
-     }
- 
-+    if (!ToNumeric(cx, lhs) || !ToNumeric(cx, rhs))
-+        return false;
-+
-+#ifdef ENABLE_BIGINT
-+    if (lhs.isBigInt() || rhs.isBigInt())
-+        return BigInt::add(cx, lhs, rhs, res);
-+#endif
-+
-+    res.setNumber(lhs.toNumber() + rhs.toNumber());
-     return true;
- }
- 
- static MOZ_ALWAYS_INLINE bool
- SubOperation(JSContext* cx, MutableHandleValue lhs, MutableHandleValue rhs, MutableHandleValue res)
- {
--    double d1, d2;
--    if (!ToNumber(cx, lhs, &d1) || !ToNumber(cx, rhs, &d2))
-+    if (!ToNumeric(cx, lhs) || !ToNumeric(cx, rhs))
-         return false;
--    res.setNumber(d1 - d2);
-+
-+#ifdef ENABLE_BIGINT
-+    if (lhs.isBigInt() || rhs.isBigInt())
-+        return BigInt::sub(cx, lhs, rhs, res);
-+#endif
-+
-+    res.setNumber(lhs.toNumber() - rhs.toNumber());
-     return true;
- }
- 
- static MOZ_ALWAYS_INLINE bool
- MulOperation(JSContext* cx, MutableHandleValue lhs, MutableHandleValue rhs, MutableHandleValue res)
- {
--    double d1, d2;
--    if (!ToNumber(cx, lhs, &d1) || !ToNumber(cx, rhs, &d2))
-+    if (!ToNumeric(cx, lhs) || !ToNumeric(cx, rhs))
-         return false;
--    res.setNumber(d1 * d2);
-+
-+#ifdef ENABLE_BIGINT
-+    if (lhs.isBigInt() || rhs.isBigInt())
-+        return BigInt::mul(cx, lhs, rhs, res);
-+#endif
-+
-+    res.setNumber(lhs.toNumber() * rhs.toNumber());
-     return true;
- }
- 
- static MOZ_ALWAYS_INLINE bool
- DivOperation(JSContext* cx, MutableHandleValue lhs, MutableHandleValue rhs, MutableHandleValue res)
- {
--    double d1, d2;
--    if (!ToNumber(cx, lhs, &d1) || !ToNumber(cx, rhs, &d2))
-+    if (!ToNumeric(cx, lhs) || !ToNumeric(cx, rhs))
-         return false;
--    res.setNumber(NumberDiv(d1, d2));
-+
-+#ifdef ENABLE_BIGINT
-+    if (lhs.isBigInt() || rhs.isBigInt())
-+        return BigInt::div(cx, lhs, rhs, res);
-+#endif
-+
-+    res.setNumber(NumberDiv(lhs.toNumber(), rhs.toNumber()));
-     return true;
- }
- 
- static MOZ_ALWAYS_INLINE bool
- ModOperation(JSContext* cx, MutableHandleValue lhs, MutableHandleValue rhs, MutableHandleValue res)
- {
-     int32_t l, r;
-     if (lhs.isInt32() && rhs.isInt32() &&
-         (l = lhs.toInt32()) >= 0 && (r = rhs.toInt32()) > 0) {
-         int32_t mod = l % r;
-         res.setInt32(mod);
-         return true;
-     }
- 
--    double d1, d2;
--    if (!ToNumber(cx, lhs, &d1) || !ToNumber(cx, rhs, &d2))
-+    if (!ToNumeric(cx, lhs) || !ToNumeric(cx, rhs))
-         return false;
- 
--    res.setNumber(NumberMod(d1, d2));
-+#ifdef ENABLE_BIGINT
-+    if (lhs.isBigInt() || rhs.isBigInt())
-+        return BigInt::mod(cx, lhs, rhs, res);
-+#endif
-+
-+    res.setNumber(NumberMod(lhs.toNumber(), rhs.toNumber()));
-     return true;
- }
- 
- static MOZ_ALWAYS_INLINE bool
- PowOperation(JSContext* cx, MutableHandleValue lhs, MutableHandleValue rhs, MutableHandleValue res)
- {
--    double x;
--    if (!ToNumber(cx, lhs, &x))
-+    if (!ToNumeric(cx, lhs) || !ToNumeric(cx, rhs))
-         return false;
- 
--    double y;
--    if (!ToNumber(cx, rhs, &y))
--        return false;
--
--    double z = ecmaPow(x, y);
--    res.setNumber(z);
-+#ifdef ENABLE_BIGINT
-+    if (lhs.isBigInt() || rhs.isBigInt())
-+        return BigInt::pow(cx, lhs, rhs, res);
-+#endif
-+
-+    res.setNumber(ecmaPow(lhs.toNumber(), rhs.toNumber()));
-     return true;
- }
- 
- static MOZ_ALWAYS_INLINE bool
- SetObjectElementOperation(JSContext* cx, HandleObject obj, HandleId id, HandleValue value,
-                           HandleValue receiver, bool strict,
-                           JSScript* script = nullptr, jsbytecode* pc = nullptr)
- {

