backports

frg/work-js/mozilla-release/patches/1302449-62a1.patch

@@ -0,0 +1,1191 @@
+# HG changeset patch
+# User Andrea Marchesini <amarchesini@mozilla.com>
+# Date 1525864508 -7200
+# Node ID eeaae6812d825fad8bb92be7f496f74952d82654
+# Parent  79b71a4a6566df217e24625670066a7fb566cb5f
+Bug 1302449 - Remove the "referrer" directive in CSP, r=ckerschb
+
+diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
+--- a/dom/base/nsDocument.cpp
++++ b/dom/base/nsDocument.cpp
+@@ -1416,17 +1416,16 @@ nsIDocument::nsIDocument()
+     mIsInitialDocumentInWindow(false),
+     mIgnoreDocGroupMismatches(false),
+     mLoadedAsData(false),
+     mLoadedAsInteractiveData(false),
+     mMayStartLayout(true),
+     mHaveFiredTitleChange(false),
+     mIsShowing(false),
+     mVisible(true),
+-    mHasReferrerPolicyCSP(false),
+     mRemovedFromDocShell(false),
+     // mAllowDNSPrefetch starts true, so that we can always reliably && it
+     // with various values that might disable it.  Since we never prefetch
+     // unless we get a window, and in that case the docshell value will get
+     // &&-ed in, this is safe.
+     mAllowDNSPrefetch(true),
+     mIsStaticDocument(false),
+     mCreatingStaticClone(false),
+@@ -2777,26 +2776,16 @@ nsDocument::ApplySettingsFromCSP(bool aS
+ {
+   nsresult rv = NS_OK;
+   if (!aSpeculative) {
+     // 1) apply settings from regular CSP
+     nsCOMPtr<nsIContentSecurityPolicy> csp;
+     rv = NodePrincipal()->GetCsp(getter_AddRefs(csp));
+     NS_ENSURE_SUCCESS_VOID(rv);
+     if (csp) {
+-      // Set up any Referrer Policy specified by CSP
+-      bool hasReferrerPolicy = false;
+-      uint32_t referrerPolicy = mozilla::net::RP_Unset;
+-      rv = csp->GetReferrerPolicy(&referrerPolicy, &hasReferrerPolicy);
+-      NS_ENSURE_SUCCESS_VOID(rv);
+-      if (hasReferrerPolicy) {
+-        mReferrerPolicy = static_cast<ReferrerPolicy>(referrerPolicy);
+-        mReferrerPolicySet = true;
+-      }
+-
+       // Set up 'block-all-mixed-content' if not already inherited
+       // from the parent context or set by any other CSP.
+       if (!mBlockAllMixedContent) {
+         rv = csp->GetBlockAllMixedContent(&mBlockAllMixedContent);
+         NS_ENSURE_SUCCESS_VOID(rv);
+       }
+       if (!mBlockAllMixedContentPreloads) {
+         mBlockAllMixedContentPreloads = mBlockAllMixedContent;
+diff --git a/dom/base/nsIDocument.h b/dom/base/nsIDocument.h
+--- a/dom/base/nsIDocument.h
++++ b/dom/base/nsIDocument.h
+@@ -717,24 +717,16 @@ public:
+    * Get mixed display content blocked flag for this document.
+    */
+   bool GetHasMixedDisplayContentBlocked()
+   {
+     return mHasMixedDisplayContentBlocked;
+   }
+ 
+   /**
+-  * Set referrer policy CSP flag for this document.
+-  */
+-  void SetHasReferrerPolicyCSP(bool aHasReferrerPolicyCSP)
+-  {
+-    mHasReferrerPolicyCSP = aHasReferrerPolicyCSP;
+-  }
+-
+-  /**
+    * Set the mixed display content blocked flag for this document.
+    */
+   void SetHasMixedDisplayContentBlocked(bool aHasMixedDisplayContentBlocked)
+   {
+     mHasMixedDisplayContentBlocked = aHasMixedDisplayContentBlocked;
+   }
+ 
+   /**
+@@ -3430,19 +3422,16 @@ protected:
+   // true otherwise.
+   bool mIsShowing : 1;
+ 
+   // State for IsVisible(). mVisible starts off true. It becomes false when
+   // OnPageHide happens, and becomes true again when OnPageShow happens.  So
+   // it's false only when we're in bfcache or unloaded.
+   bool mVisible : 1;
+ 
+-  // True if a document load has a CSP with referrer attached.
+-  bool mHasReferrerPolicyCSP : 1;
+-
+   // True if our content viewer has been removed from the docshell
+   // (it may still be displayed, but in zombie state). Form control data
+   // has been saved.
+   bool mRemovedFromDocShell : 1;
+ 
+   // True iff DNS prefetch is allowed for this document.  Note that if the
+   // document has no window, DNS prefetch won't be performed no matter what.
+   bool mAllowDNSPrefetch : 1;
+diff --git a/dom/interfaces/security/nsIContentSecurityPolicy.idl b/dom/interfaces/security/nsIContentSecurityPolicy.idl
+--- a/dom/interfaces/security/nsIContentSecurityPolicy.idl
++++ b/dom/interfaces/security/nsIContentSecurityPolicy.idl
+@@ -48,24 +48,23 @@ interface nsIContentSecurityPolicy : nsI
+   const unsigned short FRAME_SRC_DIRECTIVE            = 7;
+   const unsigned short FONT_SRC_DIRECTIVE             = 8;
+   const unsigned short CONNECT_SRC_DIRECTIVE          = 9;
+   const unsigned short REPORT_URI_DIRECTIVE           = 10;
+   const unsigned short FRAME_ANCESTORS_DIRECTIVE      = 11;
+   const unsigned short REFLECTED_XSS_DIRECTIVE        = 12;
+   const unsigned short BASE_URI_DIRECTIVE             = 13;
+   const unsigned short FORM_ACTION_DIRECTIVE          = 14;
+-  const unsigned short REFERRER_DIRECTIVE             = 15;
+-  const unsigned short WEB_MANIFEST_SRC_DIRECTIVE     = 16;
+-  const unsigned short UPGRADE_IF_INSECURE_DIRECTIVE  = 17;
+-  const unsigned short CHILD_SRC_DIRECTIVE            = 18;
+-  const unsigned short BLOCK_ALL_MIXED_CONTENT        = 19;
+-  const unsigned short REQUIRE_SRI_FOR                = 20;
+-  const unsigned short SANDBOX_DIRECTIVE              = 21;
+-  const unsigned short WORKER_SRC_DIRECTIVE           = 22;
++  const unsigned short WEB_MANIFEST_SRC_DIRECTIVE     = 15;
++  const unsigned short UPGRADE_IF_INSECURE_DIRECTIVE  = 16;
++  const unsigned short CHILD_SRC_DIRECTIVE            = 17;
++  const unsigned short BLOCK_ALL_MIXED_CONTENT        = 18;
++  const unsigned short REQUIRE_SRI_FOR                = 19;
++  const unsigned short SANDBOX_DIRECTIVE              = 20;
++  const unsigned short WORKER_SRC_DIRECTIVE           = 21;
+ 
+   /**
+    * Accessor method for a read-only string version of the policy at a given
+    * index.
+    */
+   [binaryname(GetPolicyString)] AString getPolicy(in unsigned long index);
+ 
+   /**
+@@ -98,31 +97,16 @@ interface nsIContentSecurityPolicy : nsI
+   readonly attribute bool blockAllMixedContent;
+ 
+   /**
+    * Returns whether this policy enforces the frame-ancestors directive.
+    */
+   readonly attribute bool enforcesFrameAncestors;
+ 
+   /**
+-   * Obtains the referrer policy (as integer) for this browsing context as
+-   * specified in CSP.  If there are multiple policies and...
+-   *  - only one sets a referrer policy: that policy is returned
+-   *  - more than one sets different referrer policies: no-referrer is returned
+-   *  - more than one set equivalent policies: that policy is returned
+-   * For the enumeration of policies see ReferrerPolicy.h and nsIHttpChannel.
+-   *
+-   * @param aPolicy
+-   *        The referrer policy to use for the protected resource.
+-   * @return
+-   *        true if a referrer policy is specified, false if it's unspecified.
+-   */
+-  bool getReferrerPolicy(out unsigned long policy);
+-
+-  /**
+    * Parse and install a CSP policy.
+    * @param aPolicy
+    *        String representation of the policy
+    *        (e.g., header value, meta content)
+    * @param reportOnly
+    *        Should this policy affect content, script and style processing or
+    *        just send reports if it is violated?
+    * @param deliveredViaMetaTag
+diff --git a/dom/security/nsCSPContext.cpp b/dom/security/nsCSPContext.cpp
+--- a/dom/security/nsCSPContext.cpp
++++ b/dom/security/nsCSPContext.cpp
+@@ -392,58 +392,16 @@ nsCSPContext::GetEnforcesFrameAncestors(
+       *outEnforcesFrameAncestors = true;
+       return NS_OK;
+     }
+   }
+   return NS_OK;
+ }
+ 
+ NS_IMETHODIMP
+-nsCSPContext::GetReferrerPolicy(uint32_t* outPolicy, bool* outIsSet)
+-{
+-  *outIsSet = false;
+-  *outPolicy = mozilla::net::RP_Unset;
+-  nsAutoString refpol;
+-  mozilla::net::ReferrerPolicy previousPolicy = mozilla::net::RP_Unset;
+-  for (uint32_t i = 0; i < mPolicies.Length(); i++) {
+-    mPolicies[i]->getReferrerPolicy(refpol);
+-    // only set the referrer policy if not delievered through a CSPRO and
+-    // note that and an empty string in refpol means it wasn't set
+-    // (that's the default in nsCSPPolicy).
+-    if (!mPolicies[i]->getReportOnlyFlag() && !refpol.IsEmpty()) {
+-      // Referrer Directive in CSP is no more used and going to be replaced by
+-      // Referrer-Policy HTTP header. But we still keep using referrer directive,
+-      // and would remove it later.
+-      // Referrer Directive specs is not fully compliant with new referrer policy
+-      // specs. What we are using here:
+-      // - If the value of the referrer directive is invalid, the user agent
+-      // should set the referrer policy to no-referrer.
+-      // - If there are two policies that specify a referrer policy, then they
+-      // must agree or the employed policy is no-referrer.
+-      if (!mozilla::net::IsValidReferrerPolicy(refpol)) {
+-        *outPolicy = mozilla::net::RP_No_Referrer;
+-        *outIsSet = true;
+-        return NS_OK;
+-      }
+-
+-      uint32_t currentPolicy = mozilla::net::ReferrerPolicyFromString(refpol);
+-      if (*outIsSet && previousPolicy != currentPolicy) {
+-        *outPolicy = mozilla::net::RP_No_Referrer;
+-        return NS_OK;
+-      }
+-
+-      *outPolicy = currentPolicy;
+-      *outIsSet = true;
+-    }
+-  }
+-
+-  return NS_OK;
+-}
+-
+-NS_IMETHODIMP
+ nsCSPContext::AppendPolicy(const nsAString& aPolicyString,
+                            bool aReportOnly,
+                            bool aDeliveredViaMetaTag)
+ {
+   CSPCONTEXTLOG(("nsCSPContext::AppendPolicy: %s",
+                  NS_ConvertUTF16toUTF8(aPolicyString).get()));
+ 
+   // Use the mSelfURI from setRequestContext, see bug 991474
+diff --git a/dom/security/nsCSPParser.cpp b/dom/security/nsCSPParser.cpp
+--- a/dom/security/nsCSPParser.cpp
++++ b/dom/security/nsCSPParser.cpp
+@@ -13,17 +13,16 @@
+ #include "nsIConsoleService.h"
+ #include "nsIContentPolicy.h"
+ #include "nsIScriptError.h"
+ #include "nsIStringBundle.h"
+ #include "nsNetUtil.h"
+ #include "nsReadableUtils.h"
+ #include "nsServiceManagerUtils.h"
+ #include "nsUnicharUtils.h"
+-#include "mozilla/net/ReferrerPolicy.h"
+ 
+ using namespace mozilla;
+ 
+ static LogModule*
+ GetCspParserLog()
+ {
+   static LazyLogModule gCspParserPRLog("CSPParser");
+   return gCspParserPRLog;
+@@ -868,53 +867,16 @@ nsCSPParser::sourceList(nsTArray<nsCSPBa
+       const char16_t* params[] = { CSP_EnumToUTF16Keyword(CSP_NONE) };
+       logWarningErrorToConsole(nsIScriptError::warningFlag, "ignoringUnknownOption",
+                                params, ArrayLength(params));
+     }
+   }
+ }
+ 
+ void
+-nsCSPParser::referrerDirectiveValue(nsCSPDirective* aDir)
+-{
+-  // directive-value   = "none" / "none-when-downgrade" / "origin" / "origin-when-cross-origin" / "unsafe-url"
+-  // directive name is token 0, we need to examine the remaining tokens (and
+-  // there should only be one token in the value).
+-  CSPPARSERLOG(("nsCSPParser::referrerDirectiveValue"));
+-
+-  if (mCurDir.Length() != 2) {
+-    CSPPARSERLOG(("Incorrect number of tokens in referrer directive, got %zu expected 1",
+-                 mCurDir.Length() - 1));
+-    delete aDir;
+-    return;
+-  }
+-
+-  if (!mozilla::net::IsValidReferrerPolicy(mCurDir[1])) {
+-    CSPPARSERLOG(("invalid value for referrer directive: %s",
+-                  NS_ConvertUTF16toUTF8(mCurDir[1]).get()));
+-    delete aDir;
+-    return;
+-  }
+-
+-  //referrer-directive deprecation warning
+-  const char16_t* params[] = { mCurDir[1].get() };
+-  logWarningErrorToConsole(nsIScriptError::warningFlag, "deprecatedReferrerDirective",
+-                             params, ArrayLength(params));
+-
+-  // the referrer policy is valid, so go ahead and use it.
+-  nsWeakPtr ctx = mCSPContext->GetLoadingContext();
+-  nsCOMPtr<nsIDocument> doc = do_QueryReferent(ctx);
+-  if (doc) {
+-    doc->SetHasReferrerPolicyCSP(true);
+-  }
+-  mPolicy->setReferrerPolicy(&mCurDir[1]);
+-  mPolicy->addDirective(aDir);
+-}
+-
+-void
+ nsCSPParser::requireSRIForDirectiveValue(nsRequireSRIForDirective* aDir)
+ {
+   CSPPARSERLOG(("nsCSPParser::requireSRIForDirectiveValue"));
+ 
+   // directive-value = "style" / "script"
+   // directive name is token 0, we need to examine the remaining tokens
+   for (uint32_t i = 1; i < mCurDir.Length(); i++) {
+     // mCurToken is only set here and remains the current token
+@@ -1208,23 +1170,16 @@ nsCSPParser::directive()
+ 
+   // special case handling for require-sri-for, which has directive values that
+   // are well-defined tokens but are not sources
+   if (cspDir->equals(nsIContentSecurityPolicy::REQUIRE_SRI_FOR)) {
+     requireSRIForDirectiveValue(static_cast<nsRequireSRIForDirective*>(cspDir));
+     return;
+   }
+ 
+-  // special case handling of the referrer directive (since it doesn't contain
+-  // source lists)
+-  if (cspDir->equals(nsIContentSecurityPolicy::REFERRER_DIRECTIVE)) {
+-    referrerDirectiveValue(cspDir);
+-    return;
+-  }
+-
+   // special case handling for report-uri directive (since it doesn't contain
+   // a valid source list but rather actual URIs)
+   if (CSP_IsDirective(mCurDir[0], nsIContentSecurityPolicy::REPORT_URI_DIRECTIVE)) {
+     reportURIList(cspDir);
+     return;
+   }
+ 
+   // special case handling for sandbox directive (since it doe4sn't contain
+diff --git a/dom/security/nsCSPUtils.cpp b/dom/security/nsCSPUtils.cpp
+--- a/dom/security/nsCSPUtils.cpp
++++ b/dom/security/nsCSPUtils.cpp
+@@ -1195,17 +1195,17 @@ nsCSPDirective::toDomCSPStruct(mozilla::
+       outCSP.mSandbox.Value() = mozilla::Move(srcs);
+       return;
+ 
+     case nsIContentSecurityPolicy::WORKER_SRC_DIRECTIVE:
+       outCSP.mWorker_src.Construct();
+       outCSP.mWorker_src.Value() = mozilla::Move(srcs);
+       return;
+ 
+-    // REFERRER_DIRECTIVE and REQUIRE_SRI_FOR are handled in nsCSPPolicy::toDomCSPStruct()
++    // REQUIRE_SRI_FOR is handled in nsCSPPolicy::toDomCSPStruct()
+ 
+     default:
+       NS_ASSERTION(false, "cannot find directive to convert CSP to JSON");
+   }
+ }
+ 
+ 
+ bool
+@@ -1564,44 +1564,30 @@ nsCSPPolicy::allows(nsContentPolicyType 
+   return allows(aContentType, aKeyword, NS_LITERAL_STRING(""), false);
+ }
+ 
+ void
+ nsCSPPolicy::toString(nsAString& outStr) const
+ {
+   uint32_t length = mDirectives.Length();
+   for (uint32_t i = 0; i < length; ++i) {
+-
+-    if (mDirectives[i]->equals(nsIContentSecurityPolicy::REFERRER_DIRECTIVE)) {
+-      outStr.AppendASCII(CSP_CSPDirectiveToString(nsIContentSecurityPolicy::REFERRER_DIRECTIVE));
+-      outStr.AppendASCII(" ");
+-      outStr.Append(mReferrerPolicy);
+-    } else {
+-      mDirectives[i]->toString(outStr);
+-    }
++    mDirectives[i]->toString(outStr);
+     if (i != (length - 1)) {
+       outStr.AppendASCII("; ");
+     }
+   }
+ }
+ 
+ void
+ nsCSPPolicy::toDomCSPStruct(mozilla::dom::CSP& outCSP) const
+ {
+   outCSP.mReport_only = mReportOnly;
+ 
+   for (uint32_t i = 0; i < mDirectives.Length(); ++i) {
+-    if (mDirectives[i]->equals(nsIContentSecurityPolicy::REFERRER_DIRECTIVE)) {
+-      mozilla::dom::Sequence<nsString> srcs;
+-      srcs.AppendElement(mReferrerPolicy, mozilla::fallible);
+-      outCSP.mReferrer.Construct();
+-      outCSP.mReferrer.Value() = srcs;
+-    } else {
+-      mDirectives[i]->toDomCSPStruct(outCSP);
+-    }
++    mDirectives[i]->toDomCSPStruct(outCSP);
+   }
+ }
+ 
+ bool
+ nsCSPPolicy::hasDirective(CSPDirective aDir) const
+ {
+   for (uint32_t i = 0; i < mDirectives.Length(); i++) {
+     if (mDirectives[i]->equals(aDir)) {
+diff --git a/dom/security/nsCSPUtils.h b/dom/security/nsCSPUtils.h
+--- a/dom/security/nsCSPUtils.h
++++ b/dom/security/nsCSPUtils.h
+@@ -85,17 +85,16 @@ static const char* CSPStrDirectives[] = 
+   "frame-src",                 // FRAME_SRC_DIRECTIVE
+   "font-src",                  // FONT_SRC_DIRECTIVE
+   "connect-src",               // CONNECT_SRC_DIRECTIVE
+   "report-uri",                // REPORT_URI_DIRECTIVE
+   "frame-ancestors",           // FRAME_ANCESTORS_DIRECTIVE
+   "reflected-xss",             // REFLECTED_XSS_DIRECTIVE
+   "base-uri",                  // BASE_URI_DIRECTIVE
+   "form-action",               // FORM_ACTION_DIRECTIVE
+-  "referrer",                  // REFERRER_DIRECTIVE
+   "manifest-src",              // MANIFEST_SRC_DIRECTIVE
+   "upgrade-insecure-requests", // UPGRADE_IF_INSECURE_DIRECTIVE
+   "child-src",                 // CHILD_SRC_DIRECTIVE
+   "block-all-mixed-content",   // BLOCK_ALL_MIXED_CONTENT
+   "require-sri-for",           // REQUIRE_SRI_FOR
+   "sandbox",                   // SANDBOX_DIRECTIVE
+   "worker-src"                 // WORKER_SRC_DIRECTIVE
+ };
+@@ -671,25 +670,16 @@ class nsCSPPolicy {
+     bool hasDirective(CSPDirective aDir) const;
+ 
+     inline void setReportOnlyFlag(bool aFlag)
+       { mReportOnly = aFlag; }
+ 
+     inline bool getReportOnlyFlag() const
+       { return mReportOnly; }
+ 
+-    inline void setReferrerPolicy(const nsAString* aValue)
+-      {
+-        mReferrerPolicy = *aValue;
+-        ToLowerCase(mReferrerPolicy);
+-      }
+-
+-    inline void getReferrerPolicy(nsAString& outPolicy) const
+-      { outPolicy.Assign(mReferrerPolicy); }
+-
+     void getReportURIs(nsTArray<nsString> &outReportURIs) const;
+ 
+     void getDirectiveStringForContentType(nsContentPolicyType aContentType,
+                                           nsAString& outDirective) const;
+ 
+     void getDirectiveAsString(CSPDirective aDir, nsAString& outDirective) const;
+ 
+     uint32_t getSandboxFlags() const;
+@@ -700,12 +690,11 @@ class nsCSPPolicy {
+       { return mDirectives.Length(); }
+ 
+     bool visitDirectiveSrcs(CSPDirective aDir, nsCSPSrcVisitor* aVisitor) const;
+ 
+   private:
+     nsUpgradeInsecureDirective* mUpgradeInsecDir;
+     nsTArray<nsCSPDirective*>   mDirectives;
+     bool                        mReportOnly;
+-    nsString                    mReferrerPolicy;
+ };
+ 
+ #endif /* nsCSPUtils_h___ */
+diff --git a/dom/security/test/csp/file_referrerdirective.html b/dom/security/test/csp/file_referrerdirective.html
+deleted file mode 100644
+--- a/dom/security/test/csp/file_referrerdirective.html
++++ /dev/null
+@@ -1,55 +0,0 @@
+-<!DOCTYPE HTML>
+-<html>
+-<head>
+-<title>Subframe test for bug 965727</title>
+-
+-<script type="text/javascript">
+-// we can get the ID out of the querystring.
+-var args = document.location.search.substring(1).split('&');
+-var id = "unknown";
+-for (var i=0; i < args.length; i++) {
+-  var arg = unescape(args[i]);
+-  if (arg.indexOf('=') > 0 && arg.indexOf('id') == 0) {
+-    id = arg.split('=')[1].trim();
+-  }
+-}
+-
+-var results = {
+-  'id': id,
+-  'referrer': document.location.href,
+-  'results': {
+-    'sameorigin': false,
+-    'crossorigin': false,
+-    'downgrade': false
+-  }
+-};
+-
+-// this is called back by each script load.
+-var postResult = function(loadType, referrerLevel, referrer) {
+-  results.results[loadType] = referrerLevel;
+-
+-  // and then check if all three have loaded.
+-  for (var id in results.results) {
+-    if (!results.results[id]) {
+-      return;
+-    }
+-  }
+-  //finished if we don't return early
+-  window.parent.postMessage(JSON.stringify(results), "*");
+-  console.log(JSON.stringify(results));
+-}
+-
+-</script>
+-</head>
+-<body>
+-Testing ...
+-
+-<script src="https://example.com/tests/dom/security/test/csp/referrerdirective.sjs?type=sameorigin&"
+-        onerror="postResult('sameorigin', 'error');"></script>
+-<script src="https://test2.example.com/tests/dom/security/test/csp/referrerdirective.sjs?type=crossorigin&"
+-        onerror="postResult('crossorigin', 'error');"></script>
+-<script src="http://example.com/tests/dom/security/test/csp/referrerdirective.sjs?type=downgrade&"
+-        onerror="postResult('downgrade', 'error');"></script>
+-
+-</body>
+-</html>
+diff --git a/dom/security/test/csp/file_upgrade_insecure_referrer.sjs b/dom/security/test/csp/file_upgrade_insecure_referrer.sjs
+deleted file mode 100644
+--- a/dom/security/test/csp/file_upgrade_insecure_referrer.sjs
++++ /dev/null
+@@ -1,55 +0,0 @@
+-// special *.sjs specifically customized for the needs of
+-// Bug 1139297 and Bug 663570
+-
+-const PRE_HEAD =
+-  "<!DOCTYPE HTML>" +
+-  "<html>" +
+-  "<head>";
+-
+- const POST_HEAD =
+-   "<meta charset='utf-8'>" +
+-   "<title>Bug 1139297 - Implement CSP upgrade-insecure-requests directive</title>" +
+-   "</head>" +
+-   "<body>" +
+-  "<img id='testimage' src='http://example.com/tests/dom/security/test/csp/file_upgrade_insecure_referrer_server.sjs?img'></img>" +
+-  "</body>" +
+-  "</html>";
+-
+-const PRE_CSP = "upgrade-insecure-requests; default-src https:; ";
+-const CSP_REFERRER_ORIGIN = "referrer origin";
+-const CSP_REFEFFER_NO_REFERRER = "referrer no-referrer";
+-
+-function handleRequest(request, response)
+-{
+-  // avoid confusing cache behaviors
+-  response.setHeader("Cache-Control", "no-cache", false);
+-  var queryString = request.queryString;
+-
+-  if (queryString === "test1") {
+-    response.setHeader("Content-Security-Policy", PRE_CSP + CSP_REFERRER_ORIGIN, false);
+-    response.write(PRE_HEAD + POST_HEAD);
+-  	return;
+-  }
+-
+-  if (queryString === "test2") {
+-    response.setHeader("Content-Security-Policy", PRE_CSP + CSP_REFEFFER_NO_REFERRER, false);
+-    response.write(PRE_HEAD + POST_HEAD);
+-  	return;
+-  }
+-
+-  if (queryString === "test3") {
+-  	var metacsp =  "<meta http-equiv=\"Content-Security-Policy\" content = \"" + PRE_CSP + CSP_REFERRER_ORIGIN + "\" >";
+-    response.write(PRE_HEAD + metacsp + POST_HEAD);
+-  	return;
+-  }
+-
+-  if (queryString === "test4") {
+-  	var metacsp =  "<meta http-equiv=\"Content-Security-Policy\" content = \"" + PRE_CSP + CSP_REFEFFER_NO_REFERRER + "\" >";
+-    response.write(PRE_HEAD + metacsp + POST_HEAD);
+-  	return;
+-  }
+-
+-  // we should never get here, but just in case return
+-  // something unexpected
+-  response.write("do'h");
+-}
+diff --git a/dom/security/test/csp/file_upgrade_insecure_referrer_server.sjs b/dom/security/test/csp/file_upgrade_insecure_referrer_server.sjs
+deleted file mode 100644
+--- a/dom/security/test/csp/file_upgrade_insecure_referrer_server.sjs
++++ /dev/null
+@@ -1,56 +0,0 @@
+-// Custom *.sjs file specifically for the needs of Bug:
+-// Bug 1139297 - Implement CSP upgrade-insecure-requests directive
+-
+-// small red image
+-const IMG_BYTES = atob(
+-  "iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12" +
+-  "P4//8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg==");
+-
+-function handleRequest(request, response)
+-{
+-  // avoid confusing cache behaviors
+-  response.setHeader("Cache-Control", "no-cache", false);
+-  var queryString = request.queryString;
+-
+-  // (1) lets process the queryresult request async and
+-  // wait till we have received the image request.
+-  if (queryString == "queryresult") {
+-    response.processAsync();
+-    setObjectState("queryResult", response);
+-    return;
+-  }
+-
+-  // (2) Handle the image request and return the referrer
+-  // result back to the stored queryresult request.
+-  if (request.queryString == "img") {
+-    response.setHeader("Content-Type", "image/png");
+-    response.write(IMG_BYTES);
+-
+-    let referrer = "";
+-    try {
+-      referrer = request.getHeader("referer");
+-    } catch (e) {
+-      referrer = "";
+-    }
+-    // make sure the received image request was upgraded to https,
+-    // otherwise we return not only the referrer but also indicate
+-    // that the request was not upgraded to https. Note, that
+-    // all upgrades happen in the browser before any non-secure
+-    // request hits the wire.
+-    referrer += (request.scheme == "https") ?
+-                 "" : " but request is not https";
+-
+-    getObjectState("queryResult", function(queryResponse) {
+-      if (!queryResponse) {
+-        return;
+-      }
+-      queryResponse.write(referrer);
+-      queryResponse.finish();
+-    });
+-    return;
+-  }
+-
+-  // we should not get here ever, but just in case return
+-  // something unexpected.
+-  response.write("doh!");
+-}
+diff --git a/dom/security/test/csp/mochitest.ini b/dom/security/test/csp/mochitest.ini
+--- a/dom/security/test/csp/mochitest.ini
++++ b/dom/security/test/csp/mochitest.ini
+@@ -119,26 +119,23 @@ support-files =
+   file_subframe_run_js_if_allowed.html^headers^
+   file_leading_wildcard.html
+   file_multi_policy_injection_bypass.html
+   file_multi_policy_injection_bypass.html^headers^
+   file_multi_policy_injection_bypass_2.html
+   file_multi_policy_injection_bypass_2.html^headers^
+   file_null_baseuri.html
+   file_form-action.html
+-  file_referrerdirective.html
+   referrerdirective.sjs
+   file_upgrade_insecure.html
+   file_upgrade_insecure_meta.html
+   file_upgrade_insecure_server.sjs
+   file_upgrade_insecure_wsh.py
+   file_upgrade_insecure_reporting.html
+   file_upgrade_insecure_reporting_server.sjs
+-  file_upgrade_insecure_referrer.sjs
+-  file_upgrade_insecure_referrer_server.sjs
+   file_upgrade_insecure_cors.html
+   file_upgrade_insecure_cors_server.sjs
+   file_report_for_import.css
+   file_report_for_import.html
+   file_report_for_import_server.sjs
+   file_service_worker.html
+   file_service_worker.js
+   file_child-src_iframe.html
+@@ -267,25 +264,22 @@ skip-if = toolkit == 'android' # Times o
+ [test_301_redirect.html]
+ [test_302_redirect.html]
+ [test_303_redirect.html]
+ [test_307_redirect.html]
+ [test_subframe_run_js_if_allowed.html]
+ [test_leading_wildcard.html]
+ [test_multi_policy_injection_bypass.html]
+ [test_null_baseuri.html]
+-[test_referrerdirective.html]
+ [test_dual_header.html]
+ [test_upgrade_insecure.html]
+ # no ssl support as well as websocket tests do not work (see test_websocket.html)
+ skip-if = (toolkit == 'android') || (os != 'linux' && !debug) # Bug 1183300
+ [test_upgrade_insecure_reporting.html]
+ skip-if = toolkit == 'android'
+-[test_upgrade_insecure_referrer.html]
+-skip-if = toolkit == 'android'
+ [test_upgrade_insecure_cors.html]
+ skip-if = toolkit == 'android'
+ [test_report_for_import.html]
+ [test_blocked_uri_in_reports.html]
+ [test_service_worker.html]
+ [test_child-src_worker.html]
+ [test_child-src_worker_data.html]
+ [test_child-src_worker-redirect.html]
+diff --git a/dom/security/test/csp/test_referrerdirective.html b/dom/security/test/csp/test_referrerdirective.html
+deleted file mode 100644
+--- a/dom/security/test/csp/test_referrerdirective.html
++++ /dev/null
+@@ -1,143 +0,0 @@
+-<!--
+-  Any copyright is dedicated to the Public Domain.
+-  http://creativecommons.org/publicdomain/zero/1.0/
+--->
+-<!DOCTYPE HTML>
+-<html>
+-<!--
+-https://bugzilla.mozilla.org/show_bug.cgi?id=965727
+--->
+-<head>
+-  <meta charset="utf-8">
+-  <title>Test for Content Security Policy referrer Directive (Bug 965727)</title>
+-  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+-</head>
+-<body>
+-<div id="content" style="display: none">
+-
+-</div>
+-<pre id="test">
+-<script class="testbody" type="application/javascript">
+-/*
+- * This tests various referrer policies and the referrer-sending behavior when
+- * requesting scripts in different ways:
+- *  - cross-origin (https://example.com -> https://test2.example.com)
+- *  - same-origin (https://example.com -> https://example.com)
+- *  - downgrade (https://example.com -> http://example.com)
+- *
+- * Each test creates an iframe that loads scripts for each of the checks.  If
+- * the scripts are blocked, the test fails (they should run).  When loaded,
+- * each script updates a results object in the test page, and then when the
+- * test page has finished loading all the scripts, it postMessages back to this
+- * page.  Once all tests are done, the results are checked.
+- */
+-
+-var testData = {
+-  'default': { 'csp': "script-src * 'unsafe-inline'; referrer default",
+-          'expected': {  'sameorigin': 'full',
+-                        'crossorigin': 'full',
+-                          'downgrade': 'none' }},
+-
+-  'origin':  { 'csp': "script-src * 'unsafe-inline'; referrer origin",
+-          'expected': {  'sameorigin': 'origin',
+-                        'crossorigin': 'origin',
+-                          'downgrade': 'origin' }},
+-
+-  'origin-when-cross-origin':  { 'csp': "script-src * 'unsafe-inline'; referrer origin-when-cross-origin",
+-          'expected': {  'sameorigin': 'full',
+-                        'crossorigin': 'origin',
+-                          'downgrade': 'origin' }},
+-
+-  'unsafe-url':  { 'csp': "script-src * 'unsafe-inline'; referrer unsafe-url",
+-          'expected': {  'sameorigin': 'full',
+-                        'crossorigin': 'full',
+-                          'downgrade': 'full' }},
+-
+-  'none':   { 'csp': "script-src * 'unsafe-inline'; referrer no-referrer",
+-          'expected': {  'sameorigin': 'none',
+-                        'crossorigin': 'none',
+-                          'downgrade': 'none' }},
+-
+-  // referrer delivered through CSPRO should be ignored
+-  'ignore-cspro':  { 'cspro': "script-src * 'unsafe-inline'; referrer origin",
+-          'expected': {  'sameorigin': 'full',
+-                        'crossorigin': 'full',
+-                          'downgrade': 'none' }},
+-
+-  // referrer delivered through CSPRO should be ignored
+-  'ignore-cspro2':   { 'csp'  : "script-src * 'unsafe-inline'; referrer no-referrer",
+-                       'cspro': "script-src * 'unsafe-inline'; referrer origin",
+-         'expected': {  'sameorigin': 'none',
+-                        'crossorigin': 'none',
+-                          'downgrade': 'none' }},
+-  };
+-
+-var referrerDirectiveTests = {
+-  // called via postMessage when one of the iframes is done running.
+-  onIframeComplete: function(event) {
+-    try {
+-      var results = JSON.parse(event.data);
+-      ok(results.hasOwnProperty('id'), "'id' property required in posted message " + event.data);
+-
+-      ok(testData.hasOwnProperty(results['id']), "Test " + results['id'] + " must be expected.");
+-
+-      // check all the various load types' referrers.
+-      var expected = testData[results['id']].expected;
+-      for (var t in expected) {
+-        is(results.results[t], expected[t],
+-          " referrer must match expected for " + t + " in " + results['id']);
+-      }
+-      testData[results['id']]['complete'] = true;
+-
+-    } catch(e) {
+-      // fail -- should always be JSON
+-      ok(false, "failed to parse posted message + " + event.data);
+-      // have to end as well since not all messages were valid.
+-      SimpleTest.finish();
+-    }
+-
+-    referrerDirectiveTests.checkForCompletion();
+-  },
+-
+-  // checks to see if all the parallel tests are done and validates results.
+-  checkForCompletion: function() {
+-    for (var id in testData) {
+-      if (!testData[id].hasOwnProperty('complete')) {
+-        return;
+-      }
+-    }
+-    SimpleTest.finish();
+-  }
+-};
+-
+-SimpleTest.waitForExplicitFinish();
+-// have to disable mixed content blocking to test https->http referrers.
+-SpecialPowers.pushPrefEnv({
+-    'set': [['security.mixed_content.block_active_content',   false],
+-            ['security.mixed_content.block_display_content',  false],
+-    ]
+-    },
+-    function() {
+-      // each of the iframes we create will call us back when its contents are loaded.
+-      window.addEventListener("message", referrerDirectiveTests.onIframeComplete.bind(window));
+-
+-      // one iframe created for each test case
+-      for (var id in testData) {
+-        var elt = document.createElement("iframe");
+-        var src = "https://example.com/tests/dom/security/test/csp/file_testserver.sjs?id=" + id;
+-        if (testData[id]['csp']) {
+-          src += "&csp=" + escape(testData[id]['csp']);
+-        }
+-        if (testData[id]['cspro']) {
+-          src += "&cspro=" + escape(testData[id]['cspro']);
+-        }
+-        src += "&file=tests/dom/security/test/csp/file_referrerdirective.html";
+-        elt.src = src;
+-        document.getElementById("content").appendChild(elt);
+-      }
+-    });
+-</script>
+-</pre>
+-</body>
+-</html>
+diff --git a/dom/security/test/csp/test_upgrade_insecure_referrer.html b/dom/security/test/csp/test_upgrade_insecure_referrer.html
+deleted file mode 100644
+--- a/dom/security/test/csp/test_upgrade_insecure_referrer.html
++++ /dev/null
+@@ -1,85 +0,0 @@
+-<!DOCTYPE HTML>
+-<html>
+-<head>
+-  <meta charset="utf-8">
+-  <title>Bug 1139297 - Implement CSP upgrade-insecure-requests directive</title>
+-  <!-- Including SimpleTest.js so we can use waitForExplicitFinish !-->
+-  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+-</head>
+-<body>
+-<iframe style="width:100%;" id="testframe"></iframe>
+-
+-<script class="testbody" type="text/javascript">
+-
+-/* Description of the test:
+- * We load a page that makes use of the CSP referrer directive as well
+- * as upgrade-insecure-requests. The page loads an image over http.
+- * The test makes sure the request gets upgraded to https and the
+- * correct referrer gets sent.
+- */
+-
+-var tests = [
+-  {
+-    query: "test1",
+-    description: "upgrade insecure request with 'referrer = origin' (CSP in header)",
+-    result: "http://example.com/"
+-  },
+-  {
+-    query: "test2",
+-    description: "upgrade insecure request with 'referrer = no-referrer' (CSP in header)",
+-    result: ""
+-  },
+-  {
+-    query: "test3",
+-    description: "upgrade insecure request with 'referrer = origin' (Meta CSP)",
+-    result: "http://example.com/"
+-  },
+-  {
+-    query: "test4",
+-    description: "upgrade insecure request with 'referrer = no-referrer' (Meta CSP)",
+-    result: ""
+-  }
+-];
+-
+-var counter = 0;
+-var curTest;
+-
+-function loadTestPage() {
+-  curTest = tests[counter++];
+-  var src = "http://example.com/tests/dom/security/test/csp/file_upgrade_insecure_referrer.sjs?";
+-  // append the query
+-  src += curTest.query;
+-  document.getElementById("testframe").src = src;
+-}
+-
+-function runNextTest() {
+-  // sends a request to the server which is processed async and returns
+-  // once the server received the expected image request
+-  var myXHR = new XMLHttpRequest();
+-  myXHR.open("GET", "file_upgrade_insecure_referrer_server.sjs?queryresult");
+-  myXHR.onload = function(e) {
+-    is(myXHR.responseText, curTest.result, curTest.description);
+-    if (counter == tests.length) {
+-      SimpleTest.finish();
+-      return;
+-    }
+-    // move on to the next test by setting off another query request.
+-    runNextTest();
+-  }
+-  myXHR.onerror = function(e) {
+-    ok(false, "could not query results from server (" + e.message + ")");
+-    SimpleTest.finish();
+-  }
+-  myXHR.send();
+-
+-  // give it some time and load the testpage
+-  SimpleTest.executeSoon(loadTestPage);
+-}
+-
+-SimpleTest.waitForExplicitFinish();
+-runNextTest();
+-
+-</script>
+-</body>
+-</html>
+diff --git a/dom/security/test/gtest/TestCSPParser.cpp b/dom/security/test/gtest/TestCSPParser.cpp
+--- a/dom/security/test/gtest/TestCSPParser.cpp
++++ b/dom/security/test/gtest/TestCSPParser.cpp
+@@ -207,18 +207,16 @@ TEST(CSPParser, Directives)
+     { "script-src 'nonce-correctscriptnonce'",
+       "script-src 'nonce-correctscriptnonce'" },
+     { "script-src 'nonce-a'",
+       "script-src 'nonce-a'" },
+     { "script-src 'sha256-a'",
+       "script-src 'sha256-a'" },
+     { "script-src 'sha256-siVR8vAcqP06h2ppeNwqgjr0yZ6yned4X2VF84j4GmI='",
+       "script-src 'sha256-siVR8vAcqP06h2ppeNwqgjr0yZ6yned4X2VF84j4GmI='" },
+-    { "referrer no-referrer",
+-      "referrer no-referrer" },
+     { "require-sri-for script style",
+       "require-sri-for script style"},
+     { "script-src 'nonce-foo' 'unsafe-inline' ",
+       "script-src 'nonce-foo' 'unsafe-inline'" },
+     { "script-src 'nonce-foo' 'strict-dynamic' 'unsafe-inline' https:  ",
+       "script-src 'nonce-foo' 'strict-dynamic' 'unsafe-inline' https:" },
+     { "default-src 'sha256-siVR8' 'strict-dynamic' 'unsafe-inline' https:  ",
+       "default-src 'sha256-siVR8' 'unsafe-inline' https:" },
+@@ -283,18 +281,16 @@ TEST(CSPParser, IgnoreUpperLowerCasePoli
+     { "script-src 'none' test.com;",
+       "script-src http://test.com" },
+     { "script-src 'NoNCE-correctscriptnonce'",
+       "script-src 'nonce-correctscriptnonce'" },
+     { "script-src 'NoncE-NONCENEEDSTOBEUPPERCASE'",
+       "script-src 'nonce-NONCENEEDSTOBEUPPERCASE'" },
+     { "script-src 'SHA256-siVR8vAcqP06h2ppeNwqgjr0yZ6yned4X2VF84j4GmI='",
+       "script-src 'sha256-siVR8vAcqP06h2ppeNwqgjr0yZ6yned4X2VF84j4GmI='" },
+-    { "refERRer No-refeRRer",
+-      "referrer no-referrer" },
+     { "upgrade-INSECURE-requests",
+       "upgrade-insecure-requests" },
+     { "sanDBox alloW-foRMs",
+       "sandbox allow-forms"},
+     { "require-SRI-for sCript stYle",
+       "require-sri-for script style"},
+   };
+ 
+@@ -578,18 +574,16 @@ TEST(CSPParser, BadPolicies)
+   static const PolicyTest policies[] =
+   {
+     { "script-sr 'self", "" },
+     { "", "" },
+     { "; ; ; ; ; ; ;", "" },
+     { "defaut-src asdf", "" },
+     { "default-src: aaa", "" },
+     { "asdf http://test.com", ""},
+-    { "referrer", ""},
+-    { "referrer foo", ""},
+     { "require-sri-for", ""},
+     { "require-sri-for foo", ""},
+     { "report-uri", ""},
+     { "report-uri http://:foo", ""},
+   };
+ 
+   uint32_t policyCount = sizeof(policies) / sizeof(PolicyTest);
+   ASSERT_TRUE(NS_SUCCEEDED(runTestSuite(policies, policyCount, 0)));
+diff --git a/dom/workers/WorkerLoadInfo.cpp.1302449.later b/dom/workers/WorkerLoadInfo.cpp.1302449.later
+new file mode 100644
+--- /dev/null
++++ b/dom/workers/WorkerLoadInfo.cpp.1302449.later
+@@ -0,0 +1,29 @@
++--- WorkerLoadInfo.cpp
+++++ WorkerLoadInfo.cpp
++@@ -169,26 +169,16 @@ WorkerLoadInfo::SetPrincipalOnMainThread
++   mPrincipal = aPrincipal;
++   mPrincipalIsSystem = nsContentUtils::IsSystemPrincipal(aPrincipal);
++ 
++   nsresult rv = aPrincipal->GetCsp(getter_AddRefs(mCSP));
++   NS_ENSURE_SUCCESS(rv, rv);
++ 
++   if (mCSP) {
++     mCSP->GetAllowsEval(&mReportCSPViolations, &mEvalAllowed);
++-    // Set ReferrerPolicy
++-    bool hasReferrerPolicy = false;
++-    uint32_t rp = mozilla::net::RP_Unset;
++-
++-    rv = mCSP->GetReferrerPolicy(&rp, &hasReferrerPolicy);
++-    NS_ENSURE_SUCCESS(rv, rv);
++-
++-    if (hasReferrerPolicy) {
++-      mReferrerPolicy = static_cast<net::ReferrerPolicy>(rp);
++-    }
++   } else {
++     mEvalAllowed = true;
++     mReportCSPViolations = false;
++   }
++ 
++   mLoadGroup = aLoadGroup;
++ 
++   mPrincipalInfo = new PrincipalInfo();
+diff --git a/dom/workers/WorkerPrivate.cpp b/dom/workers/WorkerPrivate.cpp
+--- a/dom/workers/WorkerPrivate.cpp
++++ b/dom/workers/WorkerPrivate.cpp
+@@ -1881,26 +1881,16 @@ WorkerLoadInfo::SetPrincipalOnMainThread
+   mPrincipal = aPrincipal;
+   mPrincipalIsSystem = nsContentUtils::IsSystemPrincipal(aPrincipal);
+ 
+   nsresult rv = aPrincipal->GetCsp(getter_AddRefs(mCSP));
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+   if (mCSP) {
+     mCSP->GetAllowsEval(&mReportCSPViolations, &mEvalAllowed);
+-    // Set ReferrerPolicy
+-    bool hasReferrerPolicy = false;
+-    uint32_t rp = mozilla::net::RP_Unset;
+-
+-    rv = mCSP->GetReferrerPolicy(&rp, &hasReferrerPolicy);
+-    NS_ENSURE_SUCCESS(rv, rv);
+-
+-    if (hasReferrerPolicy) {
+-      mReferrerPolicy = static_cast<net::ReferrerPolicy>(rp);
+-    }
+   } else {
+     mEvalAllowed = true;
+     mReportCSPViolations = false;
+   }
+ 
+   mLoadGroup = aLoadGroup;
+ 
+   mPrincipalInfo = new PrincipalInfo();
+@@ -2778,30 +2768,20 @@ WorkerPrivateParent<Derived>::SetCSPFrom
+   }
+ 
+   // Set evalAllowed, default value is set in GetAllowsEval
+   bool evalAllowed = false;
+   bool reportEvalViolations = false;
+   rv = csp->GetAllowsEval(&reportEvalViolations, &evalAllowed);
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+-  // Set ReferrerPolicy, default value is set in GetReferrerPolicy
+-  bool hasReferrerPolicy = false;
+-  uint32_t rp = mozilla::net::RP_Unset;
+-  rv = csp->GetReferrerPolicy(&rp, &hasReferrerPolicy);
+-  NS_ENSURE_SUCCESS(rv, rv);
+-
+   mLoadInfo.mCSP = csp;
+   mLoadInfo.mEvalAllowed = evalAllowed;
+   mLoadInfo.mReportCSPViolations = reportEvalViolations;
+ 
+-  if (hasReferrerPolicy) {
+-    mLoadInfo.mReferrerPolicy = static_cast<net::ReferrerPolicy>(rp);
+-  }
+-
+   return NS_OK;
+ }
+ 
+ template <class Derived>
+ void
+ WorkerPrivateParent<Derived>::SetReferrerPolicyFromHeaderValue(
+                                   const nsACString& aReferrerPolicyHeaderValue)
+ {
+diff --git a/netwerk/base/ReferrerPolicy.h b/netwerk/base/ReferrerPolicy.h
+--- a/netwerk/base/ReferrerPolicy.h
++++ b/netwerk/base/ReferrerPolicy.h
+@@ -108,40 +108,16 @@ ReferrerPolicyFromString(const nsAString
+       lowerContent.EqualsLiteral(kRPS_Unsafe_URL)) {
+     return RP_Unsafe_URL;
+   }
+   // Spec says if none of the previous match, use empty string.
+   return RP_Unset;
+ 
+ }
+ 
+-inline bool
+-IsValidReferrerPolicy(const nsAString& content)
+-{
+-  if (content.IsEmpty()) {
+-    return true;
+-  }
+-
+-  nsString lowerContent(content);
+-  ToLowerCase(lowerContent);
+-
+-  return lowerContent.EqualsLiteral(kRPS_Never)
+-      || lowerContent.EqualsLiteral(kRPS_No_Referrer)
+-      || lowerContent.EqualsLiteral(kRPS_Origin)
+-      || lowerContent.EqualsLiteral(kRPS_Default)
+-      || lowerContent.EqualsLiteral(kRPS_No_Referrer_When_Downgrade)
+-      || lowerContent.EqualsLiteral(kRPS_Origin_When_Cross_Origin)
+-      || lowerContent.EqualsLiteral(kRPS_Origin_When_Crossorigin)
+-      || lowerContent.EqualsLiteral(kRPS_Same_Origin)
+-      || lowerContent.EqualsLiteral(kRPS_Strict_Origin)
+-      || lowerContent.EqualsLiteral(kRPS_Strict_Origin_When_Cross_Origin)
+-      || lowerContent.EqualsLiteral(kRPS_Always)
+-      || lowerContent.EqualsLiteral(kRPS_Unsafe_URL);
+-}
+-
+ inline ReferrerPolicy
+ AttributeReferrerPolicyFromString(const nsAString& content)
+ {
+   // Specs : https://html.spec.whatwg.org/multipage/infrastructure.html#referrer-policy-attribute
+   // Spec says the empty string "" corresponds to no referrer policy, or RP_Unset
+   if (content.IsEmpty()) {
+     return RP_Unset;
+   }
+diff --git a/parser/html/nsHtml5TreeOpExecutor.cpp b/parser/html/nsHtml5TreeOpExecutor.cpp
+--- a/parser/html/nsHtml5TreeOpExecutor.cpp
++++ b/parser/html/nsHtml5TreeOpExecutor.cpp
+@@ -1171,25 +1171,16 @@ nsHtml5TreeOpExecutor::AddSpeculationCSP
+ 
+   // please note that meta CSPs and CSPs delivered through a header need
+   // to be joined together.
+   rv = preloadCsp->AppendPolicy(aCSP,
+                                 false, // csp via meta tag can not be report only
+                                 true); // delivered through the meta tag
+   NS_ENSURE_SUCCESS_VOID(rv);
+ 
+-  // Record "speculated" referrer policy for preloads
+-  bool hasReferrerPolicy = false;
+-  uint32_t referrerPolicy = mozilla::net::RP_Unset;
+-  rv = preloadCsp->GetReferrerPolicy(&referrerPolicy, &hasReferrerPolicy);
+-  NS_ENSURE_SUCCESS_VOID(rv);
+-  if (hasReferrerPolicy) {
+-    SetSpeculationReferrerPolicy(static_cast<ReferrerPolicy>(referrerPolicy));
+-  }
+-
+   mDocument->ApplySettingsFromCSP(true);
+ }
+ 
+ void
+ nsHtml5TreeOpExecutor::SetSpeculationReferrerPolicy(ReferrerPolicy aReferrerPolicy)
+ {
+   // Record "speculated" referrer policy locally and thread through the
+   // speculation phase.  The actual referrer policy will be set by
+diff --git a/toolkit/components/telemetry/Histograms.json b/toolkit/components/telemetry/Histograms.json
+--- a/toolkit/components/telemetry/Histograms.json
++++ b/toolkit/components/telemetry/Histograms.json
+@@ -2627,24 +2627,16 @@
+   "CSP_UNSAFE_EVAL_DOCUMENTS_COUNT": {
+     "record_in_processes": ["main", "content"],
+     "alert_emails": ["seceng-telemetry@mozilla.com"],
+     "bug_numbers": [1252829],
+     "expires_in_version": "60",
+     "kind": "count",
+     "description": "Number of unique pages that contain an unsafe-eval CSP directive"
+   },
+-  "CSP_REFERRER_DIRECTIVE": {
+-    "record_in_processes": ["main", "content"],
+-    "alert_emails": ["seceng-telemetry@mozilla.com"],
+-    "bug_numbers": [1303685],
+-    "expires_in_version": "60",
+-    "kind": "boolean",
+-    "description": "Whether a document with a CSP policy (report-only or enforcing) contains a referrer directive ('true') or not ('false')."
+-  },
+   "LINK_ICON_SIZES_ATTR_USAGE": {
+     "record_in_processes": ["main", "content"],
+     "expires_in_version" : "never",
+     "kind": "enumerated",
+     "n_values": 4,
+     "description": "The possible types of the 'sizes' attribute for <link rel=icon>. 0: Attribute not specified, 1: 'any', 2: Integer dimensions, 3: Invalid value."
+   },
+   "LINK_ICON_SIZES_ATTR_DIMENSION": {

