backports

frg/work-js/comm-release/patches/1885748-brokentab-25319.patch

@@ -0,0 +1,34 @@
+# HG changeset patch
+# User Nuno Silva <nunojsg@gmail.com>
+# Date 1710615322 -3600
+# Parent  633fb46707fd3683e5512378c887c9b44bfbba50
+Bug 1885748 - Catch webNavigation error during tab restore. r=frg a=frg
+
+diff --git a/suite/browser/tabbrowser.xml b/suite/browser/tabbrowser.xml
+--- a/suite/browser/tabbrowser.xml
++++ b/suite/browser/tabbrowser.xml
+@@ -1944,17 +1944,23 @@
+             var hist = savedData.browserData.history;
+ 
+             this.tabContainer.appendChild(t);
+             if (t.previousSibling.selected)
+               t.setAttribute("afterselected", true);
+ 
+             // navigate back to the proper page from the light page
+             b.stop();
+-            b.webNavigation.gotoIndex(0);
++            try {
++              b.webNavigation.gotoIndex(0);
++            } catch (e) {
++              // Might happen if the to be restored tag contains an invalid
++              // navigation scheme.
++              Cu.reportError(e);
++           }
+ 
+             // reattach the old history
+             b.webNavigation.sessionHistory = hist;
+ 
+             // add back the filters, security first (bug 313335)
+             var secFlags = Ci.nsIWebProgress.NOTIFY_STATE_ALL |
+                            Ci.nsIWebProgress.NOTIFY_LOCATION |
+                            Ci.nsIWebProgress.NOTIFY_SECURITY;

frg/work-js/comm-release/patches/815638-125a1.patch

@@ -0,0 +1,145 @@
+# HG changeset patch
+# User Betterbird <betterbird@betterbird.eu>
+# Date 1710181085 25200
+# Node ID d177d69029eb8d4014c05affad575945c608b9df
+# Parent  f944244bdd904730981a49eae4652fe603e7a3ef
+Bug 815638 - Fix DSN for send later. r=mkmelin
+
+
+Based on https://github.com/Betterbird/thunderbird-patches/blob/main/115/bugs/815638-fix-DSN-send-later.patch
+
+Differential Revision: https://phabricator.services.mozilla.com/D204153
+
+diff --git a/mailnews/compose/src/nsMsgSendLater.cpp b/mailnews/compose/src/nsMsgSendLater.cpp
+--- a/mailnews/compose/src/nsMsgSendLater.cpp
++++ b/mailnews/compose/src/nsMsgSendLater.cpp
+@@ -33,16 +33,20 @@
+ #include "nsArrayUtils.h"
+ 
+ // Consts for checking and sending mail in milliseconds
+ 
+ // 1 second from mail into the unsent messages folder to initially trying to
+ // send it.
+ const uint32_t kInitialMessageSendTime = 1000;
+ 
++extern char* MimeHeaders_get_parameter(const char* header_value,
++                                       const char* parm_name, char** charset,
++                                       char** language);
++
+ NS_IMPL_ISUPPORTS(nsMsgSendLater,
+                    nsIMsgSendLater,
+                    nsIFolderListener,
+                    nsIRequestObserver,
+                    nsIStreamListener,
+                    nsIObserver,
+                    nsIUrlListener,
+                    nsIMsgShutdownTask)
+@@ -68,29 +72,31 @@ nsMsgSendLater::nsMsgSendLater()
+ 
+   m_bytesRead = 0;
+   m_position = 0;
+   m_flagsPosition = 0;
+   m_headersSize = 0;
+ 
+   mIdentityKey = nullptr;
+   mAccountKey = nullptr;
++  mDraftInfo = nullptr;
+ }
+ 
+ nsMsgSendLater::~nsMsgSendLater()
+ {
+   PR_Free(m_to);
+   PR_Free(m_fcc);
+   PR_Free(m_bcc);
+   PR_Free(m_newsgroups);
+   PR_Free(m_newshost);
+   PR_Free(m_headers);
+   PR_Free(mLeftoverBuffer);
+   PR_Free(mIdentityKey);
+   PR_Free(mAccountKey);
++  PR_Free(mDraftInfo);
+ }
+ 
+ nsresult
+ nsMsgSendLater::Init()
+ {
+   nsresult rv;
+   nsCOMPtr<nsIPrefBranch> prefs = do_GetService(NS_PREFSERVICE_CONTRACTID, &rv);
+   NS_ENSURE_SUCCESS(rv, rv);
+@@ -554,16 +560,34 @@ nsMsgSendLater::CompleteMailFileSend()
+   if (m_fcc)
+   {
+     fields->SetFcc(m_fcc);
+   }
+ 
+   if (m_newsgroups)
+     fields->SetNewsgroups(m_newsgroups);
+ 
++  // Extract the returnReceipt, receiptHeaderType and DSN from the draft info.
++  if (mDraftInfo) {
++    char* param =
++        MimeHeaders_get_parameter(mDraftInfo, "receipt", nullptr, nullptr);
++    if (!param || strcmp(param, "0") == 0) {
++      fields->SetReturnReceipt(false);
++    } else {
++      int receiptType = 0;
++      fields->SetReturnReceipt(true);
++      sscanf(param, "%d", &receiptType);
++      fields->SetReceiptHeaderType(((int32_t)receiptType) - 1);
++    }
++    PR_FREEIF(param);
++    param = MimeHeaders_get_parameter(mDraftInfo, "DSN", nullptr, nullptr);
++    fields->SetDSN(param && strcmp(param, "1") == 0);
++    PR_FREEIF(param);
++  }
++
+ #if 0
+   // needs cleanup. Is this needed?
+   if (m_newshost)
+     fields->SetNewspostUrl(m_newshost);
+ #endif
+ 
+   // Create the listener for the send operation...
+   RefPtr<SendOperationListener> sendListener = new SendOperationListener(this);
+@@ -1011,17 +1035,20 @@ nsMsgSendLater::BuildHeaders()
+       {
+         if (buf + strlen(HEADER_X_MOZILLA_STATUS2) == end &&
+           !PL_strncasecmp(HEADER_X_MOZILLA_STATUS2, buf, end - buf))
+           prune_p = true;
+         else if (buf + strlen(HEADER_X_MOZILLA_STATUS) == end &&
+           !PL_strncasecmp(HEADER_X_MOZILLA_STATUS, buf, end - buf))
+           prune_p = do_flags_p = true;
+         else if (!PL_strncasecmp(HEADER_X_MOZILLA_DRAFT_INFO, buf, end - buf))
++        {
+           prune_p = true;
++          header = &mDraftInfo;
++        }
+         else if (!PL_strncasecmp(HEADER_X_MOZILLA_KEYWORDS, buf, end - buf))
+           prune_p = true;
+         else if (!PL_strncasecmp(HEADER_X_MOZILLA_NEWSHOST, buf, end - buf))
+         {
+           prune_p = true;
+           header = &m_newshost;
+         }
+         else if (!PL_strncasecmp(HEADER_X_MOZILLA_IDENTITY_KEY, buf, end - buf))
+diff --git a/mailnews/compose/src/nsMsgSendLater.h b/mailnews/compose/src/nsMsgSendLater.h
+--- a/mailnews/compose/src/nsMsgSendLater.h
++++ b/mailnews/compose/src/nsMsgSendLater.h
+@@ -130,16 +130,17 @@ private:
+   int32_t                   m_headersPosition;
+   int32_t                   m_bytesRead;
+   int32_t                   m_position;
+   int32_t                   m_flagsPosition;
+   int32_t                   m_headersSize;
+   char                      *mLeftoverBuffer;
+   char                      *mIdentityKey;
+   char                      *mAccountKey;
++  char* mDraftInfo;
+ 
+   bool mSendingMessages;
+   bool mUserInitiated;
+   nsCOMPtr<nsIMsgIdentity> mIdentity;
+ };
+ 
+ 
+ #endif /* _nsMsgSendLater_H_ */

frg/work-js/comm-release/patches/series

@@ -2150,6 +2150,8 @@ TOP-1872623-cancelbookmark-25319.patch
 1353704-69a1.patch
 1879726-port1398229-25319.patch
 1445374-61a1.patch
+815638-125a1.patch
+1885748-brokentab-25319.patch
 
 253-release-top.patch
 9999999-disablemaint-comm-25318.patch

frg/work-js/comm-release/patches/series-test

@@ -2150,3 +2150,5 @@ TOP-1872623-cancelbookmark-25319.patch
 1353704-69a1.patch
 1879726-port1398229-25319.patch
 1445374-61a1.patch
+815638-125a1.patch
+1885748-brokentab-25319.patch

frg/work-js/mozilla-release/patches/1033916-1-63a1.patch

@@ -2,7 +2,7 @@
 # User Jeff Walden <jwalden@mit.edu>
 # Date 1534776368 25200
 # Node ID 67d5039dcbc2522e187bcf3dbec1c6e92bd32167
-# Parent  5f02bf24fc03807bbbd94b0b67fa6003b9e559a0
+# Parent  b7c1999a90c62bac529b6e8122428b84d0ed60e8
 Bug 1033916 - Move JSAutoByteString out of jsapi.h into js/public/AutoByteString.h, incidentally breaking the jsfriendapi.h -> jsapi.h dependency.  r=jandem
 
 diff --git a/dom/base/ChromeUtils.cpp b/dom/base/ChromeUtils.cpp
@@ -510,7 +510,7 @@ diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
 diff --git a/js/src/jsapi.h b/js/src/jsapi.h
 --- a/js/src/jsapi.h
 +++ b/js/src/jsapi.h
-@@ -4559,29 +4559,16 @@ JS_ConcatStrings(JSContext* cx, JS::Hand
+@@ -4514,29 +4514,16 @@ JS_ConcatStrings(JSContext* cx, JS::Hand
   * NB: This function does not store an additional zero byte or char16_t after the
   * transcoded string.
   */
@@ -540,13 +540,13 @@ diff --git a/js/src/jsapi.h b/js/src/jsapi.h
  JS_GetStringEncodingLength(JSContext* cx, JSString* str);
  
  /**
-@@ -4590,85 +4577,16 @@ JS_GetStringEncodingLength(JSContext* cx
+@@ -4545,85 +4532,16 @@ JS_GetStringEncodingLength(JSContext* cx
   * encoded into bytes with no error reported. Otherwise it returns the number
   * of bytes that are necessary to encode the string. If that exceeds the
   * length parameter, the string will be cut and only length bytes will be
   * written into the buffer.
   */
- JS_PUBLIC_API(size_t)
+ MOZ_MUST_USE JS_PUBLIC_API(bool)
  JS_EncodeStringToBuffer(JSContext* cx, JSString* str, char* buffer, size_t length);
  
 -class MOZ_RAII JSAutoByteString
@@ -672,7 +672,7 @@ diff --git a/js/src/jsexn.h b/js/src/jsexn.h
 diff --git a/js/src/jsfriendapi.cpp b/js/src/jsfriendapi.cpp
 --- a/js/src/jsfriendapi.cpp
 +++ b/js/src/jsfriendapi.cpp
-@@ -14,16 +14,17 @@
+@@ -15,16 +15,17 @@
  #ifdef ENABLE_BIGINT
  #include "builtin/BigInt.h"
  #endif
@@ -717,7 +717,7 @@ diff --git a/js/src/jsfriendapi.h b/js/src/jsfriendapi.h
 diff --git a/js/src/moz.build b/js/src/moz.build
 --- a/js/src/moz.build
 +++ b/js/src/moz.build
-@@ -118,16 +118,17 @@ EXPORTS += [
+@@ -119,16 +119,17 @@ EXPORTS += [
      'jsfriendapi.h',
      'jspubtd.h',
      'jstypes.h',
@@ -885,7 +885,7 @@ diff --git a/js/src/vm/ErrorObject.cpp b/js/src/vm/ErrorObject.cpp
 diff --git a/js/src/vm/Interpreter.cpp b/js/src/vm/Interpreter.cpp
 --- a/js/src/vm/Interpreter.cpp
 +++ b/js/src/vm/Interpreter.cpp
-@@ -24,16 +24,17 @@
+@@ -25,16 +25,17 @@
  #include "builtin/Eval.h"
  #include "builtin/ModuleObject.h"
  #include "builtin/String.h"

frg/work-js/mozilla-release/patches/1267297-63a1.patch

@@ -2,7 +2,7 @@
 # User Jan de Mooij <jdemooij@mozilla.com>
 # Date 1536080396 0
 # Node ID 04eb549952d0f5eae672a84407e111cdf2a8423e
-# Parent  e3a5e10edd2ec7fe9d2b02da35c7ab8f39b1d9da
+# Parent  f7a2172bff60a105e390311aefb0ada4e75f0c67
 Bug 1267297 - Use AutoEntryScript for script activity bookkeeping instead of the request machinery. r=bholley
 
 Differential Revision: https://phabricator.services.mozilla.com/D4085
@@ -329,7 +329,7 @@ diff --git a/js/xpconnect/src/XPCShellImpl.cpp b/js/xpconnect/src/XPCShellImpl.c
 diff --git a/js/xpconnect/src/xpcprivate.h b/js/xpconnect/src/xpcprivate.h
 --- a/js/xpconnect/src/xpcprivate.h
 +++ b/js/xpconnect/src/xpcprivate.h
-@@ -422,17 +422,24 @@ public:
+@@ -420,17 +420,24 @@ public:
  
      AutoMarkingPtr** GetAutoRootsAdr() {return &mAutoRoots;}
  
@@ -355,7 +355,7 @@ diff --git a/js/xpconnect/src/xpcprivate.h b/js/xpconnect/src/xpcprivate.h
      // at the top of XPCJSRuntime.cpp
      enum {
          IDX_CONSTRUCTOR             = 0 ,
-@@ -512,16 +519,18 @@ private:
+@@ -510,16 +517,18 @@ private:
      // 2. mSlowScriptSecondHalf was set to true
      // (whichever comes later). We use it to determine whether the interrupt
      // callback needs to do anything.
@@ -408,8 +408,8 @@ diff --git a/js/xpconnect/tests/unit/test_watchdog_hibernate.js b/js/xpconnect/t
 --- a/js/xpconnect/tests/unit/test_watchdog_hibernate.js
 +++ b/js/xpconnect/tests/unit/test_watchdog_hibernate.js
 @@ -18,23 +18,21 @@ async function testBody() {
-   Assert.ok(startHibernation < now);
-   Assert.ok(stopHibernation < now);
+   Assert.ok(startHibernation < now, "startHibernation ok");
+   Assert.ok(stopHibernation < now, "stopHibernation ok");
  
    // When the watchdog runs, it hibernates if there's been no activity for the
    // last 2 seconds, otherwise it sleeps for 1 second. As such, given perfect

frg/work-js/mozilla-release/patches/mozilla-central-push_425511.patch → frg/work-js/mozilla-release/patches/1333800-1only-63a1.patch

@@ -3,7 +3,7 @@
 # Date 1531126776 -7200
 #      Mon Jul 09 10:59:36 2018 +0200
 # Node ID a197a960866b4c074633f82d4984d792d4d6a1df
-# Parent  3da753ca1fb121f8a17a52fde9136773c8e0a270
+# Parent  ee713e2ab50997960e1bfb13fd455cf083998be2
 Bug 1333800 - Part a: Make non262/extensions/regress-50447-1.js more robust against changes in the filenames; rs=Waldo
 
 The next patch will pass absolute paths to the shell, and those will end up in
@@ -61,13 +61,14 @@ diff --git a/js/src/tests/non262/extensions/regress-50447-1.js b/js/src/tests/no
  
  
  
-+  var expectedLine = 10;
-   var expectedFileName = 'non262/extensions/regress-50447-1.js';
+-  var expectedFileName = 'js1_5/extensions/regress-50447-1.js';
 -  if (typeof document != "undefined") {
 -    expectedFileName = document.location.href.
 -      replace(/[^\/]*(\?.*)$/, '') +
 -      expectedFileName;
 -  }
++  var expectedLine = 10;
++  var expectedFileName = 'non262/extensions/regress-50447-1.js';
 +  var expectedSource = /\(new InternalError\("msg", "([^"]+)", ([0-9]+)\)\)/;
  
    var e = new InternalError ("msg");

frg/work-js/mozilla-release/patches/1412200-63a1.patch

@@ -1,6 +1,7 @@
 # HG changeset patch
 # User Tooru Fujisawa <arai_a@mac.com>
 # Date 1530259981 -32400
+#      Fri Jun 29 17:13:01 2018 +0900
 # Node ID 9877b8bc201ccdba981383b536bfb017cebb76ff
 # Parent  0cb385983de86b2013e3b8154175eab435d66259
 Bug 1412200 - Do not store the then property into thenable job if it is the original Promise.prototype.then. r=anba
@@ -248,4 +249,3 @@ diff --git a/js/src/builtin/Promise.cpp b/js/src/builtin/Promise.cpp
      // Step 1.
      RootedValue thenVal(cx);
      if (!GetProperty(cx, args.thisv(), cx->names().then, &thenVal))
-

frg/work-js/mozilla-release/patches/1416723-2-63a1.patch

@@ -2,7 +2,7 @@
 # User Benjamin Bouvier <benj@benj.me>
 # Date 1532438101 -7200
 # Node ID 4534ae540e86d686f29098cbcc2f932a6b83117b
-# Parent  2d786fee82f79c374da9d3ffb20a48abf56b3ce8
+# Parent  7ee4f4b8eaeafdda95702c39cc1b07de2f2460d2
 Bug 1416723: Remove SIMD.js support; r=luke, r=nbp
 
 diff --git a/dom/serviceworkers/test/test_serviceworker_interfaces.js.1416723-2.later b/dom/serviceworkers/test/test_serviceworker_interfaces.js.1416723-2.later
@@ -3038,7 +3038,7 @@ deleted file mode 100644
 diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctions.cpp
 --- a/js/src/builtin/TestingFunctions.cpp
 +++ b/js/src/builtin/TestingFunctions.cpp
-@@ -3971,22 +3971,17 @@ ShellCloneAndExecuteScript(JSContext* cx
+@@ -3976,22 +3976,17 @@ ShellCloneAndExecuteScript(JSContext* cx
      args.rval().setUndefined();
      return true;
  }
@@ -3336,7 +3336,7 @@ diff --git a/js/src/builtin/TypedObject.cpp b/js/src/builtin/TypedObject.cpp
          if (!properties.reserve(typedObj->length()))
              return false;
  
-@@ -2526,32 +2461,16 @@ js::GetTypedObjectModule(JSContext* cx, 
+@@ -2528,32 +2463,16 @@ js::GetTypedObjectModule(JSContext* cx, 
  {
      CallArgs args = CallArgsFromVp(argc, vp);
      Rooted<GlobalObject*> global(cx, cx->global());
@@ -3369,7 +3369,7 @@ diff --git a/js/src/builtin/TypedObject.cpp b/js/src/builtin/TypedObject.cpp
      MOZ_ASSERT(args.length() == 3);                                             \
      MOZ_ASSERT(args[0].isObject() && args[0].toObject().is<TypedObject>());     \
      MOZ_ASSERT(args[1].isInt32());                                              \
-@@ -2732,17 +2651,16 @@ visitReferences(TypeDescr& descr,
+@@ -2734,17 +2653,16 @@ visitReferences(TypeDescr& descr,
                  uint8_t* mem,
                  V& visitor)
  {
@@ -12160,7 +12160,7 @@ diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
  
      // Check for natives to which template objects can be attached. This is
      // done to provide templates to Ion for inlining these natives later on.
-@@ -2156,38 +2090,29 @@ GetTemplateObjectForNative(JSContext* cx
+@@ -2156,41 +2090,32 @@ GetTemplateObjectForNative(JSContext* cx
          return !!res;
      }
  
@@ -12179,6 +12179,9 @@ diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
  GetTemplateObjectForClassHook(JSContext* cx, JSNative hook, CallArgs& args,
                                MutableHandleObject templateObject)
  {
+     if (args.callee().nonCCWRealm() != cx->realm())
+         return true;
+ 
      if (hook == TypedObject::construct) {
          Rooted<TypeDescr*> descr(cx, &args.callee().as<TypeDescr>());
          templateObject.set(TypedObject::createZeroed(cx, descr, gc::TenuredHeap));
@@ -12280,7 +12283,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
  {
      js_delete(scriptCounts_);
  }
-@@ -6373,92 +6372,16 @@ CodeGenerator::visitNewTypedObject(LNewT
+@@ -6387,92 +6386,16 @@ CodeGenerator::visitNewTypedObject(LNewT
                                     StoreRegisterTo(object));
  
      TemplateObject templateObj(templateObject);
@@ -12373,7 +12376,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
  void
  CodeGenerator::visitNewNamedLambdaObject(LNewNamedLambdaObject* lir)
  {
-@@ -7169,17 +7092,17 @@ CodeGenerator::visitWasmCallI64(LWasmCal
+@@ -7193,17 +7116,17 @@ CodeGenerator::visitWasmCallI64(LWasmCal
  }
  
  void
@@ -12392,7 +12395,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
          masm.loadPtr(addr, tmp);
          addr = Address(tmp, 0);
      }
-@@ -7196,33 +7119,29 @@ CodeGenerator::visitWasmLoadGlobalVar(LW
+@@ -7220,33 +7143,29 @@ CodeGenerator::visitWasmLoadGlobalVar(LW
        // Aligned access: code is aligned on PageSize + there is padding
        // before the global data section.
        case MIRType::Int8x16:
@@ -12427,7 +12430,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
          masm.loadPtr(addr, tmp);
          addr = Address(tmp, 0);
      }
-@@ -7239,21 +7158,17 @@ CodeGenerator::visitWasmStoreGlobalVar(L
+@@ -7263,21 +7182,17 @@ CodeGenerator::visitWasmStoreGlobalVar(L
        // Aligned access: code is aligned on PageSize + there is padding
        // before the global data section.
        case MIRType::Int8x16:
@@ -12449,7 +12452,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
  void
  CodeGenerator::visitWasmLoadGlobalVarI64(LWasmLoadGlobalVarI64* ins)
  {
-@@ -10299,17 +10214,16 @@ CodeGenerator::link(JSContext* cx, Compi
+@@ -10323,17 +10238,16 @@ CodeGenerator::link(JSContext* cx, Compi
  
      RootedScript script(cx, gen->info().script());
      OptimizationLevel optimizationLevel = gen->optimizationInfo().level();
@@ -12467,7 +12470,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
          // Do a normal invalidate, except don't cancel offThread compilations,
          // since that will cancel this compilation too.
          Invalidate(cx, script, /* resetUses */ false, /* cancelOffThread*/ false);
-@@ -11523,29 +11437,27 @@ CodeGenerator::visitLoadUnboxedScalar(LL
+@@ -11547,29 +11461,27 @@ CodeGenerator::visitLoadUnboxedScalar(LL
  {
      Register elements = ToRegister(lir->elements());
      Register temp = lir->temp()->isBogusTemp() ? InvalidReg : ToRegister(lir->temp());
@@ -12499,7 +12502,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
  
  void
  CodeGenerator::visitLoadTypedArrayElementHole(LLoadTypedArrayElementHole* lir)
-@@ -11814,23 +11726,20 @@ CodeGenerator::visitLoadElementFromState
+@@ -11838,23 +11750,20 @@ CodeGenerator::visitLoadElementFromState
  
      addOutOfLineCode(jumpTable, lir->mir());
      masm.bind(&join);
@@ -12527,7 +12530,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
      }
  }
  
-@@ -11838,27 +11747,26 @@ void
+@@ -11862,27 +11771,26 @@ void
  CodeGenerator::visitStoreUnboxedScalar(LStoreUnboxedScalar* lir)
  {
      Register elements = ToRegister(lir->elements());
@@ -12810,7 +12813,7 @@ diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
  #include "jit/IonBuilder.h"
  #include "jit/IonIC.h"
  #include "jit/IonOptimizationLevels.h"
-@@ -438,27 +437,16 @@ JitRealm::performStubReadBarriers(uint32
+@@ -439,27 +438,16 @@ JitRealm::performStubReadBarriers(uint32
      while (stubsToBarrier) {
          auto stub = PopNextBitmaskValue<StubIndex>(&stubsToBarrier);
          const ReadBarrieredJitCode& jitCode = stubs_[stub];
@@ -12838,7 +12841,7 @@ diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
          return false;
      }
  
-@@ -643,21 +631,16 @@ JitRealm::sweep(JS::Realm* realm)
+@@ -644,21 +632,16 @@ JitRealm::sweep(JS::Realm* realm)
          if (!stubCodes_->lookup(it.key))
             it = BailoutReturnStubInfo();
      }
@@ -12860,7 +12863,7 @@ diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
      baselineCacheIRStubCodes_.sweep();
  }
  
-@@ -1478,27 +1461,16 @@ OptimizeMIR(MIRGenerator* mir)
+@@ -1479,27 +1462,16 @@ OptimizeMIR(MIRGenerator* mir)
              return false;
          gs.spewPass("Apply types");
          AssertExtendedGraphCoherency(graph);
@@ -12956,7 +12959,7 @@ diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
                                                    fieldPrediction,
                                                    fieldIndex);
  
-@@ -11716,20 +11702,16 @@ IonBuilder::setPropTryTypedObject(bool* 
+@@ -11717,20 +11703,16 @@ IonBuilder::setPropTryTypedObject(bool* 
  {
      TypedObjectPrediction fieldPrediction;
      size_t fieldOffset;
@@ -13039,7 +13042,7 @@ diff --git a/js/src/jit/IonBuilder.h b/js/src/jit/IonBuilder.h
      InliningResult inlineIsConstructor(CallInfo& callInfo);
      InliningResult inlineIsObject(CallInfo& callInfo);
      InliningResult inlineToObject(CallInfo& callInfo);
-     InliningResult inlineIsWrappedArrayConstructor(CallInfo& callInfo);
+     InliningResult inlineIsCrossRealmArrayConstructor(CallInfo& callInfo);
      InliningResult inlineToInteger(CallInfo& callInfo);
      InliningResult inlineToString(CallInfo& callInfo);
 diff --git a/js/src/jit/IonOptimizationLevels.cpp b/js/src/jit/IonOptimizationLevels.cpp
@@ -13881,7 +13884,7 @@ diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp
  #include "jit/IonBuilder.h"
  #include "jit/Lowering.h"
  #include "jit/MIR.h"
-@@ -253,38 +252,16 @@ IonBuilder::inlineNativeCall(CallInfo& c
+@@ -260,38 +259,16 @@ IonBuilder::inlineNativeCall(CallInfo& c
          return inlineObject(callInfo);
        case InlinableNative::ObjectCreate:
          return inlineObjectCreate(callInfo);
@@ -13920,11 +13923,11 @@ diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp
        case InlinableNative::TestAssertRecoveredOnBailout:
          return inlineAssertRecoveredOnBailout(callInfo);
  