frg/work-js/mozilla-release/patches/mozilla-central-push_425746.patch

@@ -1,2254 +0,0 @@
-# HG changeset patch
-# User Cameron McCormack <cam@mcc.id.au>
-# Date 1530756298 -36000
-#      Thu Jul 05 12:04:58 2018 +1000
-# Node ID 6a6bef7a9177f97f6995139c1f0ebaa3a613dfbf
-# Parent  101f97abc1d417f8fe1dfcf67c78e4d2680f2502
-Bug 1473450 - Remove angle values from image-orientation. r=emilio
-
-MozReview-Commit-ID: FB74ILJM6Fm
-
-diff --git a/devtools/client/inspector/rules/test/browser_rules_cycle-angle.js b/devtools/client/inspector/rules/test/browser_rules_cycle-angle.js
---- a/devtools/client/inspector/rules/test/browser_rules_cycle-angle.js
-+++ b/devtools/client/inspector/rules/test/browser_rules_cycle-angle.js
-@@ -4,30 +4,29 @@
- 
- "use strict";
- 
- // Test cycling angle units in the rule view.
- 
- const TEST_URI = `
-   <style type="text/css">
-     body {
--      image-orientation: 1turn;
-+      filter: hue-rotate(1turn);
-     }
-     div {
--      image-orientation: 180deg;
-+      filter: hue-rotate(180deg);
-     }
-   </style>
-   <body><div>Test</div>cycling angle units in the rule view!</body>
- `;
- 
- add_task(async function() {
-   await addTab("data:text/html;charset=utf-8," + encodeURIComponent(TEST_URI));
-   const {inspector, view} = await openRuleView();
--  const container = getRuleViewProperty(
--    view, "body", "image-orientation").valueSpan;
-+  const container = getRuleViewProperty(view, "body", "filter").valueSpan;
-   await checkAngleCycling(container, view);
-   await checkAngleCyclingPersist(inspector, view);
- });
- 
- async function checkAngleCycling(container, view) {
-   const valueNode = container.querySelector(".ruleview-angle");
-   const win = view.styleWindow;
- 
-@@ -50,35 +49,34 @@ async function checkAngleCycling(contain
- 
-   for (const test of tests) {
-     await checkSwatchShiftClick(container, win, test.value, test.comment);
-   }
- }
- 
- async function checkAngleCyclingPersist(inspector, view) {
-   await selectNode("div", inspector);
--  let container = getRuleViewProperty(
--    view, "div", "image-orientation").valueSpan;
-+  let container = getRuleViewProperty(view, "div", "filter").valueSpan;
-   let valueNode = container.querySelector(".ruleview-angle");
-   const win = view.styleWindow;
- 
-   is(valueNode.textContent, "180deg", "Angle displayed as a degree value.");
- 
-   await checkSwatchShiftClick(container, win,
-     `${Math.round(Math.PI * 10000) / 10000}rad`,
-     "Angle displayed as a radian value.");
- 
-   // Select the body and reselect the div to see
-   // if the new angle unit persisted
-   await selectNode("body", inspector);
-   await selectNode("div", inspector);
- 
-   // We have to query for the container and the swatch because
-   // they've been re-generated
--  container = getRuleViewProperty(view, "div", "image-orientation").valueSpan;
-+  container = getRuleViewProperty(view, "div", "filter").valueSpan;
-   valueNode = container.querySelector(".ruleview-angle");
-   is(valueNode.textContent, `${Math.round(Math.PI * 10000) / 10000}rad`,
-     "Angle still displayed as a radian value.");
- }
- 
- async function checkSwatchShiftClick(container, win, expectedValue, comment) {
-   const swatch = container.querySelector(".ruleview-angleswatch");
-   const valueNode = container.querySelector(".ruleview-angle");
-diff --git a/devtools/shared/css/generated/properties-db.js b/devtools/shared/css/generated/properties-db.js
---- a/devtools/shared/css/generated/properties-db.js
-+++ b/devtools/shared/css/generated/properties-db.js
-@@ -6192,20 +6192,20 @@ exports.CSS_PROPERTIES = {
-   },
-   "image-orientation": {
-     "isInherited": true,
-     "subproperties": [
-       "image-orientation"
-     ],
-     "supports": [],
-     "values": [
--      "flip",
-       "from-image",
-       "inherit",
-       "initial",
-+      "none",
-       "unset"
-     ]
-   },
-   "image-rendering": {
-     "isInherited": true,
-     "subproperties": [
-       "image-rendering"
-     ],
-diff --git a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
---- a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
-+++ b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
-@@ -158,19 +158,16 @@ function treatAsSafeArgument(entry, varN
-         ["Gecko_SetCounterStyleToString", "aPtr", null],
-         ["Gecko_CopyCounterStyle", "aDst", null],
-         ["Gecko_SetMozBinding", "aDisplay", null],
-         [/ClassOrClassList/, /aClass/, null],
-         ["Gecko_GetAtomAsUTF16", "aLength", null],
-         ["Gecko_CopyMozBindingFrom", "aDest", null],
-         ["Gecko_SetNullImageValue", "aImage", null],
-         ["Gecko_SetGradientImageValue", "aImage", null],
--        ["Gecko_SetImageOrientation", "aVisibility", null],
--        ["Gecko_SetImageOrientationAsFromImage", "aVisibility", null],
--        ["Gecko_CopyImageOrientationFrom", "aDst", null],
-         ["Gecko_SetImageElement", "aImage", null],
-         ["Gecko_SetLayerImageImageValue", "aImage", null],
-         ["Gecko_CopyImageValueFrom", "aImage", null],
-         ["Gecko_SetCursorArrayLength", "aStyleUI", null],
-         ["Gecko_CopyCursorArrayFrom", "aDest", null],
-         ["Gecko_SetCursorImageValue", "aCursor", null],
-         ["Gecko_SetListStyleImageImageValue", "aList", null],
-         ["Gecko_SetListStyleImageNone", "aList", null],
-diff --git a/layout/base/nsLayoutUtils.cpp b/layout/base/nsLayoutUtils.cpp
---- a/layout/base/nsLayoutUtils.cpp
-+++ b/layout/base/nsLayoutUtils.cpp
-@@ -7166,28 +7166,23 @@ nsLayoutUtils::GetWholeImageDestination(
-   nscoord wholeSizeX = NSToCoordRound(aWholeImageSize.width*scaleX);
-   nscoord wholeSizeY = NSToCoordRound(aWholeImageSize.height*scaleY);
-   return nsRect(aDestArea.TopLeft() - nsPoint(destOffsetX, destOffsetY),
-                 nsSize(wholeSizeX, wholeSizeY));
- }
- 
- /* static */ already_AddRefed<imgIContainer>
- nsLayoutUtils::OrientImage(imgIContainer* aContainer,
--                           const nsStyleImageOrientation& aOrientation)
-+                           const StyleImageOrientation& aOrientation)
- {
-   MOZ_ASSERT(aContainer, "Should have an image container");
-   nsCOMPtr<imgIContainer> img(aContainer);
- 
--  if (aOrientation.IsFromImage()) {
-+  if (aOrientation == StyleImageOrientation::FromImage) {
-     img = ImageOps::Orient(img, img->GetOrientation());
--  } else if (!aOrientation.IsDefault()) {
--    Angle angle = aOrientation.Angle();
--    Flip flip  = aOrientation.IsFlipped() ? Flip::Horizontal
--                                          : Flip::Unflipped;
--    img = ImageOps::Orient(img, Orientation(angle, flip));
-   }
- 
-   return img.forget();
- }
- 
- static bool NonZeroStyleCoord(const nsStyleCoord& aCoord)
- {
-   if (aCoord.IsCoordPercentCalcUnit()) {
-diff --git a/layout/base/nsLayoutUtils.h b/layout/base/nsLayoutUtils.h
---- a/layout/base/nsLayoutUtils.h
-+++ b/layout/base/nsLayoutUtils.h
-@@ -56,30 +56,30 @@ class nsContainerFrame;
- class nsView;
- class nsIFrame;
- class nsStyleCoord;
- class nsStyleCorners;
- class nsPIDOMWindowOuter;
- class imgIRequest;
- class nsIDocument;
- struct nsStyleFont;
--struct nsStyleImageOrientation;
- struct nsOverflowAreas;
- 
- namespace mozilla {
- class ComputedStyle;
- enum class CSSPseudoElementType : uint8_t;
- class EventListenerManager;
- enum class LayoutFrameType : uint8_t;
- struct IntrinsicSize;
- struct ContainerLayerParameters;
- class WritingMode;
- class DisplayItemClip;
- class EffectSet;
- struct ActiveScrolledRoot;
-+enum class StyleImageOrientation : uint8_t;
- namespace dom {
- class CanvasRenderingContext2D;
- class DOMRectList;
- class Element;
- class Event;
- class HTMLImageElement;
- class HTMLCanvasElement;
- class HTMLVideoElement;
-@@ -1985,17 +1985,17 @@ public:
-    * that contains the same image, reoriented appropriately. May return the
-    * original image container if no changes are needed.
-    *
-    * @param aContainer   The image container to apply the orientation to.
-    * @param aOrientation The desired orientation.
-    */
-   static already_AddRefed<imgIContainer>
-   OrientImage(imgIContainer* aContainer,
--              const nsStyleImageOrientation& aOrientation);
-+              const mozilla::StyleImageOrientation& aOrientation);
- 
-   /**
-    * Determine if any corner radius is of nonzero size
-    *   @param aCorners the |nsStyleCorners| object to check
-    *   @return true unless all the coordinates are 0%, 0 or null.
-    *
-    * A corner radius with one dimension zero and one nonzero is
-    * treated as a nonzero-radius corner, even though it will end up
-diff --git a/layout/generic/nsImageFrame.cpp b/layout/generic/nsImageFrame.cpp
---- a/layout/generic/nsImageFrame.cpp
-+++ b/layout/generic/nsImageFrame.cpp
-@@ -257,17 +257,17 @@ nsImageFrame::DidSetComputedStyle(Comput
- {
-   nsAtomicContainerFrame::DidSetComputedStyle(aOldComputedStyle);
- 
-   if (!mImage) {
-     // We'll pick this change up whenever we do get an image.
-     return;
-   }
- 
--  nsStyleImageOrientation newOrientation = StyleVisibility()->mImageOrientation;
-+  auto newOrientation = StyleVisibility()->mImageOrientation;
- 
-   // We need to update our orientation either if we had no ComputedStyle before
-   // because this is the first time it's been set, or if the image-orientation
-   // property changed from its previous value.
-   bool shouldUpdateOrientation =
-     !aOldComputedStyle ||
-     aOldComputedStyle->StyleVisibility()->mImageOrientation != newOrientation;
- 
-diff --git a/layout/reftests/image/image-orientation-background.html b/layout/reftests/image/image-orientation-background.html
---- a/layout/reftests/image/image-orientation-background.html
-+++ b/layout/reftests/image/image-orientation-background.html
-@@ -20,29 +20,24 @@
-       background-repeat:   no-repeat;
-     }
-   </style>
- </head>
- <body>
-   <div></div>
- 
-   <script>
--    var orientation = location.search.substring(1).split("&");
--    var angle = orientation[0];
--    var flip = orientation[1] == "flip" ? true : false;
-+    var fromImage = location.search == "from-image";
- 
--    // Construct a style. "from-image" is special-cased.
-+    // Construct a style.
-     var style;
--    if (angle == "from-image") {
-+    if (fromImage) {
-       style = "div { image-orientation: from-image; }\n";
-     } else {
--      style = "div { image-orientation: "
--            + angle + "deg"
--            + (flip ? " flip" : "")
--            + "; }\n";
-+      style = "div { image-orientation: none; }\n";
-     }
- 
-     // Apply the style to the document.
-     var sheet = document.createElement('style');
-     sheet.innerHTML = style;
-     document.body.appendChild(sheet);
-   </script>
- </body>
-diff --git a/layout/reftests/image/image-orientation-border-image.html b/layout/reftests/image/image-orientation-border-image.html
---- a/layout/reftests/image/image-orientation-border-image.html
-+++ b/layout/reftests/image/image-orientation-border-image.html
-@@ -18,29 +18,24 @@
-       border-image: url(image-exif-90-deg-flip.jpg) 27 repeat;
-     }
-   </style>
- </head>
- <body>
-   <div></div>
- 
-   <script>
--    var orientation = location.search.substring(1).split("&");
--    var angle = orientation[0];
--    var flip = orientation[1] == "flip" ? true : false;
-+    var fromImage = location.search == "from-image";
- 
--    // Construct a style. "from-image" is special-cased.
-+    // Construct a style.
-     var style;
--    if (angle == "from-image") {
-+    if (fromImage) {
-       style = "div { image-orientation: from-image; }\n";
-     } else {
--      style = "div { image-orientation: "
--            + angle + "deg"
--            + (flip ? " flip" : "")
--            + "; }\n";
-+      style = "div { image-orientation: none; }\n";
-     }
- 
-     // Apply the style to the document.
-     var sheet = document.createElement('style');
-     sheet.innerHTML = style;
-     document.body.appendChild(sheet);
-   </script>
- </body>
-diff --git a/layout/reftests/image/image-orientation-dynamic-ref.html b/layout/reftests/image/image-orientation-dynamic-ref.html
---- a/layout/reftests/image/image-orientation-dynamic-ref.html
-+++ b/layout/reftests/image/image-orientation-dynamic-ref.html
-@@ -1,2 +1,33 @@
--<!DOCTYPE html>
--<img src="big.png" style="image-orientation: 90deg">
-+<!DOCTYPE>
-+<head>
-+  <style>
-+    body {
-+      border:  0px;
-+      margin:  0px;
-+      padding: 0px;
-+    }
-+    table {
-+      border-spacing: 0px;
-+    }
-+    div {
-+      width: 100px; height: 200px;
-+    }
-+    td {
-+      width: 50px; height: 100px;
-+    }
-+  </style>
-+</head>
-+<body>
-+  <div>
-+    <table>
-+      <tr>
-+        <td style="background-color: rgb(254, 0, 122);"></td>
-+        <td style="background-color: rgb(191, 0, 93);"></td>
-+      </tr>
-+      <tr>
-+        <td style="background-color: rgb(0, 255, 1);"></td>
-+        <td style="background-color: rgb(0, 191, 0);"></td>
-+      </tr>
-+    </table>
-+  </div>
-+</body>
-diff --git a/layout/reftests/image/image-orientation-dynamic.html b/layout/reftests/image/image-orientation-dynamic.html
---- a/layout/reftests/image/image-orientation-dynamic.html
-+++ b/layout/reftests/image/image-orientation-dynamic.html
-@@ -1,10 +1,17 @@
- <!DOCTYPE html>
- <html class="reftest-wait">
--  <img src="big.png">
-+  <style>
-+    body {
-+      border:  0px;
-+      margin:  0px;
-+      padding: 0px;
-+    }
-+  </style>
-+  <img src="image-exif-180-deg.jpg">
-   <script>
-     document.addEventListener("MozReftestInvalidate", function() {
--      document.querySelector("img").style.imageOrientation = "90deg";
-+      document.querySelector("img").style.imageOrientation = "from-image";
-       document.documentElement.className = "";
-     });
-   </script>
- </html>
-diff --git a/layout/reftests/image/image-orientation-explicit-none.html b/layout/reftests/image/image-orientation-explicit-none.html
-new file mode 100644
---- /dev/null
-+++ b/layout/reftests/image/image-orientation-explicit-none.html
-@@ -0,0 +1,21 @@
-+<!DOCTYPE>
-+<head>
-+  <style>
-+    body {
-+      border:  0px;
-+      margin:  0px;
-+      padding: 0px;
-+    }
-+    img {
-+      border:  50px solid black;
-+      margin:  50px;
-+      padding: 50px;
-+      image-orientation: none;
-+    }
-+  </style>
-+</head>
-+<body>
-+  <!-- This is deliberately an image with a non-neutral inherent orientation to
-+       ensure that the inherent orientation is irrelevant. -->
-+  <img src="image-exif-90-deg-flip.jpg">
-+</body>
-diff --git a/layout/reftests/image/image-orientation-explicit.html b/layout/reftests/image/image-orientation-explicit.html
-deleted file mode 100644
---- a/layout/reftests/image/image-orientation-explicit.html
-+++ /dev/null
-@@ -1,37 +0,0 @@
--<!DOCTYPE>
--<head>
--  <style>
--    body {
--      border:  0px;
--      margin:  0px;
--      padding: 0px;
--    }
--    img {
--      border:  50px solid black;
--      margin:  50px;
--      padding: 50px;
--    }
--  </style>
--</head>
--<body>
--  <!-- This is deliberately an image with a non-neutral inherent orientation to
--       ensure that the inherent orientation is irrelevant. -->
--  <img src="image-exif-90-deg-flip.jpg">
--
--  <script>
--    var orientationInfo = location.search.substring(1).split("&");
--    var angle = orientationInfo[0];
--    var flip = orientationInfo[1] == "flip" ? true : false;
--
--    // Construct a style.
--    var style = "img { image-orientation: "
--              + angle + "deg"
--              + (flip ? " flip" : "")
--              + "; }\n";
--
--    // Apply the style to the document.
--    var sheet = document.createElement('style');
--    sheet.innerHTML = style;
--    document.body.appendChild(sheet);
--  </script>
--</body>
-diff --git a/layout/reftests/image/image-orientation-generated-content-ref.html b/layout/reftests/image/image-orientation-generated-content-ref.html
---- a/layout/reftests/image/image-orientation-generated-content-ref.html
-+++ b/layout/reftests/image/image-orientation-generated-content-ref.html
-@@ -4,72 +4,30 @@
-     body {
-       border:  0px;
-       margin:  0px;
-       padding: 0px;
-     }
-     table {
-       border-spacing: 0px;
-     }
-+    div {
-+      width: 200px; height: 100px;
-+    }
-+    td {
-+      width: 100px; height: 50px;
-+    }
-   </style>
- </head>
- <body>
-   <div>
-     <table>
-       <tr>
--        <td id="ul"></td>
--        <td id="ur"></td>
-+        <td style="background-color: rgb(254, 0, 122);"></td>
-+        <td style="background-color: rgb(0, 255, 1);"></td>
-       </tr>
-       <tr>
--        <td id="ll"></td>
--        <td id="lr"></td>
-+        <td style="background-color: rgb(191, 0, 93);"></td>
-+        <td style="background-color: rgb(0, 191, 0);"></td>
-       </tr>
-     </table>
-   </div>
--
--  <script>
--    var orientationInfo = location.search.substring(1).split("&");
--    var angle = parseInt(orientationInfo[0]);
--    var flip = orientationInfo[1] == "flip" ? true : false;
--
--    // Each id corresponds to a color.
--    var ids = ["ul", "ur", "lr", "ll"];
--    var colors = [
--      "rgb(0, 191, 0)",
--      "rgb(0, 255, 1)",
--      "rgb(254, 0, 122)",
--      "rgb(191, 0, 93)",
--    ];
--
--    // 'Rotate' the colors according to the angle.
--    colors.unshift.apply(colors, colors.splice((360 - angle) / 90, colors.length));
--
--    // 'Flip' the colors if requested.
--    if (flip) {
--        var tmp = colors[0];
--        colors[0] = colors[1];
--        colors[1] = tmp;
--        tmp = colors[2];
--        colors[2] = colors[3];
--        colors[3] = tmp;
--    }
--
--    // Construct a style.
--    var style = "";
--
--    if (angle == 90 || angle == 270) {
--      style += "div { width: 200px; height: 100px; }\n";
--      style += "td { width: 100px; height: 50px; }\n";
--    } else {
--      style += "div { width: 100px; height: 200px; }\n";
--      style += "td { width: 50px; height: 100px; }\n";
--    }
--
--    for (var i = 0 ; i < 4 ; ++i) {
--      style += "#" + ids[i] + " { background-color: " + colors[i] + "; }\n";
--    }
--
--    // Apply the style to the document.
--    var sheet = document.createElement('style');
--    sheet.innerHTML = style;
--    document.body.appendChild(sheet);
--  </script>
- </body>
-diff --git a/layout/reftests/image/image-orientation-generated-content.html b/layout/reftests/image/image-orientation-generated-content.html
---- a/layout/reftests/image/image-orientation-generated-content.html
-+++ b/layout/reftests/image/image-orientation-generated-content.html
-@@ -1,38 +1,19 @@
- <!DOCTYPE>
- <head>
-   <style>
-     body {
-       border:  0px;
-       margin:  0px;
-       padding: 0px;
-     }
-+    p {
-+      image-orientation: from-image;
-+    }
-     p:before {
-       content: url(image-exif-270-deg-flip.jpg);
-     }
-   </style>
- </head>
- <body>
-   <p></p>
--
--  <script>
--    var orientationInfo = location.search.substring(1).split("&");
--    var angle = orientationInfo[0];
--    var flip = orientationInfo[1] == "flip" ? true : false;
--
--    // Construct a style. "from-image" is special-cased.
--    var style;
--    if (angle == "from-image") {
--      style = "p { image-orientation: from-image; }\n";
--    } else {
--      style = "p { image-orientation: "
--            + angle + "deg"
--            + (flip ? " flip" : "")
--            + "; }\n";
--    }
--
--    // Apply the style to the document.
--    var sheet = document.createElement('style');
--    sheet.innerHTML = style;
--    document.body.appendChild(sheet);
--  </script>
- </body>
-diff --git a/layout/reftests/image/image-orientation-none.html b/layout/reftests/image/image-orientation-none.html
-new file mode 100644
---- /dev/null
-+++ b/layout/reftests/image/image-orientation-none.html
-@@ -0,0 +1,20 @@
-+<!DOCTYPE>
-+<head>
-+  <style>
-+    body {
-+      border:  0px;
-+      margin:  0px;
-+      padding: 0px;
-+    }
-+    img {
-+      border:  50px solid black;
-+      margin:  50px;
-+      padding: 50px;
-+    }
-+  </style>
-+</head>
-+<body>
-+  <!-- This is deliberately an image with a non-neutral inherent orientation to
-+       ensure that the inherent orientation is irrelevant. -->
-+  <img src="image-exif-90-deg-flip.jpg" style="image-orientation: none;">
-+</body>
-diff --git a/layout/reftests/image/image-srcset-orientation-1x-ref.html b/layout/reftests/image/image-srcset-orientation-1x-ref.html
-deleted file mode 100644
---- a/layout/reftests/image/image-srcset-orientation-1x-ref.html
-+++ /dev/null
-@@ -1,11 +0,0 @@
--
--<!DOCTYPE html>
--<html reftest-zoom="1">
--<head>
--    <style>img { image-orientation: 90deg flip; }</style>
--</head>
--<body>
--  <img src="100.png" width="100">
--  <p>Make sure orientation is respected when using both srcset and fallback-src selections</p>
--</body>
--</html>
-diff --git a/layout/reftests/image/image-srcset-orientation-1x.html b/layout/reftests/image/image-srcset-orientation-1x.html
-deleted file mode 100644
---- a/layout/reftests/image/image-srcset-orientation-1x.html
-+++ /dev/null
-@@ -1,26 +0,0 @@
--
--<!DOCTYPE html>
--<html reftest-zoom="1" class="reftest-wait">
--<head>
--    <style>img { image-orientation: 90deg flip; }</style>
--    <script type="application/javascript">
--    // reftest-zoom is only applied at onload, so ensure the source-selection
--    // has happened after that
--    function clearWait() {
--      document.documentElement.classList.remove("reftest-wait");
--    }
--    window.addEventListener("load", function() {
--      setTimeout(function() {
--        var img = document.querySelector("img");
--        img.onload = clearWait;
--        img.onerror = clearWait;
--        img.src = img.src;
--      }, 0);
--    });
--  </script>
--</head>
--<body>
--  <img srcset="200.png 2x" src="100.png">
--  <p>Make sure orientation is respected when using both srcset and fallback-src selections</p>
--</body>
--</html>