frg/work-js/mozilla-release/patches/1418246-63a1.patch

@@ -0,0 +1,1901 @@
+# HG changeset patch
+# User Andrea Marchesini <amarchesini@mozilla.com>
+# Date 1530771664 -7200
+# Node ID 1dea8bb53b30fe722aba6d4ac6d4ff4bec28ec97
+# Parent  dc01d612de1ba980e640d75ccaa9a0b6e047a733
+Bug 1418246 - Return valid columnNumber value in CSP violation events, r=ckerschb
+
+diff --git a/caps/nsScriptSecurityManager.cpp b/caps/nsScriptSecurityManager.cpp
+--- a/caps/nsScriptSecurityManager.cpp
++++ b/caps/nsScriptSecurityManager.cpp
+@@ -423,30 +423,33 @@ nsScriptSecurityManager::ContentSecurity
+     {
+         NS_WARNING("CSP: failed to get allowsEval");
+         return true; // fail open to not break sites.
+     }
+ 
+     if (reportViolation) {
+         nsAutoString fileName;
+         unsigned lineNum = 0;
++        unsigned columnNum = 0;
+         NS_NAMED_LITERAL_STRING(scriptSample, "call to eval() or related function blocked by CSP");
+ 
+         JS::AutoFilename scriptFilename;
+-        if (JS::DescribeScriptedCaller(cx, &scriptFilename, &lineNum)) {
++        if (JS::DescribeScriptedCaller(cx, &scriptFilename, &lineNum,
++                                       &columnNum)) {
+             if (const char *file = scriptFilename.get()) {
+                 CopyUTF8toUTF16(nsDependentCString(file), fileName);
+             }
+         } else {
+             MOZ_ASSERT(!JS_IsExceptionPending(cx));
+         }
+         csp->LogViolationDetails(nsIContentSecurityPolicy::VIOLATION_TYPE_EVAL,
+                                  fileName,
+                                  scriptSample,
+                                  lineNum,
++                                 columnNum,
+                                  EmptyString(),
+                                  EmptyString());
+     }
+ 
+     return evalOK;
+ }
+ 
+ // static
+diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
+--- a/dom/base/nsDocument.cpp
++++ b/dom/base/nsDocument.cpp
+@@ -12726,16 +12726,17 @@ nsIDocument::InlineScriptAllowedByCSP()
+   NS_ENSURE_SUCCESS(rv, true);
+   bool allowsInlineScript = true;
+   if (csp) {
+     nsresult rv = csp->GetAllowsInline(nsIContentPolicy::TYPE_SCRIPT,
+                                        EmptyString(), // aNonce
+                                        true,          // aParserCreated
+                                        nullptr, // FIXME get script sample (bug 1314567)
+                                        0,             // aLineNumber
++                                       0,             // aColumnNumber
+                                        &allowsInlineScript);
+     NS_ENSURE_SUCCESS(rv, true);
+   }
+   return allowsInlineScript;
+ }
+ 
+ static bool
+ ReportExternalResourceUseCounters(nsIDocument* aDocument, void* aData)
+diff --git a/dom/base/nsIStyleSheetLinkingElement.h b/dom/base/nsIStyleSheetLinkingElement.h
+--- a/dom/base/nsIStyleSheetLinkingElement.h
++++ b/dom/base/nsIStyleSheetLinkingElement.h
+@@ -148,14 +148,27 @@ public:
+ 
+   /**
+    * Get the line number, as previously set by SetLineNumber.
+    *
+    * @return the line number of this element; or 1 if no line number
+    *         was set
+    */
+   virtual uint32_t GetLineNumber() = 0;
++
++  // This doesn't entirely belong here since they only make sense for
++  // some types of linking elements, but it's a better place than
++  // anywhere else.
++  virtual void SetColumnNumber(uint32_t aColumnNumber) = 0;
++
++  /**
++   * Get the column number, as previously set by SetColumnNumber.
++   *
++   * @return the column number of this element; or 1 if no column number
++   *         was set
++   */
++  virtual uint32_t GetColumnNumber() = 0;
+ };
+ 
+ NS_DEFINE_STATIC_IID_ACCESSOR(nsIStyleSheetLinkingElement,
+                               NS_ISTYLESHEETLINKINGELEMENT_IID)
+ 
+ #endif // nsILinkingElement_h__
+diff --git a/dom/base/nsJSTimeoutHandler.cpp b/dom/base/nsJSTimeoutHandler.cpp
+--- a/dom/base/nsJSTimeoutHandler.cpp
++++ b/dom/base/nsJSTimeoutHandler.cpp
+@@ -194,23 +194,25 @@ CheckCSPForEval(JSContext* aCx, nsGlobal
+ 
+   if (reportViolation) {
+     // TODO : need actual script sample in violation report.
+     NS_NAMED_LITERAL_STRING(scriptSample,
+                             "call to eval() or related function blocked by CSP");
+ 
+     // Get the calling location.
+     uint32_t lineNum = 0;
++    uint32_t columnNum = 0;
+     nsAutoString fileNameString;
+-    if (!nsJSUtils::GetCallingLocation(aCx, fileNameString, &lineNum)) {
++    if (!nsJSUtils::GetCallingLocation(aCx, fileNameString, &lineNum,
++                                       &columnNum)) {
+       fileNameString.AssignLiteral("unknown");
+     }
+ 
+     csp->LogViolationDetails(nsIContentSecurityPolicy::VIOLATION_TYPE_EVAL,
+-                             fileNameString, scriptSample, lineNum,
++                             fileNameString, scriptSample, lineNum, columnNum,
+                              EmptyString(), EmptyString());
+   }
+ 
+   return allowsEval;
+ }
+ 
+ nsJSScriptTimeoutHandler::nsJSScriptTimeoutHandler()
+   : mLineNo(0)
+diff --git a/dom/base/nsStyleLinkElement.cpp b/dom/base/nsStyleLinkElement.cpp
+--- a/dom/base/nsStyleLinkElement.cpp
++++ b/dom/base/nsStyleLinkElement.cpp
+@@ -36,16 +36,17 @@
+ 
+ using namespace mozilla;
+ using namespace mozilla::dom;
+ 
+ nsStyleLinkElement::nsStyleLinkElement()
+   : mDontLoadStyle(false)
+   , mUpdatesEnabled(true)
+   , mLineNumber(1)
++  , mColumnNumber(1)
+ {
+ }
+ 
+ nsStyleLinkElement::~nsStyleLinkElement()
+ {
+   nsStyleLinkElement::SetStyleSheet(nullptr);
+ }
+ 
+@@ -117,16 +118,28 @@ nsStyleLinkElement::SetLineNumber(uint32
+ }
+ 
+ /* virtual */ uint32_t
+ nsStyleLinkElement::GetLineNumber()
+ {
+   return mLineNumber;
+ }
+ 
++/* virtual */ void
++nsStyleLinkElement::SetColumnNumber(uint32_t aColumnNumber)
++{
++  mColumnNumber = aColumnNumber;
++}
++
++/* virtual */ uint32_t
++nsStyleLinkElement::GetColumnNumber()
++{
++  return mColumnNumber;
++}
++
+ static uint32_t ToLinkMask(const nsAString& aLink)
+ {
+   // Keep this in sync with sRelValues in HTMLLinkElement.cpp
+   if (aLink.EqualsLiteral("prefetch"))
+     return nsStyleLinkElement::ePREFETCH;
+   else if (aLink.EqualsLiteral("dns-prefetch"))
+     return nsStyleLinkElement::eDNS_PREFETCH;
+   else if (aLink.EqualsLiteral("stylesheet"))
+@@ -322,17 +335,18 @@ nsStyleLinkElement::DoUpdateStyleSheet(n
+     MOZ_ASSERT(thisContent->NodeInfo()->NameAtom() != nsGkAtoms::link,
+                "<link> is not 'inline', and needs different CSP checks");
+     MOZ_ASSERT(thisContent->IsElement());
+     nsresult rv = NS_OK;
+     if (!nsStyleUtil::CSPAllowsInlineStyle(thisContent->AsElement(),
+                                            thisContent->NodePrincipal(),
+                                            nullptr,
+                                            doc->GetDocumentURI(),
+-                                           mLineNumber, text, &rv)) {
++                                           mLineNumber, mColumnNumber, text,
++                                           &rv)) {
+       if (NS_FAILED(rv)) {
+         return Err(rv);
+       }
+       return Update { };
+     }
+ 
+     // Parse the style sheet.
+     return doc->CSSLoader()->
+diff --git a/dom/base/nsStyleLinkElement.h b/dom/base/nsStyleLinkElement.h
+--- a/dom/base/nsStyleLinkElement.h
++++ b/dom/base/nsStyleLinkElement.h
+@@ -53,16 +53,18 @@ public:
+     UpdateStyleSheet(nsICSSLoaderObserver*, ForceUpdate) override;
+ 
+   void SetEnableUpdates(bool aEnableUpdates) override;
+   NS_IMETHOD GetCharset(nsAString& aCharset) override;
+ 
+   void OverrideBaseURI(nsIURI* aNewBaseURI) override;
+   void SetLineNumber(uint32_t aLineNumber) override;
+   uint32_t GetLineNumber() override;
++  void SetColumnNumber(uint32_t aColumnNumber) override;
++  uint32_t GetColumnNumber() override;
+ 
+   enum RelValue {
+     ePREFETCH =     0x00000001,
+     eDNS_PREFETCH = 0x00000002,
+     eSTYLESHEET =   0x00000004,
+     eNEXT =         0x00000008,
+     eALTERNATE =    0x00000010,
+     ePRECONNECT =   0x00000020,
+@@ -136,12 +138,13 @@ private:
+                        ForceUpdate);
+ 
+   RefPtr<mozilla::StyleSheet> mStyleSheet;
+ protected:
+   nsCOMPtr<nsIPrincipal> mTriggeringPrincipal;
+   bool mDontLoadStyle;
+   bool mUpdatesEnabled;
+   uint32_t mLineNumber;
++  uint32_t mColumnNumber;
+ };
+ 
+ #endif /* nsStyleLinkElement_h___ */
+ 
+diff --git a/dom/base/nsStyledElement.cpp b/dom/base/nsStyledElement.cpp
+--- a/dom/base/nsStyledElement.cpp
++++ b/dom/base/nsStyledElement.cpp
+@@ -185,17 +185,17 @@ nsStyledElement::ParseStyleAttribute(con
+                                      bool aForceInDataDoc)
+ {
+   nsIDocument* doc = OwnerDoc();
+   bool isNativeAnon = IsInNativeAnonymousSubtree();
+ 
+   if (!isNativeAnon &&
+       !nsStyleUtil::CSPAllowsInlineStyle(nullptr, NodePrincipal(),
+                                          aMaybeScriptedPrincipal,
+-                                         doc->GetDocumentURI(), 0, aValue,
++                                         doc->GetDocumentURI(), 0, 0, aValue,
+                                          nullptr))
+     return;
+ 
+   if (aForceInDataDoc ||
+       !doc->IsLoadedAsData() ||
+       GetExistingStyle() ||
+       doc->IsStaticDocument()) {
+     bool isCSS = true; // assume CSS until proven otherwise
+diff --git a/dom/events/EventListenerManager.cpp b/dom/events/EventListenerManager.cpp
+--- a/dom/events/EventListenerManager.cpp
++++ b/dom/events/EventListenerManager.cpp
+@@ -850,16 +850,17 @@ EventListenerManager::SetEventHandler(ns
+       }
+ 
+       bool allowsInlineScript = true;
+       rv = csp->GetAllowsInline(nsIContentPolicy::TYPE_SCRIPT,
+                                 EmptyString(), // aNonce
+                                 true, // aParserCreated (true because attribute event handler)
+                                 sampleIString,
+                                 0,             // aLineNumber
++                                0,             // aColumnNumber
+                                 &allowsInlineScript);
+       NS_ENSURE_SUCCESS(rv, rv);
+ 
+       // return early if CSP wants us to block inline scripts
+       if (!allowsInlineScript) {
+         return NS_OK;
+       }
+     }
+diff --git a/dom/html/HTMLScriptElement.cpp b/dom/html/HTMLScriptElement.cpp
+--- a/dom/html/HTMLScriptElement.cpp
++++ b/dom/html/HTMLScriptElement.cpp
+@@ -227,26 +227,26 @@ HTMLScriptElement::FreezeExecutionAttrs(
+ 
+       if (!mUri) {
+         const char16_t* params[] = { u"src", src.get() };
+ 
+         nsContentUtils::ReportToConsole(nsIScriptError::warningFlag,
+           NS_LITERAL_CSTRING("HTML"), OwnerDoc(),
+           nsContentUtils::eDOM_PROPERTIES, "ScriptSourceInvalidUri",
+           params, ArrayLength(params), nullptr,
+-          EmptyString(), GetScriptLineNumber());
++          EmptyString(), GetScriptLineNumber(), GetScriptColumnNumber());
+       }
+     } else {
+       const char16_t* params[] = { u"src" };
+ 
+       nsContentUtils::ReportToConsole(nsIScriptError::warningFlag,
+         NS_LITERAL_CSTRING("HTML"), OwnerDoc(),
+         nsContentUtils::eDOM_PROPERTIES, "ScriptSourceEmpty",
+         params, ArrayLength(params), nullptr,
+-        EmptyString(), GetScriptLineNumber());
++        EmptyString(), GetScriptLineNumber(), GetScriptColumnNumber());
+     }
+ 
+     // At this point mUri will be null for invalid URLs.
+     mExternal = true;
+   }
+ 
+   bool async = (mExternal || mIsModule) && Async();
+   bool defer = mExternal && Defer();
+diff --git a/dom/interfaces/security/nsIContentSecurityPolicy.idl b/dom/interfaces/security/nsIContentSecurityPolicy.idl
+--- a/dom/interfaces/security/nsIContentSecurityPolicy.idl
++++ b/dom/interfaces/security/nsIContentSecurityPolicy.idl
+@@ -121,25 +121,28 @@ interface nsIContentSecurityPolicy : nsI
+    * @param aContentPolicyType Either TYPE_SCRIPT or TYPE_STYLESHEET
+    * @param aNonce The nonce string to check against the policy
+    * @param aParserCreated If the script element was created by the HTML Parser
+    * @param aElementOrContent The script element of the inline resource to hash
+    *        or the content of the psuedo-script to compare to hash
+    *        (and compare to the hashes listed in the policy)
+    * @param aLineNumber The line number of the inline resource
+    *        (used for reporting)
++   * @param aColumnNumber The column number of the inline resource
++   *        (used for reporting)
+    * @return
+    *     Whether or not the effects of the inline style should be allowed
+    *     (block the rules if false).
+    */
+   boolean getAllowsInline(in nsContentPolicyType aContentPolicyType,
+                           in AString aNonce,
+                           in boolean aParserCreated,
+                           in nsISupports aElementOrContent,
+-                          in unsigned long aLineNumber);
++                          in unsigned long aLineNumber,
++                          in unsigned long aColumnNumber);
+ 
+   /**
+    * whether this policy allows eval and eval-like functions
+    * such as setTimeout("code string", time).
+    * @param shouldReportViolations
+    *     Whether or not the use of eval should be reported.
+    *     This function returns "true" when violating report-only policies, but
+    *     when any policy (report-only or otherwise) is violated,
+@@ -169,30 +172,33 @@ interface nsIContentSecurityPolicy : nsI
+    * @param violationType
+    *     one of the VIOLATION_TYPE_* constants, e.g. inline-script or eval
+    * @param sourceFile
+    *     name of the source file containing the violation (if available)
+    * @param contentSample
+    *     sample of the violating content (to aid debugging)
+    * @param lineNum
+    *     source line number of the violation (if available)
++   * @param columnNum
++   *     source column number of the violation (if available)
+    * @param aNonce
+    *     (optional) If this is a nonce violation, include the nonce so we can
+    *     recheck to determine which policies were violated and send the
+    *     appropriate reports.
+    * @param aContent
+    *     (optional) If this is a hash violation, include contents of the inline
+    *     resource in the question so we can recheck the hash in order to
+    *     determine which policies were violated and send the appropriate
+    *     reports.
+    */
+   void logViolationDetails(in unsigned short violationType,
+                            in AString sourceFile,
+                            in AString scriptSample,
+                            in int32_t lineNum,
++                           in int32_t columnNum,
+                            [optional] in AString nonce,
+                            [optional] in AString content);
+ 
+   const unsigned short VIOLATION_TYPE_INLINE_SCRIPT          = 1;
+   const unsigned short VIOLATION_TYPE_EVAL                   = 2;
+   const unsigned short VIOLATION_TYPE_INLINE_STYLE           = 3;
+   const unsigned short VIOLATION_TYPE_NONCE_SCRIPT           = 4;
+   const unsigned short VIOLATION_TYPE_NONCE_STYLE            = 5;
+diff --git a/dom/jsurl/nsJSProtocolHandler.cpp b/dom/jsurl/nsJSProtocolHandler.cpp
+--- a/dom/jsurl/nsJSProtocolHandler.cpp
++++ b/dom/jsurl/nsJSProtocolHandler.cpp
+@@ -177,16 +177,17 @@ nsresult nsJSThunk::EvaluateScript(nsICh
+     NS_ENSURE_SUCCESS(rv, rv);
+     if (csp) {
+         bool allowsInlineScript = true;
+         rv = csp->GetAllowsInline(nsIContentPolicy::TYPE_SCRIPT,
+                                   EmptyString(), // aNonce
+                                   true,         // aParserCreated
+                                   nullptr, // aContent
+                                   0,             // aLineNumber
++                                  0,             // aColumnNumber
+                                   &allowsInlineScript);
+ 
+         //return early if inline scripts are not allowed
+         if (!allowsInlineScript) {
+           return NS_ERROR_DOM_RETVAL_UNDEFINED;
+         }
+     }
+ 
+diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
+--- a/dom/script/ScriptLoader.cpp
++++ b/dom/script/ScriptLoader.cpp
+@@ -1169,16 +1169,17 @@ CSPAllowsInlineScript(nsIScriptElement* 
+   nsAutoString nonce;
+   scriptContent->GetAttr(kNameSpaceID_None, nsGkAtoms::nonce, nonce);
+   bool parserCreated = aElement->GetParserCreated() != mozilla::dom::NOT_FROM_PARSER;
+ 
+   bool allowInlineScript = false;
+   rv = csp->GetAllowsInline(nsIContentPolicy::TYPE_SCRIPT,
+                             nonce, parserCreated, aElement,
+                             aElement->GetScriptLineNumber(),
++                            aElement->GetScriptColumnNumber(),
+                             &allowInlineScript);
+   return allowInlineScript;
+ }
+ 
+ ScriptLoadRequest*
+ ScriptLoader::CreateLoadRequest(ScriptKind aKind,
+                                 nsIURI* aURI,
+                                 nsIScriptElement* aElement,
+@@ -2782,20 +2783,21 @@ ScriptLoader::VerifySRI(ScriptLoadReques
+     if (loadInfo && loadInfo->GetEnforceSRI()) {
+       MOZ_LOG(SRILogHelper::GetSriLog(), mozilla::LogLevel::Debug,
+               ("ScriptLoader::OnStreamComplete, required SRI not found"));
+       nsCOMPtr<nsIContentSecurityPolicy> csp;
+       loadInfo->LoadingPrincipal()->GetCsp(getter_AddRefs(csp));
+       nsAutoCString violationURISpec;
+       mDocument->GetDocumentURI()->GetAsciiSpec(violationURISpec);
+       uint32_t lineNo = aRequest->mElement ? aRequest->mElement->GetScriptLineNumber() : 0;
++      uint32_t columnNo = aRequest->mElement ? aRequest->mElement->GetScriptColumnNumber() : 0;
+       csp->LogViolationDetails(
+         nsIContentSecurityPolicy::VIOLATION_TYPE_REQUIRE_SRI_FOR_SCRIPT,
+         NS_ConvertUTF8toUTF16(violationURISpec),
+-        EmptyString(), lineNo, EmptyString(), EmptyString());
++        EmptyString(), lineNo, columnNo, EmptyString(), EmptyString());
+       rv = NS_ERROR_SRI_CORRUPT;
+     }
+   }
+ 
+   return rv;
+ }
+ 
+ nsresult
+@@ -2867,22 +2869,23 @@ ScriptLoader::ReportErrorToConsole(Scrip
+     message =
+       isScript ? "ScriptSourceLoadFailed" : "ModuleSourceLoadFailed";
+   }
+ 
+   NS_ConvertUTF8toUTF16 url(aRequest->mURI->GetSpecOrDefault());
+   const char16_t* params[] = { url.get() };
+ 
+   uint32_t lineNo = aRequest->mElement->GetScriptLineNumber();
++  uint32_t columnNo = aRequest->mElement->GetScriptColumnNumber();
+ 
+   nsContentUtils::ReportToConsole(nsIScriptError::warningFlag,
+                                   NS_LITERAL_CSTRING("Script Loader"), mDocument,
+                                   nsContentUtils::eDOM_PROPERTIES, message,
+                                   params, ArrayLength(params), nullptr,
+-                                  EmptyString(), lineNo);
++                                  EmptyString(), lineNo, columnNo);
+ }
+ 
+ void
+ ScriptLoader::HandleLoadError(ScriptLoadRequest *aRequest, nsresult aResult)
+ {
+   /*
+    * Handle script not loading error because source was a tracking URL.
+    * We make a note of this script node by including it in a dedicated
+diff --git a/dom/script/nsIScriptElement.h b/dom/script/nsIScriptElement.h
+--- a/dom/script/nsIScriptElement.h
++++ b/dom/script/nsIScriptElement.h
+@@ -26,16 +26,17 @@
+  */
+ class nsIScriptElement : public nsIScriptLoaderObserver
+ {
+ public:
+   NS_DECLARE_STATIC_IID_ACCESSOR(NS_ISCRIPTELEMENT_IID)
+ 
+   explicit nsIScriptElement(mozilla::dom::FromParser aFromParser)
+     : mLineNumber(1),
++      mColumnNumber(1),
+       mAlreadyStarted(false),
+       mMalformed(false),
+       mDoneAddingChildren(aFromParser == mozilla::dom::NOT_FROM_PARSER ||
+                           aFromParser == mozilla::dom::FROM_PARSER_FRAGMENT),
+       mForceAsync(aFromParser == mozilla::dom::NOT_FROM_PARSER ||
+                   aFromParser == mozilla::dom::FROM_PARSER_FRAGMENT),
+       mFrozen(false),
+       mIsModule(false),
+@@ -140,16 +141,26 @@ public:
+     mLineNumber = aLineNumber;
+   }
+ 
+   uint32_t GetScriptLineNumber()
+   {
+     return mLineNumber;
+   }
+ 
++  void SetScriptColumnNumber(uint32_t aColumnNumber)
++  {
++    mColumnNumber = aColumnNumber;
++  }
++
++  uint32_t GetScriptColumnNumber()
++  {
++    return mColumnNumber;
++  }
++
+   void SetIsMalformed()
+   {
+     mMalformed = true;
+   }
+ 
+   bool IsMalformed()
+   {
+     return mMalformed;
+@@ -292,16 +303,21 @@ protected:
+   virtual bool GetAsyncState() = 0;
+ 
+   /**
+    * The start line number of the script.
+    */
+   uint32_t mLineNumber;
+ 
+   /**
++   * The start column number of the script.
++   */
++  uint32_t mColumnNumber;
++
++  /**
+    * The "already started" flag per HTML5.
+    */
+   bool mAlreadyStarted;
+ 
+   /**
+    * The script didn't have an end tag.
+    */
+   bool mMalformed;
+diff --git a/dom/security/nsCSPContext.cpp b/dom/security/nsCSPContext.cpp
+--- a/dom/security/nsCSPContext.cpp
++++ b/dom/security/nsCSPContext.cpp
+@@ -272,17 +272,18 @@ nsCSPContext::permitsInternal(CSPDirecti
+         this->AsyncReportViolation((aSendContentLocationInViolationReports ?
+                                     aContentLocation : nullptr),
+                                    aOriginalURI,  /* in case of redirect originalURI is not null */
+                                    violatedDirective,
+                                    p,             /* policy index        */
+                                    EmptyString(), /* no observer subject */
+                                    EmptyString(), /* no source file      */
+                                    EmptyString(), /* no script sample    */
+-                                   0);            /* no line number      */
++                                   0,             /* no line number      */
++                                   0);            /* no column number    */
+       }
+     }
+   }
+ 
+   return permits;
+ }
+ 
+ 
+@@ -452,17 +453,18 @@ nsCSPContext::GetAllowsEval(bool* outSho
+ 
+ // Helper function to report inline violations
+ void
+ nsCSPContext::reportInlineViolation(nsContentPolicyType aContentType,
+                                     const nsAString& aNonce,
+                                     const nsAString& aContent,
+                                     const nsAString& aViolatedDirective,
+                                     uint32_t aViolatedPolicyIndex, // TODO, use report only flag for that
+-                                    uint32_t aLineNumber)
++                                    uint32_t aLineNumber,
++                                    uint32_t aColumnNumber)
+ {
+   nsString observerSubject;
+   // if the nonce is non empty, then we report the nonce error, otherwise
+   // let's report the hash error; no need to report the unsafe-inline error
+   // anymore.
+   if (!aNonce.IsEmpty()) {
+     observerSubject = (aContentType == nsIContentPolicy::TYPE_SCRIPT)
+                       ? NS_LITERAL_STRING(SCRIPT_NONCE_VIOLATION_OBSERVER_TOPIC)
+@@ -494,25 +496,27 @@ nsCSPContext::reportInlineViolation(nsCo
+   }
+   AsyncReportViolation(selfISupports,                      // aBlockedContentSource
+                        mSelfURI,                           // aOriginalURI
+                        aViolatedDirective,                 // aViolatedDirective
+                        aViolatedPolicyIndex,               // aViolatedPolicyIndex
+                        observerSubject,                    // aObserverSubject
+                        NS_ConvertUTF8toUTF16(sourceFile),  // aSourceFile
+                        codeSample,                         // aScriptSample
+-                       aLineNumber);                       // aLineNum
++                       aLineNumber,                        // aLineNum
++                       aColumnNumber);                     // aColumnNum
+ }
+ 
+ NS_IMETHODIMP
+ nsCSPContext::GetAllowsInline(nsContentPolicyType aContentType,
+                               const nsAString& aNonce,
+                               bool aParserCreated,
+                               nsISupports* aElementOrContent,
+                               uint32_t aLineNumber,
++                              uint32_t aColumnNumber,
+                               bool* outAllowsInline)
+ {
+   *outAllowsInline = true;
+ 
+   MOZ_ASSERT(aContentType == nsContentUtils::InternalContentPolicyTypeToExternal(aContentType),
+              "We should only see external content policy types here.");
+ 
+   if (aContentType != nsIContentPolicy::TYPE_SCRIPT &&
+@@ -560,17 +564,18 @@ nsCSPContext::GetAllowsInline(nsContentP
+       }
+       nsAutoString violatedDirective;
+       mPolicies[i]->getDirectiveStringForContentType(aContentType, violatedDirective);
+       reportInlineViolation(aContentType,
+                             aNonce,
+                             content,
+                             violatedDirective,
+                             i,
+-                            aLineNumber);
++                            aLineNumber,
++                            aColumnNumber);
+     }
+   }
+   return NS_OK;
+ }
+ 
+ 
+ /**
+  * Reduces some code repetition for the various logging situations in
+@@ -579,17 +584,18 @@ nsCSPContext::GetAllowsInline(nsContentP
+  * Call-sites for the eval/inline checks recieve two return values: allows
+  * and violates.  Based on those, they must choose whether to call
+  * LogViolationDetails or not.  Policies that are report-only allow the
+  * loads/compilations but violations should still be reported.  Not all
+  * policies in this nsIContentSecurityPolicy instance will be violated,
+  * which is why we must check allows() again here.
+  *
+  * Note: This macro uses some parameters from its caller's context:
+- * p, mPolicies, this, aSourceFile, aScriptSample, aLineNum, selfISupports
++ * p, mPolicies, this, aSourceFile, aScriptSample, aLineNum, aColumnNum,
++ * selfISupports
+  *
+  * @param violationType: the VIOLATION_TYPE_* constant (partial symbol)
+  *                 such as INLINE_SCRIPT
+  * @param contentPolicyType: a constant from nsIContentPolicy such as TYPE_STYLESHEET
+  * @param nonceOrHash: for NONCE and HASH violations, it's the nonce or content
+  *               string. For other violations, it is an empty string.
+  * @param keyword: the keyword corresponding to violation (UNSAFE_INLINE for most)
+  * @param observerTopic: the observer topic string to send with the CSP
+@@ -607,48 +613,52 @@ nsCSPContext::GetAllowsInline(nsContentP
+                               keyword, nonceOrHash, false))                    \
+     {                                                                          \
+       nsAutoString violatedDirective;                                          \