-@@ -460,19 +437,16 @@ IonBuilder::InliningResult
- IonBuilder::inlineNonFunctionCall(CallInfo& callInfo, JSObject* target)
- {
-     // Inline a call to a non-function object, invoking the object's call or
-     // construct hook.
+@@ -476,19 +453,16 @@ IonBuilder::inlineNonFunctionCall(CallIn
+     if (callInfo.constructing() && callInfo.getNewTarget() != callInfo.fun()) {
+         trackOptimizationOutcome(TrackedOutcome::CantInlineUnexpectedNewTarget);
+         return InliningStatus_NotInlined;
+     }
  
      if (callInfo.constructing() && target->constructHook() == TypedObject::construct)
          return inlineConstructTypedObject(callInfo, &target->as<TypeDescr>());
@@ -13940,7 +13943,7 @@ diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp
  {
      return bytecodeTypes(pc);
  }
-@@ -3820,775 +3794,15 @@ IonBuilder::inlineConstructTypedObject(C
+@@ -3832,775 +3806,15 @@ IonBuilder::inlineConstructTypedObject(C
      MNewTypedObject* ins = MNewTypedObject::New(alloc(), constraints(), templateObject,
                                                  templateObject->group()->initialHeap(constraints()));
      current->add(ins);
@@ -16758,7 +16761,7 @@ diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
      TruncateKind operandTruncateKind(size_t index) const override;
  
      bool canConsumeFloat32(MUse* use) const override {
-@@ -14531,17 +13282,16 @@ class MAsmJSMemoryAccess
+@@ -14546,17 +13297,16 @@ class MAsmJSMemoryAccess
  
    public:
      explicit MAsmJSMemoryAccess(Scalar::Type accessType)
@@ -16776,7 +16779,7 @@ diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
      unsigned byteSize() const { return TypedArrayElemSize(accessType()); }
      bool needsBoundsCheck() const { return needsBoundsCheck_; }
  
-@@ -14841,17 +13591,17 @@ class MWasmLoadGlobalVar
+@@ -14856,17 +13606,17 @@ class MWasmLoadGlobalVar
  {
      MWasmLoadGlobalVar(MIRType type, unsigned globalDataOffset, bool isConstant, bool isIndirect,
                         MDefinition* tlsPtr)
@@ -17077,7 +17080,7 @@ diff --git a/js/src/jit/MacroAssembler.cpp b/js/src/jit/MacroAssembler.cpp
  {
      switch (arrayType) {
        case Scalar::Int8:
-@@ -3444,51 +3359,16 @@ void
+@@ -3452,51 +3367,16 @@ void
  MacroAssembler::branchIfInlineTypedObject(Register obj, Register scratch, Label* label)
  {
      loadObjClassUnsafe(obj, scratch);
@@ -17171,7 +17174,7 @@ diff --git a/js/src/jit/MacroAssembler.h b/js/src/jit/MacroAssembler.h
      inline void storeUncanonicalizedDouble(FloatRegister src, const BaseIndex& dest)
          DEFINED_ON(x86_shared, arm, arm64, mips32, mips64);
      inline void storeUncanonicalizedDouble(FloatRegister src, const Operand& dest)
-@@ -2145,17 +2140,17 @@ class MacroAssembler : public MacroAssem
+@@ -2146,17 +2141,17 @@ class MacroAssembler : public MacroAssem
          call(preBarrier);
          Pop(PreBarrierReg);
  
@@ -17190,7 +17193,7 @@ diff --git a/js/src/jit/MacroAssembler.h b/js/src/jit/MacroAssembler.h
      template<typename S, typename T>
      void storeToTypedIntArray(Scalar::Type arrayType, const S& value, const T& dest) {
          switch (arrayType) {
-@@ -2172,20 +2167,18 @@ class MacroAssembler : public MacroAssem
+@@ -2173,20 +2168,18 @@ class MacroAssembler : public MacroAssem
            case Scalar::Uint32:
              store32(value, dest);
              break;
@@ -19255,7 +19258,7 @@ diff --git a/js/src/jit/none/Lowering-none.h b/js/src/jit/none/Lowering-none.h
 diff --git a/js/src/jit/none/MacroAssembler-none.h b/js/src/jit/none/MacroAssembler-none.h
 --- a/js/src/jit/none/MacroAssembler-none.h
 +++ b/js/src/jit/none/MacroAssembler-none.h
-@@ -268,55 +268,34 @@ class MacroAssemblerNone : public Assemb
+@@ -270,55 +270,34 @@ class MacroAssemblerNone : public Assemb
      template <typename T> void movePtr(T, Register) { MOZ_CRASH(); }
      template <typename T> void move32(T, Register) { MOZ_CRASH(); }
      template <typename T, typename S> void movq(T, S) { MOZ_CRASH(); }
@@ -20244,7 +20247,7 @@ diff --git a/js/src/jit/shared/Lowering-shared-inl.h b/js/src/jit/shared/Lowerin
 diff --git a/js/src/jit/x64/Assembler-x64.h b/js/src/jit/x64/Assembler-x64.h
 --- a/js/src/jit/x64/Assembler-x64.h
 +++ b/js/src/jit/x64/Assembler-x64.h
-@@ -219,17 +219,17 @@ static constexpr uint32_t JitStackAlignm
+@@ -221,17 +221,17 @@ static constexpr uint32_t JitStackAlignm
  static constexpr uint32_t JitStackValueAlignment = JitStackAlignment / sizeof(Value);
  static_assert(JitStackAlignment % sizeof(Value) == 0 && JitStackValueAlignment >= 1,
    "Stack alignment should be a non-zero multiple of sizeof(Value)");
@@ -22216,7 +22219,7 @@ diff --git a/js/src/jit/x86-shared/MacroAssembler-x86-shared.h b/js/src/jit/x86-
 diff --git a/js/src/jit/x86/Assembler-x86.h b/js/src/jit/x86/Assembler-x86.h
 --- a/js/src/jit/x86/Assembler-x86.h
 +++ b/js/src/jit/x86/Assembler-x86.h
-@@ -136,17 +136,17 @@ static constexpr uint32_t JitStackAlignm
+@@ -138,17 +138,17 @@ static constexpr uint32_t JitStackAlignm
  static constexpr uint32_t JitStackValueAlignment = JitStackAlignment / sizeof(Value);
  static_assert(JitStackAlignment % sizeof(Value) == 0 && JitStackValueAlignment >= 1,
    "Stack alignment should be a non-zero multiple of sizeof(Value)");
@@ -22663,7 +22666,7 @@ diff --git a/js/src/jsfriendapi.h b/js/src/jsfriendapi.h
 diff --git a/js/src/moz.build b/js/src/moz.build
 --- a/js/src/moz.build
 +++ b/js/src/moz.build
-@@ -191,17 +191,16 @@ UNIFIED_SOURCES += [
+@@ -192,17 +192,16 @@ UNIFIED_SOURCES += [
      'builtin/JSON.cpp',
      'builtin/MapObject.cpp',
      'builtin/ModuleObject.cpp',
@@ -22737,12 +22740,12 @@ diff --git a/js/src/tests/jstests.list b/js/src/tests/jstests.list
  skip-if(!this.hasOwnProperty("Atomics")) include test262/built-ins/Atomics/jstests.list
  skip-if(!this.hasOwnProperty("SharedArrayBuffer")) include test262/built-ins/SharedArrayBuffer/jstests.list
  
- #####################################
- # Test262 tests disabled on browser #
- #####################################
+ # Skip Intl.RelativeTimeFormat tests when the addIntlExtras helper isn't available.
+ skip-if(!this.hasOwnProperty('addIntlExtras')) include test262/intl402/RelativeTimeFormat/jstests.list
+ 
  
- # Defines a non-configurable property on the WindowProxy object.
-@@ -344,29 +340,16 @@ skip script test262/annexB/language/eval
+ #####################################
+@@ -348,29 +344,16 @@ skip script test262/annexB/language/eval
  skip script test262/annexB/language/eval-code/indirect/global-switch-dflt-eval-global-existing-global-init.js
  skip script test262/annexB/language/eval-code/indirect/global-if-decl-no-else-eval-global-existing-global-init.js
  skip script test262/annexB/language/eval-code/indirect/global-if-decl-else-stmt-eval-global-existing-global-init.js
@@ -29907,8 +29910,8 @@ diff --git a/js/src/vm/SelfHosting.cpp b/js/src/vm/SelfHosting.cpp
      JS_INLINABLE_FN("ToObject",      intrinsic_ToObject,                1,0, IntrinsicToObject),
      JS_INLINABLE_FN("IsObject",      intrinsic_IsObject,                1,0, IntrinsicIsObject),
      JS_INLINABLE_FN("IsArray",       intrinsic_IsArray,                 1,0, ArrayIsArray),
-     JS_INLINABLE_FN("IsWrappedArrayConstructor", intrinsic_IsWrappedArrayConstructor, 1,0,
-                     IntrinsicIsWrappedArrayConstructor),
+     JS_INLINABLE_FN("IsCrossRealmArrayConstructor", intrinsic_IsCrossRealmArrayConstructor, 1,0,
+                     IntrinsicIsCrossRealmArrayConstructor),
      JS_INLINABLE_FN("ToInteger",     intrinsic_ToInteger,               1,0, IntrinsicToInteger),
      JS_INLINABLE_FN("ToString",      intrinsic_ToString,                1,0, IntrinsicToString),
 @@ -2619,17 +2605,16 @@ static const JSFunctionSpec intrinsic_fu
@@ -29932,7 +29935,7 @@ diff --git a/js/src/vm/SelfHosting.cpp b/js/src/vm/SelfHosting.cpp
 diff --git a/js/src/vm/TypedArrayObject.cpp b/js/src/vm/TypedArrayObject.cpp
 --- a/js/src/vm/TypedArrayObject.cpp
 +++ b/js/src/vm/TypedArrayObject.cpp
-@@ -1800,20 +1800,16 @@ TypedArrayObject::getElement(uint32_t in
+@@ -1799,20 +1799,16 @@ TypedArrayObject::getElement(uint32_t in
          return Uint32Array::getIndexValue(this, index);
        case Scalar::Float32:
          return Float32Array::getIndexValue(this, index);
@@ -29953,7 +29956,7 @@ diff --git a/js/src/vm/TypedArrayObject.cpp b/js/src/vm/TypedArrayObject.cpp
  }
  
  void
-@@ -1850,20 +1846,16 @@ TypedArrayObject::setElement(TypedArrayO
+@@ -1849,20 +1845,16 @@ TypedArrayObject::setElement(TypedArrayO
          return;
        case Scalar::Float32:
          Float32Array::setIndexValue(obj, index, d);
@@ -33057,7 +33060,7 @@ diff --git a/js/src/wasm/AsmJS.cpp b/js/src/wasm/AsmJS.cpp
 diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompile.cpp
 --- a/js/src/wasm/WasmBaselineCompile.cpp
 +++ b/js/src/wasm/WasmBaselineCompile.cpp
-@@ -9041,17 +9041,17 @@ BaseCompiler::emitAtomicCmpXchg(ValType 
+@@ -9045,17 +9045,17 @@ BaseCompiler::emitAtomicCmpXchg(ValType 
  
      if (!iter_.readAtomicCmpXchg(&addr, type, Scalar::byteSize(viewType), &unused, &unused))
          return false;
@@ -33076,7 +33079,7 @@ diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompi
          RegI32 rp = popMemoryAccess(&access, &check);
          RegI32 tls = maybeLoadTlsForAccess(check);
  
-@@ -9097,17 +9097,17 @@ BaseCompiler::emitAtomicLoad(ValType typ
+@@ -9101,17 +9101,17 @@ BaseCompiler::emitAtomicLoad(ValType typ
      LinearMemoryAddress<Nothing> addr;
      if (!iter_.readAtomicLoad(&addr, type, Scalar::byteSize(viewType)))
          return false;
@@ -33095,7 +33098,7 @@ diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompi
  
  #if defined(JS_64BIT)
      MOZ_CRASH("Should not happen");
-@@ -9141,17 +9141,17 @@ BaseCompiler::emitAtomicRMW(ValType type
+@@ -9145,17 +9145,17 @@ BaseCompiler::emitAtomicRMW(ValType type
      Nothing unused_value;
      if (!iter_.readAtomicRMW(&addr, type, Scalar::byteSize(viewType), &unused_value))
          return false;
@@ -33114,7 +33117,7 @@ diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompi
          RegI32 rp = popMemoryAccess(&access, &check);
          RegI32 tls = maybeLoadTlsForAccess(check);
  
-@@ -9204,17 +9204,17 @@ BaseCompiler::emitAtomicStore(ValType ty
+@@ -9208,17 +9208,17 @@ BaseCompiler::emitAtomicStore(ValType ty
      Nothing unused_value;
      if (!iter_.readAtomicStore(&addr, type, Scalar::byteSize(viewType), &unused_value))
          return false;
@@ -33133,7 +33136,7 @@ diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompi
  
  #ifdef JS_64BIT
      MOZ_CRASH("Should not happen");
-@@ -9232,17 +9232,17 @@ BaseCompiler::emitAtomicXchg(ValType typ
+@@ -9236,17 +9236,17 @@ BaseCompiler::emitAtomicXchg(ValType typ
      if (!iter_.readAtomicRMW(&addr, type, Scalar::byteSize(viewType), &unused_value))
          return false;
  
@@ -33358,7 +33361,7 @@ diff --git a/js/src/wasm/WasmInstance.cpp b/js/src/wasm/WasmInstance.cpp
  #include "wasm/WasmBuiltins.h"
  #include "wasm/WasmModule.h"
  
-@@ -137,23 +136,16 @@ Instance::callImport(JSContext* cx, uint
+@@ -139,23 +138,16 @@ Instance::callImport(JSContext* cx, uint
              args[i].set(JS::CanonicalizedDoubleValue(*(double*)&argv[i]));
              break;
            case ValType::Ref:
@@ -33380,9 +33383,9 @@ diff --git a/js/src/wasm/WasmInstance.cpp b/js/src/wasm/WasmInstance.cpp
  
      FuncImportTls& import = funcImportTls(fi);
      RootedFunction importFun(cx, &import.obj->as<JSFunction>());
-     RootedValue fval(cx, ObjectValue(*import.obj));
-     RootedValue thisv(cx, UndefinedValue());
-@@ -207,23 +199,16 @@ Instance::callImport(JSContext* cx, uint
+     MOZ_ASSERT(cx->realm() == importFun->realm());
+ 
+@@ -211,23 +203,16 @@ Instance::callImport(JSContext* cx, uint
          TypeSet::Type type = TypeSet::UnknownType();
          switch (importArgs[i].code()) {
            case ValType::I32:    type = TypeSet::Int32Type(); break;
@@ -33406,7 +33409,7 @@ diff --git a/js/src/wasm/WasmInstance.cpp b/js/src/wasm/WasmInstance.cpp
      // These arguments will be filled with undefined at runtime by the
      // arguments rectifier: check that the imported function can handle
      // undefined there.
-@@ -793,22 +778,22 @@ Instance::callExport(JSContext* cx, uint
+@@ -805,22 +790,22 @@ Instance::callExport(JSContext* cx, uint
  
      if (func.funcType().hasI64ArgOrRet()) {
          JS_ReportErrorNumberUTF8(cx, GetErrorMessage, nullptr, JSMSG_WASM_BAD_I64_TYPE);
@@ -33435,7 +33438,7 @@ diff --git a/js/src/wasm/WasmInstance.cpp b/js/src/wasm/WasmInstance.cpp
      for (unsigned i = 0; i < func.funcType().args().length(); ++i) {
          v = i < args.length() ? args[i] : UndefinedValue();
          switch (func.funcType().arg(i).code()) {
-@@ -827,68 +812,16 @@ Instance::callExport(JSContext* cx, uint
+@@ -839,68 +824,16 @@ Instance::callExport(JSContext* cx, uint
                  return false;
              break;
            case ValType::Ref:
@@ -33504,7 +33507,7 @@ diff --git a/js/src/wasm/WasmInstance.cpp b/js/src/wasm/WasmInstance.cpp
  
          void* callee;
          if (func.hasEagerStubs())
-@@ -933,51 +866,16 @@ Instance::callExport(JSContext* cx, uint
+@@ -945,51 +878,16 @@ Instance::callExport(JSContext* cx, uint
        case ExprType::F64:
          args.rval().set(NumberValue(*(double*)retAddr));
          break;
@@ -34910,7 +34913,7 @@ diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
      obj->initReservedSlot(MUTABLE_SLOT, JS::BooleanValue(isMutable));
      obj->initReservedSlot(CELL_SLOT, PrivateValue(cell));
  
-@@ -2306,17 +2292,16 @@ WasmGlobalObject::construct(JSContext* c
+@@ -2305,17 +2291,16 @@ WasmGlobalObject::construct(JSContext* c
              return false;
      } else {
          switch (globalType.code()) {
@@ -34928,7 +34931,7 @@ diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
      if (!global)
          return false;
  
-@@ -2338,17 +2323,16 @@ WasmGlobalObject::valueGetterImpl(JSCont
+@@ -2337,17 +2322,16 @@ WasmGlobalObject::valueGetterImpl(JSCont
        case ValType::F32:
        case ValType::F64:
        case ValType::AnyRef:
@@ -34946,7 +34949,7 @@ diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
  
  /* static */ bool
  WasmGlobalObject::valueGetter(JSContext* cx, unsigned argc, Value* vp)
-@@ -2389,17 +2373,16 @@ WasmGlobalObject::valueSetterImpl(JSCont
+@@ -2388,17 +2372,16 @@ WasmGlobalObject::valueSetterImpl(JSCont
        case ValType::AnyRef: {
          JSObject* prevPtr = cell->ptr;
          JSObject::writeBarrierPre(prevPtr);
@@ -34964,7 +34967,7 @@ diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
  
      args.rval().setUndefined();
      return true;
-@@ -2445,17 +2428,16 @@ WasmGlobalObject::val(MutableHandleVal o
+@@ -2444,17 +2427,16 @@ WasmGlobalObject::val(MutableHandleVal o
  {
      Cell* cell = this->cell();
      switch (type().code()) {
@@ -35466,12 +35469,12 @@ diff --git a/js/src/wasm/WasmOpIter.h b/js/src/wasm/WasmOpIter.h
          known = true;
          break;
        case uint8_t(ExprType::Ref):
-         known = env_.gcTypesEnabled == HasGcTypes::True;
+         known = env_.gcTypesEnabled == HasGcTypes::True &&
+                 uncheckedRefTypeIndex < MaxTypes &&
+                 uncheckedRefTypeIndex < env_.types.length();
          break;
        case uint8_t(ExprType::AnyRef):
-         known = env_.gcTypesEnabled == HasGcTypes::True;
-         break;
-@@ -1686,86 +1615,16 @@ OpIter<Policy>::readF64Const(double* f64
+@@ -1688,86 +1617,16 @@ OpIter<Policy>::readF64Const(double* f64
      MOZ_ASSERT(Classify(op_) == OpKind::F64);
  
      return readFixedF64(f64) &&
@@ -35558,7 +35561,7 @@ diff --git a/js/src/wasm/WasmOpIter.h b/js/src/wasm/WasmOpIter.h
      if (!d_.readValType(&code, &refTypeIndex))
          return fail("unknown nullref type");
      if (code == uint8_t(TypeCode::Ref)) {
-@@ -2139,213 +1998,16 @@ OpIter<Policy>::readOldAtomicExchange(Li
+@@ -2141,213 +2000,16 @@ OpIter<Policy>::readOldAtomicExchange(Li
          return false;
  
      infalliblePush(ValType::I32);
@@ -35936,7 +35939,7 @@ diff --git a/js/src/wasm/WasmStubs.cpp b/js/src/wasm/WasmStubs.cpp
      MOZ_ASSERT(masm.framePushed() == 0);
  #ifdef JS_CODEGEN_ARM64
      masm.loadPtr(Address(sp, 0), lr);
-@@ -1204,24 +1158,16 @@ GenerateImportInterpExit(MacroAssembler&
+@@ -1207,24 +1161,16 @@ GenerateImportInterpExit(MacroAssembler&
          masm.loadDouble(argv, ReturnDoubleReg);
          break;
        case ExprType::Ref:
@@ -35961,7 +35964,7 @@ diff --git a/js/src/wasm/WasmStubs.cpp b/js/src/wasm/WasmStubs.cpp
      // are non-volatile.
      MOZ_ASSERT(NonVolatileRegs.has(WasmTlsReg));
  #if defined(JS_CODEGEN_X64) || \
-@@ -1385,24 +1331,16 @@ GenerateImportJitExit(MacroAssembler& ma
+@@ -1388,24 +1334,16 @@ GenerateImportJitExit(MacroAssembler& ma
          masm.convertValueToDouble(JSReturnOperand, ReturnDoubleReg, &oolConvert);
          break;
        case ExprType::Ref:
@@ -35986,7 +35989,7 @@ diff --git a/js/src/wasm/WasmStubs.cpp b/js/src/wasm/WasmStubs.cpp
      masm.bind(&done);
  
      GenerateJitExitEpilogue(masm, masm.framePushed(), offsets);
-@@ -1590,21 +1528,23 @@ static const LiveRegisterSet RegsToPrese
+@@ -1593,21 +1531,23 @@ static const LiveRegisterSet RegsToPrese
  static_assert(!SupportsSimd, "high lanes of SIMD registers need to be saved too.");
  #elif defined(JS_CODEGEN_ARM64)
  // We assume that traps do not happen while lr is live. This both ensures that
@@ -36012,7 +36015,7 @@ diff --git a/js/src/wasm/WasmStubs.cpp b/js/src/wasm/WasmStubs.cpp
  GenerateTrapExit(MacroAssembler& masm, Label* throwLabel, Offsets* offsets)
  {
      AssertExpectedSP(masm);
-@@ -1651,23 +1591,22 @@ GenerateTrapExit(MacroAssembler& masm, L
+@@ -1654,23 +1594,22 @@ GenerateTrapExit(MacroAssembler& masm, L
  #else
      masm.ret();
  #endif