-diff --git a/layout/reftests/image/image-srcset-orientation-2x-ref.html b/layout/reftests/image/image-srcset-orientation-2x-ref.html
-deleted file mode 100644
---- a/layout/reftests/image/image-srcset-orientation-2x-ref.html
-+++ /dev/null
-@@ -1,11 +0,0 @@
--
--<!DOCTYPE html>
--<html reftest-zoom="2">
--<head>
--    <style>img { image-orientation: 90deg flip; }</style>
--</head>
--<body>
--  <img src="200.png" width="100">
--  <p>Make sure orientation is respected when using both srcset and fallback-src selections</p>
--</body>
--</html>
-diff --git a/layout/reftests/image/image-srcset-orientation-2x.html b/layout/reftests/image/image-srcset-orientation-2x.html
-deleted file mode 100644
---- a/layout/reftests/image/image-srcset-orientation-2x.html
-+++ /dev/null
-@@ -1,26 +0,0 @@
--
--<!DOCTYPE html>
--<html reftest-zoom="2" class="reftest-wait">
--<head>
--    <style>img { image-orientation: 90deg flip; }</style>
--    <script type="application/javascript">
--    // reftest-zoom is only applied at onload, so ensure the source-selection
--    // has happened after that
--    function clearWait() {
--      document.documentElement.classList.remove("reftest-wait");
--    }
--    window.addEventListener("load", function() {
--      setTimeout(function() {
--        var img = document.querySelector("img");
--        img.onload = clearWait;
--        img.onerror = clearWait;
--        img.src = img.src;
--      }, 0);
--    });
--  </script>
--</head>
--<body>
--  <img srcset="200.png 2x" src="100.png">
--  <p>Make sure orientation is respected when using both srcset and fallback-src selections</p>
--</body>
--</html>
-diff --git a/layout/reftests/image/reftest.list b/layout/reftests/image/reftest.list
---- a/layout/reftests/image/reftest.list
-+++ b/layout/reftests/image/reftest.list
-@@ -27,86 +27,28 @@ fuzzy(1,1) == image-orientation-from-ima
- fuzzy(1,1) == image-orientation-from-image.html?90       image-orientation-ref.html?90
- fuzzy(1,1) == image-orientation-from-image.html?180      image-orientation-ref.html?180
- fuzzy(1,1) == image-orientation-from-image.html?270      image-orientation-ref.html?270
- fuzzy(1,1) == image-orientation-from-image.html?0&flip   image-orientation-ref.html?0&flip
- fuzzy(1,1) == image-orientation-from-image.html?90&flip  image-orientation-ref.html?90&flip
- fuzzy(1,1) == image-orientation-from-image.html?180&flip image-orientation-ref.html?180&flip
- fuzzy(1,1) == image-orientation-from-image.html?270&flip image-orientation-ref.html?270&flip
- 
--# Tests for image-orientation used with an explicit orientation:
--fuzzy(1,1) == image-orientation-explicit.html?-900     image-orientation-ref.html?180
--fuzzy(1,1) == image-orientation-explicit.html?0        image-orientation-ref.html?0
--fuzzy(1,1) == image-orientation-explicit.html?90       image-orientation-ref.html?90
--fuzzy(1,1) == image-orientation-explicit.html?180      image-orientation-ref.html?180
--fuzzy(1,1) == image-orientation-explicit.html?270      image-orientation-ref.html?270
--fuzzy(1,1) == image-orientation-explicit.html?0&flip   image-orientation-ref.html?0&flip
--fuzzy(1,1) == image-orientation-explicit.html?90&flip  image-orientation-ref.html?90&flip
--fuzzy(1,1) == image-orientation-explicit.html?180&flip image-orientation-ref.html?180&flip
--fuzzy(1,1) == image-orientation-explicit.html?270&flip image-orientation-ref.html?270&flip
-+# Tests for image-orientation used with an explicit 'none' orientation:
-+fuzzy(1,1) == image-orientation-explicit-none.html image-orientation-ref.html?0
- 
--# Tests for image-orientation used with non-axis-aligned angles:
--fuzzy(1,1) == image-orientation-explicit.html?-46      image-orientation-ref.html?270
--fuzzy(1,1) == image-orientation-explicit.html?-45      image-orientation-ref.html?0
--fuzzy(1,1) == image-orientation-explicit.html?-15      image-orientation-ref.html?0
--fuzzy(1,1) == image-orientation-explicit.html?15       image-orientation-ref.html?0
--fuzzy(1,1) == image-orientation-explicit.html?45       image-orientation-ref.html?90
--fuzzy(1,1) == image-orientation-explicit.html?75       image-orientation-ref.html?90
--fuzzy(1,1) == image-orientation-explicit.html?105      image-orientation-ref.html?90
--fuzzy(1,1) == image-orientation-explicit.html?135      image-orientation-ref.html?180
--fuzzy(1,1) == image-orientation-explicit.html?165      image-orientation-ref.html?180
--fuzzy(1,1) == image-orientation-explicit.html?195      image-orientation-ref.html?180
--fuzzy(1,1) == image-orientation-explicit.html?225      image-orientation-ref.html?270
--fuzzy(1,1) == image-orientation-explicit.html?255      image-orientation-ref.html?270
--fuzzy(1,1) == image-orientation-explicit.html?285      image-orientation-ref.html?270
--fuzzy(1,1) == image-orientation-explicit.html?315      image-orientation-ref.html?0
--fuzzy(1,1) == image-orientation-explicit.html?345      image-orientation-ref.html?0
--
--# Tests for image-orientation used on generated content:
--fuzzy(1,1) == image-orientation-generated-content.html?from-image image-orientation-generated-content-ref.html?270&flip
--fuzzy(1,1) == image-orientation-generated-content.html?0          image-orientation-generated-content-ref.html?0
--fuzzy(1,1) == image-orientation-generated-content.html?90         image-orientation-generated-content-ref.html?90
--fuzzy(1,1) == image-orientation-generated-content.html?180        image-orientation-generated-content-ref.html?180
--fuzzy(1,1) == image-orientation-generated-content.html?270        image-orientation-generated-content-ref.html?270
--fuzzy(1,1) == image-orientation-generated-content.html?0&flip     image-orientation-generated-content-ref.html?0&flip
--fuzzy(1,1) == image-orientation-generated-content.html?90&flip    image-orientation-generated-content-ref.html?90&flip
--fuzzy(1,1) == image-orientation-generated-content.html?180&flip   image-orientation-generated-content-ref.html?180&flip
--fuzzy(1,1) == image-orientation-generated-content.html?270&flip   image-orientation-generated-content-ref.html?270&flip
-+# Tests for image-orientation:from-image used on generated content:
-+fuzzy(1,1) == image-orientation-generated-content.html image-orientation-generated-content-ref.html
- 
- # Tests that image-orientation does not apply to decorative images:
--fuzzy(1,1) == image-orientation-background.html?from-image   image-orientation-ref.html?0
--fuzzy(1,1) == image-orientation-background.html?90&flip      image-orientation-ref.html?0
--== image-orientation-border-image.html?from-image            image-orientation-border-image.html?0
--== image-orientation-border-image.html?90&flip               image-orientation-border-image.html?0
--== image-orientation-list-style-image.html?from-image        image-orientation-list-style-image.html?0
--== image-orientation-list-style-image.html?90&flip           image-orientation-list-style-image.html?0
-+fuzzy(1,1) == image-orientation-background.html?from-image   image-orientation-ref.html?none
-+== image-orientation-border-image.html?from-image            image-orientation-border-image.html?none
-+== image-orientation-list-style-image.html?from-image        image-orientation-list-style-image.html?none
- 
--# Sanity checks for the image-orientation tests. Ensures that the various
--# combinations of rotations and flips actually look different from each other.
--!= image-orientation-ref.html?0    image-orientation-ref.html?90
--!= image-orientation-ref.html?0    image-orientation-ref.html?180
--!= image-orientation-ref.html?0    image-orientation-ref.html?270
--!= image-orientation-ref.html?90   image-orientation-ref.html?180
--!= image-orientation-ref.html?90   image-orientation-ref.html?270
--!= image-orientation-ref.html?180  image-orientation-ref.html?270
--!= image-orientation-ref.html?0    image-orientation-ref.html?0&flip
--!= image-orientation-ref.html?90   image-orientation-ref.html?90&flip
--!= image-orientation-ref.html?180  image-orientation-ref.html?180&flip
--!= image-orientation-ref.html?270  image-orientation-ref.html?270&flip
--!= image-orientation-generated-content-ref.html?0    image-orientation-generated-content-ref.html?90
--!= image-orientation-generated-content-ref.html?0    image-orientation-generated-content-ref.html?180
--!= image-orientation-generated-content-ref.html?0    image-orientation-generated-content-ref.html?270
--!= image-orientation-generated-content-ref.html?90   image-orientation-generated-content-ref.html?180
--!= image-orientation-generated-content-ref.html?90   image-orientation-generated-content-ref.html?270
--!= image-orientation-generated-content-ref.html?180  image-orientation-generated-content-ref.html?270
--!= image-orientation-generated-content-ref.html?0    image-orientation-generated-content-ref.html?0&flip
--!= image-orientation-generated-content-ref.html?90   image-orientation-generated-content-ref.html?90&flip
--!= image-orientation-generated-content-ref.html?180  image-orientation-generated-content-ref.html?180&flip
--!= image-orientation-generated-content-ref.html?270  image-orientation-generated-content-ref.html?270&flip
--== image-orientation-dynamic.html image-orientation-dynamic-ref.html
-+fuzzy(1,1) == image-orientation-dynamic.html image-orientation-dynamic-ref.html
- 
- # <img srcset> tests
- == image-srcset-basic-selection-0.1x.html image-srcset-basic-selection-0.1x-ref.html
- == image-srcset-basic-selection-2x.html image-srcset-basic-selection-2x-ref.html
- == image-srcset-basic-selection-0.5x.html image-srcset-basic-selection-0.5x-ref.html
- == image-srcset-basic-selection-0.6x.html image-srcset-basic-selection-0.6x-ref.html
- random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == image-srcset-basic-selection-1.5x.html image-srcset-basic-selection-1.5x-ref.html # Bug 1392106
- == image-srcset-basic-selection-1x.html image-srcset-basic-selection-1x-ref.html
-@@ -114,18 +56,16 @@ random-if(/^Windows\x20NT\x206\.1/.test(
- == image-srcset-basic-selection-width-10x.html image-srcset-basic-selection-width-10x-ref.html
- == image-srcset-basic-selection-width-2x.html image-srcset-basic-selection-width-2x-ref.html
- == image-srcset-basic-selection-width-1x.html image-srcset-basic-selection-width-1x-ref.html
- == image-srcset-default-2x.html image-srcset-default-2x-ref.html
- == image-srcset-default-1x.html image-srcset-default-1x-ref.html
- == image-srcset-default-src-2x.html image-srcset-default-src-2x-ref.html
- == image-srcset-default-src-1x.html image-srcset-default-src-1x-ref.html
- == image-srcset-isize.html image-srcset-isize-ref.html
--== image-srcset-orientation-2x.html image-srcset-orientation-2x-ref.html
--== image-srcset-orientation-1x.html image-srcset-orientation-1x-ref.html
- == image-srcset-svg-3x.html image-srcset-svg-3x-ref.html
- == image-srcset-svg-2x.html image-srcset-svg-2x-ref.html
- == image-srcset-svg-1x.html image-srcset-svg-1x-ref.html
- == image-srcset-svg-default-2x.html image-srcset-svg-default-2x-ref.html
- == image-srcset-svg-default-1x.html image-srcset-svg-default-1x-ref.html
- 
- == image-resize-percent-height.html image-resize-ref.html
- == image-resize-percent-width.html image-resize-ref.html
-diff --git a/layout/reftests/svg/as-image/image-orientation-no-viewbox-and-size.html b/layout/reftests/svg/as-image/image-orientation-no-viewbox-and-size.html
-deleted file mode 100644
---- a/layout/reftests/svg/as-image/image-orientation-no-viewbox-and-size.html
-+++ /dev/null
-@@ -1,35 +0,0 @@
--<!DOCTYPE>
--<head>
--  <style>
--    body {
--      border:  0px;
--      margin:  0px;
--      padding: 0px;
--    }
--  </style>
--</head>
--<body>
--  <img src="image-orientation-no-viewbox-and-size.svg">
--
--  <script>
--    var orientationInfo = location.search.substring(1).split("&");
--    var angle = orientationInfo[0];
--    var flip = orientationInfo[1] == "flip" ? true : false;
--
--    // Construct a style. "from-image" is special-cased.
--    var style;
--    if (angle == "from-image") {
--      style = "img { image-orientation: from-image; }\n";
--    } else {
--      style = "img { image-orientation: "
--            + angle + "deg"
--            + (flip ? " flip" : "")
--            + "; }\n";
--    }
--
--    // Apply the style to the document.
--    var sheet = document.createElement('style');
--    sheet.innerHTML = style;
--    document.body.appendChild(sheet);
--  </script>
--</body>
-diff --git a/layout/reftests/svg/as-image/image-orientation-no-viewbox-and-size.svg b/layout/reftests/svg/as-image/image-orientation-no-viewbox-and-size.svg
-deleted file mode 100644
---- a/layout/reftests/svg/as-image/image-orientation-no-viewbox-and-size.svg
-+++ /dev/null
-@@ -1,7 +0,0 @@
--<svg xmlns="http://www.w3.org/2000/svg" version="1.1"
--     width="100" height="200">
--  <rect x="0"  y="0"   width="50" height="100" fill="rgb(0, 191, 0)"/>
--  <rect x="50" y="0"   width="50" height="100" fill="rgb(0, 255, 1)"/>
--  <rect x="50" y="100" width="50" height="100" fill="rgb(254, 0, 122)"/>
--  <rect x="0"  y="100" width="50" height="100" fill="rgb(191, 0, 93)"/>
--</svg>
-diff --git a/layout/reftests/svg/as-image/image-orientation-no-viewbox-no-size.html b/layout/reftests/svg/as-image/image-orientation-no-viewbox-no-size.html
-deleted file mode 100644
---- a/layout/reftests/svg/as-image/image-orientation-no-viewbox-no-size.html
-+++ /dev/null
-@@ -1,54 +0,0 @@
--<!DOCTYPE>
--<head>
--  <style>
--    body {
--      border:  0px;
--      margin:  0px;
--      padding: 0px;
--    }
--    img {
--      width:  100px;
--      height: 200px;
--    }
--  </style>
--</head>
--<body>
--  <img src="image-orientation-no-viewbox-no-size.svg">
--
--  <script>
--    var orientationInfo = location.search.substring(1).split("&");
--    var angle = orientationInfo[0];
--    var flip = orientationInfo[1] == "flip" ? true : false;
--
--    // Construct a style. "from-image" is special-cased.
--    var orientationStyle;
--    if (angle == "from-image") {
--      orientationStyle = "image-orientation: from-image;";
--    } else {
--      orientationStyle = "image-orientation: "
--                       + angle + "deg"
--                       + (flip ? " flip" : "")
--                       + ";";
--    }
--
--    // Since the SVG image has no intrinsic size, we need to apply an
--    // appropriate size to the <img> element to match the reference.
--    var boxStyle;
--    if (angle == "90" || angle == "270") {
--      boxStyle = "width: 200px; height: 100px;";
--    } else {
--      boxStyle = "width: 100px; height: 200px;";
--    }
--
--    var style = "img { "
--              + orientationStyle
--              + " "
--              + boxStyle
--              + " }\n";
--
--    // Apply the style to the document.
--    var sheet = document.createElement('style');
--    sheet.innerHTML = style;
--    document.body.appendChild(sheet);
--  </script>
--</body>
-diff --git a/layout/reftests/svg/as-image/image-orientation-no-viewbox-no-size.svg b/layout/reftests/svg/as-image/image-orientation-no-viewbox-no-size.svg
-deleted file mode 100644
---- a/layout/reftests/svg/as-image/image-orientation-no-viewbox-no-size.svg
-+++ /dev/null
-@@ -1,6 +0,0 @@
--<svg xmlns="http://www.w3.org/2000/svg" version="1.1">
--  <rect x="0"  y="0"   width="50" height="100" fill="rgb(0, 191, 0)"/>
--  <rect x="50" y="0"   width="50" height="100" fill="rgb(0, 255, 1)"/>
--  <rect x="50" y="100" width="50" height="100" fill="rgb(254, 0, 122)"/>
--  <rect x="0"  y="100" width="50" height="100" fill="rgb(191, 0, 93)"/>
--</svg>
-diff --git a/layout/reftests/svg/as-image/image-orientation-ref.html b/layout/reftests/svg/as-image/image-orientation-ref.html
---- a/layout/reftests/svg/as-image/image-orientation-ref.html
-+++ b/layout/reftests/svg/as-image/image-orientation-ref.html
-@@ -4,72 +4,30 @@
-     body {
-       border:  0px;
-       margin:  0px;
-       padding: 0px;
-     }
-     table {
-       border-spacing: 0px;
-     }
-+    div {
-+      width: 100px; height: 200px;
-+    }
-+    td {
-+      width: 50px; height: 100px;
-+    }
-   </style>
- </head>
- <body>
-   <div>
-     <table>
-       <tr>
--        <td id="ul"></td>
--        <td id="ur"></td>
-+        <td style="background-color: rgb(0, 191, 0)"></td>
-+        <td style="background-color: rgb(0, 255, 1)"></td>
-       </tr>
-       <tr>
--        <td id="ll"></td>
--        <td id="lr"></td>
-+        <td style="background-color: rgb(254, 0, 122)"></td>
-+        <td style="background-color: rgb(254, 0, 122)"></td>
-       </tr>
-     </table>
-   </div>
--
--  <script>
--    var orientationInfo = location.search.substring(1).split("&");
--    var angle = parseInt(orientationInfo[0]);
--    var flip = orientationInfo[1] == "flip" ? true : false;
--
--    // Each id corresponds to a color.
--    var ids = ["ul", "ur", "lr", "ll"];
--    var colors = [
--      "rgb(0, 191, 0)",
--      "rgb(0, 255, 1)",
--      "rgb(254, 0, 122)",
--      "rgb(191, 0, 93)",
--    ];
--
--    // 'Rotate' the colors according to the angle.
--    colors.unshift.apply(colors, colors.splice((360 - angle) / 90, colors.length));
--
--    // 'Flip' the colors if requested.
--    if (flip) {
--        var tmp = colors[0];
--        colors[0] = colors[1];
--        colors[1] = tmp;
--        tmp = colors[2];
--        colors[2] = colors[3];
--        colors[3] = tmp;
--    }
--
--    // Construct a style.
--    var style = "";
--
--    if (angle == 90 || angle == 270) {
--      style += "div { width: 200px; height: 100px; }\n";
--      style += "td { width: 100px; height: 50px; }\n";
--    } else {
--      style += "div { width: 100px; height: 200px; }\n";
--      style += "td { width: 50px; height: 100px; }\n";
--    }
--
--    for (var i = 0 ; i < 4 ; ++i) {
--      style += "#" + ids[i] + " { background-color: " + colors[i] + "; }\n";
--    }
--
--    // Apply the style to the document.
--    var sheet = document.createElement('style');
--    sheet.innerHTML = style;
--    document.body.appendChild(sheet);
--  </script>
- </body>
-diff --git a/layout/reftests/svg/as-image/image-orientation-viewbox-and-size.html b/layout/reftests/svg/as-image/image-orientation-viewbox-and-size.html
---- a/layout/reftests/svg/as-image/image-orientation-viewbox-and-size.html
-+++ b/layout/reftests/svg/as-image/image-orientation-viewbox-and-size.html
-@@ -5,31 +5,15 @@
-       border:  0px;
-       margin:  0px;
-       padding: 0px;
-     }
-   </style>
- </head>
- <body>
-   <img src="image-orientation-viewbox-and-size.svg">
--
-   <script>
--    var orientationInfo = location.search.substring(1).split("&");
--    var angle = orientationInfo[0];
--    var flip = orientationInfo[1] == "flip" ? true : false;
--
--    // Construct a style. "from-image" is special-cased.
--    var style;
--    if (angle == "from-image") {
--      style = "img { image-orientation: from-image; }\n";
--    } else {
--      style = "img { image-orientation: "
--            + angle + "deg"
--            + (flip ? " flip" : "")
--            + "; }\n";
-+    let fromImage = location.search == "from-image";
-+    if (fromImage) {
-+      document.querySelector("img").style.imageOrientation = "from-image";
-     }
--
--    // Apply the style to the document.
--    var sheet = document.createElement('style');
--    sheet.innerHTML = style;
--    document.body.appendChild(sheet);
-   </script>
- </body>
-diff --git a/layout/reftests/svg/as-image/image-orientation-viewbox-no-size.html b/layout/reftests/svg/as-image/image-orientation-viewbox-no-size.html
---- a/layout/reftests/svg/as-image/image-orientation-viewbox-no-size.html
-+++ b/layout/reftests/svg/as-image/image-orientation-viewbox-no-size.html
-@@ -1,50 +1,22 @@
- <!DOCTYPE>
- <head>
-   <style>
-     body {
-       border:  0px;
-       margin:  0px;
-       padding: 0px;
-     }
-+    img {
-+      image-orientation: from-image;
-+    }
-   </style>
- </head>
- <body>
-   <img src="image-orientation-viewbox-no-size.svg">
--
-   <script>
--    var orientationInfo = location.search.substring(1).split("&");
--    var angle = orientationInfo[0];
--    var flip = orientationInfo[1] == "flip" ? true : false;
--
--    // Construct a style. "from-image" is special-cased.
--    var orientationStyle;
--    if (angle == "from-image") {
--      orientationStyle = "image-orientation: from-image;";
--    } else {
--      orientationStyle = "image-orientation: "
--                       + angle + "deg"
--                       + (flip ? " flip" : "")
--                       + ";";
-+    let fromImage = location.search == "from-image";
-+    if (fromImage) {
-+      document.querySelector("img").style.imageOrientation = "from-image";
-     }
--
--    // Since the SVG image has no intrinsic size, we need to apply an
--    // appropriate size to the <img> element to match the reference.
--    var boxStyle;
--    if (angle == "90" || angle == "270") {
--      boxStyle = "width: 200px; height: 100px;";
--    } else {
--      boxStyle = "width: 100px; height: 200px;";
--    }
--
--    var style = "img { "
--              + orientationStyle
--              + " "
--              + boxStyle
--              + " }\n";
--
--    // Apply the style to the document.
--    var sheet = document.createElement('style');
--    sheet.innerHTML = style;
--    document.body.appendChild(sheet);
-   </script>
- </body>
-diff --git a/layout/reftests/svg/as-image/reftest.list b/layout/reftests/svg/as-image/reftest.list
---- a/layout/reftests/svg/as-image/reftest.list
-+++ b/layout/reftests/svg/as-image/reftest.list
-@@ -193,72 +193,19 @@ HTTP == svg-stylesheet-external-1.html b
- == svg-image-synthetic-viewBox-01.svg svg-image-synthetic-viewBox-01-ref.svg
- 
- # Test for painting problems with SVGs used in border images.
- # XXXseth: The underlying problems also apply to media fragments,
- # but the test case would be much simpler. This should be switched
- # over to use media fragments once bug 790640 lands.
- fuzzy(2,1) == svg-border-image-repaint-1.html svg-border-image-repaint-1-ref.html
- 
--# Tests for image-orientation with a viewbox and an intrinsic size:
--== image-orientation-viewbox-and-size.html?0        image-orientation-ref.html?0