+       mPolicies[p]->getDirectiveStringForContentType(                          \
+                         nsIContentPolicy::TYPE_ ## contentPolicyType,          \
+                         violatedDirective);                                    \
+       this->AsyncReportViolation(selfISupports, nullptr, violatedDirective, p, \
+                                  NS_LITERAL_STRING(observerTopic),             \
+-                                 aSourceFile, aScriptSample, aLineNum);        \
++                                 aSourceFile, aScriptSample, aLineNum,         \
++                                 aColumnNum);                                  \
+     }                                                                          \
+     PR_END_MACRO;                                                              \
+     break
+ 
+ /**
+  * For each policy, log any violation on the Error Console and send a report
+  * if a report-uri is present in the policy
+  *
+  * @param aViolationType
+  *     one of the VIOLATION_TYPE_* constants, e.g. inline-script or eval
+  * @param aSourceFile
+  *     name of the source file containing the violation (if available)
+  * @param aContentSample
+  *     sample of the violating content (to aid debugging)
+  * @param aLineNum
+  *     source line number of the violation (if available)
++ * @param aColumnNum
++ *     source column number of the violation (if available)
+  * @param aNonce
+  *     (optional) If this is a nonce violation, include the nonce so we can
+  *     recheck to determine which policies were violated and send the
+  *     appropriate reports.
+  * @param aContent
+  *     (optional) If this is a hash violation, include contents of the inline
+  *     resource in the question so we can recheck the hash in order to
+  *     determine which policies were violated and send the appropriate
+  *     reports.
+  */
+ NS_IMETHODIMP
+ nsCSPContext::LogViolationDetails(uint16_t aViolationType,
+                                   const nsAString& aSourceFile,
+                                   const nsAString& aScriptSample,
+                                   int32_t aLineNum,
++                                  int32_t aColumnNum,
+                                   const nsAString& aNonce,
+                                   const nsAString& aContent)
+ {
+   for (uint32_t p = 0; p < mPolicies.Length(); p++) {
+     NS_ASSERTION(mPolicies[p], "null pointer in nsTArray<nsCSPPolicy>");
+ 
+     nsCOMPtr<nsISupportsCString> selfICString(do_CreateInstance(NS_SUPPORTS_CSTRING_CONTRACTID));
+     if (selfICString) {
+@@ -856,16 +866,17 @@ nsresult
+ nsCSPContext::GatherSecurityPolicyViolationEventData(
+   nsISupports* aBlockedContentSource,
+   nsIURI* aOriginalURI,
+   nsAString& aViolatedDirective,
+   uint32_t aViolatedPolicyIndex,
+   nsAString& aSourceFile,
+   nsAString& aScriptSample,
+   uint32_t aLineNum,
++  uint32_t aColumnNum,
+   mozilla::dom::SecurityPolicyViolationEventInit& aViolationEventInit)
+ {
+   NS_ENSURE_ARG_MAX(aViolatedPolicyIndex, mPolicies.Length() - 1);
+ 
+   MOZ_ASSERT(ValidateDirectiveName(aViolatedDirective), "Invalid directive name");
+ 
+   nsresult rv;
+ 
+@@ -950,18 +961,17 @@ nsCSPContext::GatherSecurityPolicyViolat
+     }
+   }
+   aViolationEventInit.mStatusCode = statusCode;
+ 
+   // line-number
+   aViolationEventInit.mLineNumber = aLineNum;
+ 
+   // column-number
+-  // TODO: Set correct column number.
+-  aViolationEventInit.mColumnNumber = 0;
++  aViolationEventInit.mColumnNumber = aColumnNum;
+ 
+   aViolationEventInit.mBubbles = true;
+   aViolationEventInit.mComposed = true;
+ 
+   return NS_OK;
+ }
+ 
+ nsresult
+@@ -1001,16 +1011,21 @@ nsCSPContext::SendReports(
+   }
+ 
+   // line-number
+   if (aViolationEventInit.mLineNumber != 0) {
+     report.mCsp_report.mLine_number.Construct();
+     report.mCsp_report.mLine_number.Value() = aViolationEventInit.mLineNumber;
+   }
+ 
++  if (aViolationEventInit.mLineNumber != 0) {
++    report.mCsp_report.mColumn_number.Construct();
++    report.mCsp_report.mColumn_number.Value() = aViolationEventInit.mColumnNumber;
++  }
++
+   nsString csp_report;
+   if (!report.ToJSON(csp_report)) {
+     return NS_ERROR_FAILURE;
+   }
+ 
+   // ---------- Assembled, now send it to all the report URIs ----------- //
+ 
+   nsTArray<nsString> reportURIs;
+@@ -1026,17 +1041,19 @@ nsCSPContext::SendReports(
+     // try to create a new uri from every report-uri string
+     rv = NS_NewURI(getter_AddRefs(reportURI), reportURIs[r]);
+     if (NS_FAILED(rv)) {
+       const char16_t* params[] = { reportURIs[r].get() };
+       CSPCONTEXTLOG(("Could not create nsIURI for report URI %s",
+                      reportURICstring.get()));
+       logToConsole("triedToSendReport", params, ArrayLength(params),
+                    aViolationEventInit.mSourceFile, aViolationEventInit.mSample,
+-                   aViolationEventInit.mLineNumber, 0, nsIScriptError::errorFlag);
++                   aViolationEventInit.mLineNumber,
++                   aViolationEventInit.mColumnNumber,
++                   nsIScriptError::errorFlag);
+       continue; // don't return yet, there may be more URIs
+     }
+ 
+     // try to create a new channel for every report-uri
+     nsLoadFlags loadFlags = nsIRequest::LOAD_NORMAL | nsIChannel::LOAD_CLASSIFY_URI;
+     if (doc) {
+       rv = NS_NewChannel(getter_AddRefs(reportChannel),
+                          reportURI,
+@@ -1068,17 +1085,19 @@ nsCSPContext::SendReports(
+     bool isHttpScheme =
+       (NS_SUCCEEDED(reportURI->SchemeIs("http", &isHttpScheme)) && isHttpScheme) ||
+       (NS_SUCCEEDED(reportURI->SchemeIs("https", &isHttpScheme)) && isHttpScheme);
+ 
+     if (!isHttpScheme) {
+       const char16_t* params[] = { reportURIs[r].get() };
+       logToConsole("reportURInotHttpsOrHttp2", params, ArrayLength(params),
+                    aViolationEventInit.mSourceFile, aViolationEventInit.mSample,
+-                   aViolationEventInit.mLineNumber, 0, nsIScriptError::errorFlag);
++                   aViolationEventInit.mLineNumber,
++                   aViolationEventInit.mColumnNumber,
++                   nsIScriptError::errorFlag);
+       continue;
+     }
+ 
+     // make sure this is an anonymous request (no cookies) so in case the
+     // policy URI is injected, it can't be abused for CSRF.
+     nsLoadFlags flags;
+     rv = reportChannel->GetLoadFlags(&flags);
+     NS_ENSURE_SUCCESS(rv, rv);
+@@ -1134,17 +1153,19 @@ nsCSPContext::SendReports(
+     // not return an error since it's really ok if reports don't go out, but
+     // it's good to log the error locally.
+ 
+     if (NS_FAILED(rv)) {
+       const char16_t* params[] = { reportURIs[r].get() };
+       CSPCONTEXTLOG(("AsyncOpen failed for report URI %s", NS_ConvertUTF16toUTF8(params[0]).get()));
+       logToConsole("triedToSendReport", params, ArrayLength(params),
+                    aViolationEventInit.mSourceFile, aViolationEventInit.mSample,
+-                   aViolationEventInit.mLineNumber, 0, nsIScriptError::errorFlag);
++                   aViolationEventInit.mLineNumber,
++                   aViolationEventInit.mColumnNumber,
++                   nsIScriptError::errorFlag);
+     } else {
+       CSPCONTEXTLOG(("Sent violation report to URI %s", reportURICstring.get()));
+     }
+   }
+   return NS_OK;
+ }
+ 
+ nsresult
+@@ -1181,26 +1202,28 @@ class CSPReportSenderRunnable final : pu
+                             nsIURI* aOriginalURI,
+                             uint32_t aViolatedPolicyIndex,
+                             bool aReportOnlyFlag,
+                             const nsAString& aViolatedDirective,
+                             const nsAString& aObserverSubject,
+                             const nsAString& aSourceFile,
+                             const nsAString& aScriptSample,
+                             uint32_t aLineNum,
++                            uint32_t aColumnNum,
+                             nsCSPContext* aCSPContext)
+       : mozilla::Runnable("CSPReportSenderRunnable")
+       , mBlockedContentSource(aBlockedContentSource)
+       , mOriginalURI(aOriginalURI)
+       , mViolatedPolicyIndex(aViolatedPolicyIndex)
+       , mReportOnlyFlag(aReportOnlyFlag)
+       , mViolatedDirective(aViolatedDirective)
+       , mSourceFile(aSourceFile)
+       , mScriptSample(aScriptSample)
+       , mLineNum(aLineNum)
++      , mColumnNum(aColumnNum)
+       , mCSPContext(aCSPContext)
+     {
+       NS_ASSERTION(!aViolatedDirective.IsEmpty(), "Can not send reports without a violated directive");
+       // the observer subject is an nsISupports: either an nsISupportsCString
+       // from the arg passed in directly, or if that's empty, it's the blocked
+       // source.
+       if (aObserverSubject.IsEmpty()) {
+         mObserverSubject = aBlockedContentSource;
+@@ -1219,26 +1242,26 @@ class CSPReportSenderRunnable final : pu
+ 
+       nsresult rv;
+ 
+       // 0) prepare violation data
+       mozilla::dom::SecurityPolicyViolationEventInit init;
+       rv = mCSPContext->GatherSecurityPolicyViolationEventData(
+         mBlockedContentSource, mOriginalURI,
+         mViolatedDirective, mViolatedPolicyIndex,
+-        mSourceFile, mScriptSample, mLineNum,
++        mSourceFile, mScriptSample, mLineNum, mColumnNum,
+         init);
+       NS_ENSURE_SUCCESS(rv, rv);
+ 
+       // 1) notify observers
+       nsCOMPtr<nsIObserverService> observerService = mozilla::services::GetObserverService();
+       NS_ASSERTION(observerService, "needs observer service");
+       rv = observerService->NotifyObservers(mObserverSubject,
+-                                                     CSP_VIOLATION_TOPIC,
+-                                                     mViolatedDirective.get());
++                                            CSP_VIOLATION_TOPIC,
++                                            mViolatedDirective.get());
+       NS_ENSURE_SUCCESS(rv, rv);
+ 
+       // 2) send reports for the policy that was violated
+       mCSPContext->SendReports(init, mViolatedPolicyIndex);
+ 
+       // 3) log to console (one per policy violation)
+       // mBlockedContentSource could be a URI or a string.
+       nsCOMPtr<nsIURI> blockedURI = do_QueryInterface(mBlockedContentSource);
+@@ -1263,17 +1286,17 @@ class CSPReportSenderRunnable final : pu
+ 
+       if (blockedDataStr.Length() > 0) {
+         nsString blockedDataChar16 = NS_ConvertUTF8toUTF16(blockedDataStr);
+         const char16_t* params[] = { mViolatedDirective.get(),
+                                      blockedDataChar16.get() };
+         mCSPContext->logToConsole(mReportOnlyFlag ? "CSPROViolationWithURI" :
+                                                     "CSPViolationWithURI",
+                                   params, ArrayLength(params), mSourceFile, mScriptSample,
+-                                  mLineNum, 0, nsIScriptError::errorFlag);
++                                  mLineNum, mColumnNum, nsIScriptError::errorFlag);
+       }
+ 
+       // 4) fire violation event
+       mCSPContext->FireViolationEvent(init);
+ 
+       return NS_OK;
+     }
+ 
+@@ -1282,16 +1305,17 @@ class CSPReportSenderRunnable final : pu
+     nsCOMPtr<nsIURI>        mOriginalURI;
+     uint32_t                mViolatedPolicyIndex;
+     bool                    mReportOnlyFlag;
+     nsString                mViolatedDirective;
+     nsCOMPtr<nsISupports>   mObserverSubject;
+     nsString                mSourceFile;
+     nsString                mScriptSample;
+     uint32_t                mLineNum;
++    uint32_t                mColumnNum;
+     RefPtr<nsCSPContext>    mCSPContext;
+ };
+ 
+ /**
+  * Asynchronously notifies any nsIObservers listening to the CSP violation
+  * topic that a violation occurred.  Also triggers report sending and console
+  * logging.  All asynchronous on the main thread.
+  *
+@@ -1309,39 +1333,43 @@ class CSPReportSenderRunnable final : pu
+  *        optional, subject sent to the nsIObservers listening to the CSP
+  *        violation topic.
+  * @param aSourceFile
+  *        name of the file containing the inline script violation
+  * @param aScriptSample
+  *        a sample of the violating inline script
+  * @param aLineNum
+  *        source line number of the violation (if available)
++ * @param aColumnNum
++ *        source column number of the violation (if available)
+  */
+ nsresult
+ nsCSPContext::AsyncReportViolation(nsISupports* aBlockedContentSource,
+                                    nsIURI* aOriginalURI,
+                                    const nsAString& aViolatedDirective,
+                                    uint32_t aViolatedPolicyIndex,
+                                    const nsAString& aObserverSubject,
+                                    const nsAString& aSourceFile,
+                                    const nsAString& aScriptSample,
+-                                   uint32_t aLineNum)
++                                   uint32_t aLineNum,
++                                   uint32_t aColumnNum)
+ {
+   NS_ENSURE_ARG_MAX(aViolatedPolicyIndex, mPolicies.Length() - 1);
+ 
+   nsCOMPtr<nsIRunnable> task =
+     new CSPReportSenderRunnable(aBlockedContentSource,
+                                 aOriginalURI,
+                                 aViolatedPolicyIndex,
+                                 mPolicies[aViolatedPolicyIndex]->getReportOnlyFlag(),
+                                 aViolatedDirective,
+                                 aObserverSubject,
+                                 aSourceFile,
+                                 aScriptSample,
+                                 aLineNum,
++                                aColumnNum,
+                                 this);
+ 
+   // If the document is currently buffering up CSP violation reports, send the
+   // runnable to it instead of dispatching it immediately.
+   nsCOMPtr<nsIDocument> doc = do_QueryReferent(mLoadingContext);
+   if (doc && doc->ShouldBufferCSPViolations()) {
+     doc->BufferCSPViolation(task);
+     return NS_OK;
+diff --git a/dom/security/nsCSPContext.h b/dom/security/nsCSPContext.h
+--- a/dom/security/nsCSPContext.h
++++ b/dom/security/nsCSPContext.h
+@@ -72,44 +72,48 @@ class nsCSPContext : public nsIContentSe
+      * @param aViolatedDirective
+      *        the directive that was violated (string).
+      * @param aSourceFile
+      *        name of the file containing the inline script violation
+      * @param aScriptSample
+      *        a sample of the violating inline script
+      * @param aLineNum
+      *        source line number of the violation (if available)
++     * @param aColumnNum
++     *        source column number of the violation (if available)
+      * @param aViolationEventInit
+      *        The output
+      */
+     nsresult GatherSecurityPolicyViolationEventData(
+       nsISupports* aBlockedContentSource,
+       nsIURI* aOriginalURI,
+       nsAString& aViolatedDirective,
+       uint32_t aViolatedPolicyIndex,
+       nsAString& aSourceFile,
+       nsAString& aScriptSample,
+       uint32_t aLineNum,
++      uint32_t aColumnNum,
+       mozilla::dom::SecurityPolicyViolationEventInit& aViolationEventInit);
+ 
+     nsresult SendReports(
+       const mozilla::dom::SecurityPolicyViolationEventInit& aViolationEventInit,
+       uint32_t aViolatedPolicyIndex);
+ 
+     nsresult FireViolationEvent(
+       const mozilla::dom::SecurityPolicyViolationEventInit& aViolationEventInit);
+ 
+     nsresult AsyncReportViolation(nsISupports* aBlockedContentSource,
+                                   nsIURI* aOriginalURI,
+                                   const nsAString& aViolatedDirective,
+                                   uint32_t aViolatedPolicyIndex,
+                                   const nsAString& aObserverSubject,
+                                   const nsAString& aSourceFile,
+                                   const nsAString& aScriptSample,
+-                                  uint32_t aLineNum);
++                                  uint32_t aLineNum,
++                                  uint32_t aColumnNum);
+ 
+     // Hands off! Don't call this method unless you know what you
+     // are doing. It's only supposed to be called from within
+     // the principal destructor to avoid a tangling pointer.
+     void clearLoadingPrincipal() {
+       mLoadingPrincipal = nullptr;
+     }
+ 
+@@ -130,17 +134,18 @@ class nsCSPContext : public nsIContentSe
+                          bool aParserCreated);
+ 
+     // helper to report inline script/style violations
+     void reportInlineViolation(nsContentPolicyType aContentType,
+                                const nsAString& aNonce,
+                                const nsAString& aContent,
+                                const nsAString& aViolatedDirective,
+                                uint32_t aViolatedPolicyIndex,
+-                               uint32_t aLineNumber);
++                               uint32_t aLineNumber,
++                               uint32_t aColumnNumber);
+ 
+     static int32_t sScriptSampleMaxLength;
+ 
+     static uint32_t ScriptSampleMaxLength()
+     {
+       return std::max(sScriptSampleMaxLength, 0);
+     }
+ 
+diff --git a/dom/security/test/unit/test_csp_reports.js b/dom/security/test/unit/test_csp_reports.js
+--- a/dom/security/test/unit/test_csp_reports.js
++++ b/dom/security/test/unit/test_csp_reports.js
+@@ -108,26 +108,29 @@ function run_test() {
+   // test that inline script violations cause a report.
+   makeTest(0, {"blocked-uri": "self"}, false,
+       function(csp) {
+         let inlineOK = true;
+         inlineOK = csp.getAllowsInline(Ci.nsIContentPolicy.TYPE_SCRIPT,
+                                        "", // aNonce
+                                        false, // aParserCreated
+                                        content, // aContent
+-                                       0); // aLineNumber
++                                       0, // aLineNumber
++                                       0); // aColumnNumber
+ 
+         // this is not a report only policy, so it better block inline scripts
+         Assert.ok(!inlineOK);
+       });
+ 
+   // test that eval violations cause a report.
+   makeTest(1, {"blocked-uri": "self",
+                // JSON script-sample is UTF8 encoded
+-               "script-sample" : "\xc2\xa3\xc2\xa5\xc2\xb5\xe5\x8c\x97\xf0\xa0\x9d\xb9"}, false,
++               "script-sample" : "\xc2\xa3\xc2\xa5\xc2\xb5\xe5\x8c\x97\xf0\xa0\x9d\xb9",
++               "line-number": 1,
++               "column-number": 2}, false,
+       function(csp) {
+         let evalOK = true, oReportViolation = {'value': false};
+         evalOK = csp.getAllowsEval(oReportViolation);
+ 
+         // this is not a report only policy, so it better block eval
+         Assert.ok(!evalOK);
+         // ... and cause reports to go out
+         Assert.ok(oReportViolation.value);
+@@ -135,17 +138,18 @@ function run_test() {
+         if (oReportViolation.value) {
+           // force the logging, since the getter doesn't.
+           csp.logViolationDetails(Ci.nsIContentSecurityPolicy.VIOLATION_TYPE_EVAL,
+                                   selfuri.asciiSpec,
+                                   // sending UTF-16 script sample to make sure
+                                   // csp report in JSON is not cut-off, please
+                                   // note that JSON is UTF8 encoded.
+                                   "\u00a3\u00a5\u00b5\u5317\ud841\udf79",
+-                                  1);
++                                  1, // line number
++                                  2); // column number
+         }
+       });
+ 
+   makeTest(2, {"blocked-uri": "http://blocked.test"}, false,
+       function(csp) {
+         // shouldLoad creates and sends out the report here.
+         csp.shouldLoad(Ci.nsIContentPolicy.TYPE_SCRIPT,
+                       NetUtil.newURI("http://blocked.test/foo.js"),
+@@ -158,17 +162,18 @@ function run_test() {
+         let inlineOK = true;
+         let content = Cc["@mozilla.org/supports-string;1"].
+                          createInstance(Ci.nsISupportsString);
+         content.data = "";
+         inlineOK = csp.getAllowsInline(Ci.nsIContentPolicy.TYPE_SCRIPT,
+                                        "", // aNonce
+                                        false, // aParserCreated
+                                        content, // aContent
+-                                       0); // aLineNumber
++                                       0, // aLineNumber
++                                       0); // aColumnNumber
+ 
+         // this is a report only policy, so it better allow inline scripts
+         Assert.ok(inlineOK);
+       });
+ 
+   // test that eval violations cause a report in report-only policy
+   makeTest(4, {"blocked-uri": "self"}, true,
+       function(csp) {
+@@ -180,17 +185,18 @@ function run_test() {
+         // ... but still cause reports to go out
+         Assert.ok(oReportViolation.value);
+ 
+         if (oReportViolation.value) {
+           // force the logging, since the getter doesn't.
+           csp.logViolationDetails(Ci.nsIContentSecurityPolicy.VIOLATION_TYPE_INLINE_SCRIPT,
+                                   selfuri.asciiSpec,
+                                   "script sample",
+-                                  4);
++                                  4, // line number
++                                  5); // column number
+         }
+       });
+ 
+   // test that only the uri's scheme is reported for globally unique identifiers
+   makeTest(5, {"blocked-uri": "data"}, false,
+     function(csp) {
+       var base64data =
+         "iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12" +
+diff --git a/dom/smil/nsSMILCSSValueType.cpp b/dom/smil/nsSMILCSSValueType.cpp
+--- a/dom/smil/nsSMILCSSValueType.cpp
++++ b/dom/smil/nsSMILCSSValueType.cpp
+@@ -778,17 +778,17 @@ nsSMILCSSValueType::ValueFromString(nsCS
+     return;
+   }
+ 
+   nsIDocument* doc = aTargetElement->GetUncomposedDoc();
+   if (doc && !nsStyleUtil::CSPAllowsInlineStyle(nullptr,
+                                                 doc->NodePrincipal(),
+                                                 nullptr,
+                                                 doc->GetDocumentURI(),
+-                                                0, aString, nullptr)) {
++                                                0, 0, aString, nullptr)) {
+     return;
+   }
+ 
+   RefPtr<nsStyleContext> styleContext =
+     nsComputedDOMStyle::GetStyleContext(aTargetElement, nullptr);
+   if (!styleContext) {
+     return;
+   }
+@@ -837,17 +837,18 @@ nsSMILCSSValueType::ValueFromAnimationVa
+   // and an intermediate CSS value is not likely to be particularly useful
+   // in that case, we just use a generic placeholder string instead.
+   static const nsLiteralString kPlaceholderText =
+     NS_LITERAL_STRING("[SVG animation of CSS]");
+   if (doc && !nsStyleUtil::CSPAllowsInlineStyle(nullptr,
+                                                 doc->NodePrincipal(),
+                                                 nullptr,
+                                                 doc->GetDocumentURI(),
+-                                                0, kPlaceholderText, nullptr)) {
++                                                0, 0, kPlaceholderText,
++                                                nullptr)) {
+     return result;
+   }
+ 
+   sSingleton.Init(result);
+   result.mU.mPtr = new ValueWrapper(aPropID, aValue);
+ 
+   return result;
+ }
+diff --git a/dom/svg/SVGScriptElement.cpp b/dom/svg/SVGScriptElement.cpp
+--- a/dom/svg/SVGScriptElement.cpp
++++ b/dom/svg/SVGScriptElement.cpp
+@@ -165,26 +165,26 @@ SVGScriptElement::FreezeExecutionAttrs(n
+ 
+       if (!mUri) {
+         const char16_t* params[] = { isHref ? u"href" : u"xlink:href", src.get() };
+ 
+         nsContentUtils::ReportToConsole(nsIScriptError::warningFlag,
+           NS_LITERAL_CSTRING("SVG"), OwnerDoc(),
+           nsContentUtils::eDOM_PROPERTIES, "ScriptSourceInvalidUri",
+           params, ArrayLength(params), nullptr,
+-          EmptyString(), GetScriptLineNumber());
++          EmptyString(), GetScriptLineNumber(), GetScriptColumnNumber());
+       }
+     } else {
+       const char16_t* params[] = { isHref ? u"href" : u"xlink:href" };
+ 
+       nsContentUtils::ReportToConsole(nsIScriptError::warningFlag,
+         NS_LITERAL_CSTRING("SVG"), OwnerDoc(),
+         nsContentUtils::eDOM_PROPERTIES, "ScriptSourceEmpty",
+         params, ArrayLength(params), nullptr,
+-        EmptyString(), GetScriptLineNumber());
++        EmptyString(), GetScriptLineNumber(), GetScriptColumnNumber());
+     }
+ 
+     // At this point mUri will be null for invalid URLs.
+     mExternal = true;
+   }
+ 
+   mFrozen = true;
+ }
+diff --git a/dom/webidl/CSPReport.webidl b/dom/webidl/CSPReport.webidl
+--- a/dom/webidl/CSPReport.webidl
++++ b/dom/webidl/CSPReport.webidl
+@@ -11,13 +11,14 @@ dictionary CSPReportProperties {
+   DOMString document-uri = "";
+   DOMString referrer = "";
+   DOMString blocked-uri = "";
+   DOMString violated-directive = "";
+   DOMString original-policy= "";
+   DOMString source-file;
+   DOMString script-sample;
+   long line-number;
++  long column-number;
+ };
+ 
+ dictionary CSPReport {
+   CSPReportProperties csp-report;
+ };
+diff --git a/dom/workers/RuntimeService.cpp b/dom/workers/RuntimeService.cpp
+--- a/dom/workers/RuntimeService.cpp
++++ b/dom/workers/RuntimeService.cpp
+@@ -585,24 +585,28 @@ InterruptCallback(JSContext* aCx)
+ 
+   return worker->InterruptCallback(aCx);
+ }
+ 
+ class LogViolationDetailsRunnable final : public WorkerMainThreadRunnable
+ {
+   nsString mFileName;
+   uint32_t mLineNum;
++  uint32_t mColumnNum;
+ 
+ public:
+   LogViolationDetailsRunnable(WorkerPrivate* aWorker,
+                               const nsString& aFileName,
+-                              uint32_t aLineNum)
++                              uint32_t aLineNum,
++                              uint32_t aColumnNum)
+     : WorkerMainThreadRunnable(aWorker,
+                                NS_LITERAL_CSTRING("RuntimeService :: LogViolationDetails"))
+-    , mFileName(aFileName), mLineNum(aLineNum)
++    , mFileName(aFileName)
++    , mLineNum(aLineNum)
++    , mColumnNum(aColumnNum)
+   {
+     MOZ_ASSERT(aWorker);
+   }
+ 
+   virtual bool MainThreadRun() override;
+ 
+ private:
+   ~LogViolationDetailsRunnable() {}
+@@ -612,26 +616,27 @@ bool
+ ContentSecurityPolicyAllows(JSContext* aCx)
+ {
+   WorkerPrivate* worker = GetWorkerPrivateFromContext(aCx);
+   worker->AssertIsOnWorkerThread();
+ 
+   if (worker->GetReportCSPViolations()) {
+     nsString fileName;
+     uint32_t lineNum = 0;