frg/work-js/mozilla-release/patches/1426721-1-60a1.patch

@@ -0,0 +1,370 @@
+# HG changeset patch
+# User Doug Thayer <dothayer@mozilla.com>
+# Date 1516730791 28800
+# Node ID df447e1b1a3879756ca210491bfc6802f81909ce
+# Parent  faed66e0c231e918e2a5101776474a9e562887bb
+Bug 1426721 - Add async/bulk encryption interface to SDR r=keeler,MattN
+
+Since encryption can be somewhat CPU intensive, if we're encrypting
+a large number of strings we want to be able to do so in a background
+thread. This will be consumed by the profile migrators when importing
+logins.
+
+MozReview-Commit-ID: JoJGOgMzZ4u
+
+diff --git a/security/manager/ssl/SecretDecoderRing.cpp b/security/manager/ssl/SecretDecoderRing.cpp
+--- a/security/manager/ssl/SecretDecoderRing.cpp
++++ b/security/manager/ssl/SecretDecoderRing.cpp
+@@ -5,32 +5,67 @@
+  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+ 
+ #include "SecretDecoderRing.h"
+ 
+ #include "ScopedNSSTypes.h"
+ #include "mozilla/Base64.h"
+ #include "mozilla/Casting.h"
+ #include "mozilla/Services.h"
++#include "mozilla/ErrorResult.h"
++#include "mozilla/dom/Promise.h"
+ #include "nsCOMPtr.h"
+ #include "nsIInterfaceRequestor.h"
+ #include "nsIInterfaceRequestorUtils.h"
+ #include "nsIObserverService.h"
+ #include "nsIServiceManager.h"
+ #include "nsITokenPasswordDialogs.h"
+ #include "nsNSSComponent.h"
+ #include "nsNSSHelper.h"
+ #include "pk11func.h"
+ #include "pk11sdr.h" // For PK11SDR_Encrypt, PK11SDR_Decrypt
+ #include "ssl.h" // For SSL_ClearSessionCache
+ 
+ using namespace mozilla;
++using dom::Promise;
+ 
++// -// NOTE: Should these be the thread-safe versions?
+ NS_IMPL_ISUPPORTS(SecretDecoderRing, nsISecretDecoderRing)
+ 
++void BackgroundSdrEncryptStrings(const nsTArray<nsCString>& plaintexts,
++                                 RefPtr<Promise>& aPromise) {
++  nsCOMPtr<nsISecretDecoderRing> sdrService =
++    do_GetService(NS_SECRETDECODERRING_CONTRACTID);
++  InfallibleTArray<nsString> cipherTexts(plaintexts.Length());
++
++  nsresult rv = NS_ERROR_FAILURE;
++  for (uint32_t i = 0; i < plaintexts.Length(); ++i) {
++    const nsCString& plaintext = plaintexts[i];
++    nsCString cipherText;
++    rv = sdrService->EncryptString(plaintext, cipherText);
++
++    if (NS_WARN_IF(NS_FAILED(rv))) {
++      break;
++    }
++
++    cipherTexts.AppendElement(NS_ConvertASCIItoUTF16(cipherText));
++  }
++
++  nsCOMPtr<nsIRunnable> runnable(
++    NS_NewRunnableFunction("BackgroundSdrEncryptStringsResolve",
++                           [rv, aPromise = std::move(aPromise), cipherTexts = std::move(cipherTexts)]() {                             
++                             if (NS_FAILED(rv)) {
++                               aPromise->MaybeReject(rv);
++                             } else {
++                               aPromise->MaybeResolve(cipherTexts);
++                             }
++                           }));
++  NS_DispatchToMainThread(runnable);
++}
++
+ nsresult
+ SecretDecoderRing::Encrypt(const nsACString& data, /*out*/ nsACString& result)
+ {
+   UniquePK11SlotInfo slot(PK11_GetInternalKeySlot());
+   if (!slot) {
+     return NS_ERROR_NOT_AVAILABLE;
+   }
+ 
+@@ -103,16 +138,61 @@ SecretDecoderRing::EncryptString(const n
+   if (NS_FAILED(rv)) {
+     return rv;
+   }
+ 
+   return NS_OK;
+ }
+ 
+ NS_IMETHODIMP
++SecretDecoderRing::AsyncEncryptStrings(uint32_t plaintextsCount,
++                                       const char16_t** plaintexts,
++                                       JSContext* aCx,
++                                       nsISupports** aPromise) {
++  MOZ_RELEASE_ASSERT(NS_IsMainThread());
++  NS_ENSURE_ARG(plaintextsCount);
++  NS_ENSURE_ARG_POINTER(plaintexts);
++  NS_ENSURE_ARG_POINTER(aCx);
++
++  nsIGlobalObject* globalObject =
++    xpc::NativeGlobal(JS::CurrentGlobalOrNull(aCx));
++
++  if (NS_WARN_IF(!globalObject)) {
++    return NS_ERROR_UNEXPECTED;
++  }
++
++  ErrorResult result;
++  RefPtr<Promise> promise = Promise::Create(globalObject, result);
++  if (NS_WARN_IF(result.Failed())) {
++    return result.StealNSResult();
++  }
++
++  InfallibleTArray<nsCString> plaintextsUtf8(plaintextsCount);
++  for (uint32_t i = 0; i < plaintextsCount; ++i) {
++    plaintextsUtf8.AppendElement(NS_ConvertUTF16toUTF8(plaintexts[i]));
++  }
++  nsCOMPtr<nsIRunnable> runnable(
++    NS_NewRunnableFunction("BackgroundSdrEncryptStrings",
++      [promise, plaintextsUtf8 = std::move(plaintextsUtf8)]() mutable {
++        BackgroundSdrEncryptStrings(plaintextsUtf8, promise);
++      }));
++
++  nsCOMPtr<nsIThread> encryptionThread;
++  nsresult rv = NS_NewNamedThread("AsyncSDRThread",
++                                  getter_AddRefs(encryptionThread),
++                                  runnable);
++  if (NS_WARN_IF(NS_FAILED(rv))) {
++    return rv;
++  }
++
++  promise.forget(aPromise);
++  return NS_OK;
++}
++
++NS_IMETHODIMP
+ SecretDecoderRing::DecryptString(const nsACString& encryptedBase64Text,
+                          /*out*/ nsACString& decryptedText)
+ {
+   nsAutoCString encryptedText;
+   nsresult rv = Base64Decode(encryptedBase64Text, encryptedText);
+   if (NS_FAILED(rv)) {
+     return rv;
+   }
+diff --git a/security/manager/ssl/SecretDecoderRing.h b/security/manager/ssl/SecretDecoderRing.h
+--- a/security/manager/ssl/SecretDecoderRing.h
++++ b/security/manager/ssl/SecretDecoderRing.h
+@@ -13,17 +13,17 @@
+ #define NS_SECRETDECODERRING_CONTRACTID "@mozilla.org/security/sdr;1"
+ 
+ #define NS_SECRETDECODERRING_CID \
+   { 0x0c4f1ddc, 0x1dd2, 0x11b2, { 0x9d, 0x95, 0xf2, 0xfd, 0xf1, 0x13, 0x04, 0x4b } }
+ 
+ class SecretDecoderRing : public nsISecretDecoderRing
+ {
+ public:
+-  NS_DECL_ISUPPORTS
++  NS_DECL_THREADSAFE_ISUPPORTS
+   NS_DECL_NSISECRETDECODERRING
+ 
+   SecretDecoderRing() {}
+ 
+ protected:
+   virtual ~SecretDecoderRing() {}
+ 
+ private:
+diff --git a/security/manager/ssl/nsISecretDecoderRing.idl b/security/manager/ssl/nsISecretDecoderRing.idl
+--- a/security/manager/ssl/nsISecretDecoderRing.idl
++++ b/security/manager/ssl/nsISecretDecoderRing.idl
+@@ -18,16 +18,30 @@ interface nsISecretDecoderRing: nsISuppo
+    *
+    * @param text The text to encrypt.
+    * @return The encrypted text, encoded as Base64.
+    */
+   [must_use]
+   ACString encryptString(in ACString text);
+ 
+   /**
++   * Run encryptString on multiple strings, asynchronously. This will allow you
++   * to not jank the browser if you need to encrypt a large number of strings
++   * all at once. This method accepts an array of wstrings which it will convert
++   * to UTF-8 internally before encrypting.
++   *
++   * @param plaintextsCount the number of strings to encrypt.
++   * @param plaintexts the strings to encrypt.
++   * @return A promise for the list of encrypted strings, encoded as Base64.
++   */
++  [implicit_jscontext, must_use]
++  nsISupports asyncEncryptStrings(in unsigned long plaintextsCount,
++                                  [array, size_is(plaintextsCount)] in wstring plaintexts);
++
++  /**
+    * Decrypt Base64 input.
+    * See the encryptString() documentation - this method has basically the same
+    * limitations.
+    *
+    * @param encryptedBase64Text Encrypted input text, encoded as Base64.
+    * @return The decoded text.
+    */
+   [must_use]
+diff --git a/security/manager/ssl/tests/unit/test_sdr.js b/security/manager/ssl/tests/unit/test_sdr.js
+--- a/security/manager/ssl/tests/unit/test_sdr.js
++++ b/security/manager/ssl/tests/unit/test_sdr.js
+@@ -16,17 +16,17 @@ const gTokenPasswordDialogs = {
+     info(`setPassword() called; shown ${gSetPasswordShownCount} times`);
+     info(`tokenName: ${tokenName}`);
+     return false; // Returning false means "the user didn't cancel".
+   },
+ 
+   QueryInterface: XPCOMUtils.generateQI([Ci.nsITokenPasswordDialogs])
+ };
+ 
+-function run_test() {
++add_task(function testEncryptString() {
+   let sdr = Cc["@mozilla.org/security/sdr;1"]
+               .getService(Ci.nsISecretDecoderRing);
+ 
+   // Test valid inputs for encryptString() and decryptString().
+   let inputs = [
+     "",
+     " ", // First printable latin1 character (code point 32).
+     "foo",
+@@ -73,9 +73,47 @@ function run_test() {
+     });
+ 
+     equal(gSetPasswordShownCount, 0,
+           "changePassword() dialog should have been shown zero times");
+     sdr.changePassword();
+     equal(gSetPasswordShownCount, 1,
+           "changePassword() dialog should have been shown exactly once");
+   }
+-}
++});
++
++add_task(async function testAsyncEncryptStrings() {
++  let sdr = Cc["@mozilla.org/security/sdr;1"]
++              .getService(Ci.nsISecretDecoderRing);
++
++  // Test valid inputs for encryptString() and decryptString().
++  let inputs = [
++    "",
++    " ", // First printable latin1 character (code point 32).
++    "foo",
++    "1234567890`~!@#$%^&*()-_=+{[}]|\\:;'\",<.>/?",
++    "¡äöüÿ", // Misc + last printable latin1 character (code point 255).
++    "aaa 一二三", // Includes Unicode with code points outside [0, 255].
++  ];
++
++  let encrypteds = await sdr.asyncEncryptStrings(inputs.length, inputs);
++  for (let i = 0; i < inputs.length; i++) {
++    let encrypted = encrypteds[i];
++    let input = inputs[i];
++    let converter = Cc["@mozilla.org/intl/scriptableunicodeconverter"]
++                      .createInstance(Ci.nsIScriptableUnicodeConverter);
++    converter.charset = "UTF-8";
++
++    let convertedInput = converter.ConvertFromUnicode(input);
++    convertedInput += converter.Finish();
++    notEqual(convertedInput, encrypted,
++             "Encrypted input should not just be the input itself");
++
++    try {
++      atob(encrypted);
++    } catch (e) {
++      ok(false, `encryptString() should have returned Base64: ${e}`);
++    }
++
++    equal(convertedInput, sdr.decryptString(encrypted),
++          "decryptString(encryptString(input)) should return input");
++  }
++});
+diff --git a/toolkit/components/passwordmgr/crypto-SDR.js b/toolkit/components/passwordmgr/crypto-SDR.js
+--- a/toolkit/components/passwordmgr/crypto-SDR.js
++++ b/toolkit/components/passwordmgr/crypto-SDR.js
+@@ -93,16 +93,61 @@ LoginManagerCrypto_SDR.prototype = {
+       else if (canceledMP)
+         this._notifyObservers("passwordmgr-crypto-loginCanceled");
+     }
+     return cipherText;
+   },
+ 
+ 
+   /*
++   * encryptMany
++   *
++   * Encrypts the specified strings, using the SecretDecoderRing.
++   *
++   * Returns a promise which resolves with the the encrypted strings,
++   * or throws/rejects with an error if there was a problem.
++   */
++  async encryptMany(plaintexts) {
++    if (!Array.isArray(plaintexts) || !plaintexts.length) {
++      throw Components.Exception("Need at least one plaintext to encrypt",
++                                 Cr.NS_ERROR_INVALID_ARG);
++    }
++
++    let cipherTexts;
++
++    let wasLoggedIn = this.isLoggedIn;
++    let canceledMP = false;
++
++    this._uiBusy = true;
++    try {
++      cipherTexts = await this._decoderRing.asyncEncryptStrings(plaintexts.length, plaintexts);
++    } catch (e) {
++      this.log("Failed to encrypt strings. (" + e.name + ")");
++      // If the user clicks Cancel, we get NS_ERROR_FAILURE.
++      // (unlike decrypting, which gets NS_ERROR_NOT_AVAILABLE).
++      if (e.result == Cr.NS_ERROR_FAILURE) {
++        canceledMP = true;
++        throw Components.Exception("User canceled master password entry", Cr.NS_ERROR_ABORT);
++      } else {
++        throw Components.Exception("Couldn't encrypt strings", Cr.NS_ERROR_FAILURE);
++      }
++    } finally {
++      this._uiBusy = false;
++      // If we triggered a master password prompt, notify observers.
++      if (!wasLoggedIn && this.isLoggedIn) {
++        this._notifyObservers("passwordmgr-crypto-login");
++      } else if (canceledMP) {
++        this._notifyObservers("passwordmgr-crypto-loginCanceled");
++      }
++    }
++    return cipherTexts;
++  },
++
++
++  /*
+    * decrypt
+    *
+    * Decrypts the specified string, using the SecretDecoderRing.
+    *
+    * Returns the decrypted string, or throws an exception if there was a
+    * problem.
+    */
+   decrypt(cipherText) {
+diff --git a/toolkit/components/passwordmgr/nsILoginManagerCrypto.idl b/toolkit/components/passwordmgr/nsILoginManagerCrypto.idl
+--- a/toolkit/components/passwordmgr/nsILoginManagerCrypto.idl
++++ b/toolkit/components/passwordmgr/nsILoginManagerCrypto.idl
+@@ -23,16 +23,27 @@ interface nsILoginManagerCrypto : nsISup
+    * NOTE: The current implemention of this inferface simply uses NSS/PSM's
+    * "Secret Decoder Ring" service. It is not recommended for general
+    * purpose encryption/decryption.
+    *
+    * Can throw if the user cancels entry of their master password.
+    */
+   AString encrypt(in AString plainText);
+ 
++  /*
++   * encryptMany
++   *
++   * @param plainTexts
++   *        The strings to be encrypted.
++   *
++   * Encrypts the specified strings, similar to encrypt, but returning a promise
++   * which resolves with the the encrypted strings.
++   */
++  jsval encryptMany(in jsval plainTexts);
++
+   /**
+    * decrypt
+    *
+    * @param cipherText
+    *        The string to be decrypted.
+    *
+    * Decrypts the specified string, returning the plaintext value.
+    *

frg/work-js/mozilla-release/patches/1440481-2-63a1.patch

@@ -3,7 +3,7 @@
 # Date 1530120195 18000
 #      Wed Jun 27 12:23:15 2018 -0500
 # Node ID 71a6537e84fe2314ed64eddb8a91ccd97b480c98
-# Parent  171297ebd0a893a499c7f6dd744b9a31cefae714
+# Parent  8acc1871cd0df1e5479f89b49e74c004aa8333f5
 Bug 1440481 - Part 2: Delete SrcNoteLineScanner. Use BytecodeRangeWithPosition instead. r=nbp
 
 diff --git a/js/src/vm/BytecodeUtil-inl.h b/js/src/vm/BytecodeUtil-inl.h
@@ -282,7 +282,7 @@ diff --git a/js/src/vm/BytecodeUtil.h b/js/src/vm/BytecodeUtil.h
 diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
 --- a/js/src/vm/Debugger.cpp
 +++ b/js/src/vm/Debugger.cpp
-@@ -5651,112 +5651,16 @@ EnsureScriptOffsetIsValid(JSContext* cx,
+@@ -5554,110 +5554,16 @@ EnsureScriptOffsetIsValid(JSContext* cx,
      if (IsValidBytecodeOffset(cx, script, offset))
          return true;
      JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_DEBUG_BAD_OFFSET);
@@ -351,10 +351,8 @@ diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
 -
 -  private:
 -    void updatePosition() {
--        /*
--         * Determine the current line number by reading all source notes up to
--         * and including the current offset.
--         */
+-        // Determine the current line number by reading all source notes up to
+-        // and including the current offset.
 -        jsbytecode *lastLinePC = nullptr;
 -        while (!SN_IS_TERMINATOR(sn) && snpc <= frontPC()) {
 -            SrcNoteType type = SN_TYPE(sn);

frg/work-js/mozilla-release/patches/1447591-1-63a1.patch

@@ -3,7 +3,7 @@
 # Date 1529510179 -7200
 #      Wed Jun 20 17:56:19 2018 +0200
 # Node ID 38d2f921a918b7fd0269e269f48030798044438d
-# Parent  0850024c73c1b64fd4637267a1605c00987da688
+# Parent  1b2cae92851742a7831ab1a5ce7b8b378dadd554
 Bug 1447591: Stub out a few Debugger APIs for wasm; r=yury
 
 diff --git a/devtools/server/actors/source.js b/devtools/server/actors/source.js
@@ -81,7 +81,7 @@ diff --git a/dom/base/test/test_postMessages.html b/dom/base/test/test_postMessa
 diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctions.cpp
 --- a/js/src/builtin/TestingFunctions.cpp
 +++ b/js/src/builtin/TestingFunctions.cpp
-@@ -654,38 +654,66 @@ WasmTextToBinary(JSContext* cx, unsigned
+@@ -655,38 +655,66 @@ WasmTextToBinary(JSContext* cx, unsigned
          ReportUsageErrorASCII(cx, callee, "First argument must be a String");
          return false;
      }
@@ -1787,7 +1787,7 @@ diff --git a/js/src/wasm/WasmDebug.h b/js/src/wasm/WasmDebug.h
 diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
 --- a/js/src/wasm/WasmTextToBinary.cpp
 +++ b/js/src/wasm/WasmTextToBinary.cpp
-@@ -5678,37 +5678,41 @@ EncodeTableSection(Encoder& e, AstModule
+@@ -5539,35 +5539,39 @@ EncodeTableSection(Encoder& e, AstModule
              return false;
      }
  
@@ -1806,10 +1806,8 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
      size_t beforeBody = e.currentOffset();
  
      ValTypeVector varTypes;
-     for (const AstValType& vt : func.vars()) {
-         if (!varTypes.append(vt.type()))
-             return false;
-     }
+     if (!varTypes.appendAll(func.vars()))
+         return false;
      if (!EncodeLocalEntries(e, varTypes))
          return false;
  
@@ -1830,7 +1828,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
  }
  
  static bool
-@@ -5724,30 +5728,30 @@ EncodeStartSection(Encoder& e, AstModule
+@@ -5583,30 +5587,30 @@ EncodeStartSection(Encoder& e, AstModule
      if (!e.writeVarU32(module.startFunc().func().index()))
          return false;
  
@@ -1863,7 +1861,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
  }
  
  static bool
-@@ -5844,17 +5848,17 @@ EncodeElemSection(Encoder& e, AstModule&
+@@ -5703,17 +5707,17 @@ EncodeElemSection(Encoder& e, AstModule&
              return false;
      }
  
@@ -1882,7 +1880,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
  
      if (!e.writeFixedU32(EncodingVersion))
          return false;
-@@ -5881,17 +5885,17 @@ EncodeModule(AstModule& module, Bytes* b
+@@ -5740,17 +5744,17 @@ EncodeModule(AstModule& module, Bytes* b
          return false;
  
      if (!EncodeStartSection(e, module))
@@ -1901,7 +1899,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
      return true;
  }
  
-@@ -5915,25 +5919,26 @@ EncodeBinaryModule(const AstModule& modu
+@@ -5774,25 +5778,26 @@ EncodeBinaryModule(const AstModule& modu
      }
  
      return true;

frg/work-js/mozilla-release/patches/1447591-2-63a1.patch

@@ -3,7 +3,7 @@
 # Date 1529574587 -7200
 #      Thu Jun 21 11:49:47 2018 +0200
 # Node ID e7a694ff10044ca9d52f3ed05f61b93cae1a4620
-# Parent  868d1f7098ae274f7b07115563dc6ed1eed4a6f6
+# Parent  598732783ff44e021bf637f119f6c772f0c9ce6d
 Bug 1447591: Remove wasm::BinaryToText; r=luke
 
 diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctions.cpp
@@ -101,7 +101,7 @@ diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctio
      }
  
      CallArgs args = CallArgsFromVp(argc, vp);
-@@ -5666,20 +5608,16 @@ gc::ZealModeHelpText),
+@@ -5675,20 +5617,16 @@ gc::ZealModeHelpText),
  "wasmCompileMode()",
  "  Returns a string indicating the available compile policy: 'baseline', 'ion',\n"
  "  'baseline-or-ion', or 'disabled' (if wasm is not available at all)."),
@@ -566,7 +566,7 @@ deleted file mode 100644
 diff --git a/js/src/moz.build b/js/src/moz.build
 --- a/js/src/moz.build
 +++ b/js/src/moz.build
-@@ -395,18 +395,16 @@ UNIFIED_SOURCES += [
+@@ -396,18 +396,16 @@ UNIFIED_SOURCES += [
      'vm/UbiNode.cpp',
      'vm/UbiNodeCensus.cpp',
      'vm/UbiNodeShortestPaths.cpp',
@@ -585,7 +585,7 @@ diff --git a/js/src/moz.build b/js/src/moz.build
      'wasm/WasmGenerator.cpp',
      'wasm/WasmInstance.cpp',
      'wasm/WasmIonCompile.cpp',
-@@ -414,17 +412,16 @@ UNIFIED_SOURCES += [
+@@ -415,17 +413,16 @@ UNIFIED_SOURCES += [
      'wasm/WasmModule.cpp',
      'wasm/WasmOpIter.cpp',
      'wasm/WasmProcess.cpp',
@@ -606,7 +606,7 @@ diff --git a/js/src/moz.build b/js/src/moz.build
 diff --git a/js/src/wasm/WasmAST.h b/js/src/wasm/WasmAST.h
 --- a/js/src/wasm/WasmAST.h
 +++ b/js/src/wasm/WasmAST.h
-@@ -284,20 +284,27 @@ typedef AstVector<AstRef> AstRefVector;
+@@ -121,20 +121,27 @@ typedef AstVector<AstRef> AstRefVector;
  
  struct AstBase
  {
@@ -635,7 +635,7 @@ diff --git a/js/src/wasm/WasmAST.h b/js/src/wasm/WasmAST.h
      Which which_;
  
    public:
-@@ -441,29 +448,16 @@ AstTypeDef::asFuncType() const
+@@ -253,29 +260,16 @@ AstTypeDef::asFuncType() const
  
  inline const AstStructType&
  AstTypeDef::asStructType() const
@@ -665,7 +665,7 @@ diff --git a/js/src/wasm/WasmAST.h b/js/src/wasm/WasmAST.h
      AtomicStore,
      BinaryOperator,
      Block,
-@@ -1045,36 +1039,32 @@ class AstBranchTable : public AstExpr
+@@ -857,35 +851,31 @@ class AstBranchTable : public AstExpr
  
  class AstFunc : public AstNode
  {
@@ -689,7 +689,6 @@ diff --git a/js/src/wasm/WasmAST.h b/js/src/wasm/WasmAST.h
      {}
      AstRef& funcType() { return funcType_; }
      const AstValTypeVector& vars() const { return vars_; }
-     AstValTypeVector& vars() { return vars_; }
      const AstNameVector& locals() const { return localNames_; }
      const AstExprVector& body() const { return body_; }
      AstName name() const { return name_; }
@@ -701,7 +700,7 @@ diff --git a/js/src/wasm/WasmAST.h b/js/src/wasm/WasmAST.h
  {
      AstName name_;
      bool isMutable_;
-     AstValType type_;
+     ValType type_;
      Maybe<AstExpr*> init_;
 diff --git a/js/src/wasm/WasmBinaryToAST.cpp b/js/src/wasm/WasmBinaryToAST.cpp
 deleted file mode 100644

frg/work-js/mozilla-release/patches/1450261-2-63a1.patch

@@ -1,8 +1,9 @@
 # HG changeset patch
 # User Benjamin Bouvier <benj@benj.me>
 # Date 1522158013 -7200
+#      Tue Mar 27 15:40:13 2018 +0200
 # Node ID 2ffe4a57033c1a2bba3ad967109101f83ce89022
-# Parent  6171649fb3a8027731ce1f9f5b0ba7d74b893f44
+# Parent  c1683f72dac4366bbe7d07f80464aee31211d0e3
 Bug 1450261: Implement support of anyref in wasm globals; r=lth
 
 diff --git a/js/src/gc/Nursery.h b/js/src/gc/Nursery.h
@@ -374,7 +375,7 @@ diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompi
  
  using mozilla::DebugOnly;
  using mozilla::FloorLog2;
-@@ -4386,17 +4387,16 @@ class BaseCompiler final : public BaseCo
+@@ -4390,17 +4391,16 @@ class BaseCompiler final : public BaseCo
  
      //////////////////////////////////////////////////////////////////////
      //
@@ -392,7 +393,7 @@ diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompi
          return Address(tmp, globalToTlsOffset);
      }
  
-@@ -5712,16 +5712,91 @@ class BaseCompiler final : public BaseCo
+@@ -5716,16 +5716,91 @@ class BaseCompiler final : public BaseCo
      void branchTo(Assembler::Condition c, RegI64 lhs, RegI64 rhs, Label* l) {
          masm.branch64(c, lhs, rhs, l);
      }
@@ -484,7 +485,7 @@ diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompi
      // Lhs is RegI32, RegI64, or RegF32, or RegF64.
      //
      // Rhs is either the same as Lhs, or an immediate expression compatible with
-@@ -8258,16 +8333,19 @@ BaseCompiler::emitGetGlobal()
+@@ -8262,16 +8337,19 @@ BaseCompiler::emitGetGlobal()
              pushI64(value.i64());
              break;
            case ValType::F32:
@@ -504,7 +505,7 @@ diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompi
  
      switch (global.type().code()) {
        case ValType::I32: {
-@@ -8293,16 +8371,23 @@ BaseCompiler::emitGetGlobal()
+@@ -8297,16 +8375,23 @@ BaseCompiler::emitGetGlobal()
        }
        case ValType::F64: {
          RegF64 rv = needF64();
@@ -528,7 +529,7 @@ diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompi
  }
  
  bool
-@@ -8342,16 +8427,43 @@ BaseCompiler::emitSetGlobal()
+@@ -8346,16 +8431,43 @@ BaseCompiler::emitSetGlobal()
        }
        case ValType::F64: {
          RegF64 rv = popF64();
@@ -575,7 +576,7 @@ diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompi
 diff --git a/js/src/wasm/WasmBuiltins.cpp b/js/src/wasm/WasmBuiltins.cpp
 --- a/js/src/wasm/WasmBuiltins.cpp
 +++ b/js/src/wasm/WasmBuiltins.cpp
-@@ -668,16 +668,20 @@ AddressOf(SymbolicAddress imm, ABIFuncti
+@@ -672,16 +672,20 @@ AddressOf(SymbolicAddress imm, ABIFuncti
          *abiType = Args_General3;
          return FuncCast(Instance::wake, *abiType);
        case SymbolicAddress::MemCopy:
@@ -596,7 +597,7 @@ diff --git a/js/src/wasm/WasmBuiltins.cpp b/js/src/wasm/WasmBuiltins.cpp
          break;
      }
  
-@@ -746,16 +750,17 @@ wasm::NeedsBuiltinThunk(SymbolicAddress 
+@@ -750,16 +754,17 @@ wasm::NeedsBuiltinThunk(SymbolicAddress 
        case SymbolicAddress::CurrentMemory:
        case SymbolicAddress::WaitI32:
        case SymbolicAddress::WaitI64:
@@ -657,7 +658,7 @@ diff --git a/js/src/wasm/WasmInstance.cpp b/js/src/wasm/WasmInstance.cpp
  using namespace js::wasm;
  using mozilla::BitwiseCast;
  
-@@ -471,16 +472,38 @@ Instance::memFill(Instance* instance, ui
+@@ -479,16 +480,38 @@ Instance::memFill(Instance* instance, ui
  
      }
  
@@ -696,12 +697,12 @@ diff --git a/js/src/wasm/WasmInstance.cpp b/js/src/wasm/WasmInstance.cpp
                     HandleWasmMemoryObject memory,
                     SharedTableVector&& tables,
                     Handle<FunctionVector> funcImports,
-@@ -504,16 +527,20 @@ Instance::Instance(JSContext* cx,
-     tlsData()->memoryBase = memory ? memory->buffer().dataPointerEither().unwrap() : nullptr;
+@@ -513,16 +536,20 @@ Instance::Instance(JSContext* cx,
  #ifndef WASM_HUGE_MEMORY
      tlsData()->boundsCheckLimit = memory ? memory->buffer().wasmBoundsCheckLimit() : 0;
  #endif
      tlsData()->instance = this;
+     tlsData()->realm = realm_;
      tlsData()->cx = cx;
      tlsData()->resetInterrupt(cx);
      tlsData()->jumpTable = code_->tieringJumpTable();
@@ -717,7 +718,7 @@ diff --git a/js/src/wasm/WasmInstance.cpp b/js/src/wasm/WasmInstance.cpp
          const FuncImport& fi = metadata(callerTier).funcImports[i];
          FuncImportTls& import = funcImportTls(fi);
          if (!isAsmJS() && IsExportedWasmFunction(f)) {
-@@ -624,16 +651,17 @@ Instance::init(JSContext* cx)
+@@ -636,16 +663,17 @@ Instance::init(JSContext* cx)
          }
      }
  
@@ -735,7 +736,7 @@ diff --git a/js/src/wasm/WasmInstance.cpp b/js/src/wasm/WasmInstance.cpp
      realm_->wasm.unregisterInstance(*this);
  
      const FuncImportVector& funcImports = metadata(code().stableTier()).funcImports;
-@@ -691,16 +719,26 @@ Instance::tracePrivate(JSTracer* trc)
+@@ -703,16 +731,26 @@ Instance::tracePrivate(JSTracer* trc)
      // OK to just do one tier here; though the tiers have different funcImports
      // tables, they share the tls object.
      for (const FuncImport& fi : metadata(code().stableTier()).funcImports)
@@ -998,7 +999,7 @@ diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
  }
  
  /* static */ bool
-@@ -2185,16 +2222,20 @@ WasmGlobalObject::construct(JSContext* c
+@@ -2185,41 +2222,45 @@ WasmGlobalObject::construct(JSContext* c
      } else if (args.length() == 1 && StringEqualsAscii(typeLinearStr, "i64")) {
          // For the time being, i64 is allowed only if there is not an
          // initializing value.
@@ -1019,11 +1020,15 @@ diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
      RootedValue mutableVal(cx);
      if (!JS_GetProperty(cx, obj, "mutable", &mutableVal))
          return false;
-@@ -2206,20 +2247,21 @@ WasmGlobalObject::construct(JSContext* c
+ 
+     bool isMutable = ToBoolean(mutableVal);
+ 
+     // Extract the initial value, or provide a suitable default.
+     // Guard against control flow mistakes below failing to set |globalVal|.
      Val globalVal = Val(uint32_t(0));
      if (args.length() >= 2) {
          RootedValue valueVal(cx, args.get(1));
- 
+-
          if (!ToWebAssemblyValue(cx, globalType, valueVal, &globalVal))
              return false;
      } else {
@@ -1044,7 +1049,7 @@ diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
      if (!global)
          return false;
  
-@@ -2235,16 +2277,17 @@ IsGlobal(HandleValue v)
+@@ -2235,16 +2276,17 @@ IsGlobal(HandleValue v)
  
  /* static */ bool
  WasmGlobalObject::valueGetterImpl(JSContext* cx, const CallArgs& args)
@@ -1062,7 +1067,7 @@ diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
        default:
          MOZ_CRASH();
      }
-@@ -2272,20 +2315,21 @@ WasmGlobalObject::valueSetterImpl(JSCont
+@@ -2272,20 +2314,21 @@ WasmGlobalObject::valueSetterImpl(JSCont
      }
  
      Val val;
@@ -1088,7 +1093,7 @@ diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
  
  /* static */ bool
  WasmGlobalObject::valueSetter(JSContext* cx, unsigned argc, Value* vp)
-@@ -2323,21 +2367,22 @@ WasmGlobalObject::isMutable() const
+@@ -2323,21 +2366,22 @@ WasmGlobalObject::isMutable() const
  }
  