--== image-orientation-viewbox-and-size.html?90       image-orientation-ref.html?90
--== image-orientation-viewbox-and-size.html?180      image-orientation-ref.html?180
--== image-orientation-viewbox-and-size.html?270      image-orientation-ref.html?270
--== image-orientation-viewbox-and-size.html?0&flip   image-orientation-ref.html?0&flip
--== image-orientation-viewbox-and-size.html?90&flip  image-orientation-ref.html?90&flip
--== image-orientation-viewbox-and-size.html?180&flip image-orientation-ref.html?180&flip
--== image-orientation-viewbox-and-size.html?270&flip image-orientation-ref.html?270&flip
--
--# Tests for image-orientation with a viewbox and no intrinsic size:
--== image-orientation-viewbox-no-size.html?0        image-orientation-ref.html?0
--== image-orientation-viewbox-no-size.html?90       image-orientation-ref.html?90
--== image-orientation-viewbox-no-size.html?180      image-orientation-ref.html?180
--== image-orientation-viewbox-no-size.html?270      image-orientation-ref.html?270
--== image-orientation-viewbox-no-size.html?0&flip   image-orientation-ref.html?0&flip
--== image-orientation-viewbox-no-size.html?90&flip  image-orientation-ref.html?90&flip
--== image-orientation-viewbox-no-size.html?180&flip image-orientation-ref.html?180&flip
--== image-orientation-viewbox-no-size.html?270&flip image-orientation-ref.html?270&flip
--
--# Tests for image-orientation with no viewbox and an intrinsic size:
--== image-orientation-no-viewbox-and-size.html?0        image-orientation-ref.html?0
--== image-orientation-no-viewbox-and-size.html?90       image-orientation-ref.html?90
--== image-orientation-no-viewbox-and-size.html?180      image-orientation-ref.html?180
--== image-orientation-no-viewbox-and-size.html?270      image-orientation-ref.html?270
--== image-orientation-no-viewbox-and-size.html?0&flip   image-orientation-ref.html?0&flip
--== image-orientation-no-viewbox-and-size.html?90&flip  image-orientation-ref.html?90&flip
--== image-orientation-no-viewbox-and-size.html?180&flip image-orientation-ref.html?180&flip
--== image-orientation-no-viewbox-and-size.html?270&flip image-orientation-ref.html?270&flip
--
--# Tests for image-orientation with no viewbox and no intrinsic size:
--== image-orientation-no-viewbox-no-size.html?0        image-orientation-ref.html?0
--== image-orientation-no-viewbox-no-size.html?90       image-orientation-ref.html?90
--== image-orientation-no-viewbox-no-size.html?180      image-orientation-ref.html?180
--== image-orientation-no-viewbox-no-size.html?270      image-orientation-ref.html?270
--== image-orientation-no-viewbox-no-size.html?0&flip   image-orientation-ref.html?0&flip
--== image-orientation-no-viewbox-no-size.html?90&flip  image-orientation-ref.html?90&flip
--== image-orientation-no-viewbox-no-size.html?180&flip image-orientation-ref.html?180&flip
--== image-orientation-no-viewbox-no-size.html?270&flip image-orientation-ref.html?270&flip
--
- # Test that 'image-orientation: from-image' has no effect, since SVGs don't have EXIF data.
--== image-orientation-viewbox-and-size.html?from-image  image-orientation-ref.html?0
--== image-orientation-viewbox-no-size.html?from-image   image-orientation-ref.html?0
--
--# Sanity checks for the image-orientation tests. Ensures that the various
--# combinations of rotations and flips actually look different from each other.
--!= image-orientation-ref.html?0    image-orientation-ref.html?90
--!= image-orientation-ref.html?0    image-orientation-ref.html?180
--!= image-orientation-ref.html?0    image-orientation-ref.html?270
--!= image-orientation-ref.html?90   image-orientation-ref.html?180
--!= image-orientation-ref.html?90   image-orientation-ref.html?270
--!= image-orientation-ref.html?180  image-orientation-ref.html?270
--!= image-orientation-ref.html?0    image-orientation-ref.html?0&flip
--!= image-orientation-ref.html?90   image-orientation-ref.html?90&flip
--!= image-orientation-ref.html?180  image-orientation-ref.html?180&flip
--!= image-orientation-ref.html?270  image-orientation-ref.html?270&flip
-+== image-orientation-viewbox-and-size.html?from-image  image-orientation-viewbox-and-size.html?none
-+== image-orientation-viewbox-no-size.html?from-image   image-orientation-viewbox-no-size.html?none
- 
- # Tests that nonuniform scales work with SVG-as-image.
- == nonuniform-scale-2d.html?0.5&1.0  nonuniform-scale-ref.html?50&100
- == nonuniform-scale-2d.html?1.0&0.5  nonuniform-scale-ref.html?100&50
- == nonuniform-scale-3d.html?0.5&1.0&0.5  nonuniform-scale-ref.html?50&100
- == nonuniform-scale-3d.html?1.0&0.5&0.5  nonuniform-scale-ref.html?100&50
- 
- # Sanity checks that nonuniform scales don't devolve to uniform scales.
-diff --git a/layout/style/ServoBindings.cpp b/layout/style/ServoBindings.cpp
---- a/layout/style/ServoBindings.cpp
-+++ b/layout/style/ServoBindings.cpp
-@@ -1420,37 +1420,16 @@ void
- Gecko_CopyAlternateValuesFrom(nsFont* aDest, const nsFont* aSrc)
- {
-   aDest->alternateValues.Clear();
-   aDest->alternateValues.AppendElements(aSrc->alternateValues);
-   aDest->featureValueLookup = aSrc->featureValueLookup;
- }
- 
- void
--Gecko_SetImageOrientation(nsStyleVisibility* aVisibility,
--                          uint8_t aOrientation, bool aFlip)
--{
--  aVisibility->mImageOrientation =
--    nsStyleImageOrientation::CreateAsOrientationAndFlip(aOrientation, aFlip);
--}
--
--void
--Gecko_SetImageOrientationAsFromImage(nsStyleVisibility* aVisibility)
--{
--  aVisibility->mImageOrientation = nsStyleImageOrientation::CreateAsFromImage();
--}
--
--void
--Gecko_CopyImageOrientationFrom(nsStyleVisibility* aDst,
--                               const nsStyleVisibility* aSrc)
--{
--  aDst->mImageOrientation = aSrc->mImageOrientation;
--}
--
--void
- Gecko_SetCounterStyleToName(CounterStylePtr* aPtr, nsAtom* aName,
-                             RawGeckoPresContextBorrowed aPresContext)
- {
-   // Try resolving the counter style if possible, and keep it unresolved
-   // otherwise.
-   CounterStyleManager* manager = aPresContext->CounterStyleManager();
-   RefPtr<nsAtom> name = already_AddRefed<nsAtom>(aName);
-   if (CounterStyle* style = manager->GetCounterStyle(name)) {
-diff --git a/layout/style/ServoBindings.toml b/layout/style/ServoBindings.toml
---- a/layout/style/ServoBindings.toml
-+++ b/layout/style/ServoBindings.toml
-@@ -135,32 +135,32 @@ rusty-enums = [
-     "nsCSSFontDesc",
-     "nsCSSPropertyID",
-     "nsCSSCounterDesc",
-     "nsMediaFeature_RangeType",
-     "nsMediaFeature_ValueType",
-     "nsresult",
-     "nsAtom_AtomKind",
-     "nsStyleImageLayers_LayerType",
--    "nsStyleImageOrientation_Angles",
-     "nsTimingFunction_Type",
-     "mozilla::ServoElementSnapshotFlags",
-     "mozilla::Side",
-     "mozilla::dom::PlaybackDirection",
-     "mozilla::dom::FillMode",
-     "mozilla::HalfCorner",
-     "mozilla::StyleDisplay",
-     "mozilla::StyleFloatEdge",
-     "mozilla::StyleShapeRadius",
-     "mozilla::StyleWindowDragging",
-     "mozilla::StyleOrient",
-     "mozilla::StyleBoxSizing",
-     "mozilla::StyleClear",
-     "mozilla::StyleComplexColor_Tag",
-     "mozilla::StyleFloat",
-+    "mozilla::StyleImageOrientation",
-     "mozilla::StyleUserModify",
-     "mozilla::StyleUserInput",
-     "mozilla::StyleBoxDirection",
-     "mozilla::StyleTextJustify",
-     "mozilla::StyleHyphens",
-     "mozilla::StyleFillRule",
-     "mozilla::StyleShapeSourceType",
-     "mozilla::StyleBasicShapeType",
-diff --git a/layout/style/nsComputedDOMStyle.cpp b/layout/style/nsComputedDOMStyle.cpp
---- a/layout/style/nsComputedDOMStyle.cpp
-+++ b/layout/style/nsComputedDOMStyle.cpp
-@@ -3742,37 +3742,16 @@ already_AddRefed<CSSValue>
- nsComputedDOMStyle::DoGetForceBrokenImageIcon()
- {
-   RefPtr<nsROCSSPrimitiveValue> val = new nsROCSSPrimitiveValue;
-   val->SetNumber(StyleUIReset()->mForceBrokenImageIcon);
-   return val.forget();
- }
- 
- already_AddRefed<CSSValue>
--nsComputedDOMStyle::DoGetImageOrientation()
--{
--  RefPtr<nsROCSSPrimitiveValue> val = new nsROCSSPrimitiveValue;
--  nsAutoString string;
--  nsStyleImageOrientation orientation = StyleVisibility()->mImageOrientation;
--
--  if (orientation.IsFromImage()) {
--    string.AppendLiteral("from-image");
--  } else {
--    nsStyleUtil::AppendAngleValue(orientation.AngleAsCoord(), string);
--
--    if (orientation.IsFlipped()) {
--      string.AppendLiteral(" flip");
--    }
--  }
--
--  val->SetString(string);
--  return val.forget();
--}
--
--already_AddRefed<CSSValue>
- nsComputedDOMStyle::DoGetDisplay()
- {
-   RefPtr<nsROCSSPrimitiveValue> val = new nsROCSSPrimitiveValue;
-   val->SetIdent(nsCSSProps::ValueToKeywordEnum(StyleDisplay()->mDisplay,
-                                                nsCSSProps::kDisplayKTable));
-   return val.forget();
- }
- 
-diff --git a/layout/style/nsComputedDOMStyle.h b/layout/style/nsComputedDOMStyle.h
---- a/layout/style/nsComputedDOMStyle.h
-+++ b/layout/style/nsComputedDOMStyle.h
-@@ -385,17 +385,16 @@ private:
- 
-   /* Direction properties */
- 
-   /* Display properties */
-   already_AddRefed<CSSValue> DoGetBinding();
-   already_AddRefed<CSSValue> DoGetDisplay();
-   already_AddRefed<CSSValue> DoGetContain();
-   already_AddRefed<CSSValue> DoGetClip();
--  already_AddRefed<CSSValue> DoGetImageOrientation();
-   already_AddRefed<CSSValue> DoGetWillChange();
-   already_AddRefed<CSSValue> DoGetOverflow();
-   already_AddRefed<CSSValue> DoGetOverflowY();
-   already_AddRefed<CSSValue> DoGetOverflowClipBoxBlock();
-   already_AddRefed<CSSValue> DoGetOverflowClipBoxInline();
-   already_AddRefed<CSSValue> DoGetTouchAction();
-   already_AddRefed<CSSValue> DoGetTransform();
-   already_AddRefed<CSSValue> DoGetTranslate();
-diff --git a/layout/style/nsStyleConsts.h b/layout/style/nsStyleConsts.h
---- a/layout/style/nsStyleConsts.h
-+++ b/layout/style/nsStyleConsts.h
-@@ -156,16 +156,22 @@ enum class StyleFloatEdge : uint8_t {
- 
- // Hyphens
- enum class StyleHyphens : uint8_t {
-   None,
-   Manual,
-   Auto,
- };
- 
-+// image-orientation
-+enum class StyleImageOrientation : uint8_t {
-+  None,
-+  FromImage,
-+};
-+
- // <shape-radius> for <basic-shape>
- enum class StyleShapeRadius : uint8_t {
-   ClosestSide,
-   FarthestSide,
- };
- 
- // Shape source type
- enum class StyleShapeSourceType : uint8_t {
-diff --git a/layout/style/nsStyleStruct.h b/layout/style/nsStyleStruct.h
---- a/layout/style/nsStyleStruct.h
-+++ b/layout/style/nsStyleStruct.h
-@@ -1760,135 +1760,29 @@ struct MOZ_NEEDS_MEMMOVABLE_MEMBERS nsSt
-   // for those cases.
-   inline bool NewlineIsSignificant(const nsTextFrame* aContextFrame) const;
-   inline bool WhiteSpaceCanWrap(const nsIFrame* aContextFrame) const;
-   inline bool WordCanWrap(const nsIFrame* aContextFrame) const;
- 
-   mozilla::LogicalSide TextEmphasisSide(mozilla::WritingMode aWM) const;
- };
- 
--struct nsStyleImageOrientation
--{
--  static nsStyleImageOrientation CreateAsAngleAndFlip(double aRadians,
--                                                      bool aFlip) {
--    uint8_t orientation(0);
--
--    // Compute the final angle value, rounding to the closest quarter turn.
--    double roundedAngle = fmod(aRadians, 2 * M_PI);
--    if (roundedAngle < 0) {
--      roundedAngle = roundedAngle + 2 * M_PI;
--    }
--    if      (roundedAngle < 0.25 * M_PI) { orientation = ANGLE_0;  }
--    else if (roundedAngle < 0.75 * M_PI) { orientation = ANGLE_90; }
--    else if (roundedAngle < 1.25 * M_PI) { orientation = ANGLE_180;}
--    else if (roundedAngle < 1.75 * M_PI) { orientation = ANGLE_270;}
--    else                                 { orientation = ANGLE_0;  }
--
--    // Add a bit for 'flip' if needed.
--    if (aFlip) {
--      orientation |= FLIP_MASK;
--    }
--
--    return nsStyleImageOrientation(orientation);
--  }
--
--  static nsStyleImageOrientation CreateAsOrientationAndFlip(uint8_t aOrientation,
--                                                            bool aFlip) {
--    MOZ_ASSERT(aOrientation <= ANGLE_270);
--    if (aFlip) {
--      aOrientation |= FLIP_MASK;
--    }
--    return nsStyleImageOrientation(aOrientation);
--  }
--
--  static nsStyleImageOrientation CreateAsFlip() {
--    return nsStyleImageOrientation(FLIP_MASK);
--  }
--
--  static nsStyleImageOrientation CreateAsFromImage() {
--    return nsStyleImageOrientation(FROM_IMAGE_MASK);
--  }
--
--  // The default constructor yields 0 degrees of rotation and no flip.
--  nsStyleImageOrientation() : mOrientation(0) { }
--
--  bool IsDefault()   const { return mOrientation == 0; }
--  bool IsFlipped()   const { return mOrientation & FLIP_MASK; }
--  bool IsFromImage() const { return mOrientation & FROM_IMAGE_MASK; }
--  bool SwapsWidthAndHeight() const {
--    uint8_t angle = mOrientation & ORIENTATION_MASK;
--    return (angle == ANGLE_90) || (angle == ANGLE_270);
--  }
--
--  mozilla::image::Angle Angle() const {
--    switch (mOrientation & ORIENTATION_MASK) {
--      case ANGLE_0:   return mozilla::image::Angle::D0;
--      case ANGLE_90:  return mozilla::image::Angle::D90;
--      case ANGLE_180: return mozilla::image::Angle::D180;
--      case ANGLE_270: return mozilla::image::Angle::D270;
--      default:
--        MOZ_ASSERT_UNREACHABLE("Unexpected angle");
--        return mozilla::image::Angle::D0;
--    }
--  }
--
--  nsStyleCoord AngleAsCoord() const {
--    switch (mOrientation & ORIENTATION_MASK) {
--      case ANGLE_0:   return nsStyleCoord(0.0f,   eStyleUnit_Degree);
--      case ANGLE_90:  return nsStyleCoord(90.0f,  eStyleUnit_Degree);
--      case ANGLE_180: return nsStyleCoord(180.0f, eStyleUnit_Degree);
--      case ANGLE_270: return nsStyleCoord(270.0f, eStyleUnit_Degree);
--      default:
--        MOZ_ASSERT_UNREACHABLE("Unexpected angle");
--        return nsStyleCoord();
--    }
--  }
--
--  bool operator==(const nsStyleImageOrientation& aOther) const {
--    return aOther.mOrientation == mOrientation;
--  }
--
--  bool operator!=(const nsStyleImageOrientation& aOther) const {
--    return !(*this == aOther);
--  }
--
--protected:
--  enum Bits {
--    ORIENTATION_MASK = 0x1 | 0x2,  // The bottom two bits are the angle.
--    FLIP_MASK        = 0x4,        // Whether the image should be flipped.
--    FROM_IMAGE_MASK  = 0x8,        // Whether the image's inherent orientation
--  };                               // should be used.
--
--  enum Angles {
--    ANGLE_0   = 0,
--    ANGLE_90  = 1,
--    ANGLE_180 = 2,
--    ANGLE_270 = 3,
--  };
--
--  explicit nsStyleImageOrientation(uint8_t aOrientation)
--    : mOrientation(aOrientation)
--  { }
--
--  uint8_t mOrientation;
--};
--
- struct MOZ_NEEDS_MEMMOVABLE_MEMBERS nsStyleVisibility
- {
-   explicit nsStyleVisibility(const nsPresContext* aContext);
-   nsStyleVisibility(const nsStyleVisibility& aVisibility);
-   ~nsStyleVisibility() {
-     MOZ_COUNT_DTOR(nsStyleVisibility);
-   }
-   void FinishStyle(nsPresContext*, const nsStyleVisibility*) {}
-   const static bool kHasFinishStyle = false;
- 
-   nsChangeHint CalcDifference(const nsStyleVisibility& aNewData) const;
- 
--  nsStyleImageOrientation mImageOrientation;
-+  mozilla::StyleImageOrientation mImageOrientation;
-   uint8_t mDirection;                  // NS_STYLE_DIRECTION_*
-   uint8_t mVisible;                    // NS_STYLE_VISIBILITY_VISIBLE_*
-   uint8_t mImageRendering;             // NS_STYLE_IMAGE_RENDERING_*
-   uint8_t mWritingMode;                // NS_STYLE_WRITING_MODE_*
-   uint8_t mTextOrientation;            // NS_STYLE_TEXT_ORIENTATION_MIXED_*
-   uint8_t mColorAdjust;                // NS_STYLE_COLOR_ADJUST_ECONOMY_*
- 
-   bool IsVisible() const {
-diff --git a/layout/style/test/property_database.js b/layout/style/test/property_database.js
---- a/layout/style/test/property_database.js
-+++ b/layout/style/test/property_database.js
-@@ -7126,83 +7126,19 @@ if (IsCSSPropertyPrefEnabled("layout.css
-   };
- }
- 
- if (IsCSSPropertyPrefEnabled("layout.css.image-orientation.enabled")) {
-   gCSSProperties["image-orientation"] = {
-     domProp: "imageOrientation",
-     inherited: true,
-     type: CSS_TYPE_LONGHAND,
--    initial_values: [
--      "0deg",
--      "0grad",
--      "0rad",
--      "0turn",
--
--      // Rounded initial values.
--      "15deg",
--      "360deg",
--    ],
--    other_values: [
--      "-90deg",
--      "0deg flip",
--      "90deg",
--      "90deg flip",
--      "180deg",
--      "180deg flip",
--      "270deg",
--      "270deg flip",
--      "flip",
--      "from-image",
--
--      // Grad units.
--      "0grad flip",
--      "100grad",
--      "100grad flip",
--      "200grad",
--      "200grad flip",
--      "300grad",
--      "300grad flip",
--
--      // Radian units.
--      "0rad flip",
--      "1.57079633rad",
--      "1.57079633rad flip",
--      "3.14159265rad",
--      "3.14159265rad flip",
--      "4.71238898rad",
--      "4.71238898rad flip",
--
--      // Turn units.
--      "0turn flip",
--      "0.25turn",
--      "0.25turn flip",
--      "0.5turn",
--      "0.5turn flip",
--      "0.75turn",
--      "0.75turn flip",
--
--      // Rounded values.
--      "-45deg flip",
--      "65deg flip",
--      "400deg flip",
--    ],
--    invalid_values: [
--      "none",
--      "0deg none",
--      "flip 0deg",
--      "flip 0deg",
--      "0",
--      "0 flip",
--      "flip 0",
--      "0deg from-image",
--      "from-image 0deg",
--      "flip from-image",
--      "from-image flip",
--    ]
-+    initial_values: [ "none" ],
-+    other_values: [ "from-image" ],
-+    invalid_values: [ "0", "0deg" ]
-   };
- }
- 
- if (IsCSSPropertyPrefEnabled("layout.css.initial-letter.enabled")) {
-   gCSSProperties["initial-letter"] = {
-     domProp: "initialLetter",
-     inherited: false,
-     type: CSS_TYPE_LONGHAND,
-diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js
---- a/modules/libpref/init/all.js
-+++ b/modules/libpref/init/all.js
-@@ -2930,17 +2930,17 @@ pref("layout.css.convertFromNode.enabled
- #endif
- 
- // Is support for CSS "text-align: unsafe X" enabled?
- pref("layout.css.text-align-unsafe-value.enabled", false);
- 
- // Is support for CSS text-justify property enabled?
- pref("layout.css.text-justify.enabled", true);
- 
--// Is support for the CSS4 image-orientation property enabled?
-+// Is support for the CSS image-orientation property enabled?
- pref("layout.css.image-orientation.enabled", true);
- 
- // Is the paint-order property supported for HTML text?
- // (It is always supported for SVG.)
- pref("layout.css.paint-order.enabled", true);
- 
- // Are sets of prefixed properties supported?
- pref("layout.css.prefixes.border-image", true);
-diff --git a/servo/components/style/properties/data.py b/servo/components/style/properties/data.py
---- a/servo/components/style/properties/data.py
-+++ b/servo/components/style/properties/data.py
-@@ -280,17 +280,16 @@ class Longhand(object):
-                 "BorderImageRepeat",
-                 "BorderStyle",
-                 "ColumnCount",
-                 "Contain",
-                 "FontStyleAdjust",
-                 "FontSynthesis",
-                 "FontWeight",
-                 "GridAutoFlow",
--                "ImageOrientation",
-                 "InitialLetter",
-                 "Integer",
-                 "JustifyContent",
-                 "JustifyItems",
-                 "JustifySelf",
-                 "MozForceBrokenImageIcon",
-                 "MozScriptLevel",
-                 "MozScriptMinSize",
-diff --git a/servo/components/style/properties/gecko.mako.rs b/servo/components/style/properties/gecko.mako.rs
---- a/servo/components/style/properties/gecko.mako.rs
-+++ b/servo/components/style/properties/gecko.mako.rs
-@@ -4528,74 +4528,17 @@ fn static_assert() {
-                 _ => {},
-             }
-         }
-         longhands::filter::computed_value::List(filters)
-     }
- 
- </%self:impl_trait>
- 
--<%self:impl_trait style_struct_name="InheritedBox"
--                  skip_longhands="image-orientation">
--    // FIXME: Gecko uses a tricky way to store computed value of image-orientation
--    //        within an u8. We could inline following glue codes by implementing all
--    //        those tricky parts for Servo as well. But, it's not done yet just for
--    //        convenience.
--    pub fn set_image_orientation(&mut self, v: longhands::image_orientation::computed_value::T) {
--        use properties::longhands::image_orientation::computed_value::T;
--        match v {
--            T::FromImage => {
--                unsafe {
--                    bindings::Gecko_SetImageOrientationAsFromImage(&mut self.gecko);
--                }
--            },
--            T::AngleWithFlipped(ref orientation, flipped) => {
--                unsafe {
--                    bindings::Gecko_SetImageOrientation(&mut self.gecko, *orientation as u8, flipped);
--                }
--            }
--        }
--    }
--
--    pub fn copy_image_orientation_from(&mut self, other: &Self) {
--        unsafe {
--            bindings::Gecko_CopyImageOrientationFrom(&mut self.gecko, &other.gecko);
--        }
--    }
--
--    pub fn reset_image_orientation(&mut self, other: &Self) {
--        self.copy_image_orientation_from(other)
--    }
--
--    pub fn clone_image_orientation(&self) -> longhands::image_orientation::computed_value::T {
--        use gecko_bindings::structs::nsStyleImageOrientation_Angles;
--        use properties::longhands::image_orientation::computed_value::T;
--        use values::computed::Orientation;
--
--        let gecko_orientation = self.gecko.mImageOrientation.mOrientation;
--        if gecko_orientation & structs::nsStyleImageOrientation_Bits_FROM_IMAGE_MASK as u8 != 0 {
--            T::FromImage
--        } else {
--            const ANGLE0: u8 = nsStyleImageOrientation_Angles::ANGLE_0 as u8;
--            const ANGLE90: u8 = nsStyleImageOrientation_Angles::ANGLE_90 as u8;
--            const ANGLE180: u8 = nsStyleImageOrientation_Angles::ANGLE_180 as u8;
--            const ANGLE270: u8 = nsStyleImageOrientation_Angles::ANGLE_270 as u8;