++    uint32_t columnNum = 0;
+ 
+     JS::AutoFilename file;
+-    if (JS::DescribeScriptedCaller(aCx, &file, &lineNum) && file.get()) {
++    if (JS::DescribeScriptedCaller(aCx, &file, &lineNum, &columnNum) && file.get()) {
+       fileName = NS_ConvertUTF8toUTF16(file.get());
+     } else {
+       MOZ_ASSERT(!JS_IsExceptionPending(aCx));
+     }
+ 
+     RefPtr<LogViolationDetailsRunnable> runnable =
+-        new LogViolationDetailsRunnable(worker, fileName, lineNum);
++        new LogViolationDetailsRunnable(worker, fileName, lineNum, columnNum);
+ 
+     ErrorResult rv;
+     runnable->Dispatch(Killing, rv);
+     if (NS_WARN_IF(rv.Failed())) {
+       rv.SuppressException();
+     }
+   }
+ 
+@@ -2830,17 +2835,17 @@ LogViolationDetailsRunnable::MainThreadR
+   AssertIsOnMainThread();
+ 
+   nsIContentSecurityPolicy* csp = mWorkerPrivate->GetCSP();
+   if (csp) {
+     NS_NAMED_LITERAL_STRING(scriptSample,
+         "Call to eval() or related function blocked by CSP.");
+     if (mWorkerPrivate->GetReportCSPViolations()) {
+       csp->LogViolationDetails(nsIContentSecurityPolicy::VIOLATION_TYPE_EVAL,
+-                               mFileName, scriptSample, mLineNum,
++                               mFileName, scriptSample, mLineNum, mColumnNum,
+                                EmptyString(), EmptyString());
+     }
+   }
+ 
+   return true;
+ }
+ 
+ NS_IMPL_ISUPPORTS_INHERITED0(WorkerThreadPrimaryRunnable, Runnable)
+diff --git a/dom/workers/ScriptLoader.cpp b/dom/workers/ScriptLoader.cpp
+--- a/dom/workers/ScriptLoader.cpp
++++ b/dom/workers/ScriptLoader.cpp
+@@ -1168,17 +1168,17 @@ private:
+       MOZ_LOG(SRILogHelper::GetSriLog(), mozilla::LogLevel::Debug,
+             ("Scriptloader::Load, SRI required but not supported in workers"));
+       nsCOMPtr<nsIContentSecurityPolicy> wcsp;
+       chanLoadInfo->LoadingPrincipal()->GetCsp(getter_AddRefs(wcsp));
+       MOZ_ASSERT(wcsp, "We sould have a CSP for the worker here");
+       if (wcsp) {
+         wcsp->LogViolationDetails(
+             nsIContentSecurityPolicy::VIOLATION_TYPE_REQUIRE_SRI_FOR_SCRIPT,
+-            aLoadInfo.mURL, EmptyString(), 0, EmptyString(), EmptyString());
++            aLoadInfo.mURL, EmptyString(), 0, 0, EmptyString(), EmptyString());
+       }
+       return NS_ERROR_SRI_CORRUPT;
+     }
+ 
+     // Update the principal of the worker and its base URI if we just loaded the
+     // worker's primary script.
+     if (IsMainWorkerScript()) {
+       // Take care of the base URI first.
+diff --git a/dom/xbl/nsXBLContentSink.cpp b/dom/xbl/nsXBLContentSink.cpp
+--- a/dom/xbl/nsXBLContentSink.cpp
++++ b/dom/xbl/nsXBLContentSink.cpp
+@@ -243,20 +243,21 @@ nsXBLContentSink::AddField(nsXBLProtoImp
+ 
+   mImplField = aField; // Adjust our pointer to point to the new last field in the chain.
+ }
+ 
+ NS_IMETHODIMP
+ nsXBLContentSink::HandleStartElement(const char16_t *aName,
+                                      const char16_t **aAtts,
+                                      uint32_t aAttsCount,
+-                                     uint32_t aLineNumber)
++                                     uint32_t aLineNumber,
++                                     uint32_t aColumnNumber)
+ {
+   nsresult rv = nsXMLContentSink::HandleStartElement(aName, aAtts, aAttsCount,
+-                                                     aLineNumber);
++                                                     aLineNumber, aColumnNumber);
+   if (NS_FAILED(rv))
+     return rv;
+ 
+   if (mState == eXBL_InBinding && !mBinding) {
+     rv = ConstructBinding(aLineNumber);
+     if (NS_FAILED(rv))
+       return rv;
+ 
+@@ -846,25 +847,26 @@ nsXBLContentSink::ConstructParameter(con
+   const char16_t* name = nullptr;
+   if (FindValue(aAtts, nsGkAtoms::name, &name)) {
+     mMethod->AddParameter(nsDependentString(name));
+   }
+ }
+ 
+ nsresult
+ nsXBLContentSink::CreateElement(const char16_t** aAtts, uint32_t aAttsCount,
+-                                mozilla::dom::NodeInfo* aNodeInfo, uint32_t aLineNumber,
++                                mozilla::dom::NodeInfo* aNodeInfo,
++                                uint32_t aLineNumber, uint32_t aColumnNumber,
+                                 nsIContent** aResult, bool* aAppendContent,
+                                 FromParser aFromParser)
+ {
+ #ifdef MOZ_XUL
+   if (!aNodeInfo->NamespaceEquals(kNameSpaceID_XUL)) {
+ #endif
+     return nsXMLContentSink::CreateElement(aAtts, aAttsCount, aNodeInfo,
+-                                           aLineNumber, aResult,
++                                           aLineNumber, aColumnNumber, aResult,
+                                            aAppendContent, aFromParser);
+ #ifdef MOZ_XUL
+   }
+ 
+   // Note that this needs to match the code in nsXBLPrototypeBinding::ReadContentNode.
+ 
+   *aAppendContent = true;
+   RefPtr<nsXULPrototypeElement> prototype = new nsXULPrototypeElement();
+diff --git a/dom/xbl/nsXBLContentSink.h b/dom/xbl/nsXBLContentSink.h
+--- a/dom/xbl/nsXBLContentSink.h
++++ b/dom/xbl/nsXBLContentSink.h
+@@ -63,17 +63,18 @@ public:
+   nsresult Init(nsIDocument* aDoc,
+                 nsIURI* aURL,
+                 nsISupports* aContainer);
+ 
+   // nsIContentSink overrides
+   NS_IMETHOD HandleStartElement(const char16_t *aName,
+                                 const char16_t **aAtts,
+                                 uint32_t aAttsCount,
+-                                uint32_t aLineNumber) override;
++                                uint32_t aLineNumber,
++                                uint32_t aColumnNumber) override;
+ 
+   NS_IMETHOD HandleEndElement(const char16_t *aName) override;
+ 
+   NS_IMETHOD HandleCDataSection(const char16_t *aData,
+                                 uint32_t aLength) override;
+ 
+ protected:
+     // nsXMLContentSink overrides
+@@ -83,17 +84,18 @@ protected:
+                            uint32_t aAttsCount,
+                            int32_t aNameSpaceID,
+                            nsIAtom* aTagName,
+                            uint32_t aLineNumber) override;
+ 
+     bool NotifyForDocElement() override { return false; }
+ 
+     nsresult CreateElement(const char16_t** aAtts, uint32_t aAttsCount,
+-                           mozilla::dom::NodeInfo* aNodeInfo, uint32_t aLineNumber,
++                           mozilla::dom::NodeInfo* aNodeInfo,
++                           uint32_t aLineNumber, uint32_t aColumnNumber,
+                            nsIContent** aResult, bool* aAppendContent,
+                            mozilla::dom::FromParser aFromParser) override;
+ 
+     nsresult AddAttributes(const char16_t** aAtts, Element* aElement) override;
+ 
+ #ifdef MOZ_XUL
+     nsresult AddAttributesToXULPrototype(const char16_t **aAtts,
+                                          uint32_t aAttsCount,
+diff --git a/dom/xml/nsXMLContentSink.cpp b/dom/xml/nsXMLContentSink.cpp
+--- a/dom/xml/nsXMLContentSink.cpp
++++ b/dom/xml/nsXMLContentSink.cpp
+@@ -437,17 +437,18 @@ nsXMLContentSink::SetParser(nsParserBase
+ {
+   NS_PRECONDITION(aParser, "Should have a parser here!");
+   mParser = aParser;
+   return NS_OK;
+ }
+ 
+ nsresult
+ nsXMLContentSink::CreateElement(const char16_t** aAtts, uint32_t aAttsCount,
+-                                mozilla::dom::NodeInfo* aNodeInfo, uint32_t aLineNumber,
++                                mozilla::dom::NodeInfo* aNodeInfo,
++                                uint32_t aLineNumber, uint32_t aColumnNumber,
+                                 nsIContent** aResult, bool* aAppendContent,
+                                 FromParser aFromParser)
+ {
+   NS_ASSERTION(aNodeInfo, "can't create element without nodeinfo");
+ 
+   *aResult = nullptr;
+   *aAppendContent = true;
+   nsresult rv = NS_OK;
+@@ -458,16 +459,17 @@ nsXMLContentSink::CreateElement(const ch
+   NS_ENSURE_SUCCESS(rv, rv);
+ 
+   if (aNodeInfo->Equals(nsGkAtoms::script, kNameSpaceID_XHTML)
+       || aNodeInfo->Equals(nsGkAtoms::script, kNameSpaceID_SVG)
+     ) {
+     nsCOMPtr<nsIScriptElement> sele = do_QueryInterface(content);
+     if (sele) {
+       sele->SetScriptLineNumber(aLineNumber);
++      sele->SetScriptColumnNumber(aColumnNumber);
+       sele->SetCreatorParser(GetParser());
+     } else {
+       MOZ_ASSERT(nsNameSpaceManager::GetInstance()->mSVGDisabled, "Node didn't QI to script, but SVG wasn't disabled.");
+     }
+   }
+ 
+   // XHTML needs some special attention
+   if (aNodeInfo->NamespaceEquals(kNameSpaceID_XHTML)) {
+@@ -495,16 +497,17 @@ nsXMLContentSink::CreateElement(const ch
+     nsCOMPtr<nsIStyleSheetLinkingElement> ssle(do_QueryInterface(content));
+     if (ssle) {
+       ssle->InitStyleLinkElement(false);
+       if (aFromParser) {
+         ssle->SetEnableUpdates(false);
+       }
+       if (!aNodeInfo->Equals(nsGkAtoms::link, kNameSpaceID_XHTML)) {
+         ssle->SetLineNumber(aFromParser ? aLineNumber : 0);
++        ssle->SetColumnNumber(aFromParser ? aColumnNumber : 0);
+       }
+     }
+   }
+ 
+   content.forget(aResult);
+ 
+   return NS_OK;
+ }
+@@ -936,27 +939,29 @@ nsXMLContentSink::SetDocElement(int32_t 
+ 
+   return true;
+ }
+ 
+ NS_IMETHODIMP
+ nsXMLContentSink::HandleStartElement(const char16_t *aName,
+                                      const char16_t **aAtts,
+                                      uint32_t aAttsCount,
+-                                     uint32_t aLineNumber)
++                                     uint32_t aLineNumber,
++                                     uint32_t aColumnNumber)
+ {
+   return HandleStartElement(aName, aAtts, aAttsCount, aLineNumber,
+-                            true);
++                            aColumnNumber, true);
+ }
+ 
+ nsresult
+ nsXMLContentSink::HandleStartElement(const char16_t *aName,
+                                      const char16_t **aAtts,
+                                      uint32_t aAttsCount,
+                                      uint32_t aLineNumber,
++                                     uint32_t aColumnNumber,
+                                      bool aInterruptable)
+ {
+   NS_PRECONDITION(aAttsCount % 2 == 0, "incorrect aAttsCount");
+   // Adjust aAttsCount so it's the actual number of attributes
+   aAttsCount /= 2;
+ 
+   nsresult result = NS_OK;
+   bool appendContent = true;
+@@ -981,17 +986,17 @@ nsXMLContentSink::HandleStartElement(con
+     return NS_OK;
+   }
+ 
+   RefPtr<mozilla::dom::NodeInfo> nodeInfo;
+   nodeInfo = mNodeInfoManager->GetNodeInfo(localName, prefix, nameSpaceID,
+                                            nsIDOMNode::ELEMENT_NODE);
+ 
+   result = CreateElement(aAtts, aAttsCount, nodeInfo, aLineNumber,
+-                         getter_AddRefs(content), &appendContent,
++                         aColumnNumber, getter_AddRefs(content), &appendContent,
+                          FROM_PARSER_NETWORK);
+   NS_ENSURE_SUCCESS(result, result);
+ 
+   // Have to do this before we push the new content on the stack... and have to
+   // do that before we set attributes, call BindToTree, etc.  Ideally we'd push
+   // on the stack inside CreateElement (which is effectively what the HTML sink
+   // does), but that's hard with all the subclass overrides going on.
+   nsCOMPtr<nsIContent> parent = GetCurrentContent();
+diff --git a/dom/xml/nsXMLContentSink.h b/dom/xml/nsXMLContentSink.h
+--- a/dom/xml/nsXMLContentSink.h
++++ b/dom/xml/nsXMLContentSink.h
+@@ -111,17 +111,18 @@ protected:
+   // Set the given content as the root element for the created document
+   //  don't set if root element was already set.
+   //  return TRUE if this call set the root element
+   virtual bool SetDocElement(int32_t aNameSpaceID,
+                                nsIAtom *aTagName,
+                                nsIContent *aContent);
+   virtual bool NotifyForDocElement() { return true; }
+   virtual nsresult CreateElement(const char16_t** aAtts, uint32_t aAttsCount,
+-                                 mozilla::dom::NodeInfo* aNodeInfo, uint32_t aLineNumber,
++                                 mozilla::dom::NodeInfo* aNodeInfo,
++                                 uint32_t aLineNumber, uint32_t aColumnNumber,
+                                  nsIContent** aResult, bool* aAppendContent,
+                                  mozilla::dom::FromParser aFromParser);
+ 
+   // aParent is allowed to be null here if this is the root content
+   // being closed
+   virtual nsresult CloseElement(nsIContent* aContent);
+ 
+   virtual nsresult FlushText(bool aReleaseTextNode = true);
+@@ -175,17 +176,17 @@ protected:
+   bool CanStillPrettyPrint();
+ 
+   nsresult MaybePrettyPrint();
+ 
+   bool IsMonolithicContainer(mozilla::dom::NodeInfo* aNodeInfo);
+ 
+   nsresult HandleStartElement(const char16_t *aName, const char16_t **aAtts,
+                               uint32_t aAttsCount, uint32_t aLineNumber,
+-                              bool aInterruptable);
++                              uint32_t aColumnNumber, bool aInterruptable);
+   nsresult HandleEndElement(const char16_t *aName, bool aInterruptable);
+   nsresult HandleCharacterData(const char16_t *aData, uint32_t aLength,
+                                bool aInterruptable);
+ 
+   nsCOMPtr<nsIContent> mDocElement;
+   nsCOMPtr<nsIContent> mCurrentHead;  // When set, we're in an XHTML <haed>
+ 
+   XMLContentSinkState mState;
+diff --git a/dom/xml/nsXMLFragmentContentSink.cpp b/dom/xml/nsXMLFragmentContentSink.cpp
+--- a/dom/xml/nsXMLFragmentContentSink.cpp
++++ b/dom/xml/nsXMLFragmentContentSink.cpp
+@@ -78,17 +78,18 @@ public:
+ 
+ protected:
+   virtual ~nsXMLFragmentContentSink();
+ 
+   virtual bool SetDocElement(int32_t aNameSpaceID,
+                                nsIAtom* aTagName,
+                                nsIContent* aContent) override;
+   virtual nsresult CreateElement(const char16_t** aAtts, uint32_t aAttsCount,
+-                                 mozilla::dom::NodeInfo* aNodeInfo, uint32_t aLineNumber,
++                                 mozilla::dom::NodeInfo* aNodeInfo,
++                                 uint32_t aLineNumber, uint32_t aColumnNumber,
+                                  nsIContent** aResult, bool* aAppendContent,
+                                  mozilla::dom::FromParser aFromParser) override;
+   virtual nsresult CloseElement(nsIContent* aContent) override;
+ 
+   virtual void MaybeStartLayout(bool aIgnorePendingSheets) override;
+ 
+   // nsContentSink overrides
+   virtual nsresult ProcessStyleLinkFromHeader(
+@@ -204,24 +205,26 @@ nsXMLFragmentContentSink::SetDocElement(
+                                         nsIContent *aContent)
+ {
+   // this is a fragment, not a document
+   return false;
+ }
+ 
+ nsresult
+ nsXMLFragmentContentSink::CreateElement(const char16_t** aAtts, uint32_t aAttsCount,
+-                                        mozilla::dom::NodeInfo* aNodeInfo, uint32_t aLineNumber,
++                                        mozilla::dom::NodeInfo* aNodeInfo,
++                                        uint32_t aLineNumber, uint32_t aColumnNumber,
+                                         nsIContent** aResult, bool* aAppendContent,
+                                         FromParser /*aFromParser*/)
+ {
+   // Claim to not be coming from parser, since we don't do any of the
+   // fancy CloseElement stuff.
+   nsresult rv = nsXMLContentSink::CreateElement(aAtts, aAttsCount,
+                                                 aNodeInfo, aLineNumber,
++                                                aColumnNumber,
+                                                 aResult, aAppendContent,
+                                                 NOT_FROM_PARSER);
+ 
+   // When we aren't grabbing all of the content we, never open a doc
+   // element, we run into trouble on the first element, so we don't append,
+   // and simply push this onto the content stack.
+   if (mContentStack.Length() == 0) {
+     *aAppendContent = false;
+diff --git a/dom/xslt/xslt/txMozillaStylesheetCompiler.cpp b/dom/xslt/xslt/txMozillaStylesheetCompiler.cpp
+--- a/dom/xslt/xslt/txMozillaStylesheetCompiler.cpp
++++ b/dom/xslt/xslt/txMozillaStylesheetCompiler.cpp
+@@ -117,17 +117,18 @@ NS_IMPL_ISUPPORTS(txStylesheetSink,
+                   nsIStreamListener,
+                   nsIRequestObserver,
+                   nsIInterfaceRequestor)
+ 
+ NS_IMETHODIMP
+ txStylesheetSink::HandleStartElement(const char16_t *aName,
+                                      const char16_t **aAtts,
+                                      uint32_t aAttsCount,
+-                                     uint32_t aLineNumber)
++                                     uint32_t aLineNumber,
++                                     uint32_t aColumnNumber)
+ {
+     NS_PRECONDITION(aAttsCount % 2 == 0, "incorrect aAttsCount");
+ 
+     nsresult rv =
+         mCompiler->startElement(aName, aAtts, aAttsCount / 2);
+     if (NS_FAILED(rv)) {
+         mCompiler->cancel(rv);
+ 
+diff --git a/dom/xul/nsXULContentSink.cpp b/dom/xul/nsXULContentSink.cpp
+--- a/dom/xul/nsXULContentSink.cpp
++++ b/dom/xul/nsXULContentSink.cpp
+@@ -428,17 +428,18 @@ XULContentSinkImpl::CreateElement(mozill
+ 
+ /**** BEGIN NEW APIs ****/
+ 
+ 
+ NS_IMETHODIMP
+ XULContentSinkImpl::HandleStartElement(const char16_t *aName,
+                                        const char16_t **aAtts,
+                                        uint32_t aAttsCount,
+-                                       uint32_t aLineNumber)
++                                       uint32_t aLineNumber,
++                                       uint32_t aColumnNumber)
+ {
+   // XXX Hopefully the parser will flag this before we get here. If
+   // we're in the epilog, there should be no new elements
+   NS_PRECONDITION(mState != eInEpilog, "tag in XUL doc epilog");
+   NS_PRECONDITION(aAttsCount % 2 == 0, "incorrect aAttsCount");
+   // Adjust aAttsCount so it's the actual number of attributes
+   aAttsCount /= 2;
+ 
+@@ -685,27 +686,27 @@ XULContentSinkImpl::ReportError(const ch
+ 
+   NS_NAMED_LITERAL_STRING(errorNs,
+                           "http://www.mozilla.org/newlayout/xml/parsererror.xml");
+ 
+   nsAutoString parsererror(errorNs);
+   parsererror.Append((char16_t)0xFFFF);
+   parsererror.AppendLiteral("parsererror");
+ 
+-  rv = HandleStartElement(parsererror.get(), noAtts, 0, 0);
++  rv = HandleStartElement(parsererror.get(), noAtts, 0, 0, 0);
+   NS_ENSURE_SUCCESS(rv,rv);
+ 
+   rv = HandleCharacterData(aErrorText, NS_strlen(aErrorText));
+   NS_ENSURE_SUCCESS(rv,rv);
+ 
+   nsAutoString sourcetext(errorNs);
+   sourcetext.Append((char16_t)0xFFFF);
+   sourcetext.AppendLiteral("sourcetext");
+ 
+-  rv = HandleStartElement(sourcetext.get(), noAtts, 0, 0);
++  rv = HandleStartElement(sourcetext.get(), noAtts, 0, 0, 0);
+   NS_ENSURE_SUCCESS(rv,rv);
+ 
+   rv = HandleCharacterData(aSourceText, NS_strlen(aSourceText));
+   NS_ENSURE_SUCCESS(rv,rv);
+ 
+   rv = HandleEndElement(sourcetext.get());
+   NS_ENSURE_SUCCESS(rv,rv);
+ 
+diff --git a/layout/style/Loader.cpp b/layout/style/Loader.cpp
+--- a/layout/style/Loader.cpp
++++ b/layout/style/Loader.cpp
+@@ -811,17 +811,17 @@ SheetLoadData::VerifySheetReadyToParse(n
+       nsCOMPtr<nsIContentSecurityPolicy> csp;
+       loadInfo->LoadingPrincipal()->GetCsp(getter_AddRefs(csp));
+       nsAutoCString spec;
+       mLoader->mDocument->GetDocumentURI()->GetAsciiSpec(spec);
+       // line number unknown. mRequestingNode doesn't bear this info.
+       csp->LogViolationDetails(
+         nsIContentSecurityPolicy::VIOLATION_TYPE_REQUIRE_SRI_FOR_STYLE,
+         NS_ConvertUTF8toUTF16(spec), EmptyString(),
+-        0, EmptyString(), EmptyString());
++        0, 0, EmptyString(), EmptyString());
+       return NS_OK;
+     }
+   } else {
+     nsAutoCString sourceUri;
+     if (mLoader->mDocument && mLoader->mDocument->GetDocumentURI()) {
+       mLoader->mDocument->GetDocumentURI()->GetAsciiSpec(sourceUri);
+     }
+     nsresult rv = SRICheck::VerifyIntegrity(
+diff --git a/layout/style/nsStyleUtil.cpp b/layout/style/nsStyleUtil.cpp
+--- a/layout/style/nsStyleUtil.cpp
++++ b/layout/style/nsStyleUtil.cpp
+@@ -830,16 +830,17 @@ nsStyleUtil::ObjectPropsMightCauseOverfl
+ 
+ 
+ /* static */ bool
+ nsStyleUtil::CSPAllowsInlineStyle(Element* aElement,
+                                   nsIPrincipal* aPrincipal,
+                                   nsIPrincipal* aTriggeringPrincipal,
+                                   nsIURI* aSourceURI,
+                                   uint32_t aLineNumber,
++                                  uint32_t aColumnNumber,
+                                   const nsAString& aStyleText,
+                                   nsresult* aRv)
+ {
+   nsresult rv;
+ 
+   if (aRv) {
+     *aRv = NS_OK;
+   }
+@@ -878,14 +879,14 @@ nsStyleUtil::CSPAllowsInlineStyle(Elemen
+   if (styleText) {
+     styleText->SetData(aStyleText);
+   }
+ 
+   bool allowInlineStyle = true;
+   rv = csp->GetAllowsInline(nsIContentPolicy::TYPE_STYLESHEET,
+                             nonce,
+                             false, // aParserCreated only applies to scripts
+-                            styleText, aLineNumber,
++                            styleText, aLineNumber, aColumnNumber,
+                             &allowInlineStyle);
+   NS_ENSURE_SUCCESS(rv, false);
+ 
+   return allowInlineStyle;
+ }
+diff --git a/layout/style/nsStyleUtil.h b/layout/style/nsStyleUtil.h
+--- a/layout/style/nsStyleUtil.h
++++ b/layout/style/nsStyleUtil.h
+@@ -192,28 +192,32 @@ public:
+    *  @param aTriggeringPrincipal
+    *      The principal of the scripted caller which added the inline
+    *      stylesheet, or null if no scripted caller can be identified.
+    *  @param aSourceURI
+    *      URI of document containing inline style (for reporting violations)
+    *  @param aLineNumber
+    *      Line number of inline style element in the containing document (for
+    *      reporting violations)
++   *  @param aColumnNumber
++   *      Column number of inline style element in the containing document (for
++   *      reporting violations)
+    *  @param aStyleText
+    *      Contents of the inline style element (for reporting violations)
+    *  @param aRv
+    *      Return error code in case of failure
+    *  @return
+    *      Does CSP allow application of the specified inline style?
+    */
+   static bool CSPAllowsInlineStyle(mozilla::dom::Element* aContent,
+                                    nsIPrincipal* aPrincipal,
+                                    nsIPrincipal* aTriggeringPrincipal,
+                                    nsIURI* aSourceURI,
+                                    uint32_t aLineNumber,
++                                   uint32_t aColumnNumber,
+                                    const nsAString& aStyleText,
+                                    nsresult* aRv);
+ 
+   template<size_t N>
+   static bool MatchesLanguagePrefix(const char16_t* aLang, size_t aLen,
+                                     const char16_t (&aPrefix)[N])
+   {
+     return !nsCRT::strncmp(aLang, aPrefix, N - 1) &&
+diff --git a/parser/htmlparser/nsExpatDriver.cpp b/parser/htmlparser/nsExpatDriver.cpp
+--- a/parser/htmlparser/nsExpatDriver.cpp
++++ b/parser/htmlparser/nsExpatDriver.cpp
+@@ -372,17 +372,18 @@ nsExpatDriver::HandleStartElement(const 
+        aAtts[attrArrayLength];
+        attrArrayLength += 2) {
+     // Just looping till we find out what the length is
+   }
+ 
+   if (mSink) {
+     nsresult rv = mSink->
+       HandleStartElement(aValue, aAtts, attrArrayLength,
+-                         XML_GetCurrentLineNumber(mExpatParser));
++                         XML_GetCurrentLineNumber(mExpatParser),
++                         XML_GetCurrentColumnNumber(mExpatParser));
+     MaybeStopParser(rv);
+   }
+ 
+   return NS_OK;
+ }
+ 
+ nsresult
+ nsExpatDriver::HandleEndElement(const char16_t *aValue)
+diff --git a/parser/htmlparser/nsIExpatSink.idl b/parser/htmlparser/nsIExpatSink.idl
+--- a/parser/htmlparser/nsIExpatSink.idl
++++ b/parser/htmlparser/nsIExpatSink.idl
+@@ -23,21 +23,23 @@ interface nsIExpatSink : nsISupports
+    *        elements in the array is aAttsCount.  The names and values
+    *        alternate.  Thus, if we number attributes starting with 0,
+    *        aAtts[2*k] is the name of the k-th attribute and aAtts[2*k+1] is
+    *        the value of that attribute  Both explicitly specified attributes
+    *        and attributes that are defined to have default values in a DTD are
+    *        present in aAtts.
+    * @param aAttsCount the number of elements in aAtts.
+    * @param aLineNumber the line number of the start tag in the data stream.
++   * @param aColumnNumber the column number of the start tag in the data stream.
+    */
+   void HandleStartElement(in wstring aName,
+                           [array, size_is(aAttsCount)] in wstring aAtts,
+                           in unsigned long aAttsCount,
+-                          in unsigned long aLineNumber);
++                          in unsigned long aLineNumber,
++                          in unsigned long aColumnNumber);
+ 
+   /**
+    * Called to handle the closing tag of an element.
+    * @param aName the fully qualified tagname of the element
+    */
+   void HandleEndElement(in wstring aName);
+ 
+   /**
+diff --git a/parser/xml/nsSAXXMLReader.cpp b/parser/xml/nsSAXXMLReader.cpp
+--- a/parser/xml/nsSAXXMLReader.cpp
++++ b/parser/xml/nsSAXXMLReader.cpp
+@@ -78,17 +78,18 @@ nsSAXXMLReader::SetParser(nsParserBase *
+   return NS_OK;
+ }
+ 
+ // nsIExtendedExpatSink
+ NS_IMETHODIMP
+ nsSAXXMLReader::HandleStartElement(const char16_t *aName,
+                                    const char16_t **aAtts,
+                                    uint32_t aAttsCount,
+-                                   uint32_t aLineNumber)
++                                   uint32_t aLineNumber,
++                                   uint32_t aColumnNumber)
+ {
+   if (!mContentHandler)
+     return NS_OK;
+ 
+   RefPtr<nsSAXAttributes> atts = new nsSAXAttributes();
+   if (!atts)
+     return NS_ERROR_OUT_OF_MEMORY;
+   nsAutoString uri, localName, qName;
+diff --git a/rdf/base/nsRDFContentSink.cpp b/rdf/base/nsRDFContentSink.cpp
+--- a/rdf/base/nsRDFContentSink.cpp
++++ b/rdf/base/nsRDFContentSink.cpp
+@@ -377,17 +377,18 @@ RDFContentSinkImpl::QueryInterface(REFNS
+     }
+     return NS_NOINTERFACE;
+ }
+ 
+ NS_IMETHODIMP
+ RDFContentSinkImpl::HandleStartElement(const char16_t *aName,
+                                        const char16_t **aAtts,
+                                        uint32_t aAttsCount,
+-                                       uint32_t aLineNumber)
++                                       uint32_t aLineNumber,
++                                       uint32_t aColumnNumber)
+ {
+   FlushText();
+ 
+   nsresult rv = NS_ERROR_UNEXPECTED; // XXX
+ 
+   RegisterNamespaces(aAtts);
+ 
+   switch (mState) {