  Val
@@ -1162,7 +1167,7 @@ diff --git a/js/src/wasm/WasmJS.h b/js/src/wasm/WasmJS.h
 diff --git a/js/src/wasm/WasmTypes.cpp b/js/src/wasm/WasmTypes.cpp
 --- a/js/src/wasm/WasmTypes.cpp
 +++ b/js/src/wasm/WasmTypes.cpp
-@@ -77,19 +77,20 @@ Val::writePayload(uint8_t* dst) const
+@@ -78,19 +78,20 @@ Val::writePayload(uint8_t* dst) const
        case ValType::F32x4:
        case ValType::B8x16:
        case ValType::B16x8:
@@ -1316,7 +1321,7 @@ diff --git a/js/src/wasm/WasmTypes.h b/js/src/wasm/WasmTypes.h
  
  bool
  IsRoundingFunction(SymbolicAddress callee, jit::RoundingMode* mode);
-@@ -2055,16 +2064,20 @@ struct TlsData
+@@ -2058,16 +2067,20 @@ struct TlsData
      // Usually equal to cx->stackLimitForJitCode(JS::StackForUntrustedScript),
      // but can be racily set to trigger immediate trap as an opportunity to
      // CheckForInterrupt without an additional branch.
@@ -1337,7 +1342,7 @@ diff --git a/js/src/wasm/WasmTypes.h b/js/src/wasm/WasmTypes.h
  
      // Pointer that should be freed (due to padding before the TlsData).
      void* allocatedBase;
-@@ -2508,12 +2521,54 @@ class DebugFrame
+@@ -2514,12 +2527,54 @@ class DebugFrame
  
      // DebugFrames are aligned to 8-byte aligned, allowing them to be placed in
      // an AbstractFramePtr.

frg/work-js/mozilla-release/patches/1450261-3-63a1.patch

@@ -1,8 +1,9 @@
 # HG changeset patch
 # User Benjamin Bouvier <benj@benj.me>
 # Date 1529583928 -7200
+#      Thu Jun 21 14:25:28 2018 +0200
 # Node ID 631a97e399a03c3c74d1cadf8e26550373393fa9
-# Parent  2bf734fe27156251987947fb2becba3c582bda36
+# Parent  2ffe4a57033c1a2bba3ad967109101f83ce89022
 Bug 1450261: Rename Val to LitVal; r=lth
 
 diff --git a/js/src/wasm/AsmJS.cpp b/js/src/wasm/AsmJS.cpp
@@ -122,7 +123,7 @@ diff --git a/js/src/wasm/AsmJS.cpp b/js/src/wasm/AsmJS.cpp
  
  // Represents the type of a general asm.js expression.
  //
-@@ -2282,17 +2282,17 @@ class MOZ_STACK_CLASS ModuleValidator
+@@ -2282,17 +2282,17 @@ class MOZ_STACK_CLASS JS_HAZ_ROOTED Modu
          if (table.defined())
              return false;
  
@@ -340,7 +341,7 @@ diff --git a/js/src/wasm/WasmAST.h b/js/src/wasm/WasmAST.h
 diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompile.cpp
 --- a/js/src/wasm/WasmBaselineCompile.cpp
 +++ b/js/src/wasm/WasmBaselineCompile.cpp
-@@ -8319,17 +8319,17 @@ BaseCompiler::emitGetGlobal()
+@@ -8323,17 +8323,17 @@ BaseCompiler::emitGetGlobal()
          return false;
  
      if (deadCode_)
@@ -384,7 +385,7 @@ diff --git a/js/src/wasm/WasmDebug.cpp b/js/src/wasm/WasmDebug.cpp
 diff --git a/js/src/wasm/WasmInstance.cpp b/js/src/wasm/WasmInstance.cpp
 --- a/js/src/wasm/WasmInstance.cpp
 +++ b/js/src/wasm/WasmInstance.cpp
-@@ -502,17 +502,17 @@ Instance::postBarrier(Instance* instance
+@@ -510,17 +510,17 @@ Instance::postBarrier(Instance* instance
  Instance::Instance(JSContext* cx,
                     Handle<WasmInstanceObject*> object,
                     SharedCode code,
@@ -631,7 +632,7 @@ diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
      switch (val.type().code()) {
        case ValType::I32:    cell->i32 = val.i32(); break;
        case ValType::I64:    cell->i64 = val.i64(); break;
-@@ -2239,29 +2239,29 @@ WasmGlobalObject::construct(JSContext* c
+@@ -2239,28 +2239,28 @@ WasmGlobalObject::construct(JSContext* c
      RootedValue mutableVal(cx);
      if (!JS_GetProperty(cx, obj, "mutable", &mutableVal))
          return false;
@@ -644,7 +645,6 @@ diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
 +    LitVal globalVal = LitVal(uint32_t(0));
      if (args.length() >= 2) {
          RootedValue valueVal(cx, args.get(1));
- 
          if (!ToWebAssemblyValue(cx, globalType, valueVal, &globalVal))
              return false;
      } else {
@@ -666,7 +666,7 @@ diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
      if (!global)
          return false;
  
-@@ -2309,17 +2309,17 @@ WasmGlobalObject::valueSetterImpl(JSCont
+@@ -2308,17 +2308,17 @@ WasmGlobalObject::valueSetterImpl(JSCont
          return false;
      }
  
@@ -685,7 +685,7 @@ diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
        case ValType::I32:    cell->i32 = val.i32(); break;
        case ValType::F32:    cell->f32 = val.f32(); break;
        case ValType::F64:    cell->f64 = val.f64(); break;
-@@ -2361,27 +2361,27 @@ WasmGlobalObject::type() const
+@@ -2360,27 +2360,27 @@ WasmGlobalObject::type() const
  }
  
  bool
@@ -939,7 +939,7 @@ diff --git a/js/src/wasm/WasmModule.h b/js/src/wasm/WasmModule.h
 diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
 --- a/js/src/wasm/WasmTextToBinary.cpp
 +++ b/js/src/wasm/WasmTextToBinary.cpp
-@@ -2106,17 +2106,17 @@ ParseNaNLiteral(WasmParseContext& c, Was
+@@ -2110,17 +2110,17 @@ ParseNaNLiteral(WasmParseContext& c, Was
          // Produce the spec's default NaN.
          value = (Traits::kSignificandBits + 1) >> 1;
      }
@@ -958,7 +958,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
  
  template <typename Float>
  static bool
-@@ -2258,17 +2258,17 @@ ParseFloatLiteral(WasmParseContext& c, W
+@@ -2262,17 +2262,17 @@ ParseFloatLiteral(WasmParseContext& c, W
        case WasmToken::UnsignedInteger: result = token.uint(); break;
        case WasmToken::SignedInteger:   result = token.sint(); break;
        case WasmToken::NegativeZero:    result = -0.; break;
@@ -977,7 +977,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
      bool isNegated = false;
      if (*cur == '-' || *cur == '+')
          isNegated = *cur++ == '-';
-@@ -2308,51 +2308,51 @@ ParseFloatLiteral(WasmParseContext& c, W
+@@ -2312,51 +2312,51 @@ ParseFloatLiteral(WasmParseContext& c, W
          c.lifo.release(mark);
          break;
        }
@@ -1037,7 +1037,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
        case ValType::F32: {
          return ParseFloatLiteral<float>(c, val);
        }
-@@ -3585,17 +3585,17 @@ ParseMemory(WasmParseContext& c, AstModu
+@@ -3589,17 +3589,17 @@ ParseMemory(WasmParseContext& c, AstModu
          size_t totalLength = 0;
          while (c.ts.getIf(WasmToken::Text, &data)) {
              if (!fragments.append(data.text()))
@@ -1056,7 +1056,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
                  return false;
  
              pages = AlignBytes<size_t>(totalLength, PageSize) / PageSize;
-@@ -3905,17 +3905,17 @@ ParseTable(WasmParseContext& c, WasmToke
+@@ -3909,17 +3909,17 @@ ParseTable(WasmParseContext& c, WasmToke
  
      uint32_t numElements = uint32_t(elems.length());
      if (numElements != elems.length())
@@ -1078,7 +1078,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
 diff --git a/js/src/wasm/WasmTypes.cpp b/js/src/wasm/WasmTypes.cpp
 --- a/js/src/wasm/WasmTypes.cpp
 +++ b/js/src/wasm/WasmTypes.cpp
-@@ -55,17 +55,17 @@ static_assert(MaxMemoryInitialPages <= A
+@@ -56,17 +56,17 @@ static_assert(MaxMemoryInitialPages <= A
  // loads/stores, hence the lower limit of 8.  Some Intel processors support
  // AVX-512 loads/stores, hence the upper limit of 64.
  static_assert(MaxMemoryAccessSize >= 8,  "MaxMemoryAccessSize too low");
@@ -1097,7 +1097,7 @@ diff --git a/js/src/wasm/WasmTypes.cpp b/js/src/wasm/WasmTypes.cpp
          return;
        case ValType::I64:
        case ValType::F64:
-@@ -80,17 +80,17 @@ Val::writePayload(uint8_t* dst) const
+@@ -81,17 +81,17 @@ Val::writePayload(uint8_t* dst) const
        case ValType::B32x4:
          memcpy(dst, &u, jit::Simd128DataSize);
          return;
@@ -1304,7 +1304,7 @@ diff --git a/js/src/wasm/WasmTypes.h b/js/src/wasm/WasmTypes.h
      // WasmGlobalObject; the global area contains a pointer to the Cell.
      //
      // We don't want to indirect unless we must, so only mutable, exposed
-@@ -2317,17 +2317,17 @@ static const unsigned PageSize = 64 * 10
+@@ -2323,17 +2323,17 @@ static const unsigned PageSize = 64 * 10
  
  // Bounds checks always compare the base of the memory access with the bounds
  // check limit. If the memory access is unaligned, this means that, even if the

frg/work-js/mozilla-release/patches/1450261-4-63a1.patch

@@ -1,8 +1,9 @@
 # HG changeset patch
 # User Benjamin Bouvier <benj@benj.me>
 # Date 1530283400 -7200
+#      Fri Jun 29 16:43:20 2018 +0200
 # Node ID 50d6babb2ec730b1d460e74b0957db7c55b0b0dc
-# Parent  2e575c38eb49d02914e673df2a3b36206215cc42
+# Parent  631a97e399a03c3c74d1cadf8e26550373393fa9
 Bug 1450261: Implement Val, a rooted LitVal; r=luke, r=jonco
 
 diff --git a/js/src/devtools/automation/variants/msan b/js/src/devtools/automation/variants/msan
@@ -228,7 +229,7 @@ diff --git a/js/src/wasm/AsmJS.cpp b/js/src/wasm/AsmJS.cpp
 diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompile.cpp
 --- a/js/src/wasm/WasmBaselineCompile.cpp
 +++ b/js/src/wasm/WasmBaselineCompile.cpp
-@@ -8334,17 +8334,17 @@ BaseCompiler::emitGetGlobal()
+@@ -8338,17 +8338,17 @@ BaseCompiler::emitGetGlobal()
              break;
            case ValType::F32:
              pushF32(value.f32());
@@ -250,7 +251,7 @@ diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompi
 diff --git a/js/src/wasm/WasmInstance.cpp b/js/src/wasm/WasmInstance.cpp
 --- a/js/src/wasm/WasmInstance.cpp
 +++ b/js/src/wasm/WasmInstance.cpp
-@@ -400,25 +400,22 @@ Instance::wake(Instance* instance, uint3
+@@ -408,25 +408,22 @@ Instance::wake(Instance* instance, uint3
  /* static */ int32_t
  Instance::memCopy(Instance* instance, uint32_t destByteOffset, uint32_t srcByteOffset, uint32_t len)
  {
@@ -276,7 +277,7 @@ diff --git a/js/src/wasm/WasmInstance.cpp b/js/src/wasm/WasmInstance.cpp
          CheckedU32 highest_destOffset = CheckedU32(destByteOffset) + CheckedU32(len - 1);
          CheckedU32 highest_srcOffset = CheckedU32(srcByteOffset) + CheckedU32(len - 1);
  
-@@ -441,40 +438,36 @@ Instance::memCopy(Instance* instance, ui
+@@ -449,40 +446,36 @@ Instance::memCopy(Instance* instance, ui
  /* static */ int32_t
  Instance::memFill(Instance* instance, uint32_t byteOffset, uint32_t value, uint32_t len)
  {
@@ -317,7 +318,7 @@ diff --git a/js/src/wasm/WasmInstance.cpp b/js/src/wasm/WasmInstance.cpp
  }
  
  /* static */ void
-@@ -502,17 +495,17 @@ Instance::postBarrier(Instance* instance
+@@ -510,17 +503,17 @@ Instance::postBarrier(Instance* instance
  Instance::Instance(JSContext* cx,
                     Handle<WasmInstanceObject*> object,
                     SharedCode code,
@@ -336,7 +337,7 @@ diff --git a/js/src/wasm/WasmInstance.cpp b/js/src/wasm/WasmInstance.cpp
      tlsData_(std::move(tlsDataIn)),
      memory_(memory),
      tables_(std::move(tables)),
-@@ -581,42 +574,43 @@ Instance::Instance(JSContext* cx,
+@@ -593,42 +586,43 @@ Instance::Instance(JSContext* cx,
  
          uint8_t* globalAddr = globalData() + global.offset();
          switch (global.kind()) {
@@ -780,7 +781,7 @@ diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
  WasmGlobalObject::construct(JSContext* cx, unsigned argc, Value* vp)
  {
      CallArgs args = CallArgsFromVp(argc, vp);
-@@ -2238,31 +2283,31 @@ WasmGlobalObject::construct(JSContext* c
+@@ -2238,30 +2283,30 @@ WasmGlobalObject::construct(JSContext* c
  
      RootedValue mutableVal(cx);
      if (!JS_GetProperty(cx, obj, "mutable", &mutableVal))
@@ -794,7 +795,6 @@ diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
 +    RootedVal globalVal(cx);
      if (args.length() >= 2) {
          RootedValue valueVal(cx, args.get(1));
- 
          if (!ToWebAssemblyValue(cx, globalType, valueVal, &globalVal))
              return false;
      } else {
@@ -820,7 +820,7 @@ diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
          return false;
  
      args.rval().setObject(*global);
-@@ -2278,24 +2323,26 @@ IsGlobal(HandleValue v)
+@@ -2277,24 +2322,26 @@ IsGlobal(HandleValue v)
  /* static */ bool
  WasmGlobalObject::valueGetterImpl(JSContext* cx, const CallArgs& args)
  {
@@ -850,7 +850,7 @@ diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
      CallArgs args = CallArgsFromVp(argc, vp);
      return CallNonGenericMethod<IsGlobal, valueGetterImpl>(cx, args);
  }
-@@ -2309,27 +2356,44 @@ WasmGlobalObject::valueSetterImpl(JSCont
+@@ -2308,27 +2355,44 @@ WasmGlobalObject::valueSetterImpl(JSCont
          return false;
      }
  
@@ -901,7 +901,7 @@ diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
  
  /* static */ bool
  WasmGlobalObject::valueSetter(JSContext* cx, unsigned argc, Value* vp)
-@@ -2361,37 +2425,39 @@ WasmGlobalObject::type() const
+@@ -2360,37 +2424,39 @@ WasmGlobalObject::type() const
  }
  
  bool
@@ -1215,7 +1215,7 @@ diff --git a/js/src/wasm/WasmModule.h b/js/src/wasm/WasmModule.h
 diff --git a/js/src/wasm/WasmTypes.cpp b/js/src/wasm/WasmTypes.cpp
 --- a/js/src/wasm/WasmTypes.cpp
 +++ b/js/src/wasm/WasmTypes.cpp
-@@ -54,18 +54,39 @@ static_assert(MaxMemoryInitialPages <= A
+@@ -55,18 +55,39 @@ static_assert(MaxMemoryInitialPages <= A
  // All plausible targets must be able to do at least IEEE754 double
  // loads/stores, hence the lower limit of 8.  Some Intel processors support
  // AVX-512 loads/stores, hence the upper limit of 64.
@@ -1256,7 +1256,7 @@ diff --git a/js/src/wasm/WasmTypes.cpp b/js/src/wasm/WasmTypes.cpp
          return;
        case ValType::I64:
        case ValType::F64:
-@@ -77,20 +98,37 @@ LitVal::writePayload(uint8_t* dst) const
+@@ -78,20 +99,37 @@ LitVal::writePayload(uint8_t* dst) const
        case ValType::F32x4:
        case ValType::B8x16:
        case ValType::B16x8:

frg/work-js/mozilla-release/patches/mozilla-central-push_425121.patch → frg/work-js/mozilla-release/patches/1455770-63a1.patch

@@ -3,7 +3,7 @@
 # Date 1530648510 14400
 #      Tue Jul 03 16:08:30 2018 -0400
 # Node ID 67b03204c0d22f6bb9574bbdf3e26bb1b38d49a2
-# Parent  a21149d9d236696ce32fe55e51c7673021553c57
+# Parent  29df02230bf6b5169531cf492b4526eeb68d0e0f
 Bug 1455770: Collapse AliasAnalysis into AliasAnalysisShared r=jandem
 
 diff --git a/js/src/jit/AliasAnalysis.cpp b/js/src/jit/AliasAnalysis.cpp
@@ -27,7 +27,7 @@ diff --git a/js/src/jit/AliasAnalysis.cpp b/js/src/jit/AliasAnalysis.cpp
  
  #include "vm/Printer.h"
  
-@@ -50,20 +49,183 @@ class LoopAliasInfo : public TempObject
+@@ -50,20 +49,185 @@ class LoopAliasInfo : public TempObject
      MInstruction* firstInstruction() const {
          return *loopHeader_->begin();
      }
@@ -114,8 +114,6 @@ diff --git a/js/src/jit/AliasAnalysis.cpp b/js/src/jit/AliasAnalysis.cpp
 +      case MDefinition::Opcode::SetInitializedLength:
 +      case MDefinition::Opcode::ArrayLength:
 +      case MDefinition::Opcode::SetArrayLength:
-+      case MDefinition::Opcode::StoreElementHole:
-+      case MDefinition::Opcode::FallibleStoreElement:
 +      case MDefinition::Opcode::TypedObjectDescr:
 +      case MDefinition::Opcode::Slots:
 +      case MDefinition::Opcode::Elements:
@@ -126,7 +124,6 @@ diff --git a/js/src/jit/AliasAnalysis.cpp b/js/src/jit/AliasAnalysis.cpp
 +      case MDefinition::Opcode::SetDisjointTypedElements:
 +      case MDefinition::Opcode::ArrayPopShift:
 +      case MDefinition::Opcode::ArrayPush:
-+      case MDefinition::Opcode::ArraySlice:
 +      case MDefinition::Opcode::LoadTypedArrayElementHole:
 +      case MDefinition::Opcode::StoreTypedArrayElementHole:
 +      case MDefinition::Opcode::LoadFixedSlot:
@@ -151,6 +148,7 @@ diff --git a/js/src/jit/AliasAnalysis.cpp b/js/src/jit/AliasAnalysis.cpp
 +        object = ins->getOperand(0);
 +        break;
 +      case MDefinition::Opcode::GetPropertyCache:
++      case MDefinition::Opcode::CallGetProperty:
 +      case MDefinition::Opcode::GetDOMProperty:
 +      case MDefinition::Opcode::GetDOMMember:
 +      case MDefinition::Opcode::Call:
@@ -159,6 +157,7 @@ diff --git a/js/src/jit/AliasAnalysis.cpp b/js/src/jit/AliasAnalysis.cpp
 +      case MDefinition::Opcode::SetArgumentsObjectArg:
 +      case MDefinition::Opcode::GetFrameArgument:
 +      case MDefinition::Opcode::SetFrameArgument:
++      case MDefinition::Opcode::CreateThis:
 +      case MDefinition::Opcode::CompareExchangeTypedArrayElement:
 +      case MDefinition::Opcode::AtomicExchangeTypedArrayElement:
 +      case MDefinition::Opcode::AtomicTypedArrayElementBinop:
@@ -173,6 +172,9 @@ diff --git a/js/src/jit/AliasAnalysis.cpp b/js/src/jit/AliasAnalysis.cpp
 +      case MDefinition::Opcode::WasmLoadGlobalVar:
 +      case MDefinition::Opcode::WasmStoreGlobalVar:
 +      case MDefinition::Opcode::ArrayJoin:
++      case MDefinition::Opcode::ArraySlice:
++      case MDefinition::Opcode::StoreElementHole:
++      case MDefinition::Opcode::FallibleStoreElement:
 +        return nullptr;
 +      default:
 +#ifdef DEBUG
@@ -214,7 +216,7 @@ diff --git a/js/src/jit/AliasAnalysis.cpp b/js/src/jit/AliasAnalysis.cpp
  BlockMightReach(MBasicBlock* src, MBasicBlock* dest)
  {
      while (src->id() <= dest->id()) {
-@@ -283,9 +445,9 @@ AliasAnalysis::analyze()
+@@ -283,9 +447,9 @@ AliasAnalysis::analyze()
              loop_ = loop_->outer();
          }
      }
@@ -316,7 +318,7 @@ diff --git a/js/src/jit/AliasAnalysisShared.cpp b/js/src/jit/AliasAnalysisShared
 deleted file mode 100644
 --- a/js/src/jit/AliasAnalysisShared.cpp
 +++ /dev/null
-@@ -1,185 +0,0 @@
+@@ -1,187 +0,0 @@
 -/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
 - * vim: set ts=8 sts=4 et sw=4 tw=99:
 - * This Source Code Form is subject to the terms of the Mozilla Public
@@ -405,8 +407,6 @@ deleted file mode 100644
 -      case MDefinition::Opcode::SetInitializedLength:
 -      case MDefinition::Opcode::ArrayLength:
 -      case MDefinition::Opcode::SetArrayLength:
--      case MDefinition::Opcode::StoreElementHole:
--      case MDefinition::Opcode::FallibleStoreElement:
 -      case MDefinition::Opcode::TypedObjectDescr:
 -      case MDefinition::Opcode::Slots:
 -      case MDefinition::Opcode::Elements:
@@ -417,7 +417,6 @@ deleted file mode 100644
 -      case MDefinition::Opcode::SetDisjointTypedElements:
 -      case MDefinition::Opcode::ArrayPopShift:
 -      case MDefinition::Opcode::ArrayPush:
--      case MDefinition::Opcode::ArraySlice:
 -      case MDefinition::Opcode::LoadTypedArrayElementHole:
 -      case MDefinition::Opcode::StoreTypedArrayElementHole:
 -      case MDefinition::Opcode::LoadFixedSlot:
@@ -442,6 +441,7 @@ deleted file mode 100644
 -        object = ins->getOperand(0);
 -        break;
 -      case MDefinition::Opcode::GetPropertyCache:
+-      case MDefinition::Opcode::CallGetProperty:
 -      case MDefinition::Opcode::GetDOMProperty:
 -      case MDefinition::Opcode::GetDOMMember:
 -      case MDefinition::Opcode::Call:
@@ -450,6 +450,7 @@ deleted file mode 100644
 -      case MDefinition::Opcode::SetArgumentsObjectArg:
 -      case MDefinition::Opcode::GetFrameArgument:
 -      case MDefinition::Opcode::SetFrameArgument:
+-      case MDefinition::Opcode::CreateThis:
 -      case MDefinition::Opcode::CompareExchangeTypedArrayElement:
 -      case MDefinition::Opcode::AtomicExchangeTypedArrayElement:
 -      case MDefinition::Opcode::AtomicTypedArrayElementBinop:
@@ -464,6 +465,9 @@ deleted file mode 100644
 -      case MDefinition::Opcode::WasmLoadGlobalVar:
 -      case MDefinition::Opcode::WasmStoreGlobalVar:
 -      case MDefinition::Opcode::ArrayJoin:
+-      case MDefinition::Opcode::ArraySlice:
+-      case MDefinition::Opcode::StoreElementHole:
+-      case MDefinition::Opcode::FallibleStoreElement:
 -        return nullptr;
 -      default:
 -#ifdef DEBUG

frg/work-js/mozilla-release/patches/1459900-4-63a1.patch

@@ -3,7 +3,7 @@
 # Date 1527526769 -7200
 #      Mon May 28 18:59:29 2018 +0200
 # Node ID 9e3fb74a11eefbed803b9e8705c18ad754a1fe23
-# Parent  6f06798229551bb9b0b3b772dd10bbad253678b8
+# Parent  7c3c2d6c17d7563fa2ea242ee2ae08be4685370e
 Bug 1459900 - Ref types with a simple type calculus.  r=luke
 
 We generalize ExprType and StackType in the same way as ValType, in
@@ -185,7 +185,7 @@ new file mode 100644
 diff --git a/js/src/jit-test/tests/wasm/gc/structs.js b/js/src/jit-test/tests/wasm/gc/structs.js
 --- a/js/src/jit-test/tests/wasm/gc/structs.js
 +++ b/js/src/jit-test/tests/wasm/gc/structs.js
-@@ -87,16 +87,25 @@ wasmEvalText(`
+@@ -78,16 +78,25 @@ wasmEvalText(`
  
  // Empty structs are OK.
  