--
--            let flip = gecko_orientation & structs::nsStyleImageOrientation_Bits_FLIP_MASK as u8 != 0;
--            let orientation =
--                match gecko_orientation & structs::nsStyleImageOrientation_Bits_ORIENTATION_MASK as u8 {
--                    ANGLE0 => Orientation::Angle0,
--                    ANGLE90 => Orientation::Angle90,
--                    ANGLE180 => Orientation::Angle180,
--                    ANGLE270 => Orientation::Angle270,
--                    _ => unreachable!()
--                };
--            T::AngleWithFlipped(orientation, flip)
--        }
--    }
-+<%self:impl_trait style_struct_name="InheritedBox">
- </%self:impl_trait>
- 
- <%self:impl_trait style_struct_name="InheritedTable"
-                   skip_longhands="border-spacing">
- 
-     pub fn set_border_spacing(&mut self, v: longhands::border_spacing::computed_value::T) {
-         self.gecko.mBorderSpacingCol = v.horizontal().0;
-         self.gecko.mBorderSpacingRow = v.vertical().0;
-diff --git a/servo/components/style/properties/longhands/inherited_box.mako.rs b/servo/components/style/properties/longhands/inherited_box.mako.rs
---- a/servo/components/style/properties/longhands/inherited_box.mako.rs
-+++ b/servo/components/style/properties/longhands/inherited_box.mako.rs
-@@ -71,16 +71,17 @@
-     "auto",
-     extra_gecko_values="optimizespeed optimizequality -moz-crisp-edges",
-     extra_servo_values="pixelated crisp-edges",
-     custom_consts=image_rendering_custom_consts,
-     animation_value_type="discrete",
-     spec="https://drafts.csswg.org/css-images/#propdef-image-rendering",
- )}
- 
--${helpers.predefined_type("image-orientation",
--                          "ImageOrientation",
--                          "computed::ImageOrientation::zero()",
--                          products="gecko",
--                          animation_value_type="discrete",
--                          gecko_pref="layout.css.image-orientation.enabled",
--                          spec="https://drafts.csswg.org/css-images/#propdef-image-orientation, \
--                    /// additional values in https://developer.mozilla.org/en-US/docs/Web/CSS/image-orientation")}
-+${helpers.single_keyword(
-+    "image-orientation",
-+    "none from-image",
-+    products="gecko",
-+    gecko_enum_prefix="StyleImageOrientation",
-+    animation_value_type="discrete",
-+    gecko_pref="layout.css.image-orientation.enabled",
-+    spec="https://drafts.csswg.org/css-images/#propdef-image-orientation",
-+)}
-diff --git a/servo/components/style/values/computed/inherited_box.rs b/servo/components/style/values/computed/inherited_box.rs
-deleted file mode 100644
---- a/servo/components/style/values/computed/inherited_box.rs
-+++ /dev/null
-@@ -1,81 +0,0 @@
--/* This Source Code Form is subject to the terms of the Mozilla Public
-- * License, v. 2.0. If a copy of the MPL was not distributed with this
-- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
--
--//! Computed values for inherited box
--
--use std::fmt::{self, Write};
--use style_traits::{CssWriter, ToCss};
--use values::specified::Angle;
--
--/// An angle rounded and normalized per https://drafts.csswg.org/css-images/#propdef-image-orientation
--#[allow(missing_docs)]
--#[derive(Clone, Copy, Debug, Eq, MallocSizeOf, PartialEq)]
--pub enum Orientation {
--    Angle0 = 0,
--    Angle90,
--    Angle180,
--    Angle270,
--}
--
--impl Orientation {
--    /// Get the actual angle that this orientation value represents.
--    pub fn angle(&self) -> Angle {
--        match *self {
--            Orientation::Angle0 => Angle::from_degrees(0.0, false),
--            Orientation::Angle90 => Angle::from_degrees(90.0, false),
--            Orientation::Angle180 => Angle::from_degrees(180.0, false),
--            Orientation::Angle270 => Angle::from_degrees(270.0, false),
--        }
--    }
--}
--
--impl ToCss for Orientation {
--    fn to_css<W>(&self, dest: &mut CssWriter<W>) -> fmt::Result
--    where
--        W: Write,
--    {
--        // Should agree with Angle::to_css.
--        match *self {
--            Orientation::Angle0 => dest.write_str("0deg"),
--            Orientation::Angle90 => dest.write_str("90deg"),
--            Orientation::Angle180 => dest.write_str("180deg"),
--            Orientation::Angle270 => dest.write_str("270deg"),
--        }
--    }
--}
--
--/// https://drafts.csswg.org/css-images/#propdef-image-orientation
--#[derive(Clone, Copy, Debug, MallocSizeOf, PartialEq)]
--pub enum ImageOrientation {
--    /// 'from-image'
--    FromImage,
--
--    /// '<angle>' | '<angle>? flip'
--    AngleWithFlipped(Orientation, bool),
--}
--
--impl ImageOrientation {
--    #[allow(missing_docs)]
--    pub fn zero() -> Self {
--        ImageOrientation::AngleWithFlipped(Orientation::Angle0, false)
--    }
--}
--
--impl ToCss for ImageOrientation {
--    fn to_css<W>(&self, dest: &mut CssWriter<W>) -> fmt::Result
--    where
--        W: Write,
--    {
--        match *self {
--            ImageOrientation::FromImage => dest.write_str("from-image"),
--            ImageOrientation::AngleWithFlipped(angle, flipped) => {
--                angle.to_css(dest)?;
--                if flipped {
--                    dest.write_str(" flip")?;
--                }
--                Ok(())
--            },
--        }
--    }
--}
-diff --git a/servo/components/style/values/computed/mod.rs b/servo/components/style/values/computed/mod.rs
---- a/servo/components/style/values/computed/mod.rs
-+++ b/servo/components/style/values/computed/mod.rs
-@@ -46,17 +46,16 @@ pub use self::box_::{AnimationIterationC
- pub use self::box_::{OverflowClipBox, OverscrollBehavior, Perspective};
- pub use self::box_::{ScrollSnapType, TouchAction, VerticalAlign, WillChange};
- pub use self::color::{Color, ColorPropertyValue, RGBAColor};
- pub use self::column::ColumnCount;
- pub use self::counters::{Content, ContentItem, CounterIncrement, CounterReset};
- pub use self::effects::{BoxShadow, Filter, SimpleShadow};
- pub use self::flex::FlexBasis;
- pub use self::image::{Gradient, GradientItem, Image, ImageLayer, LineDirection, MozImageRect};
--pub use self::inherited_box::{ImageOrientation, Orientation};
- #[cfg(feature = "gecko")]
- pub use self::gecko::ScrollSnapPoint;
- pub use self::rect::LengthOrNumberRect;
- pub use self::resolution::Resolution;
- pub use super::{Auto, Either, None_};
- pub use super::specified::{BorderStyle, TextDecorationLine};
- pub use self::length::{CalcLengthOrPercentage, Length, LengthOrNumber, LengthOrPercentage};
- pub use self::length::{LengthOrPercentageOrAuto, LengthOrPercentageOrNone, MaxLength, MozLength};
-@@ -93,17 +92,16 @@ pub mod color;
- pub mod column;
- pub mod counters;
- pub mod effects;
- pub mod flex;
- pub mod font;
- #[cfg(feature = "gecko")]
- pub mod gecko;
- pub mod image;
--pub mod inherited_box;
- pub mod length;
- pub mod list;
- pub mod outline;
- pub mod percentage;
- pub mod position;
- pub mod rect;
- pub mod resolution;
- pub mod svg;
-diff --git a/servo/components/style/values/specified/inherited_box.rs b/servo/components/style/values/specified/inherited_box.rs
-deleted file mode 100644
---- a/servo/components/style/values/specified/inherited_box.rs
-+++ /dev/null
-@@ -1,158 +0,0 @@
--/* This Source Code Form is subject to the terms of the Mozilla Public
-- * License, v. 2.0. If a copy of the MPL was not distributed with this
-- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
--
--//! Specified values for inherited box
--
--use cssparser::Parser;
--use parser::{Parse, ParserContext};
--use std::f64::consts::PI;
--use std::fmt::{self, Write};
--use style_traits::{CssWriter, ParseError, StyleParseErrorKind, ToCss};
--use values::computed;
--use values::computed::{Context, Orientation, ToComputedValue};
--use values::specified::Angle;
--
--/// The specified value of the `image-orientation` property.
--/// https://drafts.csswg.org/css-images/#propdef-image-orientation
--#[derive(Clone, Copy, Debug, MallocSizeOf, PartialEq, SpecifiedValueInfo)]
--pub struct ImageOrientation {
--    /// The angle specified, if any
--    pub angle: Option<Angle>,
--
--    /// Whether or not "flip" was specified
--    #[value_info(other_values = "flip,from-image")]
--    pub flipped: bool,
--}
--
--impl ToCss for ImageOrientation {
--    fn to_css<W>(&self, dest: &mut CssWriter<W>) -> fmt::Result
--    where
--        W: Write,
--    {
--        if let Some(angle) = self.angle {
--            angle.to_css(dest)?;
--            if self.flipped {
--                dest.write_str(" flip")
--            } else {
--                Ok(())
--            }
--        } else {
--            if self.flipped {
--                dest.write_str("flip")
--            } else {
--                dest.write_str("from-image")
--            }
--        }
--    }
--}
--
--const TWO_PI: f64 = 2.0 * PI;
--
--// According to CSS Content Module Level 3:
--// The computed value of the property is calculated by rounding the specified angle
--// to the nearest quarter-turn, rounding away from 0, then moduloing the value by 1 turn.
--// This mirrors the Gecko implementation in
--// nsStyleImageOrientation::CreateAsAngleAndFlip.
--#[inline]
--fn orientation_of_angle(angle: &computed::Angle) -> Orientation {
--    // Note that `angle` can be negative.
--    let mut rounded_angle = angle.radians64() % TWO_PI;
--    if rounded_angle < 0.0 {
--        // This computation introduces rounding error. Gecko previously
--        // didn't handle the negative case correctly; by branching we can
--        // match Gecko's behavior when it was correct.
--        rounded_angle += TWO_PI;
--    }
--    if rounded_angle < 0.25 * PI {
--        return Orientation::Angle0;
--    }
--    if rounded_angle < 0.75 * PI {
--        return Orientation::Angle90;
--    }
--    if rounded_angle < 1.25 * PI {
--        return Orientation::Angle180;
--    }
--    if rounded_angle < 1.75 * PI {
--        return Orientation::Angle270;
--    }
--    Orientation::Angle0
--}
--
--impl ToComputedValue for ImageOrientation {
--    type ComputedValue = computed::ImageOrientation;
--
--    #[inline]
--    fn to_computed_value(&self, context: &Context) -> computed::ImageOrientation {
--        if let Some(ref angle) = self.angle {
--            let angle = angle.to_computed_value(context);
--            let orientation = orientation_of_angle(&angle);
--            computed::ImageOrientation::AngleWithFlipped(orientation, self.flipped)
--        } else {
--            if self.flipped {
--                computed::ImageOrientation::zero()
--            } else {
--                computed::ImageOrientation::FromImage
--            }
--        }
--    }
--
--    #[inline]
--    fn from_computed_value(computed: &computed::ImageOrientation) -> Self {
--        match *computed {
--            computed::ImageOrientation::FromImage => ImageOrientation {
--                angle: None,
--                flipped: false,
--            },
--
--            computed::ImageOrientation::AngleWithFlipped(ref orientation, flipped) => {
--                ImageOrientation {
--                    angle: Some(orientation.angle()),
--                    flipped: flipped,
--                }
--            },
--        }
--    }
--}
--
--impl Parse for ImageOrientation {
--    // from-image | <angle> | [<angle>? flip]
--    fn parse<'i, 't>(
--        context: &ParserContext,
--        input: &mut Parser<'i, 't>,
--    ) -> Result<Self, ParseError<'i>> {
--        if input
--            .try(|input| input.expect_ident_matching("from-image"))
--            .is_ok()
--        {
--            // Handle from-image
--            Ok(ImageOrientation {
--                angle: None,
--                flipped: false,
--            })
--        } else if input
--            .try(|input| input.expect_ident_matching("flip"))
--            .is_ok()
--        {
--            // Handle flip
--            Ok(ImageOrientation {
--                angle: Some(Angle::zero()),
--                flipped: true,
--            })
--        } else {
--            // Handle <angle> | <angle> flip
--            let angle = input.try(|input| Angle::parse(context, input)).ok();
--            if angle.is_none() {
--                return Err(input.new_custom_error(StyleParseErrorKind::UnspecifiedError));
--            }
--
--            let flipped = input
--                .try(|input| input.expect_ident_matching("flip"))
--                .is_ok();
--            Ok(ImageOrientation {
--                angle: angle,
--                flipped: flipped,
--            })
--        }
--    }
--}
-diff --git a/servo/components/style/values/specified/mod.rs b/servo/components/style/values/specified/mod.rs
---- a/servo/components/style/values/specified/mod.rs
-+++ b/servo/components/style/values/specified/mod.rs
-@@ -43,17 +43,16 @@ pub use self::box_::{ScrollSnapType, Tou
- pub use self::color::{Color, ColorPropertyValue, RGBAColor};
- pub use self::counters::{Content, ContentItem, CounterIncrement, CounterReset};
- pub use self::effects::{BoxShadow, Filter, SimpleShadow};
- pub use self::flex::FlexBasis;
- #[cfg(feature = "gecko")]
- pub use self::gecko::ScrollSnapPoint;
- pub use self::image::{ColorStop, EndingShape as GradientEndingShape, Gradient};
- pub use self::image::{GradientItem, GradientKind, Image, ImageLayer, MozImageRect};
--pub use self::inherited_box::ImageOrientation;
- pub use self::length::{AbsoluteLength, CalcLengthOrPercentage, CharacterWidth};
- pub use self::length::{FontRelativeLength, Length, LengthOrNumber};
- pub use self::length::{LengthOrPercentage, LengthOrPercentageOrAuto};
- pub use self::length::{LengthOrPercentageOrNone, MaxLength, MozLength};
- pub use self::length::{NoCalcLength, ViewportPercentageLength};
- pub use self::length::{NonNegativeLengthOrPercentage, NonNegativeLengthOrPercentageOrAuto};
- pub use self::list::Quotes;
- #[cfg(feature = "gecko")]
-@@ -93,17 +92,16 @@ pub mod column;
- pub mod counters;
- pub mod effects;
- pub mod flex;
- pub mod font;
- #[cfg(feature = "gecko")]
- pub mod gecko;
- pub mod grid;
- pub mod image;
--pub mod inherited_box;
- pub mod length;
- pub mod list;
- pub mod outline;
- pub mod percentage;
- pub mod position;
- pub mod rect;
- pub mod resolution;
- pub mod source_size_list;
-diff --git a/testing/web-platform/meta/MANIFEST.json b/testing/web-platform/meta/MANIFEST.json
---- a/testing/web-platform/meta/MANIFEST.json
-+++ b/testing/web-platform/meta/MANIFEST.json
-@@ -404559,22 +404559,16 @@
-     ]
-    ],
-    "css/css-images/image-fit-006.xht": [
-     [
-      "/css/css-images/image-fit-006.xht",
-      {}
-     ]
-    ],
--   "css/css-images/img-orient-012.xht": [
--    [
--     "/css/css-images/img-orient-012.xht",
--     {}
--    ]
--   ],
-    "css/css-lists/list-style-type-armenian-002.xht": [
-     [
-      "/css/css-lists/list-style-type-armenian-002.xht",
-      {}
-     ]
-    ],
-    "css/css-lists/list-style-type-armenian-003.xht": [
-     [
-@@ -518158,20 +518152,16 @@
-   "css/css-images/image-fit-001.xht": [
-    "868d9469f57e6013a024efa5e04ef2455d97296e",
-    "visual"
-   ],
-   "css/css-images/image-fit-006.xht": [
-    "223fe97a140e0cfb52709f02c72d8d32c5e6ae95",
-    "visual"
-   ],
--  "css/css-images/img-orient-012.xht": [
--   "6075765bed0ae20451c82a7d9802e7453ae8fcdc",
--   "visual"
--  ],
-   "css/css-images/linear-gradient-1.html": [
-    "fc00201e827325dc3897b789d0e6be920eb4e38b",
-    "reftest"
-   ],
-   "css/css-images/linear-gradient-2.html": [
-    "00eadc3f3b8e6debd50af1455f781591d32e56b2",
-    "reftest"
-   ],
-@@ -518183,21 +518173,21 @@
-    "5bae73095070f46bc8f38a58fb3808d473d60058",
-    "testharness"
-   ],
-   "css/css-images/parsing/gradient-position-valid.html": [
-    "b939e0d37a56ee607a4b7b4c59721c8facabb049",
-    "testharness"
-   ],
-   "css/css-images/parsing/image-orientation-invalid.html": [
--   "d73028ae4b50467e1a04a80c9b0a33a1f195ba5b",
-+   "4e0fc11d78b4e9aa36d558d16e6d3740ef01d6a6",
-    "testharness"
-   ],
-   "css/css-images/parsing/image-orientation-valid.html": [
--   "07a4e4f0d471c1482ec55c1237c39791590158e8",
-+   "5f7c8f0abf80cb663ff4bd76cfeef5e76f5814b4",
-    "testharness"
-   ],
-   "css/css-images/parsing/image-rendering-invalid.html": [
-    "b053afe022c8928c8c18dc4e2dbba3c7224fe8c1",
-    "testharness"
-   ],
-   "css/css-images/parsing/image-rendering-valid.html": [
-    "ee2bd095839ad643e8e1fc4e9924d11ee8befc22",
-diff --git a/testing/web-platform/tests/css/css-images/img-orient-012.xht b/testing/web-platform/tests/css/css-images/img-orient-012.xht
-deleted file mode 100644
---- a/testing/web-platform/tests/css/css-images/img-orient-012.xht
-+++ /dev/null
-@@ -1,18 +0,0 @@
--<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
--<html xmlns="http://www.w3.org/1999/xhtml">
-- <head>
--  <title>CSS Test: Image Orientation - Negative Values</title>
--  <link rel="author" title="Tom Clancy" href="mailto:tclancy@revenution.com"/>
--  <link rel="help" href="http://www.w3.org/TR/css3-images/#image-orientation"/>
--  <meta name="assert" content="A negative value for 'image-orientation' rotates the image to the left (in a counter-clockwise direction) by the given number of degrees. "/>
--  <style type="text/css"><![CDATA[
--   img.turn { image-orientation: -90deg; }
--  ]]></style>
-- </head>
-- <body>
--  	<div>
--		<p>This arrow should appear sideways, with the tip of the arrow pointing left.</p>
--		<img src="support/intrinsic-size.png" alt="FAIL: missing image" class="turn" />
--	</div>
-- </body>
--</html>
-\ No newline at end of file
-diff --git a/testing/web-platform/tests/css/css-images/parsing/image-orientation-invalid.html b/testing/web-platform/tests/css/css-images/parsing/image-orientation-invalid.html
---- a/testing/web-platform/tests/css/css-images/parsing/image-orientation-invalid.html
-+++ b/testing/web-platform/tests/css/css-images/parsing/image-orientation-invalid.html
-@@ -1,26 +1,32 @@
- <!DOCTYPE html>
- <html>
- <head>
- <meta charset="utf-8">
- <title>CSS Images Module Level 3: parsing image-orientation with invalid values</title>
- <link rel="author" title="Eric Willigers" href="mailto:ericwilligers@chromium.org">
- <link rel="help" href="https://drafts.csswg.org/css-images-3/#propdef-image-orientation">
--<meta name="assert" content="image-orientation supports only the grammar 'from-image | <angle> | [ <angle>? flip ]'.">
-+<meta name="assert" content="image-orientation supports only the grammar 'from-image | none'.">
- <script src="/resources/testharness.js"></script>
- <script src="/resources/testharnessreport.js"></script>
- <script src="resources/parsing-testcommon.js"></script>
- </head>
- <body>
- <script>
- test_invalid_value("image-orientation", "auto");
--test_invalid_value("image-orientation", "none");
- test_invalid_value("image-orientation", "0");
- test_invalid_value("image-orientation", "0 flip");
- test_invalid_value("image-orientation", "0deg from-image");
- test_invalid_value("image-orientation", "flip 0deg");
- test_invalid_value("image-orientation", "flip from-image");
- test_invalid_value("image-orientation", "from-image 0deg");
- test_invalid_value("image-orientation", "from-image flip");
-+
-+// An older version of the spec allowed [ <angle> | <angle>? flip ] values,
-+// so test that we no longer support them.
-+test_invalid_value("image-orientation", "30deg");
-+test_invalid_value("image-orientation", "flip");
-+test_invalid_value("image-orientation", "0deg flip");
-+test_invalid_value("image-orientation", "-1.25turn flip");
- </script>
- </body>
- </html>
-diff --git a/testing/web-platform/tests/css/css-images/parsing/image-orientation-valid.html b/testing/web-platform/tests/css/css-images/parsing/image-orientation-valid.html
---- a/testing/web-platform/tests/css/css-images/parsing/image-orientation-valid.html
-+++ b/testing/web-platform/tests/css/css-images/parsing/image-orientation-valid.html
-@@ -1,21 +1,19 @@
- <!DOCTYPE html>
- <html>
- <head>
- <meta charset="utf-8">
- <title>CSS Images Module Level 3: parsing image-orientation with valid values</title>
- <link rel="author" title="Eric Willigers" href="mailto:ericwilligers@chromium.org">
- <link rel="help" href="https://drafts.csswg.org/css-images-3/#propdef-image-orientation">
--<meta name="assert" content="image-orientation supports the full grammar 'from-image | <angle> | [ <angle>? flip ]'.">
-+<meta name="assert" content="image-orientation supports the full grammar 'from-image | none'.">
- <script src="/resources/testharness.js"></script>
- <script src="/resources/testharnessreport.js"></script>
- <script src="resources/parsing-testcommon.js"></script>
- </head>
- <body>
- <script>
- test_valid_value("image-orientation", "from-image");
--test_valid_value("image-orientation", "30deg");
--test_valid_value("image-orientation", "flip", "0deg flip"); // "0deg flip" in Firefox.
--test_valid_value("image-orientation", "-1.25turn flip");
-+test_valid_value("image-orientation", "none");
- </script>
- </body>
- </html>
-diff --git a/testing/web-platform/tests/web-animations/animation-model/animation-types/property-list.js b/testing/web-platform/tests/web-animations/animation-model/animation-types/property-list.js
---- a/testing/web-platform/tests/web-animations/animation-model/animation-types/property-list.js
-+++ b/testing/web-platform/tests/web-animations/animation-model/animation-types/property-list.js
-@@ -706,17 +706,17 @@ const gCSSProperties = {
-     // https://drafts.csswg.org/css-text-3/#propdef-hyphens
-     types: [
-       { type: 'discrete', options: [ [ 'manual', 'auto' ] ] }
-     ]
-   },
-   'image-orientation': {
-     // https://drafts.csswg.org/css-images-3/#propdef-image-orientation
-     types: [
--      { type: 'discrete', options: [ [ '0deg', '90deg' ] ] }
-+      { type: 'discrete', options: [ [ 'none', 'from-image' ] ] }
-     ]
-   },
-   'image-rendering': {
-     // https://drafts.csswg.org/css-images-3/#propdef-image-rendering
-     types: [
-     ]
-   },
-   'ime-mode': {