frg/work-js/mozilla-release/patches/1426865-2-72a1.patch

@@ -3,7 +3,7 @@
 # Date 1572215651 0
 #      Sun Oct 27 22:34:11 2019 +0000
 # Node ID 01c0d41a024b581d3c168ae3501f7e65ea99c550
-# Parent  920117a149c4344128848a5f52ba030e50b6e8ba
+# Parent  d4737c7e022600cb3db4986a05ce3be70a94fcc1
 Bug 1426865 - Remove JS_BROKEN_GCC_ATTRIBUTE_WARNING. r=sfink
 
 This macro makes any forward declarations unnecessarily verbose, and the
@@ -179,9 +179,9 @@ diff --git a/js/src/jstypes.h b/js/src/jstypes.h
 -// (The gcc release that *fixes* this bug will trigger no warning, and we'll
 -// naturally stop bumping this number.)  If you ever trigger this warning with
 -// the latest stable gcc, you have rs=jwalden to bump it to the next gcc minor
--// version, e.g. (8, 1, 0) to (8, 2, 0).
+-// or major version as needed, e.g. (8, 2, 0) to (8, 3, 0).
 -#if MOZ_IS_GCC
--#  if !MOZ_GCC_VERSION_AT_LEAST(8, 1, 0)
+-#  if !MOZ_GCC_VERSION_AT_LEAST(8, 2, 0)
 -#    define JS_BROKEN_GCC_ATTRIBUTE_WARNING
 -#  endif
 -#endif

frg/work-js/mozilla-release/patches/1463979-1-63a1.patch

@@ -2,7 +2,7 @@
 # User Tooru Fujisawa <arai_a@mac.com>
 # Date 1531916132 -32400
 # Node ID 6edce1e74d5aeb53247e9c22d4e3b5fce3810d8b
-# Parent  3246c273b603ce8cc41ea342330b4183617f7e16
+# Parent  7ef7a9541ba809cbb6d7ba378fd4ba2351b535cc
 Bug 1463979 - Part 1: Store a pointer to enclosing LazyScript into LazyScript. r=jimb,sfink
 
 diff --git a/js/src/frontend/BytecodeCompiler.cpp b/js/src/frontend/BytecodeCompiler.cpp
@@ -270,7 +270,7 @@ diff --git a/js/src/gc/Marking.cpp b/js/src/gc/Marking.cpp
 diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
 --- a/js/src/vm/Debugger.cpp
 +++ b/js/src/vm/Debugger.cpp
-@@ -4603,20 +4603,21 @@ class MOZ_STACK_CLASS Debugger::ScriptQu
+@@ -4568,20 +4568,21 @@ class MOZ_STACK_CLASS Debugger::ScriptQu
      }
  
      /*
@@ -299,7 +299,7 @@ diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
 diff --git a/js/src/vm/JSFunction.cpp b/js/src/vm/JSFunction.cpp
 --- a/js/src/vm/JSFunction.cpp
 +++ b/js/src/vm/JSFunction.cpp
-@@ -1584,35 +1584,43 @@ JSFunction::createScriptForLazilyInterpr
+@@ -1586,35 +1586,43 @@ JSFunction::createScriptForLazilyInterpr
          // chain of their inner functions, or in the case of eval, possibly
          // eval'd inner functions. This prohibits re-lazification as
          // StaticScopeIter queries needsCallObject of those functions, which
@@ -343,7 +343,7 @@ diff --git a/js/src/vm/JSFunction.cpp b/js/src/vm/JSFunction.cpp
          ScriptSource::PinnedChars chars(cx, lazy->scriptSource(), holder,
                                          lazy->sourceStart(), lazyLength);
          if (!chars.get())
-@@ -2120,17 +2128,17 @@ js::CanReuseScriptForClone(JS::Compartme
+@@ -2123,17 +2131,17 @@ js::CanReuseScriptForClone(JS::Realm* re
      // example.
      if (IsSyntacticEnvironment(newParent))
          return true;
@@ -534,7 +534,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
      // Copy yield offsets last, as the generator kind is set in
      // initFromFunctionBox.
      if (bce->yieldAndAwaitOffsetList.length() != 0)
-@@ -4194,17 +4205,16 @@ JSScript::formalLivesInArgumentsObject(u
+@@ -4196,17 +4207,16 @@ JSScript::formalLivesInArgumentsObject(u
  }
  
  LazyScript::LazyScript(JSFunction* fun, ScriptSourceObject& sourceObject,
@@ -552,7 +552,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
      toStringStart_(toStringStart),
      toStringEnd_(sourceEnd),
      lineno_(lineno),
-@@ -4221,21 +4231,36 @@ void
+@@ -4223,21 +4233,36 @@ void
  LazyScript::initScript(JSScript* script)
  {
      MOZ_ASSERT(script);
@@ -592,7 +592,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
      return sourceObject_->as<ScriptSourceObject>();
  }
  
-@@ -4322,28 +4347,31 @@ LazyScript::Create(JSContext* cx, Handle
+@@ -4324,28 +4349,31 @@ LazyScript::Create(JSContext* cx, Handle
      if (!res)
          return nullptr;
  
@@ -630,7 +630,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
      // holding this lazy script.
      HandleFunction dummyFun = fun;
  
-@@ -4360,20 +4388,21 @@ LazyScript::Create(JSContext* cx, Handle
+@@ -4362,20 +4390,21 @@ LazyScript::Create(JSContext* cx, Handle
      for (i = 0, num = res->numClosedOverBindings(); i < num; i++)
          closedOverBindings[i] = dummyAtom;
  
@@ -656,7 +656,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
          res->initScript(script);
  
      return res;
-@@ -4387,34 +4416,16 @@ LazyScript::initRuntimeFields(uint64_t p
+@@ -4389,34 +4418,16 @@ LazyScript::initRuntimeFields(uint64_t p
          uint64_t packed;
      };
  
@@ -928,7 +928,7 @@ diff --git a/js/src/vm/JSScript.h b/js/src/vm/JSScript.h
 diff --git a/js/src/vm/Realm.cpp b/js/src/vm/Realm.cpp
 --- a/js/src/vm/Realm.cpp
 +++ b/js/src/vm/Realm.cpp
-@@ -706,17 +706,17 @@ AddLazyFunctionsForRealm(JSContext* cx, 
+@@ -702,17 +702,17 @@ AddLazyFunctionsForRealm(JSContext* cx, 
          if (gc::IsAboutToBeFinalizedUnbarriered(&fun) ||
              fun->realm() != cx->realm())
          {

frg/work-js/mozilla-release/patches/1465585-3-std-62a1.patch

@@ -2,7 +2,7 @@
 # User Emilio Cobos Alvarez <emilio@crisal.io>
 # Date 1527707735 -7200
 # Node ID b54db66223586b4e04f5cb926fccdacf8a176b91
-# Parent  56199acb8e1360b8d5a48bf4e7bfe429b8bf43b1
+# Parent  fe58351be8426819a9f5bdb0c4ba2390857d47c7
 Bug 1465585: Switch from mozilla::Move to std::move. r=froydnj
 
 This was done automatically replacing:
@@ -3147,7 +3147,7 @@ diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
    MOZ_ASSERT(NS_IsMainThread());
    MOZ_ASSERT(aSelector);
  
-@@ -3196,19 +3196,19 @@ nsIDocument::GetDocGroup() const
+@@ -3185,19 +3185,19 @@ nsIDocument::GetDocGroup() const
  }
  
  nsresult
@@ -3170,7 +3170,7 @@ diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
    if (mDocGroup) {
      return mDocGroup->EventTargetFor(aCategory);
    }
-@@ -5666,39 +5666,39 @@ nsIDocument::GetAnonRootIfInAnonymousCon
+@@ -5655,39 +5655,39 @@ nsIDocument::GetAnonRootIfInAnonymousCon
    return nullptr;
  }
  
@@ -3219,7 +3219,7 @@ diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
  DocumentType*
  nsIDocument::GetDoctype() const
  {
-@@ -6619,17 +6619,17 @@ nsIDocument::CreateNodeIterator(nsINode&
+@@ -6608,17 +6608,17 @@ nsIDocument::CreateNodeIterator(nsINode&
  
  already_AddRefed<NodeIterator>
  nsIDocument::CreateNodeIterator(nsINode& aRoot, uint32_t aWhatToShow,
@@ -3238,7 +3238,7 @@ diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
                               uint32_t aWhatToShow,
                               nsIDOMNodeFilter *aFilter,
                               uint8_t aOptionalArgc,
-@@ -6659,17 +6659,17 @@ nsIDocument::CreateTreeWalker(nsINode& a
+@@ -6648,17 +6648,17 @@ nsIDocument::CreateTreeWalker(nsINode& a
    return CreateTreeWalker(aRoot, aWhatToShow, NodeFilterHolder(aFilter), rv);
  }
  
@@ -3257,7 +3257,7 @@ diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
  nsDocument::GetDefaultView(mozIDOMWindowProxy** aDefaultView)
  {
    *aDefaultView = nullptr;
-@@ -6918,17 +6918,17 @@ nsDocument::NotifyPossibleTitleChange(bo
+@@ -6907,17 +6907,17 @@ nsDocument::NotifyPossibleTitleChange(bo
  
    MOZ_RELEASE_ASSERT(NS_IsMainThread());
    RefPtr<nsRunnableMethod<nsDocument, void, false>> event =
@@ -3276,7 +3276,7 @@ diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
  {
    mPendingTitleChangeEvent.Forget();
    mHaveFiredTitleChange = true;
-@@ -10155,17 +10155,17 @@ nsIDocument::FlushPendingLinkUpdates()
+@@ -10144,17 +10144,17 @@ nsIDocument::FlushPendingLinkUpdates()
    if (mFlushingPendingLinkUpdates) {
      return;
    }
@@ -3295,7 +3295,7 @@ diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
          if (element->IsInComposedDoc()) {
            element->UpdateLinkState(link->LinkState());
          }
-@@ -11094,17 +11094,17 @@ ResetFullScreen(nsIDocument* aDocument, 
+@@ -11083,17 +11083,17 @@ ResetFullScreen(nsIDocument* aDocument, 
  // Since nsIDocument::ExitFullscreenInDocTree() could be called from
  // Element::UnbindFromTree() where it is not safe to synchronously run
  // script. This runnable is the script part of that function.
@@ -3314,7 +3314,7 @@ diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
      // Dispatch MozDOMFullscreen:Exited to the last document in
      // the list since we want this event to follow the same path
      // MozDOMFullscreen:Entered dispatched.
-@@ -11164,17 +11164,17 @@ nsIDocument::ExitFullscreenInDocTree(nsI
+@@ -11153,17 +11153,17 @@ nsIDocument::ExitFullscreenInDocTree(nsI
  
    NS_ASSERTION(!root->GetFullscreenElement(),
      "Fullscreen root should no longer be a fullscreen doc...");
@@ -3333,7 +3333,7 @@ diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
    if (aDoc->IsFullscreenLeaf()) {
      nsIDocument** result = static_cast<nsIDocument**>(aData);
      *result = aDoc;
-@@ -11291,23 +11291,23 @@ nsDocument::RestorePreviousFullScreenSta
+@@ -11280,23 +11280,23 @@ nsDocument::RestorePreviousFullScreenSta
    }
  }
  
@@ -3359,7 +3359,7 @@ diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
  
  void
  nsDocument::AsyncRequestFullScreen(UniquePtr<FullscreenRequest>&& aRequest)
-@@ -11315,17 +11315,17 @@ nsDocument::AsyncRequestFullScreen(Uniqu
+@@ -11304,17 +11304,17 @@ nsDocument::AsyncRequestFullScreen(Uniqu
    if (!aRequest->GetElement()) {
      MOZ_ASSERT_UNREACHABLE(
        "Must pass non-null element to nsDocument::AsyncRequestFullScreen");
@@ -3378,7 +3378,7 @@ diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
  {
    RefPtr<AsyncEventDispatcher> asyncDispatcher =
      new AsyncEventDispatcher(this,
-@@ -11499,17 +11499,17 @@ nsresult nsDocument::RemoteFrameFullscre
+@@ -11488,17 +11488,17 @@ nsresult nsDocument::RemoteFrameFullscre
  {
    // Ensure the frame element is the fullscreen element in this document.
    // If the frame element is already the fullscreen element in this document,
@@ -3397,7 +3397,7 @@ diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
  {
    RestorePreviousFullScreenState();
    return NS_OK;
-@@ -11797,17 +11797,17 @@ nsDocument::RequestFullScreen(UniquePtr<
+@@ -11786,17 +11786,17 @@ nsDocument::RequestFullScreen(UniquePtr<
    }
  
    // We don't need to check element ready before this point, because
@@ -3605,7 +3605,7 @@ diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
 diff --git a/dom/base/nsIDocument.h b/dom/base/nsIDocument.h
 --- a/dom/base/nsIDocument.h
 +++ b/dom/base/nsIDocument.h
-@@ -1148,17 +1148,17 @@ public:
+@@ -1140,17 +1140,17 @@ public:
        public:
          SelectorList()
            : mIsServo(false)
@@ -17066,7 +17066,7 @@ diff --git a/dom/security/nsCSPUtils.cpp b/dom/security/nsCSPUtils.cpp
 +      outCSP.mWorker_src.Value() = std::move(srcs);
        return;
  
-     // REFERRER_DIRECTIVE and REQUIRE_SRI_FOR are handled in nsCSPPolicy::toDomCSPStruct()
+     // REQUIRE_SRI_FOR is handled in nsCSPPolicy::toDomCSPStruct()
  
      default:
        NS_ASSERTION(false, "cannot find directive to convert CSP to JSON");
@@ -18202,7 +18202,7 @@ diff --git a/dom/workers/ServiceWorkerScriptCache.cpp b/dom/workers/ServiceWorke
 diff --git a/dom/workers/WorkerPrivate.cpp b/dom/workers/WorkerPrivate.cpp
 --- a/dom/workers/WorkerPrivate.cpp
 +++ b/dom/workers/WorkerPrivate.cpp
-@@ -4732,17 +4732,17 @@ WorkerPrivate::Constructor(JSContext* aC
+@@ -4712,17 +4712,17 @@ WorkerPrivate::Constructor(JSContext* aC
    // WorkerThreadPrimaryRunnable::Run for workers just before running worker
    // code), so this is never SpiderMonkey's builtin default locale.
    JS::UniqueChars defaultLocale = JS_GetDefaultLocale(aCx);
@@ -18221,7 +18221,7 @@ diff --git a/dom/workers/WorkerPrivate.cpp b/dom/workers/WorkerPrivate.cpp
  
    worker->EnableDebugger();
  
-@@ -5281,17 +5281,17 @@ WorkerPrivate::DispatchToMainThread(nsIR
+@@ -5261,17 +5261,17 @@ WorkerPrivate::DispatchToMainThread(nsIR
    nsCOMPtr<nsIRunnable> r = aRunnable;
    return DispatchToMainThread(r.forget(), aFlags);
  }
@@ -18240,7 +18240,7 @@ diff --git a/dom/workers/WorkerPrivate.cpp b/dom/workers/WorkerPrivate.cpp
    return mWorkerControlEventTarget;
  }
  
-@@ -7135,17 +7135,17 @@ WorkerPrivate::GetOrCreateGlobalScope(JS
+@@ -7115,17 +7115,17 @@ WorkerPrivate::GetOrCreateGlobalScope(JS
  
      JS::Rooted<JSObject*> global(aCx);
      NS_ENSURE_TRUE(globalScope->WrapGlobalObject(aCx, &global), nullptr);
@@ -18259,7 +18259,7 @@ diff --git a/dom/workers/WorkerPrivate.cpp b/dom/workers/WorkerPrivate.cpp
  
      JS_FireOnNewGlobalObject(aCx, global);
    }
-@@ -7166,17 +7166,17 @@ WorkerPrivate::CreateDebuggerGlobalScope
+@@ -7146,17 +7146,17 @@ WorkerPrivate::CreateDebuggerGlobalScope
    JS::Rooted<JSObject*> global(aCx);
    NS_ENSURE_TRUE(globalScope->WrapGlobalObject(aCx, &global), nullptr);
  

frg/work-js/mozilla-release/patches/mozilla-central-push_427025.patch → frg/work-js/mozilla-release/patches/1469330-63a1.patch

@@ -3,7 +3,7 @@
 # Date 1521064643 18000
 #      Wed Mar 14 16:57:23 2018 -0500
 # Node ID a8ec50eaf8c428df15ef3ad08ac6957f10b072c2
-# Parent  9893cdaed08b246de7c488ca3209b6b2a4b6661e
+# Parent  7309777e6bed574f112ae31722661ca8222b7057
 Bug 1469330 - Remove a redundant null-check in DebuggerArguments::create. r=jimb
 
 diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
@@ -19,8 +19,9 @@ diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
              return nullptr;
          id = INT_TO_JSID(i);
 -        if (!getobj ||
--            !NativeDefineAccessorProperty(cx, obj, id, getobj, nullptr,
-+        if (!NativeDefineAccessorProperty(cx, obj, id, getobj, nullptr,
+-            !NativeDefineAccessorProperty(cx, obj, id,
++        if (!NativeDefineAccessorProperty(cx, obj, id,
+                                           JS_DATA_TO_FUNC_PTR(GetterOp, getobj.get()), nullptr,
                                            JSPROP_ENUMERATE | JSPROP_GETTER))
          {
              return nullptr;
@@ -28,4 +29,3 @@ diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
          getobj->setExtendedSlot(0, Int32Value(i));
      }
  
-     return obj;