@@ -468,7 +468,7 @@ diff --git a/js/src/wasm/WasmAST.h b/js/src/wasm/WasmAST.h
  {
      void* operator new(size_t numBytes, LifoAlloc& astLifo) throw() {
          return astLifo.alloc(numBytes);
-@@ -147,53 +308,68 @@ class AstTypeDef : public AstBase
+@@ -154,53 +315,68 @@ class AstTypeDef : public AstNode
      inline const AstFuncType& asFuncType() const;
      inline const AstStructType& asStructType() const;
  };
@@ -544,7 +544,7 @@ diff --git a/js/src/wasm/WasmAST.h b/js/src/wasm/WasmAST.h
  };
  
  class AstStructType : public AstTypeDef
-@@ -223,16 +399,19 @@ class AstStructType : public AstTypeDef
+@@ -230,16 +406,19 @@ class AstStructType : public AstTypeDef
          return name_;
      }
      const AstNameVector& fieldNames() const {
@@ -564,7 +564,7 @@ diff --git a/js/src/wasm/WasmAST.h b/js/src/wasm/WasmAST.h
      MOZ_ASSERT(isFuncType());
      return *static_cast<AstFuncType*>(this);
  }
-@@ -314,31 +493,31 @@ enum class AstExprKind
+@@ -308,31 +487,31 @@ enum class AstExprKind
      Unreachable,
      Wait,
      Wake
@@ -602,7 +602,7 @@ diff --git a/js/src/wasm/WasmAST.h b/js/src/wasm/WasmAST.h
      }
  };
  
-@@ -479,17 +658,17 @@ class AstTeeLocal : public AstExpr
+@@ -473,17 +652,17 @@ class AstTeeLocal : public AstExpr
  class AstBlock : public AstExpr
  {
      Op op_;
@@ -621,7 +621,7 @@ diff --git a/js/src/wasm/WasmAST.h b/js/src/wasm/WasmAST.h
  
      Op op() const { return op_; }
      AstName name() const { return name_; }
-@@ -500,17 +679,17 @@ class AstBranch : public AstExpr
+@@ -494,17 +673,17 @@ class AstBranch : public AstExpr
  {
      Op op_;
      AstExpr* cond_;
@@ -640,7 +640,7 @@ diff --git a/js/src/wasm/WasmAST.h b/js/src/wasm/WasmAST.h
          value_(value)
      {}
  
-@@ -523,34 +702,34 @@ class AstBranch : public AstExpr
+@@ -517,34 +696,34 @@ class AstBranch : public AstExpr
  class AstCall : public AstExpr
  {
      Op op_;
@@ -677,7 +677,7 @@ diff --git a/js/src/wasm/WasmAST.h b/js/src/wasm/WasmAST.h
  };
  
  class AstReturn : public AstExpr
-@@ -570,17 +749,17 @@ class AstIf : public AstExpr
+@@ -564,17 +743,17 @@ class AstIf : public AstExpr
  {
      AstExpr* cond_;
      AstName name_;
@@ -696,12 +696,12 @@ diff --git a/js/src/wasm/WasmAST.h b/js/src/wasm/WasmAST.h
          elseExprs_(std::move(elseExprs))
      {}
  
-@@ -871,42 +1050,44 @@ class AstFunc : public AstNode
+@@ -863,40 +1042,42 @@ class AstFunc : public AstNode
+       : name_(name),
          funcType_(ft),
          vars_(std::move(vars)),
          localNames_(std::move(locals)),
-         body_(std::move(body)),
-         endOffset_(AstNodeUnknownOffset)
+         body_(std::move(body))
      {}
      AstRef& funcType() { return funcType_; }
      const AstValTypeVector& vars() const { return vars_; }
@@ -709,8 +709,6 @@ diff --git a/js/src/wasm/WasmAST.h b/js/src/wasm/WasmAST.h
      const AstNameVector& locals() const { return localNames_; }
      const AstExprVector& body() const { return body_; }
      AstName name() const { return name_; }
-     uint32_t endOffset() const { return endOffset_; }
-     void setEndOffset(uint32_t offset) { endOffset_ = offset; }
  };
  
  class AstGlobal : public AstNode
@@ -744,7 +742,7 @@ diff --git a/js/src/wasm/WasmAST.h b/js/src/wasm/WasmAST.h
  typedef AstVector<AstGlobal*> AstGlobalVector;
  
  class AstImport : public AstNode
-@@ -944,16 +1125,20 @@ class AstImport : public AstNode
+@@ -934,16 +1115,20 @@ class AstImport : public AstNode
      Limits limits() const {
          MOZ_ASSERT(kind_ == DefinitionKind::Memory || kind_ == DefinitionKind::Table);
          return limits_;
@@ -765,7 +763,7 @@ diff --git a/js/src/wasm/WasmAST.h b/js/src/wasm/WasmAST.h
      DefinitionKind kind_;
      AstRef ref_;
  
-@@ -1300,23 +1485,23 @@ class AstExtraConversionOperator final :
+@@ -1290,23 +1475,23 @@ class AstExtraConversionOperator final :
  
      MiscOp op() const { return op_; }
      AstExpr* operand() const { return operand_; }
@@ -795,7 +793,7 @@ diff --git a/js/src/wasm/WasmAST.h b/js/src/wasm/WasmAST.h
 diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompile.cpp
 --- a/js/src/wasm/WasmBaselineCompile.cpp
 +++ b/js/src/wasm/WasmBaselineCompile.cpp
-@@ -1051,16 +1051,17 @@ BaseLocalIter::settle()
+@@ -1052,16 +1052,17 @@ BaseLocalIter::settle()
  
      MOZ_ASSERT(argsIter_.done());
      if (index_ < locals_.length()) {
@@ -813,7 +811,7 @@ diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompi
              MOZ_CRASH("Compiler bug: Unexpected local type");
          }
          return;
-@@ -2125,69 +2126,85 @@ class BaseCompiler final : public BaseCo
+@@ -2126,69 +2127,85 @@ class BaseCompiler final : public BaseCo
      }
  
      void moveF32(RegF32 src, RegF32 dest) {
@@ -907,7 +905,7 @@ diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompi
          }
      }
  
-@@ -3094,17 +3111,17 @@ class BaseCompiler final : public BaseCo
+@@ -3095,17 +3112,17 @@ class BaseCompiler final : public BaseCo
      // JoinReg is live out of the block.  But on the way out, we
      // currently pop the JoinReg before freeing regs to be discarded,
      // so there is a real risk of some pointless shuffling there.  If
@@ -926,7 +924,7 @@ diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompi
              MOZ_ASSERT(k == Stk::RegisterI32 || k == Stk::ConstI32 || k == Stk::MemI32 ||
                         k == Stk::LocalI32);
              return Some(AnyReg(popI32(joinRegI32_)));
-@@ -3122,16 +3139,17 @@ class BaseCompiler final : public BaseCo
+@@ -3123,16 +3140,17 @@ class BaseCompiler final : public BaseCo
              return Some(AnyReg(popF64(joinRegF64_)));
            }
            case ExprType::F32: {
@@ -944,7 +942,7 @@ diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompi
            }
            default: {
              MOZ_CRASH("Compiler bug: unexpected expression type");
-@@ -3141,33 +3159,34 @@ class BaseCompiler final : public BaseCo
+@@ -3142,33 +3160,34 @@ class BaseCompiler final : public BaseCo
  
      // If we ever start not sync-ing on entry to Block (but instead try to sync
      // lazily) then this may start asserting because it does not spill the
@@ -980,7 +978,7 @@ diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompi
              return Nothing();
            default:
              MOZ_CRASH("Compiler bug: unexpected type");
-@@ -3414,58 +3433,60 @@ class BaseCompiler final : public BaseCo
+@@ -3415,58 +3434,60 @@ class BaseCompiler final : public BaseCo
          if (env_.debugEnabled())
              insertBreakablePoint(CallSiteDesc::EnterFrame);
      }
@@ -1043,7 +1041,7 @@ diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompi
          }
      }
  
-@@ -3728,16 +3749,17 @@ class BaseCompiler final : public BaseCo
+@@ -3733,16 +3754,17 @@ class BaseCompiler final : public BaseCo
                  MOZ_CRASH("Unexpected parameter passing discipline");
                }
  #endif
@@ -1061,7 +1059,7 @@ diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompi
                  masm.storePtr(scratch, Address(masm.getStackPointer(), argLoc.offsetFromArgBase()));
              } else {
                  loadRef(arg, RegPtr(argLoc.gpr()));
-@@ -7679,17 +7701,17 @@ BaseCompiler::emitDrop()
+@@ -7684,17 +7706,17 @@ BaseCompiler::emitDrop()
  
      dropValue();
      return true;
@@ -1080,7 +1078,7 @@ diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompi
          RegI32 rv = popI32(RegI32(ReturnReg));
          returnCleanup(popStack);
          freeI32(rv);
-@@ -7708,16 +7730,17 @@ BaseCompiler::doReturn(ExprType type, bo
+@@ -7713,16 +7735,17 @@ BaseCompiler::doReturn(ExprType type, bo
          break;
        }
        case ExprType::F32: {
@@ -1098,7 +1096,7 @@ diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompi
        }
        default: {
          MOZ_CRASH("Function return type");
-@@ -7754,17 +7777,17 @@ BaseCompiler::emitCallArgs(const ValType
+@@ -7759,17 +7782,17 @@ BaseCompiler::emitCallArgs(const ValType
  
      masm.loadWasmTlsRegFromFrame();
      return true;
@@ -1117,7 +1115,7 @@ diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompi
          pushI32(rv);
          break;
        }
-@@ -7778,16 +7801,17 @@ BaseCompiler::pushReturnedIfNonVoid(cons
+@@ -7783,16 +7806,17 @@ BaseCompiler::pushReturnedIfNonVoid(cons
          pushF32(rv);
          break;
        }
@@ -1135,7 +1133,7 @@ diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompi
        default:
          MOZ_CRASH("Function return type");
      }
-@@ -8108,16 +8132,17 @@ BaseCompiler::emitGetLocal()
+@@ -8113,16 +8137,17 @@ BaseCompiler::emitGetLocal()
          pushLocalI64(slot);
          break;
        case ValType::F64:
@@ -1153,7 +1151,7 @@ diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompi
      }
  
      return true;
-@@ -8167,16 +8192,17 @@ BaseCompiler::emitSetOrTeeLocal(uint32_t
+@@ -8172,16 +8197,17 @@ BaseCompiler::emitSetOrTeeLocal(uint32_t
          syncLocal(slot);
          fr.storeLocalF32(rv, localFromSlot(slot, MIRType::Float32));
          if (isSetLocal)
@@ -1171,7 +1169,7 @@ diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompi
              freeRef(rv);
          else
              pushRef(rv);
-@@ -8697,16 +8723,17 @@ BaseCompiler::emitSelect()
+@@ -8702,16 +8728,17 @@ BaseCompiler::emitSelect()
          pop2xF64(&r, &rs);
          emitBranchPerform(&b);
          moveF64(rs, r);
@@ -1189,7 +1187,7 @@ diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompi
          masm.bind(&done);
          freeRef(rs);
          pushRef(r);
-@@ -8867,17 +8894,18 @@ BaseCompiler::emitCurrentMemory()
+@@ -8872,17 +8899,18 @@ BaseCompiler::emitCurrentMemory()
  
      emitInstanceCall(lineOrBytecode, SigP_, ExprType::I32, SymbolicAddress::CurrentMemory);
      return true;
@@ -1209,7 +1207,7 @@ diff --git a/js/src/wasm/WasmBaselineCompile.cpp b/js/src/wasm/WasmBaselineCompi
      pushRef(NULLREF_VALUE);
      return true;
  }
-@@ -10206,17 +10234,17 @@ js::wasm::BaselineCompileFunctions(const
+@@ -10211,17 +10239,17 @@ js::wasm::BaselineCompileFunctions(const
      for (const FuncCompileInput& func : inputs) {
          Decoder d(func.begin, func.end, func.lineOrBytecode, error);
  
@@ -1254,7 +1252,7 @@ diff --git a/js/src/wasm/WasmBinaryConstants.h b/js/src/wasm/WasmBinaryConstants
 diff --git a/js/src/wasm/WasmBuiltins.cpp b/js/src/wasm/WasmBuiltins.cpp
 --- a/js/src/wasm/WasmBuiltins.cpp
 +++ b/js/src/wasm/WasmBuiltins.cpp
-@@ -1039,17 +1039,17 @@ wasm::SymbolicAddressTarget(SymbolicAddr
+@@ -1043,17 +1043,17 @@ wasm::SymbolicAddressTarget(SymbolicAddr
  
  static Maybe<ABIFunctionType>
  ToBuiltinABIFunctionType(const FuncType& funcType)
@@ -1276,7 +1274,7 @@ diff --git a/js/src/wasm/WasmBuiltins.cpp b/js/src/wasm/WasmBuiltins.cpp
 diff --git a/js/src/wasm/WasmDebug.cpp b/js/src/wasm/WasmDebug.cpp
 --- a/js/src/wasm/WasmDebug.cpp
 +++ b/js/src/wasm/WasmDebug.cpp
-@@ -537,17 +537,17 @@ DebugState::debugGetLocalTypes(uint32_t 
+@@ -377,17 +377,17 @@ DebugState::debugGetLocalTypes(uint32_t 
  
      // Decode local var types from wasm binary function body.
      const CodeRange& range = codeRanges(Tier::Debug)[debugFuncToCodeRangeIndex(funcIndex)];
@@ -1298,7 +1296,7 @@ diff --git a/js/src/wasm/WasmDebug.cpp b/js/src/wasm/WasmDebug.cpp
 diff --git a/js/src/wasm/WasmInstance.cpp b/js/src/wasm/WasmInstance.cpp
 --- a/js/src/wasm/WasmInstance.cpp
 +++ b/js/src/wasm/WasmInstance.cpp
-@@ -128,16 +128,17 @@ Instance::callImport(JSContext* cx, uint
+@@ -130,16 +130,17 @@ Instance::callImport(JSContext* cx, uint
              args[i].set(Int32Value(*(int32_t*)&argv[i]));
              break;
            case ValType::F32:
@@ -1316,7 +1314,7 @@ diff --git a/js/src/wasm/WasmInstance.cpp b/js/src/wasm/WasmInstance.cpp
            case ValType::I8x16:
            case ValType::I16x8:
            case ValType::I32x4:
-@@ -200,16 +201,17 @@ Instance::callImport(JSContext* cx, uint
+@@ -204,16 +205,17 @@ Instance::callImport(JSContext* cx, uint
  
      size_t numKnownArgs = Min(importArgs.length(), importFun->nargs());
      for (uint32_t i = 0; i < numKnownArgs; i++) {
@@ -1334,7 +1332,7 @@ diff --git a/js/src/wasm/WasmInstance.cpp b/js/src/wasm/WasmInstance.cpp
            case ValType::F32x4:  MOZ_CRASH("NYI");
            case ValType::B8x16:  MOZ_CRASH("NYI");
            case ValType::B16x8:  MOZ_CRASH("NYI");
-@@ -781,16 +783,17 @@ Instance::callExport(JSContext* cx, uint
+@@ -793,16 +795,17 @@ Instance::callExport(JSContext* cx, uint
            case ValType::F32:
              if (!RoundFloat32(cx, v, (float*)&exportArgs[i]))
                  return false;
@@ -1352,7 +1350,7 @@ diff --git a/js/src/wasm/WasmInstance.cpp b/js/src/wasm/WasmInstance.cpp
            case ValType::I8x16: {
              SimdConstant simd;
              if (!ToSimdConstant<Int8x16>(cx, v, &simd))
-@@ -872,31 +875,32 @@ Instance::callExport(JSContext* cx, uint
+@@ -884,31 +887,32 @@ Instance::callExport(JSContext* cx, uint
          args.rval().set(ObjectValue(*obj));
          return true;
      }
@@ -1975,7 +1973,7 @@ diff --git a/js/src/wasm/WasmStubs.cpp b/js/src/wasm/WasmStubs.cpp
        case ExprType::I16x8:
        case ExprType::I32x4:
        case ExprType::B8x16:
-@@ -1169,17 +1173,17 @@ GenerateImportInterpExit(MacroAssembler&
+@@ -1172,17 +1176,17 @@ GenerateImportInterpExit(MacroAssembler&
          masm.computeEffectiveAddress(argv, scratch);
          masm.storePtr(scratch, Address(masm.getStackPointer(), i->offsetFromArgBase()));
      }
@@ -1994,7 +1992,7 @@ diff --git a/js/src/wasm/WasmStubs.cpp b/js/src/wasm/WasmStubs.cpp
          masm.call(SymbolicAddress::CallImport_I32);
          masm.branchTest32(Assembler::Zero, ReturnReg, ReturnReg, throwLabel);
          masm.load32(argv, ReturnReg);
-@@ -1194,16 +1198,17 @@ GenerateImportInterpExit(MacroAssembler&
+@@ -1197,16 +1201,17 @@ GenerateImportInterpExit(MacroAssembler&
          masm.loadDouble(argv, ReturnDoubleReg);
          masm.convertDoubleToFloat32(ReturnDoubleReg, ReturnFloat32Reg);
          break;
@@ -2012,7 +2010,7 @@ diff --git a/js/src/wasm/WasmStubs.cpp b/js/src/wasm/WasmStubs.cpp
        case ExprType::I8x16:
        case ExprType::I16x8:
        case ExprType::I32x4:
-@@ -1359,31 +1364,34 @@ GenerateImportJitExit(MacroAssembler& ma
+@@ -1362,31 +1367,34 @@ GenerateImportJitExit(MacroAssembler& ma
          Label ok;
          masm.branchTestMagic(Assembler::NotEqual, JSReturnOperand, &ok);
          masm.breakpoint();
@@ -2048,7 +2046,7 @@ diff --git a/js/src/wasm/WasmStubs.cpp b/js/src/wasm/WasmStubs.cpp
        case ExprType::I32x4:
        case ExprType::F32x4:
        case ExprType::B8x16:
-@@ -1440,17 +1448,17 @@ GenerateImportJitExit(MacroAssembler& ma
+@@ -1443,17 +1451,17 @@ GenerateImportJitExit(MacroAssembler& ma
              masm.storePtr(scratch, Address(masm.getStackPointer(), i->offsetFromArgBase()));
          }
          i++;
@@ -2106,7 +2104,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
            case Table:
            case Text:
            case Then:
-@@ -1690,22 +1692,22 @@ WasmTokenStream::next()
+@@ -1694,22 +1696,22 @@ WasmTokenStream::next()
              return WasmToken(WasmToken::Param, begin, cur_);
          break;
  
@@ -2133,7 +2131,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
              return WasmToken(WasmToken::TernaryOpcode, Op::Select, begin, cur_);
          if (consume(u"set_global"))
              return WasmToken(WasmToken::SetGlobal, begin, cur_);
-@@ -1827,23 +1829,65 @@ ParseExprList(WasmParseContext& c, AstEx
+@@ -1831,23 +1833,65 @@ ParseExprList(WasmParseContext& c, AstEx
  
          break;
      }
@@ -2203,7 +2201,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
  MaybeMatchName(WasmParseContext& c, const AstName& name)
  {
      WasmToken tok;
-@@ -1878,17 +1922,17 @@ ParseBlock(WasmParseContext& c, Op op, b
+@@ -1882,17 +1926,17 @@ ParseBlock(WasmParseContext& c, Op op, b
      if (op == Op::Loop) {
          AstName maybeName = c.ts.getIfName();
          if (!maybeName.empty()) {
@@ -2222,7 +2220,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
  
      if (!inParens) {
          if (!c.ts.match(WasmToken::End, c.error))
-@@ -2485,17 +2529,17 @@ ParseDrop(WasmParseContext& c, bool inPa
+@@ -2489,17 +2533,17 @@ ParseDrop(WasmParseContext& c, bool inPa
      return new(c.lifo) AstDrop(*value);
  }
  
@@ -2241,7 +2239,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
          return nullptr;
  
      if (inParens) {
-@@ -3011,23 +3055,27 @@ ParseMemFill(WasmParseContext& c, bool i
+@@ -3015,23 +3059,27 @@ ParseMemFill(WasmParseContext& c, bool i
      return new(c.lifo) AstMemFill(start, val, len);
  }
  #endif
@@ -2273,7 +2271,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
      if (!CheckRecursionLimitDontReport(c.stackLimit))
          return nullptr;
      switch (token.kind()) {
-@@ -3121,51 +3169,54 @@ ParseExprInsideParens(WasmParseContext& 
+@@ -3125,51 +3173,54 @@ ParseExprInsideParens(WasmParseContext& 
      WasmToken token = c.ts.get();
  
      return ParseExprBody(c, token, true);
@@ -2342,7 +2340,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
      return c.ts.match(WasmToken::Text, &import->module, c.error) &&
             c.ts.match(WasmToken::Text, &import->field, c.error);
  }
-@@ -3197,17 +3248,17 @@ MaybeParseTypeUse(WasmParseContext& c, A
+@@ -3201,17 +3252,17 @@ MaybeParseTypeUse(WasmParseContext& c, A
      }
      return true;
  }
@@ -2361,7 +2359,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
              if (!ParseValueTypeList(c, &args))
                  return false;
              break;
-@@ -3292,17 +3343,17 @@ ParseFunc(WasmParseContext& c, AstModule
+@@ -3296,17 +3347,17 @@ ParseFunc(WasmParseContext& c, AstModule
      }
  
      AstRef funcTypeRef;
@@ -2380,7 +2378,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
                  return false;
              break;
            case WasmToken::Param:
-@@ -3338,43 +3389,43 @@ ParseFunc(WasmParseContext& c, AstModule
+@@ -3342,43 +3393,43 @@ ParseFunc(WasmParseContext& c, AstModule
          funcTypeRef.setIndex(funcTypeIndex);
      }
  
@@ -2428,7 +2426,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
  }
  
  static AstTypeDef*
-@@ -3576,32 +3627,38 @@ ParseStartFunc(WasmParseContext& c, Wasm
+@@ -3580,32 +3631,38 @@ ParseStartFunc(WasmParseContext& c, Wasm
          c.ts.generateError(token, c.error);
          return false;
      }
@@ -2481,7 +2479,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
      // Only AnyFunc is allowed at the moment.
      return c.ts.match(WasmToken::AnyFunc, c.error);
  }
-@@ -3652,25 +3709,25 @@ ParseImport(WasmParseContext& c, AstModu
+@@ -3656,25 +3713,25 @@ ParseImport(WasmParseContext& c, AstModu
                  return nullptr;
              return new(c.lifo) AstImport(name, moduleName.text(), fieldName.text(),
                                           DefinitionKind::Table, table);
@@ -2510,7 +2508,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
              AstRef funcTypeRef;
              if (!ParseFuncType(c, &funcTypeRef, module))
                  return nullptr;
-@@ -3879,62 +3936,61 @@ ParseElemSegment(WasmParseContext& c)
+@@ -3883,62 +3940,61 @@ ParseElemSegment(WasmParseContext& c)
      return new(c.lifo) AstElemSegment(offset, std::move(elems));
  }
  
@@ -2578,7 +2576,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
  {
      // By convention with EncodeBinaryModule, a binary module only contains a
      // data section containing the raw bytes contained in the module.
-@@ -4181,16 +4237,38 @@ class Resolver
+@@ -4185,16 +4241,38 @@ class Resolver
          *error_ = JS_smprintf("%s", message);
          return false;
      }
@@ -2617,7 +2615,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
      for (size_t i = 0; i < v.length(); i++) {
          if (!ResolveExpr(r, *v[i]))
              return false;
-@@ -4199,16 +4277,19 @@ ResolveExprList(Resolver& r, const AstEx
+@@ -4203,16 +4281,19 @@ ResolveExprList(Resolver& r, const AstEx
  }
  
  static bool
@@ -2637,7 +2635,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
  }
  
  static bool
-@@ -4374,16 +4455,18 @@ ResolveExtraConversionOperator(Resolver&
+@@ -4378,16 +4459,18 @@ ResolveExtraConversionOperator(Resolver&
  {
      return ResolveExpr(r, *b.operand());
  }
@@ -2656,7 +2654,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
          return false;
      if (i.hasElse()) {
          if (!ResolveExprList(r, i.elseExprs()))
-@@ -4492,25 +4575,32 @@ ResolveMemFill(Resolver& r, AstMemFill& 
+@@ -4496,25 +4579,32 @@ ResolveMemFill(Resolver& r, AstMemFill& 
  {
      return ResolveExpr(r, s.start()) &&
             ResolveExpr(r, s.val()) &&
@@ -2690,7 +2688,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
          return ResolveBlock(r, expr.as<AstBlock>());
        case AstExprKind::Branch:
          return ResolveBranch(r, expr.as<AstBranch>());
-@@ -4578,29 +4668,54 @@ ResolveExpr(Resolver& r, AstExpr& expr)
+@@ -4582,29 +4672,54 @@ ResolveExpr(Resolver& r, AstExpr& expr)
      MOZ_CRASH("Bad expr kind");
  }
  
@@ -2745,7 +2743,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
          return false;
  
      size_t numTypes = module->types().length();
-@@ -4608,17 +4723,30 @@ ResolveModule(LifoAlloc& lifo, AstModule
+@@ -4612,17 +4727,30 @@ ResolveModule(LifoAlloc& lifo, AstModule
          AstTypeDef* td = module->types()[i];
          if (td->isFuncType()) {
              AstFuncType* funcType = static_cast<AstFuncType*>(td);
@@ -2777,7 +2775,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
      size_t lastMemoryIndex = 0;
      size_t lastTableIndex = 0;
      for (AstImport* imp : module->imports()) {
-@@ -4627,16 +4755,18 @@ ResolveModule(LifoAlloc& lifo, AstModule
+@@ -4631,16 +4759,18 @@ ResolveModule(LifoAlloc& lifo, AstModule
              if (!r.registerFuncName(imp->name(), lastFuncIndex++))
                  return r.fail("duplicate import");
              if (!r.resolveSignature(imp->funcType()))
@@ -2796,7 +2794,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
            case DefinitionKind::Table:
              if (!r.registerTableName(imp->name(), lastTableIndex++))
                  return r.fail("duplicate import");
-@@ -4646,19 +4776,21 @@ ResolveModule(LifoAlloc& lifo, AstModule
+@@ -4650,19 +4780,21 @@ ResolveModule(LifoAlloc& lifo, AstModule
  
      for (AstFunc* func : module->funcs()) {
          if (!r.resolveSignature(func->funcType()))
@@ -2819,7 +2817,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
          if (table.imported)
              continue;
          if (!r.registerTableName(table.name, lastTableIndex++))
-@@ -4737,17 +4869,17 @@ EncodeExprList(Encoder& e, const AstExpr
+@@ -4741,17 +4873,17 @@ EncodeExprList(Encoder& e, const AstExpr
  }
  
  static bool
@@ -2838,7 +2836,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
      if (!e.writeOp(Op::End))
          return false;
  
-@@ -4947,17 +5079,17 @@ EncodeExtraConversionOperator(Encoder& e
+@@ -4951,17 +5083,17 @@ EncodeExtraConversionOperator(Encoder& e
  #endif
  
  static bool
@@ -2857,7 +2855,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
      if (i.hasElse()) {
          if (!e.writeOp(Op::Else))
              return false;
-@@ -5141,17 +5273,17 @@ EncodeMemFill(Encoder& e, AstMemFill& s)
+@@ -5145,17 +5277,17 @@ EncodeMemFill(Encoder& e, AstMemFill& s)
             e.writeOp(MiscOp::MemFill);
  }
  #endif
@@ -2876,7 +2874,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
      switch (expr.kind()) {
        case AstExprKind::Pop:
          return true;
-@@ -5255,38 +5387,38 @@ EncodeTypeSection(Encoder& e, AstModule&
+@@ -5259,38 +5391,38 @@ EncodeTypeSection(Encoder& e, AstModule&
          if (td->isFuncType()) {
              AstFuncType* funcType = static_cast<AstFuncType*>(td);
              if (!e.writeVarU32(uint32_t(TypeCode::Func)))
@@ -2922,7 +2920,7 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
      }
  
      e.finishSection(offset);
-@@ -5548,18 +5680,20 @@ EncodeFunctionBody(Encoder& e, AstFunc& 
+@@ -5552,18 +5684,20 @@ EncodeFunctionBody(Encoder& e, Uint32Vec
  {
      size_t bodySizeAt;
      if (!e.writePatchableVarU32(&bodySizeAt))
@@ -2941,14 +2939,14 @@ diff --git a/js/src/wasm/WasmTextToBinary.cpp b/js/src/wasm/WasmTextToBinary.cpp
          return false;
  
      for (AstExpr* expr : func.body()) {
+         if (!offsets->append(e.currentOffset()))
+             return false;
          if (!EncodeExpr(e, *expr))
              return false;
-     }
- 
 diff --git a/js/src/wasm/WasmTypes.cpp b/js/src/wasm/WasmTypes.cpp
 --- a/js/src/wasm/WasmTypes.cpp
 +++ b/js/src/wasm/WasmTypes.cpp
-@@ -75,19 +75,20 @@ Val::writePayload(uint8_t* dst) const
+@@ -76,19 +76,20 @@ Val::writePayload(uint8_t* dst) const
        case ValType::I16x8:
        case ValType::I32x4:
        case ValType::F32x4:
@@ -2970,7 +2968,7 @@ diff --git a/js/src/wasm/WasmTypes.cpp b/js/src/wasm/WasmTypes.cpp
  {
      switch (callee) {
        case SymbolicAddress::FloorD:
-@@ -198,16 +199,17 @@ IsImmediateType(ValType vt)
+@@ -199,16 +200,17 @@ IsImmediateType(ValType vt)
          return true;
        case ValType::I8x16:
        case ValType::I16x8:
@@ -2988,7 +2986,7 @@ diff --git a/js/src/wasm/WasmTypes.cpp b/js/src/wasm/WasmTypes.cpp
  static unsigned
  EncodeImmediateType(ValType vt)
  {
-@@ -225,16 +227,17 @@ EncodeImmediateType(ValType vt)
+@@ -226,16 +228,17 @@ EncodeImmediateType(ValType vt)
          return 4;
        case ValType::I8x16:
        case ValType::I16x8:
@@ -3006,7 +3004,7 @@ diff --git a/js/src/wasm/WasmTypes.cpp b/js/src/wasm/WasmTypes.cpp
  /* static */ bool
  FuncTypeIdDesc::isGlobal(const FuncType& funcType)
  {
-@@ -694,33 +697,34 @@ DebugFrame::getLocal(uint32_t localIndex
+@@ -695,33 +698,34 @@ DebugFrame::getLocal(uint32_t localIndex
      return true;
  }
  