frg/work-js/mozilla-release/patches/mozilla-central-push_426227.patch

@@ -1,51 +0,0 @@
-# HG changeset patch
-# User Logan Smyth <loganfsmyth@gmail.com>
-# Date 1530651136 25200
-#      Tue Jul 03 13:52:16 2018 -0700
-# Node ID b4a8e7ca6bcdd112df1a1ffe7dc851e991d2fd53
-# Parent  a6dc6d6f4df1516707df4d06b01704ead35a1d5c
-Bug 1472291 - Fix two small typos. r=jorendorff
-
-MozReview-Commit-ID: GPC0WF4PLpx
-
-diff --git a/js/src/vm/Opcodes.h b/js/src/vm/Opcodes.h
---- a/js/src/vm/Opcodes.h
-+++ b/js/src/vm/Opcodes.h
-@@ -1450,17 +1450,17 @@ 1234567890123456789012345678901234567890
-      *   Operands: uint8_t hops, uint24_t slot
-      *   Stack: v => v
-      */ \
-     macro(JSOP_INITALIASEDLEXICAL,  141, "initaliasedlexical",  NULL, 5,  1,  1, JOF_ENVCOORD|JOF_NAME|JOF_PROPINIT|JOF_DETECTING) \
-     /*
-      * Pushes a JS_UNINITIALIZED_LEXICAL value onto the stack, representing an
-      * uninitialized lexical binding.
-      *
--     * This opcode is used with the JSOP_INITLET opcode.
-+     * This opcode is used with the JSOP_INITLEXICAL opcode.
-      *   Category: Literals
-      *   Type: Constants
-      *   Operands:
-      *   Stack: => uninitialized
-      */ \
-     macro(JSOP_UNINITIALIZED, 142, "uninitialized", NULL, 1,  0,  1, JOF_BYTE) \
-     /* Pushes the value of the intrinsic onto the stack.
-      *
-@@ -2020,17 +2020,17 @@ 1234567890123456789012345678901234567890
-      *   Operands:
-      *   Stack: val => (typeof val)
-      */ \
-     macro(JSOP_TYPEOFEXPR,    196,"typeofexpr",  NULL,    1,  1,  1, JOF_BYTE|JOF_DETECTING) \
-     \
-     /* Lexical environment support. */ \
-     /*
-      * Replaces the current block on the env chain with a fresh block
--     * that copies all the bindings in the bock.  This operation implements the
-+     * that copies all the bindings in the block.  This operation implements the
-      * behavior of inducing a fresh lexical environment for every iteration of a
-      * for(let ...; ...; ...) loop, if any declarations induced by such a loop
-      * are captured within the loop.
-      *   Category: Variables and Scopes
-      *   Type: Block-local Scope
-      *   Operands:
-      *   Stack: =>
-      */ \