frg/work-js/mozilla-release/patches/1473218-63a1.patch

@@ -0,0 +1,448 @@
+# HG changeset patch
+# User Andrea Marchesini <amarchesini@mozilla.com>
+# Date 1530856909 -7200
+# Node ID 90f470be3f1d206410d73b8862b64dbe7391d85c
+# Parent  a90c692bc45d03ae5f5d2708e831462f86d46b9d
+Bug 1473218 - Implement report-sample support for CSP directives, r=ckerschb
+
+diff --git a/dom/security/nsCSPContext.cpp b/dom/security/nsCSPContext.cpp
+--- a/dom/security/nsCSPContext.cpp
++++ b/dom/security/nsCSPContext.cpp
+@@ -558,20 +558,23 @@ nsCSPContext::GetAllowsInline(nsContentP
+ 
+     if (!allowed) {
+       // policy is violoated: deny the load unless policy is report only and
+       // report the violation.
+       if (!mPolicies[i]->getReportOnlyFlag()) {
+         *outAllowsInline = false;
+       }
+       nsAutoString violatedDirective;
+-      mPolicies[i]->getDirectiveStringForContentType(aContentType, violatedDirective);
++      bool reportSample = false;
++      mPolicies[i]->getDirectiveStringAndReportSampleForContentType(aContentType,
++                                                                    violatedDirective,
++                                                                    &reportSample);
+       reportInlineViolation(aContentType,
+                             aNonce,
+-                            content,
++                            reportSample ? content : EmptyString(),
+                             violatedDirective,
+                             i,
+                             aLineNumber,
+                             aColumnNumber);
+     }
+   }
+   return NS_OK;
+ }
+@@ -608,23 +611,26 @@ nsCSPContext::GetAllowsInline(nsContentP
+ #define CASE_CHECK_AND_REPORT(violationType, contentPolicyType, nonceOrHash,   \
+                               keyword, observerTopic)                          \
+   case nsIContentSecurityPolicy::VIOLATION_TYPE_ ## violationType :            \
+     PR_BEGIN_MACRO                                                             \
+     if (!mPolicies[p]->allows(nsIContentPolicy::TYPE_ ## contentPolicyType,    \
+                               keyword, nonceOrHash, false))                    \
+     {                                                                          \
+       nsAutoString violatedDirective;                                          \
+-      mPolicies[p]->getDirectiveStringForContentType(                          \
++      bool reportSample = false;                                               \
++      mPolicies[p]->getDirectiveStringAndReportSampleForContentType(           \
+                         nsIContentPolicy::TYPE_ ## contentPolicyType,          \
+-                        violatedDirective);                                    \
++                        violatedDirective, &reportSample);                     \
+       this->AsyncReportViolation(selfISupports, nullptr, violatedDirective, p, \
+                                  NS_LITERAL_STRING(observerTopic),             \
+-                                 aSourceFile, aScriptSample, aLineNum,         \
+-                                 aColumnNum);                                  \
++                                 aSourceFile,                                  \
++                                 reportSample                                  \
++                                   ? aScriptSample : EmptyString(),            \
++                                 aLineNum, aColumnNum);                        \
+     }                                                                          \
+     PR_END_MACRO;                                                              \
+     break
+ 
+ /**
+  * For each policy, log any violation on the Error Console and send a report
+  * if a report-uri is present in the policy
+  *
+@@ -1272,17 +1278,17 @@ class CSPReportSenderRunnable final : pu
+ 
+       if (blockedURI) {
+         blockedURI->GetSpec(blockedDataStr);
+         if (blockedDataStr.Length() > 40) {
+           bool isData = false;
+           rv = blockedURI->SchemeIs("data", &isData);
+           if (NS_SUCCEEDED(rv) && isData) {
+             blockedDataStr.Truncate(40);
+-            blockedDataStr.AppendASCII("...");
++            blockedDataStr.AppendASCII("…");
+           }
+         }
+       } else if (blockedString) {
+         blockedString->GetData(blockedDataStr);
+       }
+ 
+       if (blockedDataStr.Length() > 0) {
+         nsString blockedDataChar16 = NS_ConvertUTF8toUTF16(blockedDataStr);
+diff --git a/dom/security/nsCSPParser.cpp b/dom/security/nsCSPParser.cpp
+--- a/dom/security/nsCSPParser.cpp
++++ b/dom/security/nsCSPParser.cpp
+@@ -535,16 +535,20 @@ nsCSPParser::keywordSource()
+                NS_ConvertUTF16toUTF8(mCurValue).get()));
+ 
+   // Special case handling for 'self' which is not stored internally as a keyword,
+   // but rather creates a nsCSPHostSrc using the selfURI
+   if (CSP_IsKeyword(mCurToken, CSP_SELF)) {
+     return CSP_CreateHostSrcFromSelfURI(mSelfURI);
+   }
+ 
++  if (CSP_IsKeyword(mCurToken, CSP_REPORT_SAMPLE)) {
++    return new nsCSPKeywordSrc(CSP_UTF16KeywordToEnum(mCurToken));
++  }
++
+   if (CSP_IsKeyword(mCurToken, CSP_STRICT_DYNAMIC)) {
+     // make sure strict dynamic is enabled
+     if (!sStrictDynamicEnabled) {
+       return nullptr;
+     }
+     if (!CSP_IsDirective(mCurDir[0], nsIContentSecurityPolicy::SCRIPT_SRC_DIRECTIVE)) {
+       // Todo: Enforce 'strict-dynamic' within default-src; see Bug 1313937
+       const char16_t* params[] = { u"strict-dynamic" };
+@@ -853,19 +857,20 @@ nsCSPParser::sourceList(nsTArray<nsCSPBa
+     if (src) {
+       outSrcs.AppendElement(src);
+     }
+   }
+ 
+   // Check if the directive contains a 'none'
+   if (isNone) {
+     // If the directive contains no other srcs, then we set the 'none'
+-    if (outSrcs.Length() == 0) {
++    if (outSrcs.IsEmpty() ||
++        (outSrcs.Length() == 1 && outSrcs[0]->isReportSample())) {
+       nsCSPKeywordSrc *keyword = new nsCSPKeywordSrc(CSP_NONE);
+-      outSrcs.AppendElement(keyword);
++      outSrcs.InsertElementAt(0, keyword);
+     }
+     // Otherwise, we ignore 'none' and report a warning
+     else {
+       const char16_t* params[] = { CSP_EnumToUTF16Keyword(CSP_NONE) };
+       logWarningErrorToConsole(nsIScriptError::warningFlag, "ignoringUnknownOption",
+                                params, ArrayLength(params));
+     }
+   }
+@@ -1199,19 +1204,20 @@ nsCSPParser::directive()
+     CSP_IsDirective(mCurDir[0], nsIContentSecurityPolicy::FRAME_ANCESTORS_DIRECTIVE);
+ 
+   // Try to parse all the srcs by handing the array off to directiveValue
+   nsTArray<nsCSPBaseSrc*> srcs;
+   directiveValue(srcs);
+ 
+   // If we can not parse any srcs; we let the source expression be the empty set ('none')
+   // see, http://www.w3.org/TR/CSP11/#source-list-parsing
+-  if (srcs.Length() == 0) {
++  if (srcs.IsEmpty() ||
++      (srcs.Length() == 1 && srcs[0]->isReportSample())) {
+     nsCSPKeywordSrc *keyword = new nsCSPKeywordSrc(CSP_NONE);
+-    srcs.AppendElement(keyword);
++    srcs.InsertElementAt(0, keyword);
+   }
+ 
+   // If policy contains 'strict-dynamic' invalidate all srcs within script-src.
+   if (mStrictDynamic) {
+     MOZ_ASSERT(cspDir->equals(nsIContentSecurityPolicy::SCRIPT_SRC_DIRECTIVE),
+                "strict-dynamic only allowed within script-src");
+     for (uint32_t i = 0; i < srcs.Length(); i++) {
+       // Please note that nsCSPNonceSrc as well as nsCSPHashSrc overwrite invalidate(),
+diff --git a/dom/security/nsCSPUtils.cpp b/dom/security/nsCSPUtils.cpp
+--- a/dom/security/nsCSPUtils.cpp
++++ b/dom/security/nsCSPUtils.cpp
+@@ -1249,16 +1249,28 @@ bool nsCSPDirective::equals(CSPDirective
+ }
+ 
+ void
+ nsCSPDirective::getDirName(nsAString& outStr) const
+ {
+   outStr.AppendASCII(CSP_CSPDirectiveToString(mDirective));
+ }
+ 
++bool
++nsCSPDirective::hasReportSampleKeyword() const
++{
++  for (nsCSPBaseSrc* src : mSrcs) {
++    if (src->isReportSample()) {
++      return true;
++    }
++  }
++
++  return false;
++}
++
+ /* =============== nsCSPChildSrcDirective ============= */
+ 
+ nsCSPChildSrcDirective::nsCSPChildSrcDirective(CSPDirective aDirective)
+   : nsCSPDirective(aDirective)
+   , mRestrictFrames(false)
+   , mRestrictWorkers(false)
+ {
+ }
+@@ -1599,33 +1611,39 @@ nsCSPPolicy::hasDirective(CSPDirective a
+ 
+ /*
+  * Use this function only after ::allows() returned 'false'. Most and
+  * foremost it's used to get the violated directive before sending reports.
+  * The parameter outDirective is the equivalent of 'outViolatedDirective'
+  * for the ::permits() function family.
+  */
+ void
+-nsCSPPolicy::getDirectiveStringForContentType(nsContentPolicyType aContentType,
+-                                              nsAString& outDirective) const
++nsCSPPolicy::getDirectiveStringAndReportSampleForContentType(nsContentPolicyType aContentType,
++                                                             nsAString& outDirective,
++                                                             bool* aReportSample) const
+ {
++  MOZ_ASSERT(aReportSample);
++  *aReportSample = false;
++
+   nsCSPDirective* defaultDir = nullptr;
+   for (uint32_t i = 0; i < mDirectives.Length(); i++) {
+     if (mDirectives[i]->restrictsContentType(aContentType)) {
+       mDirectives[i]->getDirName(outDirective);
++      *aReportSample = mDirectives[i]->hasReportSampleKeyword();
+       return;
+     }
+     if (mDirectives[i]->isDefaultDirective()) {
+       defaultDir = mDirectives[i];
+     }
+   }
+   // if we haven't found a matching directive yet,
+   // the contentType must be restricted by the default directive
+   if (defaultDir) {
+     defaultDir->getDirName(outDirective);
++    *aReportSample = defaultDir->hasReportSampleKeyword();
+     return;
+   }
+   NS_ASSERTION(false, "Can not query directive string for contentType!");
+   outDirective.AppendASCII("couldNotQueryViolatedDirective");
+ }
+ 
+ void
+ nsCSPPolicy::getDirectiveAsString(CSPDirective aDir, nsAString& outDirective) const
+diff --git a/dom/security/nsCSPUtils.h b/dom/security/nsCSPUtils.h
+--- a/dom/security/nsCSPUtils.h
++++ b/dom/security/nsCSPUtils.h
+@@ -121,16 +121,17 @@ inline CSPDirective CSP_StringToCSPDirec
+ 
+ #define FOR_EACH_CSP_KEYWORD(macro) \
+   macro(CSP_SELF,            "'self'") \
+   macro(CSP_UNSAFE_INLINE,   "'unsafe-inline'") \
+   macro(CSP_UNSAFE_EVAL,     "'unsafe-eval'") \
+   macro(CSP_NONE,            "'none'") \
+   macro(CSP_NONCE,           "'nonce-") \
+   macro(CSP_REQUIRE_SRI_FOR, "require-sri-for") \
++  macro(CSP_REPORT_SAMPLE,   "'report-sample'") \
+   macro(CSP_STRICT_DYNAMIC,  "'strict-dynamic'")
+ 
+ enum CSPKeyword {
+   #define KEYWORD_ENUM(id_, string_) id_,
+   FOR_EACH_CSP_KEYWORD(KEYWORD_ENUM)
+   #undef KEYWORD_ENUM
+ 
+   // CSP_LAST_KEYWORD_VALUE always needs to be the last element in the enum
+@@ -232,16 +233,19 @@ class nsCSPBaseSrc {
+     virtual bool allows(enum CSPKeyword aKeyword, const nsAString& aHashOrNonce,
+                         bool aParserCreated) const;
+     virtual bool visit(nsCSPSrcVisitor* aVisitor) const = 0;
+     virtual void toString(nsAString& outStr) const = 0;
+ 
+     virtual void invalidate() const
+       { mInvalidated = true; }
+ 
++    virtual bool isReportSample() const
++      { return false; }
++
+   protected:
+     // invalidate srcs if 'script-dynamic' is present or also invalidate
+     // unsafe-inline' if nonce- or hash-source specified
+     mutable bool mInvalidated;
+ 
+ };
+ 
+ /* =============== nsCSPSchemeSrc ============ */
+@@ -330,16 +334,18 @@ class nsCSPKeywordSrc : public nsCSPBase
+     inline void invalidate() const override
+     {
+       // keywords that need to invalidated
+       if (mKeyword == CSP_SELF || mKeyword == CSP_UNSAFE_INLINE) {
+         mInvalidated = true;
+       }
+     }
+ 
++    bool isReportSample() const override
++      { return mKeyword == CSP_REPORT_SAMPLE; }
+   private:
+     CSPKeyword mKeyword;
+ };
+ 
+ /* =============== nsCSPNonceSource =========== */
+ 
+ class nsCSPNonceSrc : public nsCSPBaseSrc {
+   public:
+@@ -469,16 +475,18 @@ class nsCSPDirective {
+     virtual bool equals(CSPDirective aDirective) const;
+ 
+     void getReportURIs(nsTArray<nsString> &outReportURIs) const;
+ 
+     bool visitSrcs(nsCSPSrcVisitor* aVisitor) const;
+ 
+     virtual void getDirName(nsAString& outStr) const;
+ 
++    bool hasReportSampleKeyword() const;
++
+   protected:
+     CSPDirective            mDirective;
+     nsTArray<nsCSPBaseSrc*> mSrcs;
+ };
+ 
+ /* =============== nsCSPChildSrcDirective ============= */
+ 
+ /*
+@@ -672,18 +680,19 @@ class nsCSPPolicy {
+     inline void setReportOnlyFlag(bool aFlag)
+       { mReportOnly = aFlag; }
+ 
+     inline bool getReportOnlyFlag() const
+       { return mReportOnly; }
+ 
+     void getReportURIs(nsTArray<nsString> &outReportURIs) const;
+ 
+-    void getDirectiveStringForContentType(nsContentPolicyType aContentType,
+-                                          nsAString& outDirective) const;
++    void getDirectiveStringAndReportSampleForContentType(nsContentPolicyType aContentType,
++                                                         nsAString& outDirective,
++                                                         bool* aReportSample) const;
+ 
+     void getDirectiveAsString(CSPDirective aDir, nsAString& outDirective) const;
+ 
+     uint32_t getSandboxFlags() const;
+ 
+     bool requireSRIForType(nsContentPolicyType aContentType);
+ 
+     inline uint32_t getNumDirectives() const
+diff --git a/dom/security/test/csp/file_data-uri_blocked.html^headers^ b/dom/security/test/csp/file_data-uri_blocked.html^headers^
+--- a/dom/security/test/csp/file_data-uri_blocked.html^headers^
++++ b/dom/security/test/csp/file_data-uri_blocked.html^headers^
+@@ -1,1 +1,1 @@
+-Content-Security-Policy: default-src 'self'; img-src 'none'
++Content-Security-Policy: default-src 'self' 'report-sample'; img-src 'none' 'report-sample'
+diff --git a/dom/security/test/csp/test_bug1242019.html b/dom/security/test/csp/test_bug1242019.html
+--- a/dom/security/test/csp/test_bug1242019.html
++++ b/dom/security/test/csp/test_bug1242019.html
+@@ -27,17 +27,17 @@ var expectedURI = "data:image/png;base64
+ 
+ SpecialPowers.registerConsoleListener(function ConsoleMsgListener(aMsg) {
+   // look for the message with data uri and see the data uri is truncated to 40 chars
+   data_start = aMsg.message.indexOf(expectedURI) 
+   if (data_start > -1) {
+     data_uri = "";
+     data_uri = aMsg.message.substr(data_start);
+     // this will either match the elipsis after the URI or the . at the end of the message
+-    data_uri = data_uri.substr(0, data_uri.indexOf("."));
++    data_uri = data_uri.substr(0, data_uri.indexOf("…"));
+     if (data_uri == "") {
+       return;
+     }
+ 
+     ok(data_uri.length == 40, "Data URI only shows 40 characters in the console");
+     SimpleTest.executeSoon(cleanup);
+   }
+ });
+diff --git a/dom/security/test/csp/test_report.html b/dom/security/test/csp/test_report.html
+--- a/dom/security/test/csp/test_report.html
++++ b/dom/security/test/csp/test_report.html
+@@ -24,20 +24,20 @@ https://bugzilla.mozilla.org/show_bug.cg
+  * of the JSON is not formatted properly (e.g. not properly escaped)
+  * then JSON.parse will fail, which allows to pinpoint such errors
+  * in the catch block, and the test will fail. Since we use an
+  * observer, we can set the actual report-uri to a foo value.
+  */
+ 
+ const testfile = "tests/dom/security/test/csp/file_report.html";
+ const reportURI = "http://mochi.test:8888/foo.sjs";
+-const policy = "default-src 'none'; report-uri " + reportURI;
++const policy = "default-src 'none' 'report-sample'; report-uri " + reportURI;
+ const docUri = "http://mochi.test:8888/tests/dom/security/test/csp/file_testserver.sjs" +
+                "?file=tests/dom/security/test/csp/file_report.html" +
+-               "&csp=default-src%20%27none%27%3B%20report-uri%20http%3A//mochi.test%3A8888/foo.sjs";
++               "&csp=default-src%20%27none%27%20%27report-sample%27%3B%20report-uri%20http%3A//mochi.test%3A8888/foo.sjs";
+ 
+ window.checkResults = function(reportObj) {
+   var cspReport = reportObj["csp-report"];
+ 
+   // The following uris' fragments should be stripped before reporting:
+   //    * document-uri
+   //    * blocked-uri
+   //    * source-file
+@@ -47,17 +47,17 @@ window.checkResults = function(reportObj
+   // we can not test for the whole referrer since it includes platform specific information
+   ok(cspReport["referrer"].startsWith("http://mochi.test:8888/tests/dom/security/test/csp/test_report.html"),
+      "Incorrect referrer");
+ 
+   is(cspReport["blocked-uri"], "self", "Incorrect blocked-uri");
+ 
+   is(cspReport["violated-directive"], "default-src", "Incorrect violated-directive");
+ 
+-  is(cspReport["original-policy"], "default-src 'none'; report-uri http://mochi.test:8888/foo.sjs",
++  is(cspReport["original-policy"], "default-src 'none' 'report-sample'; report-uri http://mochi.test:8888/foo.sjs",
+      "Incorrect original-policy");
+ 
+   is(cspReport["source-file"], docUri, "Incorrect source-file");
+ 
+   is(cspReport["script-sample"], "\n    var foo = \"propEscFoo\";\n    var bar...",
+      "Incorrect script-sample");
+ 
+   is(cspReport["line-number"], 7, "Incorrect line-number");
+diff --git a/dom/security/test/unit/test_csp_reports.js b/dom/security/test/unit/test_csp_reports.js
+--- a/dom/security/test/unit/test_csp_reports.js
++++ b/dom/security/test/unit/test_csp_reports.js
+@@ -65,17 +65,17 @@ function makeReportHandler(testpath, mes
+  */
+ function makeTest(id, expectedJSON, useReportOnlyPolicy, callback) {
+   testsToFinish++;
+   do_test_pending();
+ 
+   // set up a new CSP instance for each test.
+   var csp = Cc["@mozilla.org/cspcontext;1"]
+               .createInstance(Ci.nsIContentSecurityPolicy);
+-  var policy = "default-src 'none'; " +
++  var policy = "default-src 'none' 'report-sample'; " +
+                "report-uri " + REPORT_SERVER_URI +
+                                ":" + REPORT_SERVER_PORT +
+                                "/test" + id;
+   var selfuri = NetUtil.newURI(REPORT_SERVER_URI +
+                                ":" + REPORT_SERVER_PORT +
+                                "/foo/self");
+ 
+   dump("Created test " + id + " : " + policy + "\n\n");
+diff --git a/toolkit/components/extensions/test/xpcshell/test_ext_contentscript_triggeringPrincipal.js b/toolkit/components/extensions/test/xpcshell/test_ext_contentscript_triggeringPrincipal.js
+--- a/toolkit/components/extensions/test/xpcshell/test_ext_contentscript_triggeringPrincipal.js
++++ b/toolkit/components/extensions/test/xpcshell/test_ext_contentscript_triggeringPrincipal.js
+@@ -1066,17 +1066,17 @@ add_task(async function test_contentscri
+  * content page.
+  */
+ add_task(async function test_contentscript_csp() {
+   // We currently don't get the full set of CSP reports when running in network
+   // scheduling chaos mode (bug 1408193). It's not entirely clear why.
+   let chaosMode = parseInt(env.get("MOZ_CHAOSMODE"), 16);
+   let checkCSPReports = !(chaosMode === 0 || chaosMode & 0x02);
+ 
+-  gContentSecurityPolicy = `default-src 'none'; script-src 'nonce-deadbeef' 'unsafe-eval'; report-uri ${CSP_REPORT_PATH};`;
++  gContentSecurityPolicy = `default-src 'none' 'report-sample'; script-src 'nonce-deadbeef' 'unsafe-eval' 'report-sample'; report-uri ${CSP_REPORT_PATH};`;
+ 
+   let extension = ExtensionTestUtils.loadExtension(EXTENSION_DATA);
+   await extension.startup();
+ 
+   let urlsPromise = extension.awaitMessage("css-sources").then(msg => {
+     return mergeSources(
+       computeExpectedForbiddenURLs(msg, true),
+       computeBaseURLs(TESTS, EXTENSION_SOURCES, PAGE_SOURCES));

frg/work-js/mozilla-release/patches/mozilla-central-push_426737.patch → frg/work-js/mozilla-release/patches/1473587-63a1.patch

@@ -3,13 +3,13 @@
 # Date 1531756684 -7200
 #      Mon Jul 16 17:58:04 2018 +0200
 # Node ID ca44c68906d0395259fbaca282c6e662abdcf481
-# Parent  d686b90e9c64c46ce0c49ab83edff387cda40a38
+# Parent  2acc13d933d0afca6810db5344a0ddcce89237a4
 Bug 1473587 - CSP Violation events should have the correct sample for inline contexts, r=jorendorff, r=ckerschb
 
 diff --git a/caps/nsScriptSecurityManager.cpp b/caps/nsScriptSecurityManager.cpp
 --- a/caps/nsScriptSecurityManager.cpp
 +++ b/caps/nsScriptSecurityManager.cpp
-@@ -466,17 +466,18 @@ NS_IMPL_ISUPPORTS(nsScriptSecurityManage
+@@ -398,17 +398,18 @@ NS_IMPL_ISUPPORTS(nsScriptSecurityManage
  
  ///////////////////////////////////////////////////
  // Methods implementing nsIScriptSecurityManager //
@@ -29,7 +29,7 @@ diff --git a/caps/nsScriptSecurityManager.cpp b/caps/nsScriptSecurityManager.cpp
      NS_ASSERTION(NS_SUCCEEDED(rv), "CSP: Failed to get CSP from principal.");
  
      // don't do anything unless there's a CSP
-@@ -489,22 +490,32 @@ nsScriptSecurityManager::ContentSecurity
+@@ -421,22 +422,32 @@ nsScriptSecurityManager::ContentSecurity
  
      if (NS_FAILED(rv))
      {
@@ -90,7 +90,7 @@ diff --git a/caps/nsScriptSecurityManager.h b/caps/nsScriptSecurityManager.h
 diff --git a/dom/base/nsJSTimeoutHandler.cpp b/dom/base/nsJSTimeoutHandler.cpp
 --- a/dom/base/nsJSTimeoutHandler.cpp
 +++ b/dom/base/nsJSTimeoutHandler.cpp
-@@ -159,17 +159,18 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
+@@ -160,17 +160,18 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
    NS_INTERFACE_MAP_ENTRY(nsITimeoutHandler)
    NS_INTERFACE_MAP_ENTRY(nsISupports)
  NS_INTERFACE_MAP_END
@@ -99,8 +99,8 @@ diff --git a/dom/base/nsJSTimeoutHandler.cpp b/dom/base/nsJSTimeoutHandler.cpp
  NS_IMPL_CYCLE_COLLECTING_RELEASE(nsJSScriptTimeoutHandler)
  
  static bool
--CheckCSPForEval(JSContext* aCx, nsGlobalWindowInner* aWindow, ErrorResult& aError)
-+CheckCSPForEval(JSContext* aCx, nsGlobalWindowInner* aWindow,
+-CheckCSPForEval(JSContext* aCx, nsGlobalWindow* aWindow, ErrorResult& aError)
++CheckCSPForEval(JSContext* aCx, nsGlobalWindow* aWindow,
 +                const nsAString& aExpression, ErrorResult& aError)
  {
    // if CSP is enabled, and setTimeout/setInterval was called with a string,
@@ -110,7 +110,7 @@ diff --git a/dom/base/nsJSTimeoutHandler.cpp b/dom/base/nsJSTimeoutHandler.cpp
      // if there's no document, we don't have to do anything.
      return true;
    }
-@@ -187,32 +188,28 @@ CheckCSPForEval(JSContext* aCx, nsGlobal
+@@ -188,31 +189,27 @@ CheckCSPForEval(JSContext* aCx, nsGlobal
    bool allowsEval = true;
    bool reportViolation = false;
    aError = csp->GetAllowsEval(&reportViolation, &allowsEval);
@@ -133,7 +133,6 @@ diff --git a/dom/base/nsJSTimeoutHandler.cpp b/dom/base/nsJSTimeoutHandler.cpp
      }
  
      csp->LogViolationDetails(nsIContentSecurityPolicy::VIOLATION_TYPE_EVAL,
-                              nullptr, // triggering element
 -                             fileNameString, scriptSample, lineNum, columnNum,
 +                             fileNameString, aExpression, lineNum, columnNum,
                               EmptyString(), EmptyString());
@@ -166,7 +165,7 @@ diff --git a/dom/base/nsJSTimeoutHandler.cpp b/dom/base/nsJSTimeoutHandler.cpp
 diff --git a/dom/events/EventListenerManager.cpp b/dom/events/EventListenerManager.cpp
 --- a/dom/events/EventListenerManager.cpp
 +++ b/dom/events/EventListenerManager.cpp
-@@ -853,40 +853,33 @@ EventListenerManager::SetEventHandler(ns
+@@ -824,43 +824,32 @@ EventListenerManager::SetEventHandler(ns
        return NS_ERROR_DOM_SECURITY_ERR;
      }
  
@@ -189,22 +188,25 @@ diff --git a/dom/events/EventListenerManager.cpp b/dom/events/EventListenerManag
 -      // the script sample in aContent.
 -      nsAutoString scriptSample, attr, tagName(NS_LITERAL_STRING("UNKNOWN"));
 -      aName->ToString(attr);
--      nsCOMPtr<nsINode> domNode(do_QueryInterface(mTarget));
+-      nsCOMPtr<nsIDOMNode> domNode(do_QueryInterface(mTarget));
 -      if (domNode) {
--        tagName = domNode->NodeName();
+-        domNode->GetNodeName(tagName);
 -      }
 -      // build a "script sample" based on what we know about this element
 -      scriptSample.Assign(attr);
 -      scriptSample.AppendLiteral(" attribute on ");
 -      scriptSample.Append(tagName);
 -      scriptSample.AppendLiteral(" element");
+-      nsCOMPtr<nsISupportsString> sampleIString(do_CreateInstance(NS_SUPPORTS_STRING_CONTRACTID));
+-      if (sampleIString) {
+-        sampleIString->SetData(scriptSample);
+-      }
 -
        bool allowsInlineScript = true;
        rv = csp->GetAllowsInline(nsIContentPolicy::TYPE_SCRIPT,
                                  EmptyString(), // aNonce
                                  true, // aParserCreated (true because attribute event handler)
-                                 aElement,
--                                scriptSample,
+-                                sampleIString,
 -                                0,             // aLineNumber
 -                                0,             // aColumnNumber
 +                                aBody,
@@ -221,7 +223,7 @@ diff --git a/dom/events/EventListenerManager.cpp b/dom/events/EventListenerManag
 diff --git a/dom/security/nsCSPContext.cpp b/dom/security/nsCSPContext.cpp
 --- a/dom/security/nsCSPContext.cpp
 +++ b/dom/security/nsCSPContext.cpp
-@@ -488,31 +488,24 @@ nsCSPContext::reportInlineViolation(nsCo
+@@ -483,29 +483,23 @@ nsCSPContext::reportInlineViolation(nsCo
    nsCOMPtr<nsISupports> selfISupports(do_QueryInterface(selfICString));
  
    // use selfURI as the sourceFile
@@ -236,9 +238,7 @@ diff --git a/dom/security/nsCSPContext.cpp b/dom/security/nsCSPContext.cpp
 -    codeSample.Truncate(ScriptSampleMaxLength());
 -    codeSample.AppendLiteral("...");
 -  }
--
-   AsyncReportViolation(aTriggeringElement,
-                        selfISupports,                      // aBlockedContentSource
+   AsyncReportViolation(selfISupports,                      // aBlockedContentSource
                         mSelfURI,                           // aOriginalURI
                         aViolatedDirective,                 // aViolatedDirective
                         aViolatedPolicyIndex,               // aViolatedPolicyIndex
@@ -254,7 +254,7 @@ diff --git a/dom/security/nsCSPContext.cpp b/dom/security/nsCSPContext.cpp
  nsCSPContext::GetAllowsInline(nsContentPolicyType aContentType,
                                const nsAString& aNonce,
                                bool aParserCreated,
-@@ -941,18 +934,29 @@ nsCSPContext::GatherSecurityPolicyViolat
+@@ -938,18 +932,29 @@ nsCSPContext::GatherSecurityPolicyViolat
      if (sourceURI) {
        nsAutoCString spec;
        sourceURI->GetSpecIgnoringRef(spec);
@@ -285,8 +285,8 @@ diff --git a/dom/security/nsCSPContext.cpp b/dom/security/nsCSPContext.cpp
  
    // status-code
    uint16_t statusCode = 0;
-@@ -1306,22 +1310,23 @@ class CSPReportSenderRunnable final : pu
-       // 3) log to console (one per policy violation)
+@@ -1273,22 +1278,23 @@ class CSPReportSenderRunnable final : pu
+       nsCOMPtr<nsIURI> blockedURI = do_QueryInterface(mBlockedContentSource);
        // if mBlockedContentSource is not a URI, it could be a string
        nsCOMPtr<nsISupportsCString> blockedString = do_QueryInterface(mBlockedContentSource);
  
@@ -316,7 +316,7 @@ diff --git a/dom/security/nsCSPContext.cpp b/dom/security/nsCSPContext.cpp
 diff --git a/dom/security/nsCSPContext.h b/dom/security/nsCSPContext.h
 --- a/dom/security/nsCSPContext.h
 +++ b/dom/security/nsCSPContext.h
-@@ -123,16 +123,21 @@ class nsCSPContext : public nsIContentSe
+@@ -116,16 +116,21 @@ class nsCSPContext : public nsIContentSe
      void clearLoadingPrincipal() {
        mLoadingPrincipal = nullptr;
      }
@@ -332,13 +332,13 @@ diff --git a/dom/security/nsCSPContext.h b/dom/security/nsCSPContext.h
 +
    private:
      bool permitsInternal(CSPDirective aDir,
-                          mozilla::dom::Element* aTriggeringElement,
                           nsIURI* aContentLocation,
                           nsIURI* aOriginalURI,
                           const nsAString& aNonce,
                           bool aWasRedirected,
                           bool aIsPreload,
-@@ -148,21 +153,16 @@ class nsCSPContext : public nsIContentSe
+                          bool aSpecific,
+@@ -139,21 +144,16 @@ class nsCSPContext : public nsIContentSe
                                 const nsAString& aContent,
                                 const nsAString& aViolatedDirective,
                                 uint32_t aViolatedPolicyIndex,
@@ -433,7 +433,7 @@ diff --git a/dom/security/test/csp/test_report.html b/dom/security/test/csp/test
 diff --git a/dom/workers/RuntimeService.cpp b/dom/workers/RuntimeService.cpp
 --- a/dom/workers/RuntimeService.cpp
 +++ b/dom/workers/RuntimeService.cpp
-@@ -581,57 +581,73 @@ InterruptCallback(JSContext* aCx)
+@@ -586,57 +586,73 @@ InterruptCallback(JSContext* aCx)
    return worker->InterruptCallback(aCx);
  }
  
@@ -510,7 +510,7 @@ diff --git a/dom/workers/RuntimeService.cpp b/dom/workers/RuntimeService.cpp
      }
    }
  
-@@ -2633,22 +2649,20 @@ RuntimeService::Observe(nsISupports* aSu
+@@ -2831,21 +2847,19 @@ RuntimeService::WorkerPrefChanged(const 
  
  bool
  LogViolationDetailsRunnable::MainThreadRun()
@@ -523,7 +523,6 @@ diff --git a/dom/workers/RuntimeService.cpp b/dom/workers/RuntimeService.cpp
 -        "Call to eval() or related function blocked by CSP.");
      if (mWorkerPrivate->GetReportCSPViolations()) {
        csp->LogViolationDetails(nsIContentSecurityPolicy::VIOLATION_TYPE_EVAL,
-                                nullptr, // triggering element
 -                               mFileName, scriptSample, mLineNum, mColumnNum,
 +                               mFileName, mScriptSample, mLineNum, mColumnNum,
                                 EmptyString(), EmptyString());
@@ -533,7 +532,7 @@ diff --git a/dom/workers/RuntimeService.cpp b/dom/workers/RuntimeService.cpp
    return true;
  }
  
- NS_IMETHODIMP
+ NS_IMPL_ISUPPORTS_INHERITED0(WorkerThreadPrimaryRunnable, Runnable)
 diff --git a/js/public/Principals.h b/js/public/Principals.h
 --- a/js/public/Principals.h
 +++ b/js/public/Principals.h
@@ -605,7 +604,7 @@ diff --git a/js/src/builtin/Eval.cpp b/js/src/builtin/Eval.cpp
 diff --git a/js/src/vm/GlobalObject.cpp b/js/src/vm/GlobalObject.cpp
 --- a/js/src/vm/GlobalObject.cpp
 +++ b/js/src/vm/GlobalObject.cpp
-@@ -674,27 +674,33 @@ GlobalObject::initSelfHostingBuiltins(JS
+@@ -706,27 +706,33 @@ GlobalObject::initSelfHostingBuiltins(JS
             InitBareBuiltinCtor(cx, global, JSProto_TypedArray) &&
             InitBareBuiltinCtor(cx, global, JSProto_Uint8Array) &&
             InitBareBuiltinCtor(cx, global, JSProto_Int32Array) &&
@@ -646,7 +645,7 @@ diff --git a/js/src/vm/GlobalObject.cpp b/js/src/vm/GlobalObject.cpp
 diff --git a/js/src/vm/GlobalObject.h b/js/src/vm/GlobalObject.h
 --- a/js/src/vm/GlobalObject.h
 +++ b/js/src/vm/GlobalObject.h
-@@ -734,17 +734,18 @@ class GlobalObject : public NativeObject
+@@ -737,17 +737,18 @@ class GlobalObject : public NativeObject
  
      bool hasRegExpStatics() const;
      static RegExpStatics* getRegExpStatics(JSContext* cx,
@@ -718,117 +717,3 @@ diff --git a/js/src/vm/JSFunction.cpp b/js/src/vm/JSFunction.cpp
       */
      RootedAtom anonymousAtom(cx, cx->names().anonymous);
  
-diff --git a/testing/web-platform/meta/content-security-policy/securitypolicyviolation/script-sample.html.ini b/testing/web-platform/meta/content-security-policy/securitypolicyviolation/script-sample.html.ini
---- a/testing/web-platform/meta/content-security-policy/securitypolicyviolation/script-sample.html.ini
-+++ b/testing/web-platform/meta/content-security-policy/securitypolicyviolation/script-sample.html.ini
-@@ -4,20 +4,16 @@
-     expected: FAIL
- 
-   [Inline event handlers should have a sample.]
-     expected: FAIL
- 
-   [JavaScript URLs in iframes should have a sample.]
-     expected: TIMEOUT
- 
--  [eval() should not have a sample.]
--    expected: TIMEOUT
--
-   [eval() should have a sample.]
-     expected: TIMEOUT
- 
-   [setInterval() should have a sample.]
-     expected: TIMEOUT
- 
-   [setTimeout() should have a sample.]
-     expected: TIMEOUT
--
-diff --git a/testing/web-platform/meta/content-security-policy/unsafe-hashes/script_event_handlers_allowed.html.ini b/testing/web-platform/meta/content-security-policy/unsafe-hashes/script_event_handlers_allowed.html.ini
-deleted file mode 100644
---- a/testing/web-platform/meta/content-security-policy/unsafe-hashes/script_event_handlers_allowed.html.ini
-+++ /dev/null
-@@ -1,4 +0,0 @@
--[script_event_handlers_allowed.html]
--  [Test that the inline event handler is allowed to run]
--    expected: FAIL
--
-diff --git a/testing/web-platform/meta/content-security-policy/unsafe-hashes/script_event_handlers_denied_missing_unsafe_hashes.html.ini b/testing/web-platform/meta/content-security-policy/unsafe-hashes/script_event_handlers_denied_missing_unsafe_hashes.html.ini
---- a/testing/web-platform/meta/content-security-policy/unsafe-hashes/script_event_handlers_denied_missing_unsafe_hashes.html.ini
-+++ b/testing/web-platform/meta/content-security-policy/unsafe-hashes/script_event_handlers_denied_missing_unsafe_hashes.html.ini
-@@ -1,4 +1,5 @@
- [script_event_handlers_denied_missing_unsafe_hashes.html]
-+  expected: TIMEOUT
-   [Test that the inline event handler is not allowed to run]
--    expected: FAIL
-+    expected: NOTRUN
- 
-diff --git a/testing/web-platform/tests/content-security-policy/securitypolicyviolation/targeting.html b/testing/web-platform/tests/content-security-policy/securitypolicyviolation/targeting.html
---- a/testing/web-platform/tests/content-security-policy/securitypolicyviolation/targeting.html
-+++ b/testing/web-platform/tests/content-security-policy/securitypolicyviolation/targeting.html
-@@ -30,33 +30,40 @@
-             }))
-             .then(t.step_func(e => {
-                 assert_equals(e.blockedURI, "inline");
-                 assert_equals(e.target, document.querySelector('#block5'));
-                 return watcher.wait_for('securitypolicyviolation');
-             }))
-             .then(t.step_func(e => {
-                 assert_equals(e.blockedURI, "inline");
--                assert_equals(e.lineNumber, 135);
--                assert_equals(e.columnNumber, 7);
--                assert_equals(e.target, document, "Disconnected elements target the document");
-+                assert_equals(e.lineNumber, 118);
-+                assert_equals(e.columnNumber, 4);
-+                assert_equals(e.target, document, "Elements created in this document, but pushed into a same-origin frame trigger on that frame's document, not on this frame's document.");
-                 return watcher.wait_for('securitypolicyviolation');
-             }))
-             .then(t.step_func(e => {
-                 assert_equals(e.blockedURI, "inline");
--                assert_equals(e.lineNumber, 146);
--                assert_equals(e.columnNumber, 7);
--                assert_equals(e.target, document, "Elements disconnected after triggering target the document.");
-+                assert_equals(e.lineNumber, 131);
-+                assert_equals(e.columnNumber, 4);
-+                assert_equals(e.target, document, "Elements created in this document, but pushed into a same-origin frame trigger on that frame's document, not on this frame's document.");
-                 return watcher.wait_for('securitypolicyviolation');
-             }))
-             .then(t.step_func(e => {
-                 assert_equals(e.blockedURI, "inline");
--                assert_equals(e.lineNumber, 160);
--                assert_equals(e.columnNumber, 7);
--                assert_equals(e.target, document, "Elements in DocumentFragments target the document");
-+                assert_equals(e.lineNumber, 139);
-+                assert_equals(e.columnNumber, 4);
-+                assert_equals(e.target, document, "Inline event handlers for disconnected elements target the document.");
-+                return watcher.wait_for('securitypolicyviolation');
-+            }))
-+            .then(t.step_func(e => {
-+                assert_equals(e.blockedURI, "inline");
-+                assert_equals(e.lineNumber, 0);
-+                assert_equals(e.columnNumber, 0);
-+                assert_equals(e.target, document, "Inline event handlers for elements disconnected after triggering target the document.");
-             }))
-             .then(t.step_func_done(_ => {
-                 unexecuted_test.done();
-             }));
-     }, "Inline violations target the right element.");
- 
- </script>
- <!-- Inline block with no nonce. -->
-@@ -117,17 +124,16 @@
-     }));
-     document.querySelector('#block6').contentDocument.addEventListener('securitypolicyviolation', t.step_func_done(e => {
-       events++;
-       assert_equals(e.blockedURI, "inline");
-       assert_equals(e.target, d);
-       assert_equals(events, 2);
-     }));
-     document.querySelector('#block6').contentDocument.body.appendChild(d);
--    d.click();
-   }, "Elements created in this document, but pushed into a same-origin frame trigger on that frame's document, not on this frame's document.");
- </script>
- 
- <!-- Disconnected inline event handler -->
- <script nonce="abc">
-   async_test(t => {
-     var d = document.createElement("div");
-     d.setAttribute("onclick", "void(0);");

frg/work-js/mozilla-release/patches/mozilla-central-push_427428.patch → frg/work-js/mozilla-release/patches/1476383-63a1.patch