@@ -4161,7 +4159,7 @@ diff --git a/js/src/wasm/WasmValidate.cpp b/js/src/wasm/WasmValidate.cpp
 diff --git a/js/src/wasm/WasmValidate.h b/js/src/wasm/WasmValidate.h
 --- a/js/src/wasm/WasmValidate.h
 +++ b/js/src/wasm/WasmValidate.h
-@@ -264,23 +264,31 @@ class Encoder
+@@ -261,23 +261,31 @@ class Encoder
      MOZ_MUST_USE bool writeVarU64(uint64_t i) {
          return writeVarU<uint64_t>(i);
      }
@@ -4197,7 +4195,7 @@ diff --git a/js/src/wasm/WasmValidate.h b/js/src/wasm/WasmValidate.h
      }
      MOZ_MUST_USE bool writeOp(MiscOp op) {
          static_assert(size_t(MiscOp::Limit) <= 256, "fits");
-@@ -542,23 +550,39 @@ class Decoder
+@@ -539,23 +547,39 @@ class Decoder
          return readVarS<int32_t>(out);
      }
      MOZ_MUST_USE bool readVarU64(uint64_t* out) {
@@ -4241,7 +4239,7 @@ diff --git a/js/src/wasm/WasmValidate.h b/js/src/wasm/WasmValidate.h
              return false;
          op->b0 = u8;
          if (MOZ_LIKELY(!IsPrefixByte(u8)))
-@@ -666,19 +690,16 @@ class Decoder
+@@ -663,19 +687,16 @@ class Decoder
      uint64_t uncheckedReadVarU64() {
          return uncheckedReadVarU<uint64_t>();
      }
@@ -4261,7 +4259,7 @@ diff --git a/js/src/wasm/WasmValidate.h b/js/src/wasm/WasmValidate.h
                 : Op(uncheckedReadFixedU8() + UINT8_MAX);
      }
      void uncheckedReadFixedI8x16(I8x16* i8x16) {
-@@ -704,18 +725,27 @@ class Decoder
+@@ -701,18 +722,27 @@ class Decoder
  };
  
  // The local entries are part of function bodies and thus serialized by both

frg/work-js/mozilla-release/patches/mozilla-central-push_424822.patch → frg/work-js/mozilla-release/patches/1463163-63a1.patch

@@ -3,7 +3,7 @@
 # Date 1530605316 -7200
 #      Tue Jul 03 10:08:36 2018 +0200
 # Node ID 07b0a9838f2d2c06b7f82e74b4f75a12fedfb2c6
-# Parent  82a5ce0860f640d6d4e9709611ae4ebc02c5df0a
+# Parent  98c22b90be7af5eee323cae0ab8814ce2452e171
 Bug 1463163 - Make ArraySpeciesCreate realm check work with same-compartment realms. r=anba
 
 diff --git a/js/src/builtin/Array.cpp b/js/src/builtin/Array.cpp
@@ -12,7 +12,7 @@ diff --git a/js/src/builtin/Array.cpp b/js/src/builtin/Array.cpp
 @@ -1018,48 +1018,45 @@ AddLengthProperty(JSContext* cx, HandleA
      return NativeObject::addAccessorProperty(cx, obj, lengthId,
                                               array_length_getter, array_length_setter,
-                                              JSPROP_PERMANENT);
+                                              JSPROP_PERMANENT | JSPROP_SHADOWABLE);
  }
  
  static bool
@@ -173,7 +173,7 @@ new file mode 100644
 diff --git a/js/src/jit/InlinableNatives.h b/js/src/jit/InlinableNatives.h
 --- a/js/src/jit/InlinableNatives.h
 +++ b/js/src/jit/InlinableNatives.h
-@@ -118,17 +118,17 @@
+@@ -119,17 +119,17 @@
      _(IntrinsicUnsafeGetInt32FromReservedSlot) \
      _(IntrinsicUnsafeGetStringFromReservedSlot) \
      _(IntrinsicUnsafeGetBooleanFromReservedSlot) \
@@ -195,7 +195,7 @@ diff --git a/js/src/jit/InlinableNatives.h b/js/src/jit/InlinableNatives.h
 diff --git a/js/src/jit/IonBuilder.h b/js/src/jit/IonBuilder.h
 --- a/js/src/jit/IonBuilder.h
 +++ b/js/src/jit/IonBuilder.h
-@@ -775,17 +775,17 @@ class IonBuilder
+@@ -776,17 +776,17 @@ class IonBuilder
      InliningResult inlineSimdAnyAllTrue(CallInfo& callInfo, bool IsAllTrue, JSNative native,
                                          SimdType type);
  
@@ -217,7 +217,7 @@ diff --git a/js/src/jit/IonBuilder.h b/js/src/jit/IonBuilder.h
 diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp
 --- a/js/src/jit/MCallOptimize.cpp
 +++ b/js/src/jit/MCallOptimize.cpp
-@@ -311,18 +311,18 @@ IonBuilder::inlineNativeCall(CallInfo& c
+@@ -313,18 +313,18 @@ IonBuilder::inlineNativeCall(CallInfo& c
        case InlinableNative::IntrinsicIsCallable:
          return inlineIsCallable(callInfo);
        case InlinableNative::IntrinsicIsConstructor:
@@ -238,7 +238,7 @@ diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp
          return inlineIsConstructing(callInfo);
        case InlinableNative::IntrinsicSubstringKernel:
          return inlineSubstringKernel(callInfo);
-@@ -3294,40 +3294,36 @@ IonBuilder::inlineToObject(CallInfo& cal
+@@ -3334,40 +3334,36 @@ IonBuilder::inlineToObject(CallInfo& cal
  
          MOZ_TRY(pushTypeBarrier(ins, getInlineReturnTypeSet(), BarrierKind::TypeSet));
      }
@@ -312,7 +312,7 @@ diff --git a/js/src/vm/SelfHosting.cpp b/js/src/vm/SelfHosting.cpp
  static bool
  intrinsic_ToInteger(JSContext* cx, unsigned argc, Value* vp)
  {
-@@ -2415,18 +2415,18 @@ static const JSFunctionSpec intrinsic_fu
+@@ -2426,18 +2426,18 @@ static const JSFunctionSpec intrinsic_fu
      JS_FN("std_SIMD_Bool16x8_extractLane",       simd_bool16x8_extractLane,    2,0),
      JS_FN("std_SIMD_Bool32x4_extractLane",       simd_bool32x4_extractLane,    2,0),
      JS_FN("std_SIMD_Bool64x2_extractLane",       simd_bool64x2_extractLane,    2,0),
@@ -400,7 +400,7 @@ diff --git a/js/src/vm/TypeInference.cpp b/js/src/vm/TypeInference.cpp
 diff --git a/js/src/vm/TypeInference.h b/js/src/vm/TypeInference.h
 --- a/js/src/vm/TypeInference.h
 +++ b/js/src/vm/TypeInference.h
-@@ -873,16 +873,23 @@ class TemporaryTypeSet : public TypeSet
+@@ -877,16 +877,23 @@ class TemporaryTypeSet : public TypeSet
      }
  
      /* Whether the type set contains objects with any of a set of flags. */

frg/work-js/mozilla-release/patches/mozilla-central-push_424882.patch → frg/work-js/mozilla-release/patches/1464475-63a1.patch

@@ -3,7 +3,7 @@
 # Date 1529938367 25200
 #      Mon Jun 25 07:52:47 2018 -0700
 # Node ID 8bfa09b6fb7dd7574833339c541a8e442103c790
-# Parent  e90b073a7269ae245a544e6b525dfc911033929e
+# Parent  0a99fae57864a0df7a08f8622e4ecf6e630c0be3
 Bug 1464475 - Use HandleValue for setPendingException(). r=sfink
 
 diff --git a/js/src/jsexn.cpp b/js/src/jsexn.cpp
@@ -120,13 +120,13 @@ diff --git a/js/src/vm/JSContext-inl.h b/js/src/vm/JSContext-inl.h
 -JSContext::setPendingException(const js::Value& v)
 +JSContext::setPendingException(JS::HandleValue v)
  {
- #if defined(NIGHTLY_BUILD)
-     do {
-         // Do not intercept exceptions if we are already
-         // in the exception interceptor. That would lead
-         // to infinite recursion.
-         if (this->runtime()->errorInterception.isExecuting)
-             break;
+     // overRecursed_ is set after the fact by ReportOverRecursed.
+     this->overRecursed_ = false;
+     this->throwing = true;
+     this->unwrappedException() = v;
+     // We don't use assertSameCompartment here to allow
+     // js::SetPendingExceptionCrossContext to work.
+     MOZ_ASSERT_IF(v.isObject(), v.toObject().compartment() == compartment());
 diff --git a/js/src/vm/JSContext.cpp b/js/src/vm/JSContext.cpp
 --- a/js/src/vm/JSContext.cpp
 +++ b/js/src/vm/JSContext.cpp

frg/work-js/mozilla-release/patches/mozilla-central-push_425164.patch → frg/work-js/mozilla-release/patches/1465505-63a1.patch

@@ -3,7 +3,7 @@
 # Date 1530734111 10800
 #      Wed Jul 04 16:55:11 2018 -0300
 # Node ID 05329bb2ebf89f407e0c7ec1e35280e7b2cd11c8
-# Parent  6792d723a2b1d4f2ff2a702f7ae1f4c52fa32346
+# Parent  19dc8d36e98a34d62e92b81d627729bc932ad7d7
 Bug 1465505: Replace PRMJ_Now() by mozilla::TimeStamp r=jonco
 
 Notice as TimeStamp is not an integral type, it can't be wrapped by
@@ -136,7 +136,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
      static const uint64_t HighFrequencyHighLimitBytes = 500 * 1024 * 1024;
  
      /* JSGC_HIGH_FREQUENCY_HEAP_GROWTH_MAX */
-@@ -341,16 +341,18 @@ namespace TuningDefaults {
+@@ -344,16 +344,18 @@ namespace TuningDefaults {
      static const bool CompactingEnabled = true;
  
      /* JSGC_NURSERY_FREE_THRESHOLD_FOR_IDLE_COLLECTION */
@@ -155,7 +155,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
   */
  static const double MinAllocationThresholdFactor = 0.9;
  
-@@ -948,17 +950,17 @@ GCRuntime::GCRuntime(JSRuntime* rt) :
+@@ -951,17 +953,17 @@ GCRuntime::GCRuntime(JSRuntime* rt) :
      atomsZone(nullptr),
      stats_(rt),
      marker(rt),
@@ -174,7 +174,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
      majorGCTriggerReason(JS::gcreason::NO_REASON),
      fullGCForAtomsRequested_(false),
      minorGCNumber(0),
-@@ -1409,17 +1411,17 @@ GCSchedulingTunables::setParameter(JSGCP
+@@ -1415,17 +1417,17 @@ GCSchedulingTunables::setParameter(JSGCP
      switch(key) {
        case JSGC_MAX_BYTES:
          gcMaxBytes_ = value;
@@ -193,7 +193,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
          setHighFrequencyLowLimit(newLimit);
          break;
        }
-@@ -1565,17 +1567,17 @@ GCSchedulingTunables::GCSchedulingTunabl
+@@ -1574,17 +1576,17 @@ GCSchedulingTunables::GCSchedulingTunabl
    : gcMaxBytes_(0),
      maxMallocBytes_(TuningDefaults::MaxMallocBytes),
      gcMaxNurseryBytes_(0),
@@ -210,9 +210,9 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
      highFrequencyHeapGrowthMin_(TuningDefaults::HighFrequencyHeapGrowthMin),
      lowFrequencyHeapGrowth_(TuningDefaults::LowFrequencyHeapGrowth),
      dynamicMarkSliceEnabled_(TuningDefaults::DynamicMarkSliceEnabled),
+     refreshFrameSlicesEnabled_(TuningDefaults::RefreshFrameSlicesEnabled),
      minEmptyChunkCount_(TuningDefaults::MinEmptyChunkCount),
-     maxEmptyChunkCount_(TuningDefaults::MaxEmptyChunkCount),
-@@ -1616,18 +1618,18 @@ GCSchedulingTunables::resetParameter(JSG
+@@ -1626,18 +1628,18 @@ GCSchedulingTunables::resetParameter(JSG
      switch(key) {
        case JSGC_MAX_BYTES:
          gcMaxBytes_ = 0xffffffff;
@@ -233,7 +233,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
          setHighFrequencyHighLimit(TuningDefaults::HighFrequencyHighLimitBytes);
          break;
        case JSGC_HIGH_FREQUENCY_HEAP_GROWTH_MAX:
-@@ -1693,17 +1695,17 @@ GCRuntime::getParameter(JSGCParamKey key
+@@ -1706,17 +1708,17 @@ GCRuntime::getParameter(JSGCParamKey key
          } else {
              MOZ_RELEASE_ASSERT(defaultTimeBudget_ >= 0);
              MOZ_RELEASE_ASSERT(defaultTimeBudget_ <= UINT32_MAX);
@@ -252,7 +252,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
          return uint32_t(tunables.highFrequencyHeapGrowthMax() * 100);
        case JSGC_HIGH_FREQUENCY_HEAP_GROWTH_MIN:
          return uint32_t(tunables.highFrequencyHeapGrowthMin() * 100);
-@@ -2137,17 +2139,18 @@ GCRuntime::shouldCompact()
+@@ -2152,17 +2154,18 @@ GCRuntime::shouldCompact()
          return false;
  
      if (initialReason == JS::gcreason::USER_INACTIVE ||
@@ -272,7 +272,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
      return compactingEnabled && rt->mainContextFromOwnThread()->compactingDisabledCount == 0;
  }
  
-@@ -3243,41 +3246,43 @@ void
+@@ -3300,41 +3303,43 @@ void
  ArenaLists::queueForegroundThingsForSweep()
  {
      gcShapeArenasToUpdate = arenaListsToSweep(AllocKind::SHAPE);
@@ -318,7 +318,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
  SliceBudget::describe(char* buffer, size_t maxlen) const
  {
      if (isUnlimited())
-@@ -3286,17 +3291,20 @@ SliceBudget::describe(char* buffer, size
+@@ -3343,17 +3348,20 @@ SliceBudget::describe(char* buffer, size
          return snprintf(buffer, maxlen, "work(%" PRId64 ")", workBudget.budget);
      else
          return snprintf(buffer, maxlen, "%" PRId64 "ms", timeBudget.budget);
@@ -340,7 +340,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
  void
  GCRuntime::requestMajorGC(JS::gcreason::Reason reason)
  {
-@@ -4048,30 +4056,34 @@ GCRuntime::purgeRuntime()
+@@ -4105,30 +4113,34 @@ GCRuntime::purgeRuntime()
      if (auto cache = rt->maybeThisRuntimeSharedImmutableStrings())
          cache->purge();
  
@@ -377,7 +377,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
  
  #ifdef DEBUG
  class CompartmentCheckTracer : public JS::CallbackTracer
-@@ -4235,17 +4247,17 @@ GCRuntime::prepareZonesForCollection(JS:
+@@ -4292,17 +4304,17 @@ GCRuntime::prepareZonesForCollection(JS:
          for (auto i : AllAllocKinds())
              MOZ_ASSERT(!zone->arenas.arenaListsToSweep(i));
      }
@@ -396,7 +396,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
              any = true;
              zone->changeGCState(Zone::NoGC, Zone::Mark);
          } else {
-@@ -6779,17 +6791,17 @@ GCRuntime::endCompactPhase()
+@@ -6852,17 +6864,17 @@ GCRuntime::endCompactPhase()
  void
  GCRuntime::finishCollection()
  {
@@ -436,7 +436,7 @@ diff --git a/js/src/gc/GCRuntime.h b/js/src/gc/GCRuntime.h
  #include "gc/Nursery.h"
  #include "gc/Scheduling.h"
  #include "gc/Statistics.h"
-@@ -595,17 +596,17 @@ class GCRuntime
+@@ -596,17 +597,17 @@ class GCRuntime
  
      friend class AutoCallGCCallbacks;
      void maybeCallGCCallback(JSGCStatus status);
@@ -455,7 +455,7 @@ diff --git a/js/src/gc/GCRuntime.h b/js/src/gc/GCRuntime.h
      void maybeDoCycleCollection();
      void markCompartments();
      IncrementalProgress drainMarkStack(SliceBudget& sliceBudget, gcstats::PhaseKind phase);
-@@ -743,17 +744,17 @@ class GCRuntime
+@@ -744,17 +745,17 @@ class GCRuntime
      /*
       * Number of the committed arenas in all GC chunks including empty chunks.
       */
@@ -499,7 +499,7 @@ diff --git a/js/src/gc/Scheduling.h b/js/src/gc/Scheduling.h
       * JSGC_HIGH_FREQUENCY_HEAP_GROWTH_MIN
       *
       * When in the |highFrequencyGC| mode, these parameterize the per-zone
-@@ -445,17 +445,17 @@ class GCSchedulingTunables
+@@ -452,17 +452,17 @@ class GCSchedulingTunables
      size_t gcMaxBytes() const { return gcMaxBytes_; }
      size_t maxMallocBytes() const { return maxMallocBytes_; }
      size_t gcMaxNurseryBytes() const { return gcMaxNurseryBytes_; }
@@ -516,9 +516,9 @@ diff --git a/js/src/gc/Scheduling.h b/js/src/gc/Scheduling.h
      double highFrequencyHeapGrowthMin() const { return highFrequencyHeapGrowthMin_; }
      double lowFrequencyHeapGrowth() const { return lowFrequencyHeapGrowth_; }
      bool isDynamicMarkSliceEnabled() const { return dynamicMarkSliceEnabled_; }
+     bool areRefreshFrameSlicesEnabled() const { return refreshFrameSlicesEnabled_; }
      unsigned minEmptyChunkCount(const AutoLockGC&) const { return minEmptyChunkCount_; }
-     unsigned maxEmptyChunkCount() const { return maxEmptyChunkCount_; }
-@@ -490,21 +490,21 @@ class GCSchedulingState
+@@ -498,21 +498,21 @@ class GCSchedulingState
  
    public:
      GCSchedulingState()
@@ -665,7 +665,7 @@ diff --git a/js/src/vm/Runtime.h b/js/src/vm/Runtime.h
  #include "builtin/AtomicsObject.h"
  #include "builtin/intl/SharedIntlData.h"
  #include "builtin/Promise.h"
-@@ -929,17 +930,17 @@ struct JSRuntime : public js::MallocProv
+@@ -928,17 +929,17 @@ struct JSRuntime : public js::MallocProv
  
      /*
       * Debugger.Memory functions like takeCensus use this embedding-provided

frg/work-js/mozilla-release/patches/mozilla-central-push_424035.patch → frg/work-js/mozilla-release/patches/1471089-63a1.patch

@@ -3,7 +3,7 @@
 # Date 1529973934 25200
 #      Mon Jun 25 17:45:34 2018 -0700
 # Node ID ac67cc017934d225ce663484e1348e77818c0535
-# Parent  939a0137318e29a28e6fb8e5e026a910b8e80635
+# Parent  a7c7d03f9b2780df8ecb8c908fa20a78dedc83d7
 Bug 1471089: Improve handling of pre-loaded content processes in script preloader. r=erahm
 
 MozReview-Commit-ID: GwZzQ0ic5Et
@@ -11,7 +11,7 @@ MozReview-Commit-ID: GwZzQ0ic5Et
 diff --git a/js/xpconnect/loader/ScriptPreloader.cpp b/js/xpconnect/loader/ScriptPreloader.cpp
 --- a/js/xpconnect/loader/ScriptPreloader.cpp
 +++ b/js/xpconnect/loader/ScriptPreloader.cpp
-@@ -22,28 +22,33 @@
+@@ -22,27 +22,32 @@
  #include "mozilla/dom/ContentParent.h"
  
  #include "MainThreadUtils.h"
@@ -26,9 +26,8 @@ diff --git a/js/xpconnect/loader/ScriptPreloader.cpp b/js/xpconnect/loader/Scrip
  #include "nsXULAppAPI.h"
  #include "xpcpublic.h"
  
- #define STARTUP_COMPLETE_TOPIC "browser-delayed-startup-finished"
+ #define DELAYED_STARTUP_TOPIC "browser-delayed-startup-finished"
  #define DOC_ELEM_INSERTED_TOPIC "document-element-inserted"
- #define CACHE_WRITE_TOPIC "browser-idle-startup-tasks-finished"
  #define CLEANUP_TOPIC "xpcom-shutdown"
  #define SHUTDOWN_TOPIC "quit-application-granted"
  #define CACHE_INVALIDATE_TOPIC "startupcache-invalidate"
@@ -45,9 +44,9 @@ diff --git a/js/xpconnect/loader/ScriptPreloader.cpp b/js/xpconnect/loader/Scrip
  }
  
  using mozilla::dom::AutoJSAPI;
-@@ -351,36 +356,59 @@ ScriptPreloader::Observe(nsISupports* su
-         MOZ_ASSERT(mStartupFinished);
-         MOZ_ASSERT(XRE_IsParentProcess());
+@@ -345,36 +350,59 @@ ScriptPreloader::Observe(nsISupports* su
+ 
+         mStartupFinished = true;
  
          if (mChildCache) {
              Unused << NS_NewNamedThread("SaveScripts",
@@ -108,11 +107,11 @@ diff --git a/js/xpconnect/loader/ScriptPreloader.cpp b/js/xpconnect/loader/Scrip
  Result<nsCOMPtr<nsIFile>, nsresult>
  ScriptPreloader::GetCacheFile(const nsAString& suffix)
  {
-     NS_ENSURE_TRUE(mProfD, Err(NS_ERROR_NOT_INITIALIZED));
- 
      nsCOMPtr<nsIFile> cacheFile;
      MOZ_TRY(mProfD->Clone(getter_AddRefs(cacheFile)));
-@@ -453,16 +481,29 @@ ScriptPreloader::InitCache(const Maybe<i
+ 
+     MOZ_TRY(cacheFile->AppendNative(NS_LITERAL_CSTRING("startupCache")));
+@@ -445,16 +473,29 @@ ScriptPreloader::InitCache(const Maybe<i
  {
      MOZ_ASSERT(XRE_IsContentProcess());
  

frg/work-js/mozilla-release/patches/mozilla-central-push_425454.patch → frg/work-js/mozilla-release/patches/1471091-1-63a1.patch

@@ -3,7 +3,7 @@
 # Date 1530320866 25200
 #      Fri Jun 29 18:07:46 2018 -0700
 # Node ID 9bb8b9e818869e1a6a9f52213aea66c085d3921a
-# Parent  e2d3d7bb9d1f7150ec3be7f8507977f7378ec541
+# Parent  410ba35eee849c10f51d0724bf6ab0b1c5d40434
 Bug 1471091: Avoid cloning and caching process scripts. r=mccr8
 
 We only run process scripts once per process, so there's no need to compile
@@ -20,14 +20,14 @@ MozReview-Commit-ID: EfKo2aYbBxl
 diff --git a/dom/base/ProcessGlobal.h b/dom/base/ProcessGlobal.h
 --- a/dom/base/ProcessGlobal.h
 +++ b/dom/base/ProcessGlobal.h
-@@ -89,16 +89,21 @@ public:
-   virtual void LoadScript(const nsAString& aURL);
+@@ -59,16 +59,21 @@ public:
+   }
+   virtual nsIPrincipal* GetPrincipal() override { return mPrincipal; }
  
-   virtual JSObject* GetGlobalJSObject() override
+   virtual JSObject* WrapObject(JSContext* cx, JS::Handle<JSObject*> aGivenProto) override
    {
-     return GetWrapper();
+     MOZ_CRASH("ProcessGlobal doesn't use DOM bindings!");
    }
-   virtual nsIPrincipal* GetPrincipal() override { return mPrincipal; }
  
 +  bool IsProcessScoped() const override
 +  {
@@ -41,11 +41,11 @@ diff --git a/dom/base/ProcessGlobal.h b/dom/base/ProcessGlobal.h
  
  private:
    bool mInitialized;
- 
+   RefPtr<nsFrameMessageManager> mMessageManager;
 diff --git a/dom/base/nsFrameMessageManager.cpp b/dom/base/nsFrameMessageManager.cpp
 --- a/dom/base/nsFrameMessageManager.cpp
 +++ b/dom/base/nsFrameMessageManager.cpp
-@@ -1253,17 +1253,17 @@ nsMessageManagerScriptExecutor::LoadScri
+@@ -1552,17 +1552,17 @@ nsMessageManagerScriptExecutor::LoadScri
    nsMessageManagerScriptHolder* holder = sCachedScripts->Get(aURL);
    if (holder && holder->WillRunInGlobalScope() == aRunInGlobalScope) {
      script = holder->mScript;
@@ -58,13 +58,13 @@ diff --git a/dom/base/nsFrameMessageManager.cpp b/dom/base/nsFrameMessageManager
 +                                 shouldCache, aGlobal, &script);
    }
  
-   AutoEntryScript aes(aGlobal, "message manager script load");
-   JSContext* cx = aes.cx();
-   if (script) {
-     if (aRunInGlobalScope) {
-       JS::RootedValue rval(cx);
-       JS::CloneAndExecuteScript(cx, script, &rval);
-@@ -1278,16 +1278,17 @@ nsMessageManagerScriptExecutor::LoadScri
+   JS::Rooted<JSObject*> global(rcx, mGlobal);
+   if (global) {
+     AutoEntryScript aes(global, "message manager script load");
+     JSContext* cx = aes.cx();
+     if (script) {
+       if (aRunInGlobalScope) {
+@@ -1580,16 +1580,17 @@ nsMessageManagerScriptExecutor::LoadScri
    }
  }
  
@@ -82,7 +82,7 @@ diff --git a/dom/base/nsFrameMessageManager.cpp b/dom/base/nsFrameMessageManager
    if (NS_FAILED(rv)) {
      return;
    }
-@@ -1296,20 +1297,27 @@ nsMessageManagerScriptExecutor::TryCache
+@@ -1598,20 +1599,27 @@ nsMessageManagerScriptExecutor::TryCache
    rv = NS_URIChainHasFlags(uri,
                             nsIProtocolHandler::URI_IS_LOCAL_RESOURCE,
                             &hasFlags);
@@ -113,7 +113,7 @@ diff --git a/dom/base/nsFrameMessageManager.cpp b/dom/base/nsFrameMessageManager
    script = ScriptPreloader::GetChildSingleton().GetCachedScript(cx, url);
  
    if (!script) {
-@@ -1366,30 +1374,26 @@ nsMessageManagerScriptExecutor::TryCache
+@@ -1668,30 +1676,26 @@ nsMessageManagerScriptExecutor::TryCache
  