frg/work-js/mozilla-release/patches/mozilla-central-push_426228.patch

@@ -1,455 +0,0 @@
-# HG changeset patch
-# User Logan Smyth <loganfsmyth@gmail.com>
-# Date 1530654332 25200
-#      Tue Jul 03 14:45:32 2018 -0700
-# Node ID a1757187c5a9a6892bc28309567bceb5fdca3798
-# Parent  b4a8e7ca6bcdd112df1a1ffe7dc851e991d2fd53
-Bug 1472291 - Ensure that if, switch, do-while, with, break, and continue statements have column offsets. r=jorendorff
-
-MozReview-Commit-ID: J1RL0xbW0qR
-
-diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
---- a/js/src/frontend/BytecodeEmitter.cpp
-+++ b/js/src/frontend/BytecodeEmitter.cpp
-@@ -4758,16 +4758,20 @@ BytecodeEmitter::emitNumberOp(double dva
-  */
- MOZ_NEVER_INLINE bool
- BytecodeEmitter::emitSwitch(ParseNode* pn)
- {
-     ParseNode* cases = pn->pn_right;
-     MOZ_ASSERT(cases->isKind(ParseNodeKind::LexicalScope) ||
-                cases->isKind(ParseNodeKind::StatementList));
- 
-+    // Ensure that the column of the switch statement is set properly.
-+    if (!updateSourceCoordNotes(pn->pn_pos.begin))
-+        return false;
-+
-     // Emit code for the discriminant.
-     if (!emitTree(pn->pn_left))
-         return false;
- 
-     // Enter the scope before pushing the switch BreakableControl since all
-     // breaks are under this scope.
-     Maybe<TDZCheckCache> tdzCache;
-     Maybe<EmitterScope> emitterScope;
-@@ -7017,16 +7021,21 @@ BytecodeEmitter::emitTry(ParseNode* pn)
- }
- 
- bool
- BytecodeEmitter::emitIf(ParseNode* pn)
- {
-     IfEmitter ifThenElse(this);
- 
-   if_again:
-+    // Make sure this code is attributed to the "if" so that it gets a useful
-+    // column number, instead of the default 0 value.
-+    if (!updateSourceCoordNotes(pn->pn_pos.begin))
-+        return false;
-+
-     /* Emit code for the condition before pushing stmtInfo. */
-     if (!emitTree(pn->pn_kid1))
-         return false;
- 
-     ParseNode* elseNode = pn->pn_kid3;
-     if (elseNode) {
-         if (!ifThenElse.emitThenElse())
-             return false;
-@@ -7147,16 +7156,20 @@ BytecodeEmitter::emitLexicalScope(ParseN
-     }
- 
-     return emitterScope.leave(this);
- }
- 
- bool
- BytecodeEmitter::emitWith(ParseNode* pn)
- {
-+    // Ensure that the column of the 'with' is set properly.
-+    if (!updateSourceCoordNotes(pn->pn_pos.begin))
-+        return false;
-+
-     if (!emitTree(pn->pn_left))
-         return false;
- 
-     EmitterScope emitterScope(this);
-     if (!emitterScope.enterWith(this))
-         return false;
- 
-     if (!emitTree(pn->pn_right))
-@@ -8285,16 +8298,20 @@ BytecodeEmitter::emitAsyncWrapper(unsign
-             return false;
-     }
-     return true;
- }
- 
- bool
- BytecodeEmitter::emitDo(ParseNode* pn)
- {
-+    // Ensure that the column of the 'do' is set properly.
-+    if (!updateSourceCoordNotes(pn->pn_pos.begin))
-+        return false;
-+
-     /* Emit an annotated nop so IonBuilder can recognize the 'do' loop. */
-     unsigned noteIndex;
-     if (!newSrcNote(SRC_WHILE, &noteIndex))
-         return false;
-     if (!emit1(JSOP_NOP))
-         return false;
- 
-     unsigned noteIndex2;
-@@ -10938,21 +10955,29 @@ BytecodeEmitter::emitTree(ParseNode* pn,
-         break;
- 
-       case ParseNodeKind::For:
-         if (!emitFor(pn))
-             return false;
-         break;
- 
-       case ParseNodeKind::Break:
-+        // Ensure that the column of the 'break' is set properly.
-+        if (!updateSourceCoordNotes(pn->pn_pos.begin))
-+            return false;
-+
-         if (!emitBreak(pn->as<BreakStatement>().label()))
-             return false;
-         break;
- 
-       case ParseNodeKind::Continue:
-+        // Ensure that the column of the 'continue' is set properly.
-+        if (!updateSourceCoordNotes(pn->pn_pos.begin))
-+            return false;
-+
-         if (!emitContinue(pn->as<ContinueStatement>().label()))
-             return false;
-         break;
- 
-       case ParseNodeKind::With:
-         if (!emitWith(pn))
-             return false;
-         break;
-diff --git a/js/src/jit-test/lib/assert-offset-columns.js b/js/src/jit-test/lib/assert-offset-columns.js
-new file mode 100644
---- /dev/null
-+++ b/js/src/jit-test/lib/assert-offset-columns.js
-@@ -0,0 +1,74 @@
-+// Set breakpoints "everywhere" in a function, then call the function and check that
-+// the breakpoints were added are at the expected columns, and the breakpoints
-+// were executed in th expected order.
-+//
-+// `code` is a JS Script. The final line should define a function `f` to validate.
-+// `expectedBpts` is a string of spaces and carets ('^'). Throws if we don't hit
-+// breakpoints on exactly the columns indicated by the carets.
-+// `expectedOrdering` is a string of integer indices for the offsets that are
-+// executed, in the order that then are executed. Test code can also push
-+// additional items into this string using items.push("!").
-+function assertOffsetColumns(code, expectedBpts, expectedOrdering = null) {
-+    if (expectedOrdering === null) {
-+        // The default ordering simply runs the breakpoints in order.
-+        expectedOrdering = Array.from(expectedBpts.match(/\^/g), (_, i) => i).join(" ");
-+    }
-+
-+    // Define the function `f` in a new global.
-+    const global = newGlobal();
-+
-+    const lines = code.split(/\r?\n|\r]/g);
-+    const initCode = lines.slice(0, -1).join("\n");
-+    const execCode = lines[lines.length - 1];
-+
-+    // Treat everything but the last line as initialization code.
-+    global.eval(initCode);
-+
-+    // Run the test code itself.
-+    global.eval(execCode);
-+
-+    // Allow some tests to append to a log that will show up in expected ordering.
-+    const hits = global.hits = [];
-+    const bpts = new Set();
-+
-+    // Set breakpoints everywhere and call the function.
-+    const dbg = new Debugger;
-+    const script = dbg.addDebuggee(global).makeDebuggeeValue(global.f).script;
-+    for (const offset of script.getAllColumnOffsets()) {
-+        assertEq(offset.lineNumber, 1);
-+        assertEq(offset.columnNumber < execCode.length, true);
-+        bpts.add(offset.columnNumber);
-+
-+        script.setBreakpoint(offset.offset, {
-+            hit(frame) {
-+                hits.push(offset.columnNumber);
-+            },
-+        });
-+    }
-+    global.f(3);
-+
-+    const actualBpts = Array.from(execCode, (_, i) => {
-+        return bpts.has(i) ? "^" : " ";
-+    }).join("");
-+
-+    if (actualBpts.trimEnd() !== expectedBpts.trimEnd()) {
-+        throw new Error(`Assertion failed:
-+                     code: ${execCode}
-+            expected bpts: ${expectedBpts}
-+              actual bpts: ${actualBpts}\n`);
-+    }
-+
-+    const indexLookup = new Map(
-+        Array.from(bpts).sort().map((col, i) => [col, i]));
-+    const actualOrdering = hits
-+        .map(item => typeof item === "number" ? indexLookup.get(item) : item)
-+        .join(" ");
-+
-+    if (actualOrdering.trimEnd() !== expectedOrdering.trimEnd()) {
-+        throw new Error(`Assertion failed:
-+                     code: ${execCode}
-+                     bpts: ${expectedBpts}
-+           expected order: ${expectedOrdering}
-+             actual order: ${actualOrdering}\n`);
-+    }
-+}
-diff --git a/js/src/jit-test/tests/debug/Script-getAllColumnOffsets-01.js b/js/src/jit-test/tests/debug/Script-getAllColumnOffsets-01.js
-deleted file mode 100644
---- a/js/src/jit-test/tests/debug/Script-getAllColumnOffsets-01.js
-+++ /dev/null
-@@ -1,19 +0,0 @@
--// getColumnOffsets correctly places the various parts of a ForStatement.
--
--var global = newGlobal();
--Debugger(global).onDebuggerStatement = function (frame) {
--    var script = frame.eval("f").return.script;
--    script.getAllColumnOffsets().forEach(function (offset) {
--        script.setBreakpoint(offset.offset, {
--            hit: function (frame) {
--                assertEq(offset.lineNumber, 1);
--                global.log += offset.columnNumber + " ";
--            }
--        });
--    });
--};
--
--global.log = '';
--global.eval("function f(n) { for (var i = 0; i < n; ++i) log += '. '; log += '! '; } debugger;");
--global.f(3);
--assertEq(global.log, "25 32 44 . 39 32 44 . 39 32 44 . 39 32 57 ! 70 ");
-diff --git a/js/src/jit-test/tests/debug/Script-getAllColumnOffsets-02.js b/js/src/jit-test/tests/debug/Script-getAllColumnOffsets-02.js
-deleted file mode 100644
---- a/js/src/jit-test/tests/debug/Script-getAllColumnOffsets-02.js
-+++ /dev/null
-@@ -1,21 +0,0 @@
--// getColumnOffsets correctly places multiple variable declarations.
--
--var global = newGlobal();
--Debugger(global).onDebuggerStatement = function (frame) {
--    var script = frame.eval("f").return.script;
--    script.getAllColumnOffsets().forEach(function (offset) {
--        script.setBreakpoint(offset.offset, {
--            hit: function (frame) {
--                assertEq(offset.lineNumber, 1);
--                global.log += offset.columnNumber + " ";
--            }
--        });
--    });
--};
--
--global.log = '';
--global.eval("function f(n){var w0,x1=3,y2=4,z3=9} debugger;");
--global.f(3);
--
--// Should have hit each variable declared.
--assertEq(global.log, "21 26 31 35 ");
-diff --git a/js/src/jit-test/tests/debug/Script-getAllColumnOffsets-03.js b/js/src/jit-test/tests/debug/Script-getAllColumnOffsets-03.js
-deleted file mode 100644
---- a/js/src/jit-test/tests/debug/Script-getAllColumnOffsets-03.js
-+++ /dev/null
-@@ -1,20 +0,0 @@
--// getColumnOffsets correctly places comma separated expressions.
--
--var global = newGlobal();
--Debugger(global).onDebuggerStatement = function (frame) {
--    var script = frame.eval("f").return.script;
--    script.getAllColumnOffsets().forEach(function (offset) {
--        script.setBreakpoint(offset.offset, {
--            hit: function (frame) {
--                assertEq(offset.lineNumber, 1);
--                global.log += offset.columnNumber + " ";
--            }
--        });
--    });
--};
--
--global.log = '';
--global.eval("function f(n){print(n),print(n),print(n)} debugger;");
--global.f(3);
--// Should hit each call that was separated by commas.
--assertEq(global.log, "14 23 32 40 ");
-diff --git a/js/src/jit-test/tests/debug/Script-getAllColumnOffsets-04.js b/js/src/jit-test/tests/debug/Script-getAllColumnOffsets-04.js
-deleted file mode 100644
---- a/js/src/jit-test/tests/debug/Script-getAllColumnOffsets-04.js
-+++ /dev/null
-@@ -1,20 +0,0 @@
--// getColumnOffsets correctly places object properties.
--
--var global = newGlobal();
--Debugger(global).onDebuggerStatement = function (frame) {
--    var script = frame.eval("f").return.script;
--    script.getAllColumnOffsets().forEach(function (offset) {
--        script.setBreakpoint(offset.offset, {
--            hit: function (frame) {
--                assertEq(offset.lineNumber, 1);
--                global.log += offset.columnNumber + " ";
--            }
--        });
--    });
--};
--
--global.log = '';
--global.eval("function f(n){var o={a:1,b:2,c:3}} debugger;");
--global.f(3);
--// Should hit each property in the object.
--assertEq(global.log, "18 21 25 29 33 ");
-diff --git a/js/src/jit-test/tests/debug/Script-getAllColumnOffsets-05.js b/js/src/jit-test/tests/debug/Script-getAllColumnOffsets-05.js
-deleted file mode 100644
---- a/js/src/jit-test/tests/debug/Script-getAllColumnOffsets-05.js
-+++ /dev/null
-@@ -1,20 +0,0 @@
--// getColumnOffsets correctly places array properties.
--
--var global = newGlobal();
--Debugger(global).onDebuggerStatement = function (frame) {
--    var script = frame.eval("f").return.script;
--    script.getAllColumnOffsets().forEach(function (offset) {
--        script.setBreakpoint(offset.offset, {
--            hit: function (frame) {
--                assertEq(offset.lineNumber, 1);
--                global.log += offset.columnNumber + " ";
--            }
--        });
--    });
--};
--
--global.log = '';
--global.eval("function f(n){var a=[1,2,n]} debugger;");
--global.f(3);
--// Should hit each item in the array.
--assertEq(global.log, "18 21 23 25 27 ");
-diff --git a/js/src/jit-test/tests/debug/Script-getAllColumnOffsets-06.js b/js/src/jit-test/tests/debug/Script-getAllColumnOffsets-06.js
-deleted file mode 100644
---- a/js/src/jit-test/tests/debug/Script-getAllColumnOffsets-06.js
-+++ /dev/null
-@@ -1,28 +0,0 @@
--// getColumnOffsets correctly places function calls.
--
--var global = newGlobal();
--Debugger(global).onDebuggerStatement = function (frame) {
--    var script = frame.eval("f").return.script;
--    script.getAllColumnOffsets().forEach(function (offset) {
--        script.setBreakpoint(offset.offset, {
--            hit: function (frame) {
--                assertEq(offset.lineNumber, 1);
--                global.log += offset.columnNumber + " ";
--            }
--        });
--    });
--};
--
--global.log = "";
--global.eval("function ppppp() { return 1; }");
--//                     1         2         3         4
--//           01234567890123456789012345678901234567890123456789
--global.eval("function f(){ 1 && ppppp(ppppp()) && new Error() } debugger;");
--global.f();
--
--// 14 - Enter the function body
--// 25 - Inner print()
--// 19 - Outer print()
--// 37 - new Error()
--// 49 - Exit the function body
--assertEq(global.log, "14 25 19 37 49 ");
-diff --git a/js/src/jit-test/tests/debug/Script-getAllColumnOffsets.js b/js/src/jit-test/tests/debug/Script-getAllColumnOffsets.js
-new file mode 100644
---- /dev/null
-+++ b/js/src/jit-test/tests/debug/Script-getAllColumnOffsets.js
-@@ -0,0 +1,85 @@
-+load(libdir + "assert-offset-columns.js");
-+
-+// getColumnOffsets correctly places the various parts of a ForStatement.
-+assertOffsetColumns(
-+    "function f(n) { for (var i = 0; i < n; ++i) hits.push('.'); hits.push('!'); }",
-+    "                         ^      ^      ^    ^               ^               ^",
-+    "0 1 3 . 2 1 3 . 2 1 3 . 2 1 4 ! 5",
-+);
-+
-+// getColumnOffsets correctly places multiple variable declarations.
-+assertOffsetColumns(
-+    "function f(n){var w0,x1=3,y2=4,z3=9}",
-+    "                     ^    ^    ^   ^",
-+);
-+
-+// getColumnOffsets correctly places comma separated expressions.
-+assertOffsetColumns(
-+    "function f(n){print(n),print(n),print(n)}",
-+    "              ^        ^        ^       ^",
-+);
-+
-+// getColumnOffsets correctly places object properties.
-+assertOffsetColumns(
-+    // Should hit each property in the object.
-+    "function f(n){var o={a:1,b:2,c:3}}",
-+    "                  ^  ^   ^   ^   ^",
-+);
-+
-+// getColumnOffsets correctly places array properties.
-+assertOffsetColumns(
-+    // Should hit each item in the array.
-+    "function f(n){var a=[1,2,n]}",
-+    "                  ^  ^ ^ ^ ^",
-+);
-+
-+// getColumnOffsets correctly places function calls.
-+assertOffsetColumns(
-+    "function ppppp() { return 1; }\n" +
-+    "function f(){ 1 && ppppp(ppppp()) && new Error() }",
-+    "              ^    ^     ^           ^           ^",
-+    "0 2 1 3 4",
-+);
-+
-+// getColumnOffsets correctly places the various parts of a SwitchStatement.
-+assertOffsetColumns(
-+    "function f(n) { switch(n) { default: print(n); } }",
-+    "                ^                    ^           ^",
-+);
-+
-+// getColumnOffsets correctly places the various parts of a BreakStatement.
-+assertOffsetColumns(
-+    "function f(n) { do { print(n); break; } while(false); }",
-+    "                ^    ^         ^                      ^",
-+);
-+
-+// getColumnOffsets correctly places the various parts of a ContinueStatement.
-+assertOffsetColumns(
-+    "function f(n) { do { print(n); continue; } while(false); }",
-+    "                ^    ^         ^                         ^",
-+);
-+
-+// getColumnOffsets correctly places the various parts of a WithStatement.
-+assertOffsetColumns(
-+    "function f(n) { with({}) { print(n); } }",
-+    "                ^          ^           ^",
-+);
-+
-+// getColumnOffsets correctly places the various parts of a IfStatement.
-+assertOffsetColumns(
-+    "function f(n) { if (n == 3) print(n); }",
-+    "                ^           ^         ^",
-+);
-+
-+// getColumnOffsets correctly places the various parts of a IfStatement
-+// with an if/else
-+assertOffsetColumns(
-+    "function f(n) { if (n == 2); else if (n === 3) print(n); }",
-+    "                ^                 ^            ^         ^",
-+);
-+
-+// getColumnOffsets correctly places the various parts of a DoWhileStatement.
-+assertOffsetColumns(
-+    "function f(n) { do { print(n); } while(false); }",
-+    "                ^    ^                         ^",
-+);