@@ -1,7 +1,6 @@
 # HG changeset patch
 # User Steve Fink <sfink@mozilla.com>
 # Date 1531952541 25200
-#      Wed Jul 18 15:22:21 2018 -0700
 # Node ID f4963b77d3894e0d8e2c5ec63b7d57f19fc0d8b0
 # Parent  1134174a8b6a87d484d9bb09234629e79b4446c0
 Bug 1476383 - cx->pod_callocCanGC can set an exception when succeeding, r=pbone
@@ -48,3 +47,4 @@ diff --git a/js/src/vm/JSContext.h b/js/src/vm/JSContext.h
              return nullptr;
          }
          p = static_cast<T*>(runtime()->onOutOfMemoryCanGC(js::AllocFunction::Calloc, bytes));
+

frg/work-js/mozilla-release/patches/mozilla-central-push_427442.patch → frg/work-js/mozilla-release/patches/1476500-2-63a1.patch

@@ -3,13 +3,13 @@
 # Date 1532054553 -36000
 #      Fri Jul 20 12:42:33 2018 +1000
 # Node ID 47be709bc6ca985c41a9c5fff89c2e1cc4abfce1
-# Parent  6db05e2cc96ff33736d32787bb6e333386a45e0e
+# Parent  bbc3feebba58a7345a55891dedb8545492eccba3
 Bug 1476500 - Add extra assignments and make some types more specific r=nbp
 
 diff --git a/js/src/gc/ArenaList.h b/js/src/gc/ArenaList.h
 --- a/js/src/gc/ArenaList.h
 +++ b/js/src/gc/ArenaList.h
-@@ -236,17 +236,17 @@ class FreeLists
+@@ -237,17 +237,17 @@ class FreeLists
      inline void clear();
  
      MOZ_ALWAYS_INLINE TenuredCell* allocate(AllocKind kind);
@@ -28,7 +28,7 @@ diff --git a/js/src/gc/ArenaList.h b/js/src/gc/ArenaList.h
  {
      JS::Zone* zone_;
  
-@@ -293,17 +293,17 @@ class ArenaLists
+@@ -294,17 +294,17 @@ class ArenaLists
  
    public:
      explicit ArenaLists(JS::Zone* zone);
@@ -50,10 +50,10 @@ diff --git a/js/src/gc/ArenaList.h b/js/src/gc/ArenaList.h
 diff --git a/js/src/gc/GCRuntime.h b/js/src/gc/GCRuntime.h
 --- a/js/src/gc/GCRuntime.h
 +++ b/js/src/gc/GCRuntime.h
-@@ -288,17 +288,19 @@ class GCRuntime
- 
+@@ -289,17 +289,19 @@ class GCRuntime
      void purgeRuntimeForMinorGC();
  
+     void notifyDidPaint();
      void shrinkBuffers();
      void onOutOfMallocMemory();
      void onOutOfMallocMemory(const AutoLockGC& lock);
@@ -71,7 +71,7 @@ diff --git a/js/src/gc/GCRuntime.h b/js/src/gc/GCRuntime.h
      void maybeVerifyPreBarriers(bool always);
      bool selectForMarking(JSObject* object);
      void clearSelectedForMarking();
-@@ -1000,17 +1002,17 @@ class GCRuntime
+@@ -1008,17 +1010,17 @@ class GCRuntime
    public:
      Nursery& nursery() { return nursery_.ref(); }
      gc::StoreBuffer& storeBuffer() { return storeBuffer_.ref(); }
@@ -93,7 +93,7 @@ diff --git a/js/src/gc/GCRuntime.h b/js/src/gc/GCRuntime.h
 diff --git a/js/src/gc/Nursery.h b/js/src/gc/Nursery.h
 --- a/js/src/gc/Nursery.h
 +++ b/js/src/gc/Nursery.h
-@@ -319,19 +319,21 @@ class Nursery
+@@ -320,19 +320,21 @@ class Nursery
      void renderProfileJSON(JSONPrinter& json) const;
  
      /* Print header line for profile times. */
@@ -121,7 +121,7 @@ diff --git a/js/src/gc/Nursery.h b/js/src/gc/Nursery.h
 diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
 --- a/js/src/jit/CodeGenerator.cpp
 +++ b/js/src/jit/CodeGenerator.cpp
-@@ -4044,18 +4044,19 @@ CodeGenerator::maybeEmitGlobalBarrierChe
+@@ -4037,18 +4037,19 @@ CodeGenerator::maybeEmitGlobalBarrierChe
  
      if (!maybeGlobal->isConstant())
          return;
@@ -143,7 +143,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
  {
      addOutOfLineCode(ool, lir->mir());
  
-@@ -13281,17 +13282,18 @@ CodeGenerator::visitRandom(LRandom* ins)
+@@ -13275,17 +13276,18 @@ CodeGenerator::visitRandom(LRandom* ins)
  #ifdef JS_PUNBOX64
      Register64 s0Reg(ToRegister(ins->temp1()));
      Register64 s1Reg(ToRegister(ins->temp2()));
@@ -338,7 +338,7 @@ diff --git a/js/src/jit/MacroAssembler-inl.h b/js/src/jit/MacroAssembler-inl.h
 diff --git a/js/src/jit/MacroAssembler.cpp b/js/src/jit/MacroAssembler.cpp
 --- a/js/src/jit/MacroAssembler.cpp
 +++ b/js/src/jit/MacroAssembler.cpp
-@@ -813,19 +813,20 @@ void
+@@ -879,19 +879,20 @@ void
  MacroAssembler::checkAllocatorState(Label* fail)
  {
      // Don't execute the inline path if we are tracing allocations.
@@ -362,7 +362,7 @@ diff --git a/js/src/jit/MacroAssembler.cpp b/js/src/jit/MacroAssembler.cpp
          jump(fail);
  }
  
-@@ -858,20 +859,23 @@ MacroAssembler::nurseryAllocateObject(Re
+@@ -924,20 +925,23 @@ MacroAssembler::nurseryAllocateObject(Re
      }
  
      // No explicit check for nursery.isEnabled() is needed, as the comparison
@@ -389,7 +389,7 @@ diff --git a/js/src/jit/MacroAssembler.cpp b/js/src/jit/MacroAssembler.cpp
  }
  
  // Inlined version of FreeSpan::allocate. This does not fill in slots_.
-@@ -881,35 +885,36 @@ MacroAssembler::freeListAllocate(Registe
+@@ -947,35 +951,36 @@ MacroAssembler::freeListAllocate(Registe
      CompileZone* zone = GetJitContext()->realm->zone();
      int thingSize = int(gc::Arena::thingSize(allocKind));
  
@@ -432,7 +432,7 @@ diff --git a/js/src/jit/MacroAssembler.cpp b/js/src/jit/MacroAssembler.cpp
 diff --git a/js/src/vm/Realm.h b/js/src/vm/Realm.h
 --- a/js/src/vm/Realm.h
 +++ b/js/src/vm/Realm.h
-@@ -807,17 +807,18 @@ class JS::Realm : public JS::shadow::Rea
+@@ -815,17 +815,18 @@ class JS::Realm : public JS::shadow::Rea
      // scripts.
      bool ensureDelazifyScriptsForDebugger(JSContext* cx);
  

frg/work-js/mozilla-release/patches/1480720-63a1.patch

@@ -2,7 +2,7 @@
 # User Jon Coppeard <jcoppeard@mozilla.com>
 # Date 1533549268 -3600
 # Node ID 5f9c8d7612a7e44685a7c64815d86f5299f1b8b3
-# Parent  7d9946c59d5963256ba7c8636707387024fc878b
+# Parent  9f80b0b6c87db6dfb8ebda32d425dbd74e005468
 Bug 1480720 - Factor out script fetch options from script load request classes r=baku
 
 diff --git a/dom/script/ModuleLoadRequest.cpp b/dom/script/ModuleLoadRequest.cpp
@@ -594,7 +594,7 @@ diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
        MOZ_ASSERT(NS_SUCCEEDED(rv));
      }
    }
-@@ -1169,30 +1169,31 @@ CSPAllowsInlineScript(nsIScriptElement* 
+@@ -1170,30 +1170,31 @@ CSPAllowsInlineScript(nsIScriptElement* 
                              &allowInlineScript);
    return allowInlineScript;
  }
@@ -630,7 +630,7 @@ diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
    // We need a document to evaluate scripts.
    NS_ENSURE_TRUE(mDocument, false);
  
-@@ -1312,19 +1313,18 @@ ScriptLoader::ProcessExternalScript(nsIS
+@@ -1313,19 +1314,18 @@ ScriptLoader::ProcessExternalScript(nsIS
  
      nsCOMPtr<nsIPrincipal> principal = aElement->GetScriptURITriggeringPrincipal();
      if (!principal) {
@@ -651,7 +651,7 @@ diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
  
      LOG(("ScriptLoadRequest (%p): Created request for external script",
           request.get()));
-@@ -1453,25 +1453,25 @@ ScriptLoader::ProcessInlineScript(nsIScr
+@@ -1454,25 +1454,25 @@ ScriptLoader::ProcessInlineScript(nsIScr
    // Inline classic scripts ignore their CORS mode and are always CORS_NONE.
    CORSMode corsMode = CORS_NONE;
    if (aScriptKind == ScriptKind::eModule) {
@@ -679,7 +679,7 @@ diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
    request->SetScriptMode(false, aElement->GetScriptAsync());
  
    LOG(("ScriptLoadRequest (%p): Created request for inline script",
-@@ -1545,27 +1545,27 @@ ScriptLoader::LookupPreloadRequest(nsISc
+@@ -1546,27 +1546,27 @@ ScriptLoader::LookupPreloadRequest(nsISc
      mPreloads.IndexOf(aElement->GetScriptURI(), 0, PreloadURIComparator());
    if (i == nsTArray<PreloadInfo>::NoIndex) {
      return nullptr;
@@ -710,7 +710,7 @@ diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
  
    return request;
  }
-@@ -1818,17 +1818,17 @@ SourceBufferHolder
+@@ -1819,17 +1819,17 @@ SourceBufferHolder
  ScriptLoader::GetScriptSource(JSContext* aCx, ScriptLoadRequest* aRequest)
  {
    // Return a SourceBufferHolder object holding the script's source text.
@@ -729,7 +729,7 @@ diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
      return SourceBufferHolder(std::move(chars), inlineData.Length());
    }
  
-@@ -1861,31 +1861,31 @@ ScriptLoader::ProcessRequest(ScriptLoadR
+@@ -1862,31 +1862,31 @@ ScriptLoader::ProcessRequest(ScriptLoadR
      if (!request->mModuleScript) {
        // There was an error fetching a module script.  Nothing to do here.
        LOG(("ScriptLoadRequest (%p):   Error loading request, firing error", aRequest));
@@ -765,7 +765,7 @@ diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
  
    {
      // Try to perform a microtask checkpoint
-@@ -1920,17 +1920,17 @@ ScriptLoader::ProcessRequest(ScriptLoadR
+@@ -1921,17 +1921,17 @@ ScriptLoader::ProcessRequest(ScriptLoadR
      nsContentUtils::DispatchTrustedEvent(scriptElem->OwnerDoc(),
                                           scriptElem,
                                           NS_LITERAL_STRING("afterscriptexecute"),
@@ -784,7 +784,7 @@ diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
    if (aRequest->mOffThreadToken) {
      // The request was parsed off-main-thread, but the result of the off
      // thread parse was not actually needed to process the request
-@@ -1954,31 +1954,31 @@ ScriptLoader::ProcessRequest(ScriptLoadR
+@@ -1955,31 +1955,31 @@ ScriptLoader::ProcessRequest(ScriptLoadR
  }
  
  void
@@ -818,7 +818,7 @@ diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
  
  already_AddRefed<nsIScriptGlobalObject>
  ScriptLoader::GetScriptGlobalObject()
-@@ -2039,18 +2039,18 @@ ScriptLoader::FillCompileOptionsForReque
+@@ -2040,18 +2040,18 @@ ScriptLoader::FillCompileOptionsForReque
      aOptions->setMutedErrors(!subsumes);
    }
  
@@ -839,7 +839,7 @@ diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
    }
  
    return NS_OK;
-@@ -2147,17 +2147,17 @@ ScriptLoader::EvaluateScript(ScriptLoadR
+@@ -2148,17 +2148,17 @@ ScriptLoader::EvaluateScript(ScriptLoadR
    using namespace mozilla::Telemetry;
    MOZ_ASSERT(aRequest->IsReadyToRun());
  
@@ -858,7 +858,7 @@ diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
  
    // Get the script-type to be used by this element.
    NS_ASSERTION(scriptContent, "no content - what is default script-type?");
-@@ -2208,17 +2208,17 @@ ScriptLoader::EvaluateScript(ScriptLoadR
+@@ -2209,17 +2209,17 @@ ScriptLoader::EvaluateScript(ScriptLoadR
          JS_SetPendingException(cx, error);
          return NS_OK; // An error is reported by AutoEntryScript.
        }
@@ -877,7 +877,7 @@ diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
          JS::ExposeScriptToDebugger(cx, script);
        }
  
-@@ -2227,24 +2227,24 @@ ScriptLoader::EvaluateScript(ScriptLoadR
+@@ -2228,24 +2228,24 @@ ScriptLoader::EvaluateScript(ScriptLoadR
        if (NS_FAILED(rv)) {
          LOG(("ScriptLoadRequest (%p):   evaluation failed", aRequest));
          rv = NS_OK; // An error is reported by AutoEntryScript.
@@ -904,7 +904,7 @@ diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
              LOG(("ScriptLoadRequest (%p): Decode Bytecode and Execute", aRequest));
              rv = exec.DecodeAndExec(options, aRequest->mScriptBytecode,
                                      aRequest->mBytecodeOffset);
-@@ -2255,17 +2255,17 @@ ScriptLoader::EvaluateScript(ScriptLoadR
+@@ -2256,17 +2256,17 @@ ScriptLoader::EvaluateScript(ScriptLoadR
          } else {
            MOZ_ASSERT(aRequest->IsSource());
            JS::Rooted<JSScript*> script(cx);
@@ -923,7 +923,7 @@ diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
                rv = exec.JoinAndExec(&aRequest->mOffThreadToken, &script);
              } else {
                // Main thread parsing (inline and small scripts)
-@@ -2275,23 +2275,23 @@ ScriptLoader::EvaluateScript(ScriptLoadR
+@@ -2276,23 +2276,23 @@ ScriptLoader::EvaluateScript(ScriptLoadR
                rv = exec.CompileAndExec(options, srcBuf, &script);
              }
            }
@@ -949,7 +949,7 @@ diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
  
      // Even if we are not saving the bytecode of the current script, we have
      // to trigger the encoding of the bytecode, as the current script can
-@@ -2402,17 +2402,17 @@ ScriptLoader::EncodeBytecode()
+@@ -2403,17 +2403,17 @@ ScriptLoader::EncodeBytecode()
  
  void
  ScriptLoader::EncodeRequestBytecode(JSContext* aCx, ScriptLoadRequest* aRequest)
@@ -968,7 +968,7 @@ diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
           aRequest));
      return;
    }
-@@ -2446,17 +2446,17 @@ ScriptLoader::EncodeRequestBytecode(JSCo
+@@ -2447,17 +2447,17 @@ ScriptLoader::EncodeRequestBytecode(JSCo
                       aRequest->mScriptBytecode.length(), &n);
    LOG(("ScriptLoadRequest (%p): Write bytecode cache (rv = %X, length = %u, written = %u)",
         aRequest, unsigned(rv), unsigned(aRequest->mScriptBytecode.length()), n));
@@ -987,7 +987,7 @@ diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
    // If the document went away prematurely, we still want to set this, in order
    // to avoid queuing more scripts.
    mGiveUpEncoding = true;
-@@ -2473,17 +2473,17 @@ ScriptLoader::GiveUpBytecodeEncoding()
+@@ -2474,17 +2474,17 @@ ScriptLoader::GiveUpBytecodeEncoding()
      if (context) {
        aes.emplace(globalObject, "give-up bytecode encoding", true);
      }
@@ -1006,7 +1006,7 @@ diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
      }
  
      request->mScriptBytecode.clearAndFree();
-@@ -2791,17 +2791,18 @@ ScriptLoader::VerifySRI(ScriptLoadReques
+@@ -2792,18 +2792,18 @@ ScriptLoader::VerifySRI(ScriptLoadReques
  
      if (loadInfo && loadInfo->GetEnforceSRI()) {
        MOZ_LOG(SRILogHelper::GetSriLog(), mozilla::LogLevel::Debug,
@@ -1016,17 +1016,18 @@ diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
        nsAutoCString violationURISpec;
        mDocument->GetDocumentURI()->GetAsciiSpec(violationURISpec);
 -      uint32_t lineNo = aRequest->mElement ? aRequest->mElement->GetScriptLineNumber() : 0;
+-      uint32_t columnNo = aRequest->mElement ? aRequest->mElement->GetScriptColumnNumber() : 0;
 +      uint32_t lineNo = aRequest->Element() ? aRequest->Element()->GetScriptLineNumber() : 0;
-+//     uint32_t columnNo = aRequest->Element() ? aRequest->Element()->GetScriptColumnNumber() : 0;
++      uint32_t columnNo = aRequest->Element() ? aRequest->Element()->GetScriptColumnNumber() : 0;
        csp->LogViolationDetails(
          nsIContentSecurityPolicy::VIOLATION_TYPE_REQUIRE_SRI_FOR_SCRIPT,
          NS_ConvertUTF8toUTF16(violationURISpec),
-         EmptyString(), lineNo, EmptyString(), EmptyString());
+         EmptyString(), lineNo, columnNo, EmptyString(), EmptyString());
        rv = NS_ERROR_SRI_CORRUPT;
      }
    }
  
-@@ -2855,17 +2856,17 @@ ScriptLoader::SaveSRIHash(ScriptLoadRequ
+@@ -2857,17 +2857,17 @@ ScriptLoader::SaveSRIHash(ScriptLoadRequ
  }
  
  void
@@ -1045,7 +1046,7 @@ diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
    if (aResult == NS_ERROR_MALFORMED_URI) {
      message =
        isScript ? "ScriptSourceMalformed" : "ModuleSourceMalformed";
-@@ -2876,17 +2877,18 @@ ScriptLoader::ReportErrorToConsole(Scrip
+@@ -2878,18 +2878,18 @@ ScriptLoader::ReportErrorToConsole(Scrip
    } else {
      message =
        isScript ? "ScriptSourceLoadFailed" : "ModuleSourceLoadFailed";
@@ -1055,17 +1056,18 @@ diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
    const char16_t* params[] = { url.get() };
  
 -  uint32_t lineNo = aRequest->mElement->GetScriptLineNumber();
+-  uint32_t columnNo = aRequest->mElement->GetScriptColumnNumber();
 +  uint32_t lineNo = aRequest->Element()->GetScriptLineNumber();
-+//   uint32_t columnNo = aRequest->Element()->GetScriptColumnNumber();
++  uint32_t columnNo = aRequest->Element()->GetScriptColumnNumber();
  
    nsContentUtils::ReportToConsole(nsIScriptError::warningFlag,
                                    NS_LITERAL_CSTRING("Script Loader"), mDocument,
                                    nsContentUtils::eDOM_PROPERTIES, message,
                                    params, ArrayLength(params), nullptr,
-                                   EmptyString(), lineNo);
+                                   EmptyString(), lineNo, columnNo);
  }
  
-@@ -2894,17 +2896,17 @@ void
+@@ -2897,17 +2897,17 @@ void
  ScriptLoader::HandleLoadError(ScriptLoadRequest *aRequest, nsresult aResult)
  {
    /*
@@ -1084,7 +1086,7 @@ diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
      SetModuleFetchFinishedAndResumeWaitingRequests(request, aResult);
    }
  
-@@ -2939,22 +2941,22 @@ ScriptLoader::HandleLoadError(ScriptLoad
+@@ -2942,22 +2942,22 @@ ScriptLoader::HandleLoadError(ScriptLoad
      MOZ_ASSERT(!modReq->isInList());
      modReq->Cancel();
      // A single error is fired for the top level module.
@@ -1110,7 +1112,7 @@ diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
        aRequest->Cancel();
      }
      if (aRequest->IsTopLevel()) {
-@@ -2966,23 +2968,23 @@ ScriptLoader::HandleLoadError(ScriptLoad
+@@ -2969,23 +2969,23 @@ ScriptLoader::HandleLoadError(ScriptLoad
      MOZ_ASSERT(aRequest->IsCanceled());
      MOZ_ASSERT(!aRequest->isInList());
    }
@@ -1136,7 +1138,7 @@ diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
    if (mNumberOfProcessors > 0)
      return mNumberOfProcessors;
  
-@@ -3052,17 +3054,17 @@ ScriptLoader::PrepareLoadedRequest(Scrip
+@@ -3055,17 +3055,17 @@ ScriptLoader::PrepareLoadedRequest(Scrip
        aRequest->SetIsTracking();
      }
    }
@@ -1155,7 +1157,7 @@ diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
    // This assertion could fire errorously if we ran out of memory when
    // inserting the request in the array. However it's an unlikely case
    // so if you see this assertion it is likely something else that is
-@@ -3206,19 +3208,19 @@ ScriptLoader::PreloadURI(nsIURI* aURI,
+@@ -3209,19 +3209,19 @@ ScriptLoader::PreloadURI(nsIURI* aURI,
      return;
    }
  

frg/work-js/mozilla-release/patches/1485347-1-63a1.patch

@@ -3,7 +3,7 @@
 # Date 1534962482 14400
 #      Wed Aug 22 14:28:02 2018 -0400
 # Node ID a6aa090e485ef4e81fc6e090e12ab6d2019f21aa
-# Parent  47fe229461d185434e43425add9242075bdab551
+# Parent  893f7c9a80c0640d16803a05137e7081b8ccf12d
 Bug 1485347 - Part 1: Remove nTypeSets argument from JSScript::partiallyInit. r=jandem
 
 MozReview-Commit-ID: I6xBHG8FLlq
@@ -11,7 +11,7 @@ MozReview-Commit-ID: I6xBHG8FLlq
 diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
 --- a/js/src/vm/JSScript.cpp
 +++ b/js/src/vm/JSScript.cpp
-@@ -543,25 +543,28 @@ js::XDRScript(XDRState<mode>* xdr, Handl
+@@ -545,25 +545,28 @@ js::XDRScript(XDRState<mode>* xdr, Handl
      } else {
          // When encoding, we do not mutate any of the JSScript or LazyScript, so
          // we can safely unwrap it here.
@@ -41,7 +41,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
              script->bitFields_.explicitUseStrict_ = true;
          if (scriptBits & (1 << ContainsDynamicNameAccess))
              script->bitFields_.bindingsAccessedDynamically_ = true;
-@@ -2752,30 +2755,27 @@ AllocScriptData(JS::Zone* zone, size_t s
+@@ -2753,31 +2756,28 @@ AllocScriptData(JSContext* cx, size_t si
          return nullptr;
      MOZ_ASSERT(size_t(data) % sizeof(Value) == 0);
      return data;
@@ -53,13 +53,14 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
 -                        uint32_t nscopenotes, uint32_t nyieldoffsets, uint32_t nTypeSets)
 +                        uint32_t nscopenotes, uint32_t nyieldoffsets)
  {
+     assertSameCompartment(cx, script);
+ 
      size_t size = ScriptDataSize(nscopes, nconsts, nobjects, ntrynotes,
                                   nscopenotes, nyieldoffsets);
-     script->data = AllocScriptData(script->zone(), size);
-     if (size && !script->data) {
-         ReportOutOfMemory(cx);
+     script->data = AllocScriptData(cx, size);
+     if (size && !script->data)
          return false;
-     }
+ 
      script->dataSize_ = size;
  
 -    MOZ_ASSERT(nTypeSets <= UINT16_MAX);
@@ -73,7 +74,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
  
      if (nconsts != 0) {
          script->setHasArray(CONSTS);
-@@ -2856,23 +2856,24 @@ JSScript::initFunctionPrototype(JSContex
+@@ -2858,23 +2858,24 @@ JSScript::initFunctionPrototype(JSContex
                                  HandleFunction functionProto)
  {
      uint32_t numScopes = 1;
@@ -100,7 +101,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
      script->scopes()->vector[0].init(functionProtoScope);
  
      uint32_t codeLength = 1;
-@@ -2971,24 +2972,24 @@ JSScript::fullyInitFromEmitter(JSContext
+@@ -2973,24 +2974,24 @@ JSScript::fullyInitFromEmitter(JSContext
      uint32_t prologueLength = bce->prologueOffset();
      uint32_t nsrcnotes;
      if (!bce->finishTakingSrcNotes(&nsrcnotes))

frg/work-js/mozilla-release/patches/1488698-7-WIP-64a1.patch

@@ -3,7 +3,7 @@
 # Date 1536225329 -7200
 #      Thu Sep 06 11:15:29 2018 +0200
 # Node ID 3810b18e5e79dc6a5204a2df01bfaafc40f0573e
-# Parent  db6ed56575b771af73419a4cb17892031cf44f3b
+# Parent  840e93d1d970b363e7d5f1d7057a398602ccb181
 Bug 1488698 - Always use braces for if/for/while statements in js/src/vm, part 7. r=jorendorff
 
 diff --git a/js/src/vm/JSAtom-inl.h b/js/src/vm/JSAtom-inl.h
@@ -2649,7 +2649,7 @@ new file mode 100644
 diff --git a/js/src/vm/JSContext.h b/js/src/vm/JSContext.h
 --- a/js/src/vm/JSContext.h
 +++ b/js/src/vm/JSContext.h
-@@ -611,18 +611,19 @@ struct JSContext : public JS::RootingCon
+@@ -632,18 +632,19 @@ struct JSContext : public JS::RootingCon
      js::ThreadData<js::UniquePtr<js::jit::PcScriptCache>> ionPcScriptCache;
  
    private:
@@ -2670,7 +2670,7 @@ diff --git a/js/src/vm/JSContext.h b/js/src/vm/JSContext.h
      js::ThreadData<bool> overRecursed_;
  
      // True if propagating a forced return from an interrupt handler during
-@@ -689,18 +690,19 @@ struct JSContext : public JS::RootingCon
+@@ -710,18 +711,19 @@ struct JSContext : public JS::RootingCon
       *
       * New activations will reset this to nullptr on construction after getting
       * the current value, and will restore the previous value on destruction.
@@ -4328,7 +4328,7 @@ diff --git a/js/src/vm/JSFunction.cpp b/js/src/vm/JSFunction.cpp
      if (isSelfHostedBuiltin() &&
          (!isExtended() || !getExtendedSlot(LAZY_FUNCTION_NAME_SLOT).isString()))
      {
-@@ -2005,63 +2127,70 @@ JSFunction::isBuiltinFunctionConstructor
+@@ -2006,63 +2128,70 @@ JSFunction::isBuiltinFunctionConstructor
      return maybeNative() == Function || maybeNative() == Generator;
  }
  
@@ -4407,7 +4407,7 @@ diff --git a/js/src/vm/JSFunction.cpp b/js/src/vm/JSFunction.cpp
  {
      // Assert that the terminating environment is null, global, or a debug
      // scope proxy. All other cases of polluting global scope behavior are
-@@ -2384,24 +2513,26 @@ NameToFunctionName(JSContext* cx, Handle
+@@ -2385,24 +2514,26 @@ NameToFunctionName(JSContext* cx, Handle
   */
  JSAtom*
  js::IdToFunctionName(JSContext* cx, HandleId id,
@@ -4436,7 +4436,7 @@ diff --git a/js/src/vm/JSFunction.cpp b/js/src/vm/JSFunction.cpp
  
  bool
  js::SetFunctionNameIfNoOwnName(JSContext* cx, HandleFunction fun, HandleValue name,
-@@ -2414,28 +2545,30 @@ js::SetFunctionNameIfNoOwnName(JSContext
+@@ -2415,28 +2546,30 @@ js::SetFunctionNameIfNoOwnName(JSContext
      // end up not adding a new inferred name if |fun| is a class constructor.
      if (fun->hasInferredName()) {
          MOZ_ASSERT(fun->isSingleton());
@@ -12322,7 +12322,48 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
  /* static */ JSFlatString*
  JSScript::sourceData(JSContext* cx, HandleScript script)
  {
-@@ -1568,18 +1690,19 @@ UncompressedSourceCache::purge()
+@@ -1533,34 +1655,37 @@ UncompressedSourceCache::lookup(const Sc
+ bool
+ UncompressedSourceCache::put(const ScriptSourceChunk& ssc, UniqueTwoByteChars str,
+                              AutoHoldEntry& holder)
+ {
+     MOZ_ASSERT(!holder_);
+ 
+     if (!map_) {
+         UniquePtr<Map> map = MakeUnique<Map>();
+-        if (!map || !map->init())
++        if (!map || !map->init()) {
+             return false;
++        }
+ 
+         map_ = std::move(map);
+     }
+ 
+-    if (!map_->put(ssc, std::move(str)))
++    if (!map_->put(ssc, std::move(str))) {
+         return false;
++    }
+ 
+     holdEntry(holder, ssc);
+     return true;
+ }
+ 
+ void
+ UncompressedSourceCache::purge()
+ {
+-    if (!map_)
++    if (!map_) {
+         return;
++    }
+ 
+     for (Map::Range r = map_->all(); !r.empty(); r.popFront()) {
+         if (holder_ && r.front().key() == holder_->sourceChunk()) {
+             holder_->deferDelete(std::move(r.front().value()));
+             holder_ = nullptr;
+         }
+     }
+ 
+@@ -1568,31 +1693,33 @@ UncompressedSourceCache::purge()
  }
  
  size_t
@@ -12343,7 +12384,22 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
  ScriptSource::chunkChars(JSContext* cx, UncompressedSourceCache::AutoHoldEntry& holder,
                           size_t chunk)
  {
-@@ -1634,26 +1757,28 @@ ScriptSource::PinnedChars::PinnedChars(J
+     const Compressed& c = data.as<Compressed>();
+ 
+     ScriptSourceChunk ssc(this, chunk);
+-    if (const char16_t* decompressed = cx->caches().uncompressedSourceCache.lookup(ssc, holder))
++    if (const char16_t* decompressed = cx->caches().uncompressedSourceCache.lookup(ssc, holder)) {
+         return decompressed;
++    }
+ 
+     size_t totalLengthInBytes = length() * sizeof(char16_t);
+     size_t chunkBytes = Compressor::chunkSize(totalLengthInBytes, chunk);
+ 
+     MOZ_ASSERT((chunkBytes % sizeof(char16_t)) == 0);
+     const size_t lengthWithNull = (chunkBytes / sizeof(char16_t)) + 1;
+     UniqueTwoByteChars decompressed(js_pod_malloc<char16_t>(lengthWithNull));
+     if (!decompressed) {
+@@ -1634,26 +1761,28 @@ ScriptSource::PinnedChars::PinnedChars(J
      }
  }
  
@@ -12374,7 +12430,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
  
      data = SourceType(Compressed(std::move(pendingCompressed_->raw),
                                   pendingCompressed_->uncompressedLength));
-@@ -1663,41 +1788,44 @@ ScriptSource::movePendingCompressedSourc
+@@ -1663,41 +1792,44 @@ ScriptSource::movePendingCompressedSourc
  const char16_t*
  ScriptSource::chars(JSContext* cx, UncompressedSourceCache::AutoHoldEntry& holder,
                      size_t begin, size_t len)
@@ -12422,7 +12478,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
      // chunkChars() so we benefit from chunk caching by UncompressedSourceCache.
  