    MOZ_ASSERT(script);
    aScriptp.set(script);
@@ -156,12 +156,12 @@ diff --git a/dom/base/nsFrameMessageManager.cpp b/dom/base/nsFrameMessageManager
 diff --git a/dom/base/nsFrameMessageManager.h b/dom/base/nsFrameMessageManager.h
 --- a/dom/base/nsFrameMessageManager.h
 +++ b/dom/base/nsFrameMessageManager.h
-@@ -426,28 +426,35 @@ protected:
+@@ -385,26 +385,33 @@ protected:
+   nsMessageManagerScriptExecutor() { MOZ_COUNT_CTOR(nsMessageManagerScriptExecutor); }
    ~nsMessageManagerScriptExecutor() { MOZ_COUNT_DTOR(nsMessageManagerScriptExecutor); }
  
    void DidCreateGlobal();
-   void LoadScriptInternal(JS::Handle<JSObject*> aGlobal, const nsAString& aURL,
-                           bool aRunInGlobalScope);
+   void LoadScriptInternal(const nsAString& aURL, bool aRunInGlobalScope);
    void TryCacheLoadAndCompileScript(const nsAString& aURL,
                                      bool aRunInGlobalScope,
                                      bool aShouldCache,
@@ -169,12 +169,10 @@ diff --git a/dom/base/nsFrameMessageManager.h b/dom/base/nsFrameMessageManager.h
                                      JS::MutableHandle<JSScript*> aScriptp);
 -  void TryCacheLoadAndCompileScript(const nsAString& aURL,
 -                                    bool aRunInGlobalScope);
-   bool InitChildGlobalInternal(const nsACString& aID);
-   virtual bool WrapGlobalObject(JSContext* aCx,
-                                 JS::RealmOptions& aOptions,
-                                 JS::MutableHandle<JSObject*> aReflector) = 0;
+   bool InitChildGlobalInternal(nsISupports* aScope, const nsACString& aID);
    void Trace(const TraceCallbacks& aCallbacks, void* aClosure);
    void Unlink();
+   JS::TenuredHeap<JSObject*> mGlobal;
    nsCOMPtr<nsIPrincipal> mPrincipal;
    AutoTArray<JS::Heap<JSObject*>, 2> mAnonymousGlobalScopes;
  
@@ -197,7 +195,7 @@ diff --git a/dom/base/nsFrameMessageManager.h b/dom/base/nsFrameMessageManager.h
 diff --git a/js/xpconnect/loader/ScriptPreloader.cpp b/js/xpconnect/loader/ScriptPreloader.cpp
 --- a/js/xpconnect/loader/ScriptPreloader.cpp
 +++ b/js/xpconnect/loader/ScriptPreloader.cpp
-@@ -402,16 +402,22 @@ ScriptPreloader::FinishContentStartup()
+@@ -394,16 +394,22 @@ ScriptPreloader::FinishContentStartup()
  
      mStartupFinished = true;
  
@@ -215,12 +213,12 @@ diff --git a/js/xpconnect/loader/ScriptPreloader.cpp b/js/xpconnect/loader/Scrip
  Result<nsCOMPtr<nsIFile>, nsresult>
  ScriptPreloader::GetCacheFile(const nsAString& suffix)
  {
-     NS_ENSURE_TRUE(mProfD, Err(NS_ERROR_NOT_INITIALIZED));
- 
      nsCOMPtr<nsIFile> cacheFile;
      MOZ_TRY(mProfD->Clone(getter_AddRefs(cacheFile)));
  
-@@ -792,33 +798,46 @@ ScriptPreloader::Run()
+     MOZ_TRY(cacheFile->AppendNative(NS_LITERAL_CSTRING("startupCache")));
+     Unused << cacheFile->Create(nsIFile::DIRECTORY_TYPE, 0777);
+@@ -782,33 +788,46 @@ ScriptPreloader::Run()
                                        mSaveThread.forget());
  
      mal.NotifyAll();
@@ -270,7 +268,7 @@ diff --git a/js/xpconnect/loader/ScriptPreloader.cpp b/js/xpconnect/loader/Scrip
      script->UpdateLoadTime(TimeStamp::Now());
      script->mProcessTypes += CurrentProcessType();
  }
-@@ -1108,16 +1127,20 @@ ScriptPreloader::CachedScript::CachedScr
+@@ -1104,16 +1123,20 @@ ScriptPreloader::CachedScript::CachedScr
      // compare against last session's values later.
      mOriginalProcessTypes = mProcessTypes;
      mProcessTypes = {};
@@ -294,7 +292,7 @@ diff --git a/js/xpconnect/loader/ScriptPreloader.cpp b/js/xpconnect/loader/Scrip
 diff --git a/js/xpconnect/loader/ScriptPreloader.h b/js/xpconnect/loader/ScriptPreloader.h
 --- a/js/xpconnect/loader/ScriptPreloader.h
 +++ b/js/xpconnect/loader/ScriptPreloader.h
-@@ -77,17 +77,22 @@ public:
+@@ -76,17 +76,22 @@ public:
  
      // Retrieves the script with the given cache key from the script cache.
      // Returns null if the script is not cached.
@@ -318,7 +316,7 @@ diff --git a/js/xpconnect/loader/ScriptPreloader.h b/js/xpconnect/loader/ScriptP
      // Initializes the script cache from the startup script cache file.
      Result<Ok, nsresult> InitCache(const nsAString& = NS_LITERAL_STRING("scriptCache"));
  
-@@ -144,22 +149,24 @@ private:
+@@ -143,22 +148,24 @@ private:
      // the next session's cache file. If it was compiled in this session, its
      // mXDRRange will initially be empty, and its mXDRData buffer will be
      // populated just before it is written to the cache file.
@@ -344,7 +342,7 @@ diff --git a/js/xpconnect/loader/ScriptPreloader.h b/js/xpconnect/loader/ScriptP
  
          ScriptStatus Status() const
          {
-@@ -208,16 +215,33 @@ private:
+@@ -207,16 +214,33 @@ private:
  
          void UpdateLoadTime(const TimeStamp& loadTime)
          {
@@ -378,7 +376,7 @@ diff --git a/js/xpconnect/loader/ScriptPreloader.h b/js/xpconnect/loader/ScriptP
          // script cache file.
          template<typename Buffer>
          void Code(Buffer& buffer)
-@@ -299,16 +323,21 @@ private:
+@@ -298,16 +322,21 @@ private:
          JS::Heap<JSScript*> mScript;
  
          // True if this script is ready to be executed. This means that either the
@@ -400,7 +398,7 @@ diff --git a/js/xpconnect/loader/ScriptPreloader.h b/js/xpconnect/loader/ScriptP
          EnumSet<ProcessType> mOriginalProcessTypes{};
  
          // The read-only XDR data for this script, which was either read from an
-@@ -378,16 +407,22 @@ private:
+@@ -377,16 +406,22 @@ private:
      // Prepares scripts for writing to the cache, serializing new scripts to
      // XDR, and calculating their size-based offsets.
      void PrepareCacheWrite();

frg/work-js/mozilla-release/patches/1471272-63a1.patch

@@ -1,8 +1,9 @@
 # HG changeset patch
 # User Ted Campbell <tcampbell@mozilla.com>
 # Date 1530028979 14400
+#      Tue Jun 26 12:02:59 2018 -0400
 # Node ID 67c0442a7a44a0618504911b3239aa0117b3d4ee
-# Parent  7e4da7391ba0e11bcbb0820c41eb993605a28a03
+# Parent  9f5863545b247fa401c122d7c884d6bd78a2a7b5
 Bug 1471272 - Add [SMDOC] tags for in-source documentation. r=jandem,nbp
 
 MozReview-Commit-ID: I038aYgvwe4
@@ -358,7 +359,7 @@ diff --git a/js/src/gc/Scheduling.h b/js/src/gc/Scheduling.h
 diff --git a/js/src/gc/Zone.h b/js/src/gc/Zone.h
 --- a/js/src/gc/Zone.h
 +++ b/js/src/gc/Zone.h
-@@ -96,16 +96,18 @@ class MOZ_NON_TEMPORARY_CLASS FunctionTo
+@@ -94,16 +94,18 @@ class MOZ_NON_TEMPORARY_CLASS FunctionTo
      MOZ_ALWAYS_INLINE JSString* lookup(JSScript* script) const;
      MOZ_ALWAYS_INLINE void put(JSScript* script, JSString* string);
  };
@@ -1080,7 +1081,7 @@ diff --git a/js/src/vm/Realm.h b/js/src/vm/Realm.h
 diff --git a/js/src/vm/Runtime.h b/js/src/vm/Runtime.h
 --- a/js/src/vm/Runtime.h
 +++ b/js/src/vm/Runtime.h
-@@ -97,17 +97,17 @@ class CompileRuntime;
+@@ -102,17 +102,17 @@ class CompileRuntime;
  
  #ifdef JS_SIMULATOR_ARM64
  typedef vixl::Simulator Simulator;

frg/work-js/mozilla-release/patches/1471289-63a1.patch

@@ -2,7 +2,7 @@
 # User Lars T Hansen <lhansen@mozilla.com>
 # Date 1530173163 -7200
 # Node ID 7c3c2d6c17d7563fa2ea242ee2ae08be4685370e
-# Parent  de900ae11c0287126721a63a408e699cfcd05700
+# Parent  63a25831ccb5b3c07bb1ab722ca650f0f5b19187
 Bug 1471289 - Handle 'new WebAssembly.Global' on i64 with default value. r=jseward
 
 As a tweak the wasm CG has decided to allow the special case where an i64 global is
@@ -136,4 +136,3 @@ diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
  
      WasmGlobalObject* global = WasmGlobalObject::create(cx, globalVal, isMutable);
      if (!global)
-

frg/work-js/mozilla-release/patches/1471841-63a1.patch

@@ -1,6 +1,7 @@
 # HG changeset patch
 # User Andre Bargull <andre.bargull@gmail.com>
 # Date 1530218662 25200
+#      Thu Jun 28 13:44:22 2018 -0700
 # Node ID ffa64e3aff88f81d0931fa815a60d0d0a57a7e11
 # Parent  3b0f73ff448258a7e2562d6af5cfbab35c33227c
 Bug 1471841: Move WouldDefinePastNonwritableLength into NativeObject.cpp. r=jandem
@@ -201,4 +202,3 @@ diff --git a/js/src/vm/NativeObject.cpp b/js/src/vm/NativeObject.cpp
          //   doesn't have that many elements.
          // - We're being called from a resolve hook to assign to the property
          //   being resolved.
-

frg/work-js/mozilla-release/patches/mozilla-central-push_424413.patch → frg/work-js/mozilla-release/patches/1471900-63a1.patch

@@ -3,13 +3,13 @@
 # Date 1530196520 25200
 #      Thu Jun 28 07:35:20 2018 -0700
 # Node ID d7fa36e754406fdef9be78cff326d084db92bd64
-# Parent  3bddc4c525047acca7150005ca349ed75cf68b42
+# Parent  7a9e871741aadd33b00aa585f5a7ea65a477cbf5
 Bug 1471900: Change return type of JS_EncodeStringToBuffer to bool. r=jandem
 
 diff --git a/dom/bindings/BindingUtils.cpp b/dom/bindings/BindingUtils.cpp
 --- a/dom/bindings/BindingUtils.cpp
 +++ b/dom/bindings/BindingUtils.cpp
-@@ -2888,17 +2888,19 @@ ConvertJSValueToByteString(JSContext* cx
+@@ -2769,17 +2769,19 @@ ConvertJSValueToByteString(JSContext* cx
  
    static_assert(js::MaxStringLength < UINT32_MAX,
                  "length+1 shouldn't overflow");
@@ -33,7 +33,7 @@ diff --git a/dom/bindings/BindingUtils.cpp b/dom/bindings/BindingUtils.cpp
 diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
 --- a/js/src/jsapi.cpp
 +++ b/js/src/jsapi.cpp
-@@ -6126,37 +6126,37 @@ JS_GetStringEncodingLength(JSContext* cx
+@@ -6085,37 +6085,37 @@ JS_GetStringEncodingLength(JSContext* cx
      AssertHeapIsIdle();
      CHECK_REQUEST(cx);
  
@@ -77,7 +77,7 @@ diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
 diff --git a/js/src/jsapi.h b/js/src/jsapi.h
 --- a/js/src/jsapi.h
 +++ b/js/src/jsapi.h
-@@ -4631,17 +4631,17 @@ JS_GetStringEncodingLength(JSContext* cx
+@@ -4590,17 +4590,17 @@ JS_GetStringEncodingLength(JSContext* cx
  /**
   * Encode string into a buffer. The function does not stores an additional
   * zero byte. The function returns (size_t) -1 if the string can not be
@@ -99,15 +99,15 @@ diff --git a/js/src/jsapi.h b/js/src/jsapi.h
 diff --git a/js/xpconnect/src/XPCConvert.cpp b/js/xpconnect/src/XPCConvert.cpp
 --- a/js/xpconnect/src/XPCConvert.cpp
 +++ b/js/xpconnect/src/XPCConvert.cpp
-@@ -637,17 +637,20 @@ XPCConvert::JSData2Native(void* d, Handl
-             if (length < arrlen) {
-                 length = arrlen;
-             }
+@@ -569,17 +569,20 @@ XPCConvert::JSData2Native(void* d, Handl
+                 CheckCharsInCharRange(chars, len);
          }
-         char* buffer = static_cast<char*>(moz_xmalloc(length + 1));
-         if (!buffer) {
+ #endif // DEBUG
+         size_t length = JS_GetStringEncodingLength(cx, str);
+         if (length == size_t(-1)) {
              return false;
          }
+         char* buffer = static_cast<char*>(moz_xmalloc(length + 1));
 -        JS_EncodeStringToBuffer(cx, str, buffer, length);
 +        if (!JS_EncodeStringToBuffer(cx, str, buffer, length)) {
 +            free(buffer);
@@ -119,13 +119,13 @@ diff --git a/js/xpconnect/src/XPCConvert.cpp b/js/xpconnect/src/XPCConvert.cpp
      }
  
      case nsXPTType::T_WCHAR_STR:
-     case nsXPTType::T_PWSTRING_SIZE_IS:
      {
-@@ -745,17 +748,19 @@ XPCConvert::JSData2Native(void* d, Handl
-             rs->Truncate();
+         JSString* str;
+@@ -661,17 +664,19 @@ XPCConvert::JSData2Native(void* d, Handl
              return true;
          }
  
+         nsACString* rs = *((nsACString**)d);
          rs->SetLength(uint32_t(length));
          if (rs->Length() != uint32_t(length)) {
              return false;
@@ -142,3 +142,25 @@ diff --git a/js/xpconnect/src/XPCConvert.cpp b/js/xpconnect/src/XPCConvert.cpp
      case nsXPTType::T_INTERFACE_IS:
      {
          MOZ_ASSERT(iid,"can't do interface conversions without iid");
+@@ -1688,17 +1693,20 @@ XPCConvert::JSStringWithSize2Native(void
+             }
+             len = uint32_t(length);
+ 
+             if (len < count)
+                 len = count;
+ 
+             uint32_t alloc_len = (len + 1) * sizeof(char);
+             char* buffer = static_cast<char*>(moz_xmalloc(alloc_len));
+-            JS_EncodeStringToBuffer(cx, str, buffer, len);
++            if (!JS_EncodeStringToBuffer(cx, str, buffer, len)) {
++                free(buffer);
++               return false;
++            }
+             buffer[len] = '\0';
+             *((char**)d) = buffer;
+ 
+             return true;
+         }
+ 
+         case nsXPTType::T_PWSTRING_SIZE_IS:
+         {

frg/work-js/mozilla-release/patches/1472211-1-63a1.patch

@@ -2,13 +2,13 @@
 # User Andre Bargull <andre.bargull@gmail.com>
 # Date 1533070478 25200
 # Node ID c7d750528120ec4998cecb466bbe20f744fd2323
-# Parent  96bc6ef6437bdc79794e8725b1ebbf66598901bd
+# Parent  75b525f1e767f3f85316c2027aee22cb6039a089
 Bug 1472211 - Part 1: Reorder super-property evaluation order per latest spec change. r=arai, f=Waldo
 
 diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
 --- a/js/src/frontend/BytecodeEmitter.cpp
 +++ b/js/src/frontend/BytecodeEmitter.cpp
-@@ -4370,23 +4370,23 @@ BytecodeEmitter::emitPropOp(ParseNode* p
+@@ -1955,23 +1955,23 @@ BytecodeEmitter::emitPropOp(ParseNode* p
  
      if (op == JSOP_CALLPROP && !emit1(JSOP_SWAP))
          return false;
@@ -34,7 +34,7 @@ diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitt
      return true;
  }
  
-@@ -4524,62 +4524,52 @@ BytecodeEmitter::emitElemOperands(ParseN
+@@ -2109,62 +2109,52 @@ BytecodeEmitter::emitElemOperands(ParseN
      } else if (opts == EmitElemOption::Call) {
          if (!emit1(JSOP_DUP))
              return false;
@@ -115,7 +115,7 @@ diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitt
  bool
  BytecodeEmitter::emitElemOpBase(JSOp op)
  {
-@@ -4588,40 +4578,37 @@ BytecodeEmitter::emitElemOpBase(JSOp op)
+@@ -2173,40 +2163,37 @@ BytecodeEmitter::emitElemOpBase(JSOp op)
  
      checkTypeSet(op);
      return true;
@@ -172,7 +172,7 @@ diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitt
  bool
  BytecodeEmitter::emitElemIncDec(ParseNode* pn)
  {
-@@ -9078,56 +9065,74 @@ BytecodeEmitter::emitDeleteName(ParseNod
+@@ -6472,56 +6459,74 @@ BytecodeEmitter::emitDeleteName(ParseNod
  }
  
  bool
@@ -262,7 +262,7 @@ diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitt
  
  bool
  BytecodeEmitter::emitDeleteExpression(ParseNode* node)
-@@ -9413,28 +9418,28 @@ BytecodeEmitter::emitCallee(ParseNode* c
+@@ -6807,28 +6812,28 @@ BytecodeEmitter::emitCallee(ParseNode* c
      switch (callee->getKind()) {
        case ParseNodeKind::Name:
          if (!emitGetName(callee, *callop))
@@ -293,7 +293,7 @@ diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitt
                  if (!emit1(JSOP_SWAP))
                      return false;
              }
-@@ -11135,27 +11140,27 @@ BytecodeEmitter::emitTree(ParseNode* pn,
+@@ -8537,27 +8542,27 @@ BytecodeEmitter::emitTree(ParseNode* pn,
  
        case ParseNodeKind::DeleteExpr:
          if (!emitDeleteExpression(pn))
@@ -326,7 +326,7 @@ diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitt
 diff --git a/js/src/frontend/BytecodeEmitter.h b/js/src/frontend/BytecodeEmitter.h
 --- a/js/src/frontend/BytecodeEmitter.h
 +++ b/js/src/frontend/BytecodeEmitter.h
-@@ -716,17 +716,17 @@ struct MOZ_STACK_CLASS BytecodeEmitter
+@@ -671,17 +671,17 @@ struct MOZ_STACK_CLASS BytecodeEmitter
      MOZ_MUST_USE bool emitAsyncWrapper(unsigned index, bool needsHomeObject, bool isArrow,
                                         bool isGenerator);
  
@@ -345,7 +345,7 @@ diff --git a/js/src/frontend/BytecodeEmitter.h b/js/src/frontend/BytecodeEmitter
  
      MOZ_MUST_USE bool emitCatch(ParseNode* pn);
      MOZ_MUST_USE bool emitIf(ParseNode* pn);
-@@ -889,20 +889,20 @@ struct MOZ_STACK_CLASS BytecodeEmitter
+@@ -844,20 +844,20 @@ struct MOZ_STACK_CLASS BytecodeEmitter
      // It will pop the iterator and I, then iterate over the iterator by calling
      // |.next()| and put the results into the I-th element of array with
      // incrementing I, then push the result I (it will be original I +
@@ -371,27 +371,25 @@ diff --git a/js/src/frontend/BytecodeEmitter.h b/js/src/frontend/BytecodeEmitter
 diff --git a/js/src/tests/jstests.list b/js/src/tests/jstests.list
 --- a/js/src/tests/jstests.list
 +++ b/js/src/tests/jstests.list
-@@ -441,16 +441,21 @@ skip script test262/built-ins/Function/p
- skip script test262/built-ins/Function/prototype/toString/proxy-generator-function.js
- 
- # https://bugzilla.mozilla.org/show_bug.cgi?id=1462741
+@@ -444,19 +444,16 @@ skip script test262/built-ins/Function/p
  skip script test262/built-ins/Function/prototype/toString/well-known-intrinsic-object-functions.js
  
  # https://bugzilla.mozilla.org/show_bug.cgi?id=1462745
  skip script test262/annexB/language/function-code/block-decl-nested-blocks-with-fun-decl.js
  
-+# Remove
-+# -# https://bugzilla.mozilla.org/show_bug.cgi?id=1472211
-+# -skip script test262/language/statements/class/super/in-constructor-superproperty-evaluation.js
-+# -
-+
+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1406171
+ skip script test262/built-ins/Reflect/ownKeys/return-on-corresponding-order-large-index.js
  
- ###########################################################
- # Tests disabled due to issues in test262 importer script #
- ###########################################################
+-# https://bugzilla.mozilla.org/show_bug.cgi?id=1472211
+-skip script test262/language/statements/class/super/in-constructor-superproperty-evaluation.js
+-
+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1473228
+ skip script test262/intl402/RelativeTimeFormat/prototype/toStringTag/toStringTag.js
  
- # test262 importer merges all includes in a per directory shell.js file, breaking this harness test case.
- skip script test262/harness/detachArrayBuffer.js
+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1473229
+ skip script test262/intl402/RelativeTimeFormat/prototype/formatToParts/length.js
+ skip script test262/intl402/RelativeTimeFormat/prototype/formatToParts/name.js
+ skip script test262/intl402/RelativeTimeFormat/prototype/formatToParts/prop-desc.js
  
 diff --git a/js/src/tests/non262/class/superElemDelete.js b/js/src/tests/non262/class/superElemDelete.js
 new file mode 100644

frg/work-js/mozilla-release/patches/1472973-1-63a1.patch

@@ -0,0 +1,30 @@
+# HG changeset patch
+# User Jan de Mooij <jdemooij@mozilla.com>
+# Date 1530893783 -7200
+# Node ID a8c62e8a608043a2eeeb80fe95555b1fd3705b68
+# Parent  a985c7fbfd01e4826b414ce22c4b756c3210cf0e
+Bug 1472973 part 1 - Use JS::GetNonCCWObjectGlobal in Codegen.py. r=bz
+
+diff --git a/dom/bindings/Codegen.py b/dom/bindings/Codegen.py
+--- a/dom/bindings/Codegen.py
++++ b/dom/bindings/Codegen.py
+@@ -5404,17 +5404,17 @@ def getJSToNativeConversionInfo(type, de
+                   return nullptr;
+                 }
+                 JSObject* unwrappedVal = js::CheckedUnwrap(&$${val}.toObject());
+                 if (!unwrappedVal) {
+                   // A slight lie, but not much of one, for a dead object wrapper.
+                   aRv.ThrowTypeError<MSG_NOT_OBJECT>(NS_LITERAL_STRING("${sourceDescription}"));
+                   return nullptr;
+                 }
+-                globalObj = js::GetGlobalForObjectCrossCompartment(unwrappedVal);
++                globalObj = JS::GetNonCCWObjectGlobal(unwrappedVal);
+                 """,
+                 sourceDescription=sourceDescription)
+         elif isCallbackReturnValue == "Callback":
+             getPromiseGlobal = dedent(
+                 """
+                 // We basically want our entry global here.  Play it safe
+                 // and use GetEntryGlobal() to get it, with whatever
+                 // principal-clamping it ends up doing.
+

frg/work-js/mozilla-release/patches/1472973-4-63a1.patch

@@ -0,0 +1,42 @@
+# HG changeset patch
+# User Jan de Mooij <jdemooij@mozilla.com>
+# Date 1530893783 -7200
+# Node ID aaaa74019db7f6d20fbdc88eac13043ba155441b
+# Parent  5bcad8d8216835eedcab55ea218e8715692aeb80
+Bug 1472973 part 4 - Use JS::GetNonCCWObjectGlobal in PrefableDisablers::isEnabled. r=bz
+
+diff --git a/dom/bindings/DOMJSClass.h b/dom/bindings/DOMJSClass.h
+--- a/dom/bindings/DOMJSClass.h
++++ b/dom/bindings/DOMJSClass.h
+@@ -116,28 +116,27 @@ struct PrefableDisablers {
+     // So we want to avoid doing that.  But we don't particularly want to make
+     // expensive NS_IsMainThread calls here.
+     //
+     // The good news is that "enabled" is only written for things that have a
+     // Pref annotation, and such things can never be exposed on non-Window
+     // globals; our IDL parser enforces that.  So as long as we check our
+     // exposure set before checking "enabled" we will be ok.
+     if (nonExposedGlobals &&
+-        IsNonExposedGlobal(cx, js::GetGlobalForObjectCrossCompartment(obj),
++        IsNonExposedGlobal(cx, JS::GetNonCCWObjectGlobal(obj),
+                            nonExposedGlobals)) {
+       return false;
+     }
+     if (!enabled) {
+       return false;
+     }
+     if (secureContext && !IsSecureContextOrObjectIsFromSecureContext(cx, obj)) {
+       return false;
+     }
+-    if (enabledFunc &&
+-        !enabledFunc(cx, js::GetGlobalForObjectCrossCompartment(obj))) {
++    if (enabledFunc && !enabledFunc(cx, JS::GetNonCCWObjectGlobal(obj))) {
+       return false;
+     }
+     return true;
+   }
+ 
+   // A boolean indicating whether this set of specs is enabled. Not const
+   // because it will change at runtime if the corresponding pref is changed.
+   bool enabled;
+

frg/work-js/mozilla-release/patches/1472973-9-63a1.patch

@@ -0,0 +1,30 @@
+# HG changeset patch
+# User Jan de Mooij <jdemooij@mozilla.com>
+# Date 1530893784 -7200
+# Node ID e17b68432e95aed0dbc48f9f377d699f16c4a675
+# Parent  1016754c7749a5d8bf51e8d1ce3705b879035489
+Bug 1472973 part 9 - Use JS::GetNonCCWObjectGlobal in worker wrap-callback. r=bz
+
+diff --git a/dom/workers/RuntimeService.cpp b/dom/workers/RuntimeService.cpp
+--- a/dom/workers/RuntimeService.cpp
++++ b/dom/workers/RuntimeService.cpp
+@@ -942,17 +942,18 @@ PreserveWrapper(JSContext *cx, JSObject 
+ JSObject*
+ Wrap(JSContext *cx, JS::HandleObject existing, JS::HandleObject obj)
+ {
+   JSObject* targetGlobal = JS::CurrentGlobalOrNull(cx);
+   if (!IsDebuggerGlobal(targetGlobal) && !IsDebuggerSandbox(targetGlobal)) {
+     MOZ_CRASH("There should be no edges from the debuggee to the debugger.");
+   }
+ 
+-  JSObject* originGlobal = js::GetGlobalForObjectCrossCompartment(obj);
++  // Note: the JS engine unwraps CCWs before calling this callback.
++  JSObject* originGlobal = JS::GetNonCCWObjectGlobal(obj);
+ 
+   const js::Wrapper* wrapper = nullptr;
+   if (IsDebuggerGlobal(originGlobal) || IsDebuggerSandbox(originGlobal)) {
+     wrapper = &js::CrossCompartmentWrapper::singleton;
+   } else {
+     wrapper = &js::OpaqueCrossCompartmentWrapper::singleton;
+   }
+ 

frg/work-js/mozilla-release/patches/mozilla-central-push_425700.patch → frg/work-js/mozilla-release/patches/1473818-63a1.patch