frg/work-js/mozilla-release/patches/series

@@ -544,6 +544,8 @@ NOBUG-20170803-promisehelper-57a1.patch
 1408939-59a1.patch
 1408934-59a1.patch
 1419301-59a1.patch
+1345433-1-59a1.patch
+1345433-2-59a1.patch
 1422314-59a1.patch
 1420594-1-59a1.patch
 1420594-2-59a1.patch
@@ -605,6 +607,7 @@ NOBUG-20170803-promisehelper-57a1.patch
 1424338-7-59a1.patch
 1419401-59a1.patch
 1424658-59a1.patch
+1424809-59a1.patch
 1411622-59a1.patch
 1293277-1-59a1.patch
 1293277-2-59a1.patch
@@ -706,6 +709,12 @@ NOBUG-20170803-promisehelper-57a1.patch
 1426920-59a1.patch
 1428231-59a1.patch
 1428043-59a1.patch
+1406161-1-59a1.patch
+1406161-2-59a1.patch
+1406161-3-59a1.patch
+1406161-4-59a1.patch
+1406161-5-59a1.patch
+1406161-6-59a1.patch
 1427392-59a1.patch
 1427187-59a1.patch
 1398981-59a1.patch
@@ -4946,7 +4955,15 @@ NOBUG-20231031-formattingfixes-253.patch
 1466121-7-62a1.patch
 1468137-62a1.patch
 1468219-62a1.patch
-taken-out-stuff-comes-here.patch
+1468252-1-62a1.patch
+1468252-2-62a1.patch
+1468252-3-62a1.patch
+1468252-4-62a1.patch
+1468252-5-62a1.patch
+1468252-6-62a1.patch
+1468252-7-62a1.patch
+1468252-8-62a1.patch
+1343620-62a1.patch
 1467752-62a1.patch
 1467751-62a1.patch
 1319228-3only-62a1.patch
@@ -4971,6 +4988,9 @@ taken-out-stuff-comes-here.patch
 1467319-1only-62a1.patch
 1466401-62a1.patch
 1467274-62a1.patch
+1468406-1-62a1.patch
+1468406-2-62a1.patch
+1468406-3-62a1.patch
 1468860-62a1.patch
 1459900-2-62a1.patch
 1459900-3-62a1.patch
@@ -4993,6 +5013,11 @@ taken-out-stuff-comes-here.patch
 1441098-3-62a1.patch
 1441098-4-62a1.patch
 1468792-62a1.patch
+1468406-4-62a1.patch
+1466503-1-62a1.patch
+1466503-2-62a1.patch
+1466503-3-62a1.patch
+1444202-62a1.patch
 1465709-2-62a1.patch
 1468811-1-62a1.patch
 1468811-2-62a1.patch
@@ -5001,8 +5026,14 @@ taken-out-stuff-comes-here.patch
 1437600-2-62a1.patch
 1470053-62a1.patch
 1453795-36-62a1.patch
+1453795-39-62a1.patch
+1470181-62a1.patch
+1469006-62a1.patch
+1465693-62a1.patch
 1480521-BACKOUT-60.patch
 1453795-41-62a1.patch
+1469640-62a1.patch
+1469786-62a1.patch
 1470492-62a1.patch
 1470494-1-62a1.patch
 1470494-2-62a1.patch
@@ -5018,11 +5049,21 @@ taken-out-stuff-comes-here.patch
 1467438-3-62a1.patch
 1467438-5-62a1.patch
 1450261-1-62a1.patch
+1469297-63a1.patch
+1468816-1-63a1.patch
+1468816-2-63a1.patch
 1442765-1-63a1.patch
 1442765-2-63a1.patch
 1466626-2no1-63a1.patch
 1466626-3-63a1.patch
 1398839-63a1.patch
+1407143-1-63a1.patch
+1407143-2-63a1.patch
+1407143-3-63a1.patch
+1407143-4-63a1.patch
+1407143-5-63a1.patch
+1407143-6-63a1.patch
+1407143-7-63a1.patch
 1466211-1-63a1.patch
 1466211-2-63a1.patch
 1466211-3-63a1.patch
@@ -5050,13 +5091,28 @@ taken-out-stuff-comes-here.patch
 1471261-2-63a1.patch
 1464257-63a1.patch
 1470250-1-63a1.patch
+1470250-2-63a1.patch
+1470250-3-63a1.patch
+1470250-4-63a1.patch
+1470250-5-63a1.patch
+1470250-6-63a1.patch
+1470250-7-63a1.patch
 1464782-1-63a1.patch
 1464782-2no34-63a1.patch
+1470522-63a1.patch
+1470904-1-63a1.patch
+1470904-2-63a1.patch
+1470992-63a1.patch
+1470732-1-63a1.patch
+1470732-2-63a1.patch
+1470732-3-63a1.patch
+1470890-63a1.patch
+1471361-63a1.patch
+taken-out-stuff-comes-here.patch
 1459900-4-63a1.patch
 1459900-5-63a1.patch
 1459900-6-63a1.patch
 1471289-63a1.patch
-1470522-63a1.patch
 1447591-1-63a1.patch
 1447591-2-63a1.patch
 1471272-63a1.patch
@@ -5162,6 +5218,7 @@ NOBUG-20180629-testingfunctions-63a1.patch
 1426909-1-63a1.patch
 1472066-3-63a1.patch
 1472066-4-63a1.patch
+1472639-63a1.patch
 1471134-1-63a1.patch
 1471134-2-63a1.patch
 1471134-3-63a1.patch
@@ -8134,6 +8191,7 @@ NOBUG-JSFIXUPS-25319.patch
 NOBUG-textrange-25319.patch
 
 
+
 ipc-start
 
 
@@ -8946,102 +9004,42 @@ L-1523003-67a1.patch
 
 
 
-
-
-
-
-
-
 X-1467327-62a1.patch
 
 
-
-
 webrender-start
 
 
 
-
-
-
-
-
 L-1770869-1-103a1.patch
 L-1770869-2-103a1.patch
 L-1770869-3-103a1.patch
 
 
-
-
-
-
-
 L-1610246-83a1.patch
 
 
-
-
-
-
 L-1443954-1-61a1.patch
 L-1443954-2-61a1.patch
 L-1443954-3-61a1.patch
-
-
-
-
-
-
-
-
-
-
-
 L-1770048-o9110.patch
 L-1735923-9110.patch
 L-1743767-9110-needs1616715.patch
 L-1754752-9111.patch
 L-1768734-9110.patch
-
-
-
-
-
-
-
-
-
-
-
-
-
 L-1547196-68a1.patch
 L-mozilla-esr78-push_507216.patch
 L-1492716-1-65a1.patch
 L-1492716-2-65a1.patch
 L-1492716-2_1no34-65a1.patch
 L-1528194-1-67a1.patch
-
-
-
 L-1504308-68a1.patch
 mozilla-esr68-push_500347.patch
 
-
-
-
-
-
 L-9999999-killtelemetrybrowser-25313.patch
 
 
 
-
-
-
-
-
-
 mozilla-56-release-top2.patch
 
 
@@ -9063,6 +9061,7 @@ js-patches-start
 
 mozilla-central_518695.patch
 js-patches-end
+
 mozilla-esr91-push_538632.patch
 mozilla-esr91-push_538633.patch
 mozilla-esr91-push_538634.patch
@@ -9072,8 +9071,6 @@ mozilla-esr91-push_542498.patch
 mozilla-esr91-push_542499.patch
 
 
-
-
 custom-elements-start
 mozilla-central_568579.patch
 custom-elements-end
@@ -9089,61 +9086,13 @@ L-1476327-63a1.patch
 L-1559195-70a1.patch
 L-1654146-80a1.patch
 L-1683226-01-86a1.patch
-
-
-
-
-
-
-
 L-1736243-917-needs1492573.patch
-
-
-
 L-NOBUG-20190902-indexdb-70a1.patch
-
-
-
-
-
-
-
-
-
-
-
-
 L-1478849-63a1-needs-1451363.patch
-
-
-
-
-
-
-
-
-
-
-
-
-
-
 L-1409018-3-63a1.patch
-
-
-
-
-
-
-
-
-
-
 L-1728413-916-reallybad.patch
 L-1745566-916.patch
 
-
-
 start-servo-58-patches
 mozilla-release58_438300.patch
 mozilla-release58_439057.patch
@@ -10916,33 +10865,10 @@ mozilla-central-push_421909.patch
 mozilla-central-push_422052.patch
 mozilla-central-push_422372.patch
 mozilla-central-push_422427.patch
-the-taken-out-stuff-start.patch
-I-am-here.patch
-aaaaaaaaaaaaaaaaaaaaaaa
-mozilla-central-push_422551.patch
-mozilla-central-push_422552.patch
-mozilla-central-push_422553.patch
-mozilla-central-push_422554.patch
-mozilla-central-push_422555.patch
-mozilla-central-push_422556.patch
-mozilla-central-push_422557.patch
-mozilla-central-push_422558.patch
 mozilla-central-push_422644.patch
-mozilla-central-push_422645.patch
 mozilla-central-push_422799.patch
 mozilla-central-push_422819.patch
 mozilla-central-push_422885.patch
-mozilla-central-push_422903.patch
-mozilla-central-push_422904.patch
-mozilla-central-push_422905.patch
-mozilla-central-push_422976.patch
-mozilla-central-push_423135.patch
-mozilla-central-push_423155.patch
-mozilla-central-push_423158.patch
-mozilla-central-push_423159.patch
-mozilla-central-push_423160.patch
-mozilla-central-push_423175.patch
-mozilla-central-push_423178.patch
 mozilla-central-push_423250.patch
 mozilla-central-push_423251.patch
 mozilla-central-push_423252.patch
@@ -10951,46 +10877,14 @@ mozilla-central-push_423254.patch
 mozilla-central-push_423255.patch
 mozilla-central-push_423256.patch
 mozilla-central-push_423257.patch
-mozilla-central-push_423265.patch
-mozilla-central-push_423286.patch
 mozilla-central-push_423303.patch
-mozilla-central-push_423362.patch
-mozilla-central-push_423363.patch
-mozilla-central-push_423385.patch
-mozilla-central-push_423440.patch
-mozilla-central-push_423535.patch
-mozilla-central-push_423542.patch
-mozilla-central-push_423543.patch
-mozilla-central-push_423550.patch
-mozilla-central-push_423624.patch
-mozilla-central-push_423625.patch
-mozilla-central-push_423644.patch
 mozilla-central-push_423645.patch
 mozilla-central-push_423646.patch
-mozilla-central-push_423655.patch
-mozilla-central-push_423656.patch
-mozilla-central-push_423657.patch
-mozilla-central-push_423658.patch
-mozilla-central-push_423659.patch
-mozilla-central-push_423660.patch
-mozilla-central-push_423661.patch
-mozilla-central-push_423672.patch
-mozilla-central-push_423673.patch
-mozilla-central-push_423674.patch
-mozilla-central-push_423675.patch
-mozilla-central-push_423676.patch
-mozilla-central-push_423677.patch
-mozilla-central-push_423678.patch
-mozilla-central-push_423808.patch
-mozilla-central-push_423829.patch
-mozilla-central-push_423830.patch
 mozilla-central-push_423859.patch
-mozilla-central-push_423910.patch
-mozilla-central-push_423916.patch
-mozilla-central-push_423917.patch
-mozilla-central-push_423918.patch
-mozilla-central-push_423920.patch
-mozilla-central-push_423922.patch
+
+the-taken-out-stuff-start.patch
+I-am-here.patch
+aaaaaaaaaaaaaaaaaaaaaaa
 mozilla-central-push_423923.patch
 mozilla-central-push_423927.patch
 mozilla-central-push_423988.patch
@@ -11086,7 +10980,6 @@ mozilla-central-push_425263.patch
 mozilla-central-push_425273.patch
 mozilla-central-push_425274.patch
 mozilla-central-push_425275.patch
-mozilla-central-push_425349.patch
 mozilla-central-push_425350.patch
 mozilla-central-push_425351.patch
 mozilla-central-push_425352.patch
@@ -11105,7 +10998,6 @@ mozilla-central-push_425367.patch
 mozilla-central-push_425368.patch
 mozilla-central-push_425369.patch
 mozilla-central-push_425384.patch
-mozilla-central-push_425385.patch
 mozilla-central-push_425388.patch
 mozilla-central-push_425389.patch
 mozilla-central-push_425391.patch
@@ -11113,8 +11005,6 @@ mozilla-central-push_425392.patch
 mozilla-central-push_425393.patch
 mozilla-central-push_425394.patch
 mozilla-central-push_425396.patch
-mozilla-central-push_425408.patch
-mozilla-central-push_425413.patch
 mozilla-central-push_425433.patch
 mozilla-central-push_425436.patch
 mozilla-central-push_425442.patch
@@ -11124,11 +11014,6 @@ mozilla-central-push_425462.patch
 mozilla-central-push_425499.patch
 mozilla-central-push_425511.patch
 mozilla-central-push_425512.patch
-mozilla-central-push_425615.patch
-mozilla-central-push_425616.patch
-mozilla-central-push_425617.patch
-mozilla-central-push_425618.patch
-mozilla-central-push_425619.patch
 mozilla-central-push_425634.patch
 mozilla-central-push_425637.patch
 mozilla-central-push_425638.patch
@@ -11139,16 +11024,12 @@ mozilla-central-push_425700.patch
 mozilla-central-push_425702.patch
 mozilla-central-push_425728.patch
 mozilla-central-push_425729.patch
-mozilla-central-push_425746.patch
 mozilla-central-push_425765.patch
 mozilla-central-push_426193.patch
 mozilla-central-push_426194.patch
 mozilla-central-push_426195.patch
 mozilla-central-push_426202.patch
 mozilla-central-push_426209.patch
-mozilla-central-push_426223.patch
-mozilla-central-push_426227.patch
-mozilla-central-push_426228.patch
 mozilla-central-push_426231.patch
 mozilla-central-push_426232.patch
 mozilla-central-push_426233.patch
@@ -12623,6 +12504,8 @@ mozilla-central-push_442436.patch
 
 bbbbbbbbbbbbbbbbbbbbbbbbbb
 1494752 check 604 patch
+1510145
+1520076
 1532851
 cccccccccccccccccccccccccccc
 

frg/work-js/mozilla-release/patches/series-test

@@ -544,6 +544,8 @@ NOBUG-20170803-promisehelper-57a1.patch
 1408939-59a1.patch
 1408934-59a1.patch
 1419301-59a1.patch
+1345433-1-59a1.patch
+1345433-2-59a1.patch
 1422314-59a1.patch
 1420594-1-59a1.patch
 1420594-2-59a1.patch
@@ -605,6 +607,7 @@ NOBUG-20170803-promisehelper-57a1.patch
 1424338-7-59a1.patch
 1419401-59a1.patch
 1424658-59a1.patch
+1424809-59a1.patch
 1411622-59a1.patch
 1293277-1-59a1.patch
 1293277-2-59a1.patch
@@ -706,6 +709,12 @@ NOBUG-20170803-promisehelper-57a1.patch
 1426920-59a1.patch
 1428231-59a1.patch
 1428043-59a1.patch
+1406161-1-59a1.patch
+1406161-2-59a1.patch
+1406161-3-59a1.patch
+1406161-4-59a1.patch
+1406161-5-59a1.patch
+1406161-6-59a1.patch
 1427392-59a1.patch
 1427187-59a1.patch
 1398981-59a1.patch
@@ -4946,6 +4955,15 @@ NOBUG-20231031-formattingfixes-253.patch
 1466121-7-62a1.patch
 1468137-62a1.patch
 1468219-62a1.patch
+1468252-1-62a1.patch
+1468252-2-62a1.patch
+1468252-3-62a1.patch
+1468252-4-62a1.patch
+1468252-5-62a1.patch
+1468252-6-62a1.patch
+1468252-7-62a1.patch
+1468252-8-62a1.patch
+1343620-62a1.patch
 1467752-62a1.patch
 1467751-62a1.patch
 1319228-3only-62a1.patch
@@ -4970,6 +4988,9 @@ NOBUG-20231031-formattingfixes-253.patch
 1467319-1only-62a1.patch
 1466401-62a1.patch
 1467274-62a1.patch
+1468406-1-62a1.patch
+1468406-2-62a1.patch
+1468406-3-62a1.patch
 1468860-62a1.patch
 1459900-2-62a1.patch
 1459900-3-62a1.patch
@@ -4992,6 +5013,11 @@ NOBUG-20231031-formattingfixes-253.patch
 1441098-3-62a1.patch
 1441098-4-62a1.patch
 1468792-62a1.patch
+1468406-4-62a1.patch
+1466503-1-62a1.patch
+1466503-2-62a1.patch
+1466503-3-62a1.patch
+1444202-62a1.patch
 1465709-2-62a1.patch
 1468811-1-62a1.patch
 1468811-2-62a1.patch
@@ -5000,8 +5026,14 @@ NOBUG-20231031-formattingfixes-253.patch
 1437600-2-62a1.patch
 1470053-62a1.patch
 1453795-36-62a1.patch
+1453795-39-62a1.patch
+1470181-62a1.patch
+1469006-62a1.patch
+1465693-62a1.patch
 1480521-BACKOUT-60.patch
 1453795-41-62a1.patch
+1469640-62a1.patch
+1469786-62a1.patch
 1470492-62a1.patch
 1470494-1-62a1.patch
 1470494-2-62a1.patch
@@ -5017,11 +5049,21 @@ NOBUG-20231031-formattingfixes-253.patch
 1467438-3-62a1.patch
 1467438-5-62a1.patch
 1450261-1-62a1.patch
+1469297-63a1.patch
+1468816-1-63a1.patch
+1468816-2-63a1.patch
 1442765-1-63a1.patch
 1442765-2-63a1.patch
 1466626-2no1-63a1.patch
 1466626-3-63a1.patch
 1398839-63a1.patch
+1407143-1-63a1.patch
+1407143-2-63a1.patch
+1407143-3-63a1.patch
+1407143-4-63a1.patch
+1407143-5-63a1.patch
+1407143-6-63a1.patch
+1407143-7-63a1.patch
 1466211-1-63a1.patch
 1466211-2-63a1.patch
 1466211-3-63a1.patch
@@ -5049,13 +5091,27 @@ NOBUG-20231031-formattingfixes-253.patch
 1471261-2-63a1.patch
 1464257-63a1.patch
 1470250-1-63a1.patch
+1470250-2-63a1.patch
+1470250-3-63a1.patch
+1470250-4-63a1.patch
+1470250-5-63a1.patch
+1470250-6-63a1.patch
+1470250-7-63a1.patch
 1464782-1-63a1.patch
 1464782-2no34-63a1.patch
+1470522-63a1.patch
+1470904-1-63a1.patch
+1470904-2-63a1.patch
+1470992-63a1.patch
+1470732-1-63a1.patch
+1470732-2-63a1.patch
+1470732-3-63a1.patch
+1470890-63a1.patch
+1471361-63a1.patch
 1459900-4-63a1.patch
 1459900-5-63a1.patch
 1459900-6-63a1.patch
 1471289-63a1.patch
-1470522-63a1.patch
 1447591-1-63a1.patch
 1447591-2-63a1.patch
 1471272-63a1.patch
@@ -5161,6 +5217,7 @@ NOBUG-20180629-testingfunctions-63a1.patch
 1426909-1-63a1.patch
 1472066-3-63a1.patch
 1472066-4-63a1.patch
+1472639-63a1.patch
 1471134-1-63a1.patch
 1471134-2-63a1.patch
 1471134-3-63a1.patch