@@ -3,7 +3,7 @@
 # Date 1530912488 10800
 #      Fri Jul 06 18:28:08 2018 -0300
 # Node ID 0cf8916182199093523be45b7c13c61b8bc76b84
-# Parent  2b1bc2f3a4874d742ecbadc2855a211b6cb06d02
+# Parent  3a46d6733e1cc6a05979f4ace975a446dff68654
 Bug 1473818: Fix global constructors count regression r=jonco
 
 Bug 1465505 moved from PRJ_Now to mozilla::TimeStamp. As a side effect,
@@ -97,7 +97,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
      static const uint64_t HighFrequencyHighLimitBytes = 500 * 1024 * 1024;
  
      /* JSGC_HIGH_FREQUENCY_HEAP_GROWTH_MAX */
-@@ -341,18 +341,16 @@ namespace TuningDefaults {
+@@ -344,18 +344,16 @@ namespace TuningDefaults {
      static const bool CompactingEnabled = true;
  
      /* JSGC_NURSERY_FREE_THRESHOLD_FOR_IDLE_COLLECTION */
@@ -116,7 +116,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
   */
  static const double MinAllocationThresholdFactor = 0.9;
  
-@@ -1567,17 +1565,17 @@ GCSchedulingTunables::GCSchedulingTunabl
+@@ -1576,17 +1574,17 @@ GCSchedulingTunables::GCSchedulingTunabl
    : gcMaxBytes_(0),
      maxMallocBytes_(TuningDefaults::MaxMallocBytes),
      gcMaxNurseryBytes_(0),
@@ -133,9 +133,9 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
      highFrequencyHeapGrowthMin_(TuningDefaults::HighFrequencyHeapGrowthMin),
      lowFrequencyHeapGrowth_(TuningDefaults::LowFrequencyHeapGrowth),
      dynamicMarkSliceEnabled_(TuningDefaults::DynamicMarkSliceEnabled),
+     refreshFrameSlicesEnabled_(TuningDefaults::RefreshFrameSlicesEnabled),
      minEmptyChunkCount_(TuningDefaults::MinEmptyChunkCount),
-     maxEmptyChunkCount_(TuningDefaults::MaxEmptyChunkCount),
-@@ -1619,17 +1617,17 @@ GCSchedulingTunables::resetParameter(JSG
+@@ -1629,17 +1627,17 @@ GCSchedulingTunables::resetParameter(JSG
        case JSGC_MAX_BYTES:
          gcMaxBytes_ = 0xffffffff;
          break;
@@ -154,7 +154,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
          setHighFrequencyHighLimit(TuningDefaults::HighFrequencyHighLimitBytes);
          break;
        case JSGC_HIGH_FREQUENCY_HEAP_GROWTH_MAX:
-@@ -2120,27 +2118,31 @@ GCMarker::delayMarkingChildren(const voi
+@@ -2135,27 +2133,31 @@ GCMarker::delayMarkingChildren(const voi
  
  bool
  GCRuntime::shouldCompact()
@@ -187,7 +187,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
      return compactingEnabled && rt->mainContextFromOwnThread()->compactingDisabledCount == 0;
  }
  
-@@ -3224,18 +3226,16 @@ void
+@@ -3281,18 +3283,16 @@ void
  ArenaLists::queueForegroundThingsForSweep()
  {
      gcShapeArenasToUpdate = arenaListsToSweep(AllocKind::SHAPE);
@@ -206,7 +206,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
  
  SliceBudget::SliceBudget(TimeBudget time)
    : timeBudget(time), workBudget(UnlimitedWorkBudget)
-@@ -4041,29 +4041,30 @@ GCRuntime::purgeRuntime()
+@@ -4098,29 +4098,30 @@ GCRuntime::purgeRuntime()
      MOZ_ASSERT(unmarkGrayStack.empty());
      unmarkGrayStack.clearAndFree();
  }

frg/work-js/mozilla-release/patches/mozilla-central-push_426195.patch → frg/work-js/mozilla-release/patches/1474522-63a1.patch

@@ -3,7 +3,7 @@
 # Date 1531302292 -7200
 #      Wed Jul 11 11:44:52 2018 +0200
 # Node ID 397856154e99bd0c2029aa3e4fdf5170e7966465
-# Parent  e378e29a5ebbbff1605efee6739cbf3d4581101f
+# Parent  5c8bd877e46bd9c2d70502609d7f980183d44f8d
 Bug 1474522 - Change PrepareScriptEnvironmentAndInvoke to always take a global object instead of an arbitrary scope. r=bholley
 
 js-ctypse now passes the context's current global instead of the closure function it's calling.
@@ -33,7 +33,7 @@ diff --git a/js/src/builtin/Promise.cpp b/js/src/builtin/Promise.cpp
 diff --git a/js/src/ctypes/CTypes.cpp b/js/src/ctypes/CTypes.cpp
 --- a/js/src/ctypes/CTypes.cpp
 +++ b/js/src/ctypes/CTypes.cpp
-@@ -7506,19 +7506,23 @@ CClosure::ClosureStub(ffi_cif* cif, void
+@@ -7507,19 +7507,23 @@ CClosure::ClosureStub(ffi_cif* cif, void
    MOZ_ASSERT(cif);
    MOZ_ASSERT(result);
    MOZ_ASSERT(args);
@@ -63,7 +63,7 @@ diff --git a/js/src/ctypes/CTypes.cpp b/js/src/ctypes/CTypes.cpp
 diff --git a/js/src/jsfriendapi.cpp b/js/src/jsfriendapi.cpp
 --- a/js/src/jsfriendapi.cpp
 +++ b/js/src/jsfriendapi.cpp
-@@ -1400,24 +1400,26 @@ js::detail::IdMatchesAtom(jsid id, JSAto
+@@ -1406,24 +1406,26 @@ js::detail::IdMatchesAtom(jsid id, JSAto
  
  bool
  js::detail::IdMatchesAtom(jsid id, JSString* atom)
@@ -95,7 +95,7 @@ diff --git a/js/src/jsfriendapi.cpp b/js/src/jsfriendapi.cpp
 diff --git a/js/src/jsfriendapi.h b/js/src/jsfriendapi.h
 --- a/js/src/jsfriendapi.h
 +++ b/js/src/jsfriendapi.h
-@@ -2729,42 +2729,37 @@ IdToValue(jsid id)
+@@ -2730,42 +2730,37 @@ IdToValue(jsid id)
          return JS::Int32Value(JSID_TO_INT(id));
      if (JSID_IS_SYMBOL(id))
          return JS::SymbolValue(JSID_TO_SYMBOL(id));
@@ -149,7 +149,7 @@ diff --git a/js/src/jsfriendapi.h b/js/src/jsfriendapi.h
 diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
 --- a/js/src/shell/js.cpp
 +++ b/js/src/shell/js.cpp
-@@ -474,17 +474,17 @@ struct ShellCompartmentPrivate {
+@@ -472,17 +472,17 @@ struct ShellCompartmentPrivate {
      JS::Heap<JSObject*> grayRoot;
  };
  
@@ -168,7 +168,7 @@ diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
  static bool offthreadCompilation = false;
  static bool enableBaseline = false;
  static bool enableIon = false;
-@@ -791,22 +791,24 @@ SkipUTF8BOM(FILE* file)
+@@ -789,22 +789,24 @@ SkipUTF8BOM(FILE* file)
          ungetc(ch3, file);
      if (ch2 != EOF)
          ungetc(ch2, file);
@@ -248,7 +248,7 @@ diff --git a/js/src/vm/ErrorReporting.h b/js/src/vm/ErrorReporting.h
 diff --git a/xpcom/base/CycleCollectedJSRuntime.cpp b/xpcom/base/CycleCollectedJSRuntime.cpp
 --- a/xpcom/base/CycleCollectedJSRuntime.cpp
 +++ b/xpcom/base/CycleCollectedJSRuntime.cpp
-@@ -1544,25 +1544,26 @@ CycleCollectedJSRuntime::PrepareWaitingZ
+@@ -1528,25 +1528,26 @@ CycleCollectedJSRuntime::PrepareWaitingZ
      for (auto iter = mZonesWaitingForGC.Iter(); !iter.Done(); iter.Next()) {
        JS::PrepareZoneForGC(iter.Get()->GetKey());
      }
@@ -282,7 +282,7 @@ diff --git a/xpcom/base/CycleCollectedJSRuntime.cpp b/xpcom/base/CycleCollectedJ
 diff --git a/xpcom/base/CycleCollectedJSRuntime.h b/xpcom/base/CycleCollectedJSRuntime.h
 --- a/xpcom/base/CycleCollectedJSRuntime.h
 +++ b/xpcom/base/CycleCollectedJSRuntime.h
-@@ -363,17 +363,17 @@ private:
+@@ -358,17 +358,17 @@ private:
      mNurseryObjects;
    SegmentedVector<JS::PersistentRooted<JSObject*>, kSegmentSize,
                    InfallibleAllocPolicy>
@@ -295,9 +295,9 @@ diff --git a/xpcom/base/CycleCollectedJSRuntime.h b/xpcom/base/CycleCollectedJSR
 +    void invoke(JS::HandleObject global, Closure& closure) override;
    };
    EnvironmentPreparer mEnvironmentPreparer;
+ };
  
- #ifdef DEBUG
-   bool mShutdownCalled;
- #endif
+ void TraceScriptHolder(nsISupports* aHolder, JSTracer* aTracer);
  
- #ifdef NIGHTLY_BUILD
+ // Returns true if the JS::TraceKind is one the cycle collector cares about.
+ inline bool AddToCCKind(JS::TraceKind aKind)

frg/work-js/mozilla-release/patches/mozilla-central-push_429175.patch → frg/work-js/mozilla-release/patches/1478402-63a1.patch

@@ -3,13 +3,13 @@
 # Date 1532946111 -3600
 #      Mon Jul 30 11:21:51 2018 +0100
 # Node ID 7b8baf03f67e386546c9951a4241bc62f6dbbbe9
-# Parent  351c166e1728098b5c68d380b145d5ddd5dc88ed
+# Parent  fac87187a7d90435e5d99987ca61e8b1c2883882
 Bug 1478402 - Fix race reading/writing atoms zone concurrent use flag r=sfink
 
 diff --git a/js/src/gc/Allocator.cpp b/js/src/gc/Allocator.cpp
 --- a/js/src/gc/Allocator.cpp
 +++ b/js/src/gc/Allocator.cpp
-@@ -504,16 +504,20 @@ Arena::arenaAllocatedDuringGC()
+@@ -503,16 +503,20 @@ Arena::arenaAllocatedDuringGC()
              cell->markBlack();
          }
      }
@@ -33,7 +33,7 @@ diff --git a/js/src/gc/Allocator.cpp b/js/src/gc/Allocator.cpp
 diff --git a/js/src/vm/HelperThreads.cpp b/js/src/vm/HelperThreads.cpp
 --- a/js/src/vm/HelperThreads.cpp
 +++ b/js/src/vm/HelperThreads.cpp
-@@ -2092,17 +2092,20 @@ HelperThread::handleParseWorkload(AutoLo
+@@ -1994,17 +1994,20 @@ HelperThread::handleParseWorkload(AutoLo
  {
      MOZ_ASSERT(HelperThreadState().canStartParseTask(locked));
      MOZ_ASSERT(idle());
@@ -54,7 +54,7 @@ diff --git a/js/src/vm/HelperThreads.cpp b/js/src/vm/HelperThreads.cpp
          JSContext* cx = TlsContext.get();
  
          Zone* zone = task->parseGlobal->zoneFromAnyThread();
-@@ -2121,17 +2124,19 @@ HelperThread::handleParseWorkload(AutoLo
+@@ -2023,17 +2026,19 @@ HelperThread::handleParseWorkload(AutoLo
  
      // The callback is invoked while we are still off thread.
      task->callback(task, task->callbackData);
@@ -97,7 +97,7 @@ diff --git a/js/src/vm/Runtime.cpp b/js/src/vm/Runtime.cpp
  #ifdef DEBUG
      MOZ_ASSERT(!initialized_);
      initialized_ = true;
-@@ -778,26 +781,31 @@ JSRuntime::activeGCInAtomsZone()
+@@ -767,26 +770,31 @@ JSRuntime::activeGCInAtomsZone()
  }
  
  void
@@ -134,14 +134,14 @@ diff --git a/js/src/vm/Runtime.cpp b/js/src/vm/Runtime.cpp
 diff --git a/js/src/vm/Runtime.h b/js/src/vm/Runtime.h
 --- a/js/src/vm/Runtime.h
 +++ b/js/src/vm/Runtime.h
-@@ -852,18 +852,18 @@ struct JSRuntime : public js::MallocProv
+@@ -840,18 +840,18 @@ struct JSRuntime : public js::MallocProv
+ 
+     void addSizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf, JS::RuntimeSizes* rtSizes);
  
    private:
      // Settings for how helper threads can be used.
-     mozilla::Atomic<bool, mozilla::SequentiallyConsistent,
-                     mozilla::recordreplay::Behavior::DontPreserve> offthreadIonCompilationEnabled_;
-     mozilla::Atomic<bool, mozilla::SequentiallyConsistent,
-                     mozilla::recordreplay::Behavior::DontPreserve> parallelParsingEnabled_;
+     mozilla::Atomic<bool> offthreadIonCompilationEnabled_;
+     mozilla::Atomic<bool> parallelParsingEnabled_;
  
 +#ifdef DEBUG
      mozilla::Atomic<uint32_t> offThreadParsesRunning_;
@@ -154,7 +154,7 @@ diff --git a/js/src/vm/Runtime.h b/js/src/vm/Runtime.h
    public:
  
      // Note: these values may be toggled dynamically (in response to about:config
-@@ -876,32 +876,28 @@ struct JSRuntime : public js::MallocProv
+@@ -864,32 +864,28 @@ struct JSRuntime : public js::MallocProv
      }
      void setParallelParsingEnabled(bool value) {
          parallelParsingEnabled_ = value;

frg/work-js/mozilla-release/patches/1479900-2-63a1.patch

@@ -2,7 +2,7 @@
 # User Ted Campbell <tcampbell@mozilla.com>
 # Date 1533234736 25200
 # Node ID 819b923159847ebf0227a910e966490f4f9dc177
-# Parent  1a0015d8ae2560f77c091d6ac5019d0db6d0a154
+# Parent  9b87251dedb102f85edf8a725e73c427df435b38
 Bug 1479900 - Part 2: Refactor GC relocation to use a reserved flag. r=sfink
 
 This refactors gc::Cell derived types to start with a uintptr_t-sized
@@ -236,7 +236,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
  #endif
  #include "vm/Debugger.h"
  #include "vm/GeckoProfiler.h"
-@@ -381,16 +382,27 @@ static const int IGC_MARK_SLICE_MULTIPLI
+@@ -383,16 +384,27 @@ static const int IGC_MARK_SLICE_MULTIPLI
  const AllocKind gc::slotsToThingKind[] = {
      /*  0 */ AllocKind::OBJECT0,  AllocKind::OBJECT2,  AllocKind::OBJECT2,  AllocKind::OBJECT4,
      /*  4 */ AllocKind::OBJECT4,  AllocKind::OBJECT8,  AllocKind::OBJECT8,  AllocKind::OBJECT8,
@@ -264,7 +264,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
                    #sizedType " is smaller than SortedArenaList::MinThingSize!"); \
      static_assert(sizeof(sizedType) >= sizeof(FreeSpan), \
                    #sizedType " is smaller than FreeSpan"); \
-@@ -2423,17 +2435,17 @@ RelocateArena(Arena* arena, SliceBudget&
+@@ -2398,17 +2410,17 @@ RelocateArena(Arena* arena, SliceBudget&
      for (ArenaCellIterUnderGC i(arena); !i.done(); i.next()) {
          RelocateCell(zone, i.getCell(), thingKind, thingSize);
          sliceBudget.step();
@@ -283,7 +283,7 @@ diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
  }
  
  static inline bool
-@@ -8527,18 +8539,18 @@ js::gc::AssertGCThingHasType(js::gc::Cel
+@@ -8511,18 +8523,18 @@ js::gc::AssertGCThingHasType(js::gc::Cel
      if (!cell) {
          MOZ_ASSERT(kind == JS::TraceKind::Null);
          return;
@@ -403,7 +403,7 @@ diff --git a/js/src/gc/Marking-inl.h b/js/src/gc/Marking-inl.h
 diff --git a/js/src/gc/Marking.cpp b/js/src/gc/Marking.cpp
 --- a/js/src/gc/Marking.cpp
 +++ b/js/src/gc/Marking.cpp
-@@ -2827,17 +2827,17 @@ js::gc::StoreBuffer::CellPtrEdge::trace(
+@@ -2826,17 +2826,17 @@ js::gc::StoreBuffer::CellPtrEdge::trace(
  #endif
  
      // Bug 1376646: Make separate store buffers for strings and objects, and
@@ -983,7 +983,7 @@ diff --git a/js/src/vm/StringType.h b/js/src/vm/StringType.h
 diff --git a/js/src/vm/SymbolType.h b/js/src/vm/SymbolType.h
 --- a/js/src/vm/SymbolType.h
 +++ b/js/src/vm/SymbolType.h
-@@ -27,46 +27,54 @@
+@@ -27,45 +27,53 @@
  namespace js {
  class AutoAccessAtomsZone;
  } // namespace js
@@ -1025,8 +1025,7 @@ diff --git a/js/src/vm/SymbolType.h b/js/src/vm/SymbolType.h
      void operator=(const Symbol&) = delete;
  
      static Symbol*
-     newInternal(JSContext* cx, SymbolCode code, js::HashNumber hash,
-                 JSAtom* description, const js::AutoAccessAtomsZone& access);
+     newInternal(JSContext* cx, SymbolCode code, js::HashNumber hash, JSAtom* description);
  
 +    static void staticAsserts() {
 +        static_assert(uint32_t(SymbolCode::WellKnownAPILimit) == JS::shadow::Symbol::WellKnownAPILimit,

frg/work-js/mozilla-release/patches/1480819-6-63a1.patch

@@ -3,7 +3,7 @@
 # Date 1533916228 25200
 #      Fri Aug 10 08:50:28 2018 -0700
 # Node ID 411fa809129a533f492136cb8ac58a4ef7e1119e
-# Parent  7c2955ada3c27d2def1493b456b4a7e95af98b61
+# Parent  8dc89fa0c4b68fe5ff5d947bc362aa0fcd161ce0
 Bug 1480819 - Part 6: Add helper methods to MacroAssembler to work with CharEncoding and reduce code duplication. r=mgaudet
 
 diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
@@ -286,7 +286,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
  typedef JSString* (*StringReplaceFn)(JSContext*, HandleString, HandleString, HandleString);
  static const VMFunction StringFlatReplaceInfo =
      FunctionInfo<StringReplaceFn>(js::str_flat_replace_string, "str_flat_replace_string");
-@@ -8125,149 +8128,144 @@ CodeGenerator::visitConcat(LConcat* lir)
+@@ -8149,149 +8152,144 @@ CodeGenerator::visitConcat(LConcat* lir)
      MOZ_ASSERT(ToRegister(lir->temp5()) == CallTempReg4);
      MOZ_ASSERT(output == CallTempReg5);
  
@@ -479,7 +479,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
  static const VMFunction SubstringKernelInfo =
      FunctionInfo<SubstringKernelFn>(SubstringKernel, "SubstringKernel");
  
-@@ -8310,79 +8308,69 @@ CodeGenerator::visitSubstr(LSubstr* lir)
+@@ -8334,79 +8332,69 @@ CodeGenerator::visitSubstr(LSubstr* lir)
      masm.bind(&nonZero);
      masm.branchIfRopeOrExternal(string, temp, slowPath);
  
@@ -591,7 +591,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
  JitCode*
  JitRealm::generateStringConcatStub(JSContext* cx)
  {
-@@ -8461,21 +8449,21 @@ JitRealm::generateStringConcatStub(JSCon
+@@ -8485,21 +8473,21 @@ JitRealm::generateStringConcatStub(JSCon
      masm.ret();
  
      masm.bind(&rightEmpty);
@@ -764,5 +764,5 @@ diff --git a/js/src/jit/MacroAssembler.h b/js/src/jit/MacroAssembler.h
      void switchToRealm(const void* realm, Register scratch);
      void switchToObjectRealm(Register obj, Register scratch);
      void switchToBaselineFrameRealm(Register scratch);
+     void switchToWasmTlsRealm(Register scratch1, Register scratch2);
      void debugAssertContextRealm(const void* realm, Register scratch);
- 

frg/work-js/mozilla-release/patches/1483275-1-63a1.patch

@@ -2,7 +2,7 @@
 # User Ted Campbell <tcampbell@mozilla.com>
 # Date 1521060914 14400
 # Node ID cf5e7017ffdc1ebc32f564f95de1ca91bf7a5795
-# Parent  bee7df40babdbe30ecf77afca9f18f879bf9dc26
+# Parent  92e9e61a496d79c317a6c3fb911a3267f7855e6e
 Bug 1483275 - Fix some SpiderMonkey unified-build conflicts. r=waldo
 
 MozReview-Commit-ID: CqFbs7149CZ
@@ -125,7 +125,7 @@ diff --git a/js/src/jit/BaselineCacheIRCompiler.cpp b/js/src/jit/BaselineCacheIR
  
          // The reserved slots on the expando should all be in fixed slots.
          Address protoAddress(scratch, NativeObject::getFixedSlotOffset(GetXrayJitInfo()->expandoProtoSlot));
-@@ -2039,17 +2039,17 @@ BaselineCacheIRCompiler::emitLoadDOMExpa
+@@ -2055,17 +2055,17 @@ BaselineCacheIRCompiler::emitLoadDOMExpa
      AutoScratchRegister scratch(allocator, masm);
      ValueOperand output = allocator.defineValueRegister(masm, reader.valOperandId());
  
@@ -228,7 +228,9 @@ diff --git a/js/src/vm/ErrorReporting.cpp b/js/src/vm/ErrorReporting.cpp
      // it later.
      CompileError tempErr;
      CompileError* err = &tempErr;
-@@ -121,42 +128,19 @@ js::ReportCompileError(JSContext* cx, Er
+@@ -119,44 +126,21 @@ js::ReportCompileError(JSContext* cx, Er
+     {
+         return;
      }
  
      if (!cx->helperThread())
@@ -259,7 +261,7 @@ diff --git a/js/src/vm/ErrorReporting.cpp b/js/src/vm/ErrorReporting.cpp
 -} // anonymous namespace
 -
  void
- js::ReportErrorToGlobal(JSContext* cx, HandleObject global, HandleValue error)
+ js::ReportErrorToGlobal(JSContext* cx, Handle<GlobalObject*> global, HandleValue error)
  {
      MOZ_ASSERT(!cx->isExceptionPending());
  #ifdef DEBUG
@@ -325,7 +327,7 @@ diff --git a/js/src/vm/ErrorReporting.h b/js/src/vm/ErrorReporting.h
 diff --git a/js/src/vm/JSContext.cpp b/js/src/vm/JSContext.cpp
 --- a/js/src/vm/JSContext.cpp
 +++ b/js/src/vm/JSContext.cpp
-@@ -1047,36 +1047,16 @@ InternalEnqueuePromiseJobCallback(JSCont
+@@ -1045,36 +1045,16 @@ InternalEnqueuePromiseJobCallback(JSCont
      MOZ_ASSERT(job);
      if (!cx->jobQueue->append(job)) {
          ReportOutOfMemory(cx);
@@ -362,7 +364,7 @@ diff --git a/js/src/vm/JSContext.cpp b/js/src/vm/JSContext.cpp
      MOZ_RELEASE_ASSERT(!cx->runtime()->hasInitializedSelfHosting(),
                         "js::UseInternalJobQueues must be called early during runtime startup.");
      MOZ_ASSERT(!cx->jobQueue);
-@@ -1162,17 +1142,17 @@ js::RunJobs(JSContext* cx)
+@@ -1160,17 +1140,17 @@ js::RunJobs(JSContext* cx)
                      RootedValue exn(cx);
                      if (cx->getPendingException(&exn)) {
                          /*

frg/work-js/mozilla-release/patches/1486577-3-63a1.patch

@@ -3,7 +3,7 @@
 # Date 1535139844 18000
 #      Fri Aug 24 14:44:04 2018 -0500
 # Node ID daa263f9eda35ced064b6c12626249c12427311d
-# Parent  90c32c1a3f18e1b284ece255ae127a2e1b6b114f
+# Parent  638c3a74eb07e3b737c7b41afa7d3ad679658915
 Bug 1486577 - Move script/function transcoding API into a new public js/Transcoding.h header.  r=jandem
 
 diff --git a/js/public/Transcoding.h b/js/public/Transcoding.h
@@ -132,7 +132,7 @@ diff --git a/js/src/jsapi.h b/js/src/jsapi.h
  /************************************************************************/
  
  namespace JS {
-@@ -286,22 +287,16 @@ JS_NumberValue(double d)
+@@ -282,22 +283,16 @@ JS_NumberValue(double d)
      return JS::DoubleValue(d);
  }
  
@@ -155,7 +155,7 @@ diff --git a/js/src/jsapi.h b/js/src/jsapi.h
   *     a uint8_t to store the relevant information. Proceed with caution if
   *     trying to reorder or change the the first byte worth of flags.
   */
-@@ -4805,89 +4800,16 @@ class MOZ_RAII AutoHideScriptedCaller
+@@ -4770,89 +4765,16 @@ class MOZ_RAII AutoHideScriptedCaller
          UnhideScriptedCaller(mContext);
      }
  
@@ -248,7 +248,7 @@ diff --git a/js/src/jsapi.h b/js/src/jsapi.h
 diff --git a/js/src/moz.build b/js/src/moz.build
 --- a/js/src/moz.build
 +++ b/js/src/moz.build
-@@ -162,16 +162,17 @@ EXPORTS.js += [
+@@ -163,16 +163,17 @@ EXPORTS.js += [
      '../public/SourceBufferHolder.h',
      '../public/StableStringChars.h',
      '../public/Stream.h',
@@ -265,7 +265,7 @@ diff --git a/js/src/moz.build b/js/src/moz.build
      '../public/UbiNodeDominatorTree.h',
      '../public/UbiNodePostOrder.h',
      '../public/UbiNodeShortestPaths.h',
-     '../public/UniquePtr.h',
+     '../public/UbiNodeUtils.h',
 diff --git a/js/src/vm/Xdr.h b/js/src/vm/Xdr.h
 --- a/js/src/vm/Xdr.h
 +++ b/js/src/vm/Xdr.h