      MOZ_ASSERT(firstChunk < lastChunk);
-@@ -1710,18 +1838,19 @@ ScriptSource::chars(JSContext* cx, Uncom
+@@ -1710,18 +1842,19 @@ ScriptSource::chars(JSContext* cx, Uncom
      }
  
      size_t totalLengthInBytes = length() * sizeof(char16_t);
@@ -12443,7 +12499,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
              numChars -= firstChar;
          } else if (i == lastChunk) {
              size_t numCharsNew = lastChunkOffset / sizeof(char16_t) + 1;
-@@ -1743,44 +1872,48 @@ ScriptSource::chars(JSContext* cx, Uncom
+@@ -1743,44 +1876,48 @@ ScriptSource::chars(JSContext* cx, Uncom
  
  JSFlatString*
  ScriptSource::substring(JSContext* cx, size_t start, size_t stop)
@@ -12496,7 +12552,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
  {
      MOZ_ASSERT(isFunctionBody());
  
-@@ -1807,46 +1940,49 @@ ScriptSource::setSource(SharedImmutableT
+@@ -1807,46 +1944,49 @@ ScriptSource::setSource(SharedImmutableT
  {
      MOZ_ASSERT(data.is<Missing>());
      data = SourceType(Uncompressed(std::move(string)));
@@ -12549,7 +12605,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
          ReportOutOfMemory(cx);
          return false;
      }
-@@ -1869,20 +2005,21 @@ ScriptSource::setCompressedSource(JSCont
+@@ -1869,20 +2009,21 @@ ScriptSource::setCompressedSource(JSCont
  }
  
  void
@@ -12573,7 +12629,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
      MOZ_ASSERT(!hasSourceData());
  
      JSRuntime* runtime = cx->zone()->runtimeFromAnyThread();
-@@ -1900,91 +2037,99 @@ ScriptSource::setSourceCopy(JSContext* c
+@@ -1900,91 +2041,99 @@ ScriptSource::setSourceCopy(JSContext* c
  
      return true;
  }
@@ -12681,7 +12737,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
  void
  SourceCompressionTask::complete()
  {
-@@ -2003,18 +2148,19 @@ ScriptSource::addSizeOfIncludingThis(moz
+@@ -2003,18 +2152,19 @@ ScriptSource::addSizeOfIncludingThis(moz
                    mallocSizeOf(introducerFilename_.get());
      info->numScripts++;
  }
@@ -12702,7 +12758,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
      }
  
      MOZ_ASSERT(hasEncoder());
-@@ -2027,18 +2173,19 @@ ScriptSource::xdrEncodeTopLevel(JSContex
+@@ -2027,18 +2177,19 @@ ScriptSource::xdrEncodeTopLevel(JSContex
          return false;
      }
  
@@ -12723,7 +12779,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
      return true;
  }
  
-@@ -2052,30 +2199,32 @@ ScriptSource::xdrEncodeFunction(JSContex
+@@ -2052,30 +2203,32 @@ ScriptSource::xdrEncodeFunction(JSContex
          xdrEncoder_.reset(nullptr);
      });
  
@@ -12758,7 +12814,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
      XDRResult res = xdrEncoder_->linearize(buffer);
      return res.isOk();
  }
-@@ -2120,41 +2269,45 @@ ScriptSource::performXDR(XDRState<mode>*
+@@ -2120,41 +2273,45 @@ ScriptSource::performXDR(XDRState<mode>*
      MOZ_TRY(xdr->codeUint8(&hasSource));
  
      uint8_t retrievable = sourceRetrievable_;
@@ -12808,7 +12864,28 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
          }
      }
  
-@@ -2266,28 +2419,31 @@ ScriptSource::initFromOptions(JSContext*
+@@ -2237,18 +2394,19 @@ js::FormatIntroducedFilename(JSContext* 
+     size_t introducerLen = strlen(introducer);
+     size_t len = filenameLen                    +
+                  6 /* == strlen(" line ") */    +
+                  linenoLen                      +
+                  3 /* == strlen(" > ") */       +
+                  introducerLen                  +
+                  1 /* \0 */;
+     char* formatted = cx->pod_malloc<char>(len);
+-    if (!formatted)
++    if (!formatted) {
+         return nullptr;
++    }
+ 
+     mozilla::DebugOnly<size_t> checkLen = snprintf(formatted, len, "%s line %s > %s",
+                                                    filename, linenoBuf, introducer);
+     MOZ_ASSERT(checkLen == len - 1);
+ 
+     return formatted;
+ }
+ 
+@@ -2265,28 +2423,31 @@ ScriptSource::initFromOptions(JSContext*
      setIntroductionOffset(options.introductionOffset);
      parameterListEnd_ = parameterListEnd.isSome() ? parameterListEnd.value() : 0;
  
@@ -12843,7 +12920,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
  bool
  ScriptSource::setFilename(JSContext* cx, const char* filename)
  {
-@@ -2307,31 +2463,33 @@ ScriptSource::setDisplayURL(JSContext* c
+@@ -2306,31 +2467,33 @@ ScriptSource::setDisplayURL(JSContext* c
                                                  GetErrorMessage, nullptr,
                                                  JSMSG_ALREADY_HAS_PRAGMA, filename_.get(),
                                                  "//# sourceURL"))
@@ -12879,7 +12956,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
  /*
   * [SMDOC] JSScript data layout (shared)
   *
-@@ -2370,18 +2528,19 @@ js::SharedScriptData::new_(JSContext* cx
+@@ -2369,18 +2532,19 @@ js::SharedScriptData::new_(JSContext* cx
  
      /*
       * Call constructors to initialize the storage that will be accessed as a
@@ -12900,7 +12977,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
  }
  
  inline
-@@ -2399,18 +2558,19 @@ js::ScriptBytecodeHasher::Lookup::~Looku
+@@ -2398,18 +2562,19 @@ js::ScriptBytecodeHasher::Lookup::~Looku
  }
  
  bool
@@ -12921,7 +12998,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
  void
  JSScript::freeScriptData()
  {
-@@ -2602,26 +2762,31 @@ JS_STATIC_ASSERT((NoPaddingBetweenEntrie
+@@ -2601,26 +2766,31 @@ JS_STATIC_ASSERT((NoPaddingBetweenEntrie
  static inline size_t
  ScriptDataSize(uint32_t nscopes, uint32_t nconsts, uint32_t nobjects,
                 uint32_t ntrynotes, uint32_t nscopenotes, uint32_t nyieldoffsets)
@@ -12958,7 +13035,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
                     HandleObject sourceObject, uint32_t bufStart, uint32_t bufEnd,
                     uint32_t toStringStart, uint32_t toStringEnd)
    :
-@@ -2657,18 +2822,19 @@ JSScript::JSScript(JS::Realm* realm, uin
+@@ -2656,18 +2826,19 @@ JSScript::JSScript(JS::Realm* realm, uin
  
  /* static */ JSScript*
  JSScript::createInitialized(JSContext* cx, const ReadOnlyCompileOptions& options,
@@ -12979,7 +13056,101 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
          nullptr
  #endif
          ;
-@@ -2855,25 +3021,27 @@ JSScript::initFunctionPrototype(JSContex
+@@ -2678,40 +2849,44 @@ JSScript::createInitialized(JSContext* c
+ 
+ /* static */ JSScript*
+ JSScript::Create(JSContext* cx, const ReadOnlyCompileOptions& options,
+                  HandleObject sourceObject, uint32_t bufStart, uint32_t bufEnd,
+                  uint32_t toStringStart, uint32_t toStringEnd)
+ {
+     RootedScript script(cx, createInitialized(cx, options, sourceObject, bufStart, bufEnd,
+                                               toStringStart, toStringEnd));
+-    if (!script)
++    if (!script) {
+         return nullptr;
++    }
+ 
+     if (cx->runtime()->lcovOutput().isEnabled()) {
+-        if (!script->initScriptName(cx))
++        if (!script->initScriptName(cx)) {
+             return nullptr;
++        }
+     }
+ 
+     return script;
+ }
+ 
+ bool
+ JSScript::initScriptName(JSContext* cx)
+ {
+     MOZ_ASSERT(!hasScriptName());
+ 
+-    if (!filename())
++    if (!filename()) {
+         return true;
++    }
+ 
+     // Create realm's scriptNameMap if necessary.
+     if (!realm()->scriptNameMap) {
+         auto map = cx->make_unique<ScriptNameMap>();
+-        if (!map)
++        if (!map) {
+             return false;
++        }
+ 
+         if (!map->init()) {
+             ReportOutOfMemory(cx);
+             return false;
+         }
+ 
+         realm()->scriptNameMap = std::move(map);
+     }
+@@ -2729,38 +2904,41 @@ JSScript::initScriptName(JSContext* cx)
+     }
+ 
+     return true;
+ }
+ 
+ static inline uint8_t*
+ AllocScriptData(JSContext* cx, size_t size)
+ {
+-    if (!size)
++    if (!size) {
+         return nullptr;
++    }
+ 
+     uint8_t* data = cx->pod_calloc<uint8_t>(JS_ROUNDUP(size, sizeof(Value)));
+-    if (!data)
++    if (!data) {
+         return nullptr;
++    }
+     MOZ_ASSERT(size_t(data) % sizeof(Value) == 0);
+     return data;
+ }
+ 
+ /* static */ bool
+ JSScript::partiallyInit(JSContext* cx, HandleScript script, uint32_t nscopes,
+                         uint32_t nconsts, uint32_t nobjects, uint32_t ntrynotes,
+                         uint32_t nscopenotes, uint32_t nyieldoffsets)
+ {
+     assertSameCompartment(cx, script);
+ 
+     size_t size = ScriptDataSize(nscopes, nconsts, nobjects, ntrynotes,
+                                  nscopenotes, nyieldoffsets);
+     script->data = AllocScriptData(cx, size);
+-    if (size && !script->data)
++    if (size && !script->data) {
+         return false;
++    }
+ 
+     script->dataSize_ = size;
+ 
+     uint8_t* cursor = script->data;
+ 
+     // There must always be at least 1 scope, the body scope.
+     MOZ_ASSERT(nscopes != 0);
+     cursor += sizeof(ScopeArray);
+@@ -2855,25 +3033,27 @@ JSScript::initFunctionPrototype(JSContex
          return false;
      }
  
@@ -13009,7 +13180,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
  }
  
  static void
-@@ -2886,47 +3054,51 @@ InitAtomMap(frontend::AtomIndexMap& indi
+@@ -2886,47 +3066,51 @@ InitAtomMap(frontend::AtomIndexMap& indi
          atoms[index].init(atom);
      }
  }
@@ -13066,7 +13237,25 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
  /* static */ void
  JSScript::initFromModuleContext(HandleScript script)
  {
-@@ -2970,18 +3142,19 @@ JSScript::fullyInitFromEmitter(JSContext
+@@ -2954,82 +3138,92 @@ JSScript::fullyInitFromEmitter(JSContext
+     if (nslots > UINT32_MAX) {
+         bce->reportError(nullptr, JSMSG_NEED_DIET, js_script_str);
+         return false;
+     }
+ 
+     uint32_t mainLength = bce->offset();
+     uint32_t prologueLength = bce->prologueOffset();
+     uint32_t nsrcnotes;
+-    if (!bce->finishTakingSrcNotes(&nsrcnotes))
++    if (!bce->finishTakingSrcNotes(&nsrcnotes)) {
+         return false;
++    }
+     uint32_t natoms = bce->atomIndices->count();
+     if (!partiallyInit(cx, script,
+                        bce->scopeList.length(), bce->constList.length(), bce->objectList.length,
+                        bce->tryNoteList.length(), bce->scopeNoteList.length(),
+                        bce->yieldAndAwaitOffsetList.length()))
+     {
          return false;
      }
  
@@ -13087,7 +13276,42 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
  
      jsbytecode* code = script->code();
      PodCopy<jsbytecode>(code, bce->prologue.code.begin(), prologueLength);
-@@ -3011,25 +3184,27 @@ JSScript::fullyInitFromEmitter(JSContext
+     PodCopy<jsbytecode>(code + prologueLength, bce->main.code.begin(), mainLength);
+     bce->copySrcNotes((jssrcnote*)(code + script->length()), nsrcnotes);
+     InitAtomMap(*bce->atomIndices, script->atoms());
+ 
+-    if (!script->shareScriptData(cx))
++    if (!script->shareScriptData(cx)) {
+         return false;
+-
+-    if (bce->constList.length() != 0)
++    }
++
++    if (bce->constList.length() != 0) {
+         bce->constList.finish(script->consts());
+-    if (bce->objectList.length != 0)
++    }
++    if (bce->objectList.length != 0) {
+         bce->objectList.finish(script->objects());
+-    if (bce->scopeList.length() != 0)
++    }
++    if (bce->scopeList.length() != 0) {
+         bce->scopeList.finish(script->scopes());
+-    if (bce->tryNoteList.length() != 0)
++    }
++    if (bce->tryNoteList.length() != 0) {
+         bce->tryNoteList.finish(script->trynotes());
+-    if (bce->scopeNoteList.length() != 0)
++    }
++    if (bce->scopeNoteList.length() != 0) {
+         bce->scopeNoteList.finish(script->scopeNotes(), prologueLength);
++    }
+     script->bitFields_.strict_ = bce->sc->strict();
+     script->bitFields_.explicitUseStrict_ = bce->sc->hasExplicitUseStrict();
+     script->bitFields_.bindingsAccessedDynamically_ = bce->sc->bindingsAccessedDynamically();
+     script->bitFields_.hasSingletons_ = bce->hasSingletons;
+ 
+     script->nfixed_ = bce->maxFixedSlots;
      script->nslots_ = nslots;
      script->bodyScopeIndex_ = bce->bodyScopeIndex;
      script->bitFields_.hasNonSyntacticScope_ =
@@ -13118,7 +13342,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
      return true;
  }
  
-@@ -3080,18 +3255,19 @@ JSScript::assertValidJumpTargets() const
+@@ -3080,18 +3274,19 @@ JSScript::assertValidJumpTargets() const
  
      // Check catch/finally blocks as jump targets.
      if (hasTrynotes()) {
@@ -13139,7 +13363,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
          }
      }
  }
-@@ -3134,31 +3310,33 @@ JSScript::finalize(FreeOp* fop)
+@@ -3134,31 +3329,33 @@ JSScript::finalize(FreeOp* fop)
      MOZ_ASSERT_IF(hasScriptName(), fop->runtime()->lcovOutput().isEnabled());
      if (fop->runtime()->lcovOutput().isEnabled() && hasScriptName()) {
          realm()->lcovOutput.collectCodeCoverageInfo(realm(), this, getScriptName());
@@ -13175,7 +13399,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
      MOZ_ASSERT_IF(lazyScript && !IsAboutToBeFinalizedUnbarriered(&lazyScript),
                    !lazyScript->hasScript() || lazyScript->maybeScriptUnbarriered() != this);
  }
-@@ -3172,18 +3350,19 @@ GSNCache::purge()
+@@ -3172,18 +3369,19 @@ GSNCache::purge()
      if (map.initialized())
          map.finish();
  }
@@ -13196,7 +13420,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
      }
  
      size_t offset = 0;
-@@ -3200,32 +3379,34 @@ js::GetSrcNote(GSNCache& cache, JSScript
+@@ -3200,32 +3398,34 @@ js::GetSrcNote(GSNCache& cache, JSScript
          }
      }
  
@@ -13233,7 +13457,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
      return result;
  }
  
-@@ -3246,98 +3427,105 @@ js::PCToLineNumber(unsigned startLine, j
+@@ -3246,98 +3446,105 @@ js::PCToLineNumber(unsigned startLine, j
       * Walk through source notes accumulating their deltas, keeping track of
       * line-number notes, until we pass the note for pc's offset within
       * script->code.
@@ -13348,7 +13572,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
  void
  js::DescribeScriptedCallerForDirectEval(JSContext* cx, HandleScript script, jsbytecode* pc,
                                          const char** file, unsigned* linenop, uint32_t* pcOffset,
-@@ -3405,47 +3593,53 @@ Rebase(JSScript* dst, JSScript* src, T* 
+@@ -3405,47 +3612,53 @@ Rebase(JSScript* dst, JSScript* src, T* 
  
  static JSObject*
  CloneInnerInterpretedFunction(JSContext* cx, HandleScope enclosingScope, HandleFunction srcFun)
@@ -13409,7 +13633,48 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
  js::detail::CopyScript(JSContext* cx, HandleScript src, HandleScript dst,
                         MutableHandle<GCVector<Scope*>> scopes)
  {
-@@ -3514,59 +3708,64 @@ js::detail::CopyScript(JSContext* cx, Ha
+@@ -3465,36 +3678,38 @@ js::detail::CopyScript(JSContext* cx, Ha
+     uint32_t ntrynotes = src->hasTrynotes() ? src->trynotes()->length : 0;
+     uint32_t nscopenotes = src->hasScopeNotes() ? src->scopeNotes()->length : 0;
+     uint32_t nyieldoffsets = src->hasYieldAndAwaitOffsets() ? src->yieldAndAwaitOffsets().length() : 0;
+ 
+     /* Script data */
+ 
+     size_t size = src->dataSize();
+     UniquePtr<uint8_t, JS::FreePolicy> data(AllocScriptData(cx, size));
+-    if (size && !data)
++    if (size && !data) {
+         return false;
++    }
+ 
+     /* Scopes */
+ 
+     // The passed in scopes vector contains body scopes that needed to be
+     // cloned especially, depending on whether the script is a function or
+     // global scope. Starting at scopes.length() means we only deal with
+     // intra-body scopes.
+     {
+         MOZ_ASSERT(nscopes != 0);
+         MOZ_ASSERT(src->bodyScopeIndex() + 1 == scopes.length());
+         GCPtrScope* vector = src->scopes()->vector;
+         RootedScope original(cx);
+         RootedScope clone(cx);
+         for (uint32_t i = scopes.length(); i < nscopes; i++) {
+             original = vector[i];
+             clone = Scope::clone(cx, original, scopes[FindScopeIndex(src, *original->enclosing())]);
+-            if (!clone || !scopes.append(clone))
++            if (!clone || !scopes.append(clone)) {
+                 return false;
++            }
+         }
+     }
+ 
+     /* Objects */
+ 
+     AutoObjectVector objects(cx);
+     if (nobjects != 0) {
+         GCPtrObject* vector = src->objects()->vector;
+@@ -3512,59 +3727,64 @@ js::detail::CopyScript(JSContext* cx, Ha
                          MOZ_ASSERT(innerFun->isAsmJSNative());
                          JS_ReportErrorASCII(cx, "AsmJS modules do not yet support cloning.");
                          return false;
@@ -13479,7 +13744,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
      dst->bitFields_.strict_ = src->strict();
      dst->bitFields_.explicitUseStrict_ = src->explicitUseStrict();
      dst->bitFields_.hasNonSyntacticScope_ = scopes[0]->hasOnChain(ScopeKind::NonSyntactic);
-@@ -3582,35 +3781,40 @@ js::detail::CopyScript(JSContext* cx, Ha
+@@ -3580,35 +3800,40 @@ js::detail::CopyScript(JSContext* cx, Ha
      dst->bitFields_.isDefaultClassConstructor_ = src->isDefaultClassConstructor();
      dst->bitFields_.isAsync_ = src->bitFields_.isAsync_;
      dst->bitFields_.hasRest_ = src->bitFields_.hasRest_;
@@ -13526,7 +13791,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
      return true;
  }
  
-@@ -3624,25 +3828,27 @@ CreateEmptyScriptForClone(JSContext* cx,
+@@ -3622,25 +3847,27 @@ CreateEmptyScriptForClone(JSContext* cx,
       */
      RootedObject sourceObject(cx);
      if (src->realm()->isSelfHostingRealm()) {
@@ -13556,7 +13821,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
             .setNoScriptRval(src->noScriptRval());
  
      return JSScript::Create(cx, options, sourceObject, src->sourceStart(), src->sourceEnd(),
-@@ -3650,79 +3856,86 @@ CreateEmptyScriptForClone(JSContext* cx,
+@@ -3648,79 +3875,86 @@ CreateEmptyScriptForClone(JSContext* cx,
  }
  
  JSScript*
@@ -13654,28 +13919,24 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
  JSScript::debugScript()
  {
      MOZ_ASSERT(bitFields_.hasDebugScript_);
-@@ -3775,18 +3988,19 @@ JSScript::ensureHasDebugScript(JSContext
-     if (!debug) {
-         ReportOutOfMemory(cx);
-         return false;
-     }
+@@ -3795,49 +4029,53 @@ JSScript::ensureHasDebugScript(JSContext
+     bitFields_.hasDebugScript_ = true; // safe to set this;  we can't fail after this point
  
-     /* Create realm's debugScriptMap if necessary. */
-     if (!realm()->debugScriptMap) {
-         auto map = cx->make_unique<DebugScriptMap>();
--        if (!map)
-+        if (!map) {
-             return false;
+     /*
+      * Ensure that any Interpret() instances running on this script have
+      * interrupts enabled. The interrupts must stay enabled until the
+      * debug state is destroyed.
+      */
+     for (ActivationIterator iter(cx); !iter.done(); ++iter) {
+-        if (iter->isInterpreter())
++        if (iter->isInterpreter()) {
+             iter->asInterpreter()->enableInterruptsIfRunning(this);
 +        }
+     }
  
-         if (!map->init()) {
-             ReportOutOfMemory(cx);
-             return false;
-         }
+     return true;
+ }
  
-         realm()->debugScriptMap = std::move(map);
-     }
-@@ -3814,32 +4028,35 @@ JSScript::ensureHasDebugScript(JSContext
  void
  JSScript::setNewStepMode(FreeOp* fop, uint32_t newValue)
  {
@@ -13703,6 +13964,8 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
      assertSameCompartment(cx, this);
      MOZ_ASSERT(cx->realm()->isDebuggee());
  
+     AutoRealm ar(cx, this);
+ 
 -    if (!ensureHasDebugScript(cx))
 +    if (!ensureHasDebugScript(cx)) {
          return false;
@@ -13715,15 +13978,15 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
  }
  
  void
-@@ -3849,18 +4066,19 @@ JSScript::decrementStepModeCount(FreeOp*
-     uint32_t count = debug->stepMode;
-     MOZ_ASSERT(count > 0);
+@@ -3849,100 +4087,109 @@ JSScript::decrementStepModeCount(FreeOp*
      setNewStepMode(fop, count - 1);
  }
  
  BreakpointSite*
  JSScript::getOrCreateBreakpointSite(JSContext* cx, jsbytecode* pc)
  {
+     AutoRealm ar(cx, this);
+ 
 -    if (!ensureHasDebugScript(cx))
 +    if (!ensureHasDebugScript(cx)) {
          return nullptr;
@@ -13733,10 +13996,19 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
      BreakpointSite*& site = debug->breakpoints[pcToOffset(pc)];
  
      if (!site) {
-         site = cx->zone()->new_<JSBreakpointSite>(this, pc);
-         if (!site) {
-             ReportOutOfMemory(cx);
-@@ -3877,74 +4095,81 @@ JSScript::destroyBreakpointSite(FreeOp* 
+         site = cx->new_<JSBreakpointSite>(this, pc);
+-        if (!site)
++        if (!site) {
+             return nullptr;
++        }
+         debug->numSites++;
+     }
+ 
+     return site;
+ }
+ 
+ void
+ JSScript::destroyBreakpointSite(FreeOp* fop, jsbytecode* pc)
  {
      DebugScript* debug = debugScript();
      BreakpointSite*& site = debug->breakpoints[pcToOffset(pc)];
@@ -13826,7 +14098,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
  
      if (hasObjects()) {
          ObjectArray* objarray = objects();
-@@ -3971,47 +4196,51 @@ LazyScript::finalize(FreeOp* fop)
+@@ -3969,47 +4216,51 @@ LazyScript::finalize(FreeOp* fop)
  
  size_t
  JSScript::calculateLiveFixed(jsbytecode* pc)
@@ -13883,7 +14155,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
  
      // Find the innermost block chain using a binary search.
      size_t bottom = 0;
-@@ -4028,40 +4257,43 @@ JSScript::lookupScope(jsbytecode* pc)
+@@ -4026,40 +4277,43 @@ JSScript::lookupScope(jsbytecode* pc)
              // the searched range for coverage.
              size_t check = mid;
              while (check >= bottom) {
@@ -13931,7 +14203,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
  {
      bitFields_.argsHasVarBinding_ = true;
      bitFields_.needsArgsAnalysis_ = true;
-@@ -4080,43 +4312,48 @@ js::SetFrameArgumentsObject(JSContext* c
+@@ -4078,43 +4332,48 @@ js::SetFrameArgumentsObject(JSContext* c
                              HandleScript script, JSObject* argsobj)
  {
      /*
@@ -13985,7 +14257,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
  {
      MOZ_ASSERT(script->functionNonDelazifying());
      MOZ_ASSERT(script->analyzedArgsUsage());
-@@ -4124,31 +4361,33 @@ JSScript::argumentsOptimizationFailed(JS
+@@ -4122,31 +4381,33 @@ JSScript::argumentsOptimizationFailed(JS
  
      /*
       * It is possible that the arguments optimization has already failed,
@@ -14021,7 +14293,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
       * 'f.apply(x, arguments)'. Thus, there are no outstanding values of
       * MagicValue(JS_OPTIMIZED_ARGUMENTS) on the stack. However, there are
       * three things that need fixup:
-@@ -4161,41 +4400,45 @@ JSScript::argumentsOptimizationFailed(JS
+@@ -4159,41 +4420,45 @@ JSScript::argumentsOptimizationFailed(JS
      for (AllScriptFramesIter i(cx); !i.done(); ++i) {
          /*
           * We cannot reliably create an arguments object for Ion activations of
@@ -14071,7 +14343,35 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
  JSScript::formalLivesInArgumentsObject(unsigned argSlot)
  {
      return argsObjAliasesFormals() && !formalIsAliased(argSlot);
-@@ -4336,28 +4579,31 @@ LazyScript::Create(JSContext* cx, Handle
+@@ -4287,23 +4552,25 @@ LazyScript::CreateRaw(JSContext* cx, Han
+     p.treatAsRunOnce = false;
+ 
+     size_t bytes = (p.numClosedOverBindings * sizeof(JSAtom*))
+                  + (p.numInnerFunctions * sizeof(GCPtrFunction));
+ 
+     UniquePtr<uint8_t, JS::FreePolicy> table;
+     if (bytes) {
+         table.reset(cx->pod_malloc<uint8_t>(bytes));
+-        if (!table)
++        if (!table) {
+             return nullptr;
++        }
+     }
+ 
+     LazyScript* res = Allocate<LazyScript>(cx);
+-    if (!res)
++    if (!res) {
+         return nullptr;
++    }
+ 
+     cx->realm()->scheduleDelazificationForDebugger();
+ 
+     return new (res) LazyScript(fun, *sourceObject, table.release(), packed, sourceStart,
+                                 sourceEnd, toStringStart, lineno, column);
+ }
+ 
+ /* static */ LazyScript*
+@@ -4334,28 +4601,31 @@ LazyScript::Create(JSContext* cx, Handle
      p.isLikelyConstructorWrapper = false;
      p.isDerivedClassConstructor = false;
      p.needsHomeObject = false;
@@ -14106,7 +14406,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
  /* static */ LazyScript*
  LazyScript::CreateForXDR(JSContext* cx, HandleFunction fun,
                           HandleScript script, HandleScope enclosingScope,
-@@ -4370,42 +4616,47 @@ LazyScript::CreateForXDR(JSContext* cx, 
+@@ -4368,42 +4638,47 @@ LazyScript::CreateForXDR(JSContext* cx, 
  
      // Dummy function which is not a valid function as this is the one which is
      // holding this lazy script.
@@ -14159,7 +14459,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
  LazyScript::initRuntimeFields(uint64_t packedFields)
  {
      union {
-@@ -4438,18 +4689,19 @@ JSScript::updateJitCodeRaw(JSRuntime* rt
+@@ -4436,18 +4711,19 @@ JSScript::updateJitCodeRaw(JSRuntime* rt
      }
      MOZ_ASSERT(jitCodeRaw_);
      MOZ_ASSERT(jitCodeSkipArgCheck_);
@@ -14180,7 +14480,7 @@ diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
            case JSTRY_FOR_OF:
            case JSTRY_LOOP:
              return true;
-@@ -4536,13 +4788,14 @@ JS::ubi::Concrete<js::LazyScript>::size(
+@@ -4534,13 +4810,14 @@ JS::ubi::Concrete<js::LazyScript>::size(
      size += get().sizeOfExcludingThis(mallocSizeOf);
      return size;
  }

frg/work-js/mozilla-release/patches/1539694-1-68a1.patch

@@ -0,0 +1,421 @@
+# HG changeset patch
+# User Andre Bargull <andre.bargull@gmail.com>
+# Date 1555016777 0
+#      Thu Apr 11 21:06:17 2019 +0000
+# Node ID af57f8ff4600757ecef6e5491f8e5d6e51df67ed
+# Parent  73cf8dd65340bd44058532ca2d4ce079b45abff4
+Bug 1539694 - Part 1: Modify shared Promise.all/race helper to allow passing in a different reject function. r=jorendorff
+
+And a shared helper function for Promise.all, Promise.race, and soon
+Promise.allSettled to avoid code repetition.
+
+Differential Revision: https://phabricator.services.mozilla.com/D25208
+
+diff --git a/js/src/builtin/Promise.cpp b/js/src/builtin/Promise.cpp
+--- a/js/src/builtin/Promise.cpp
++++ b/js/src/builtin/Promise.cpp
+@@ -2058,71 +2058,111 @@ class MOZ_STACK_CLASS PromiseForOfIterat
+         return index != NOT_ARRAY && IsPackedArray(iterator);
+     }
+ };
+ 
+ static MOZ_MUST_USE bool
+ PerformPromiseAll(JSContext *cx, PromiseForOfIterator& iterator, HandleObject C,
+                   Handle<PromiseCapability> resultCapability, bool* done);
+ 
+-// ES2016, 25.4.4.1.
+-static bool
+-Promise_static_all(JSContext* cx, unsigned argc, Value* vp)
+-{
+-    CallArgs args = CallArgsFromVp(argc, vp);
+-    HandleValue iterable = args.get(0);
+-
+-    // Step 2 (reordered).
+-    HandleValue CVal = args.thisv();
+-    if (!CVal.isObject()) {
+-        JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_NOT_NONNULL_OBJECT,
+-                                  "Receiver of Promise.all call");
++static MOZ_MUST_USE bool PerformPromiseRace(
++    JSContext* cx, PromiseForOfIterator& iterator, HandleObject C,
++    Handle<PromiseCapability> resultCapability, bool* done);
++
++enum class IterationMode { All, Race };
++
++// ES2020 draft rev a09fc232c137800dbf51b6204f37fdede4ba1646
++//
++// Unified implementation of
++// 25.6.4.1 Promise.all ( iterable )
++// 25.6.4.3 Promise.race ( iterable )
++static MOZ_MUST_USE bool CommonStaticAllRace(JSContext* cx, CallArgs& args,
++                                             IterationMode mode) {
++  HandleValue iterable = args.get(0);
++
++  // Step 2 (reordered).
++  HandleValue CVal = args.thisv();
++  if (!CVal.isObject()) {
++    const char* message;
++    switch (mode) {
++      case IterationMode::All:
++        message = "Receiver of Promise.all call";
++        break;
++      case IterationMode::Race:
++        message = "Receiver of Promise.race call";
++        break;
++    }
++    JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
++                              JSMSG_NOT_NONNULL_OBJECT, message);
+         return false;
+     }
+ 
+     // Step 1.
+     RootedObject C(cx, &CVal.toObject());
+ 
+     // Step 3.
+     Rooted<PromiseCapability> promiseCapability(cx);
+     if (!NewPromiseCapability(cx, C, &promiseCapability, false))
+         return false;
+ 
+     // Steps 4-5.
+     PromiseForOfIterator iter(cx);
+     if (!iter.init(iterable, JS::ForOfIterator::AllowNonIterable))
+         return AbruptRejectPromise(cx, args, promiseCapability);
+ 
+-    if (!iter.valueIsIterable()) {
+-        JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_NOT_ITERABLE,
+-                                  "Argument of Promise.all");
+-        return AbruptRejectPromise(cx, args, promiseCapability);
++  if (!iter.valueIsIterable()) {
++    const char* message;
++    switch (mode) {
++      case IterationMode::All:
++        message = "Argument of Promise.all";
++        break;
++      case IterationMode::Race:
++        message = "Argument of Promise.race";
++        break;
+     }
++    JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_NOT_ITERABLE,
++                              message);
++    return AbruptRejectPromise(cx, args, promiseCapability);
++  }
+ 
+     // Step 6 (implicit).
+ 
+     // Step 7.
+-    bool done;
+-    bool result = PerformPromiseAll(cx, iter, C, promiseCapability, &done);
++  bool done, result;
++  switch (mode) {
++    case IterationMode::All:
++      result = PerformPromiseAll(cx, iter, C, promiseCapability, &done);
++      break;
++    case IterationMode::Race:
++      result = PerformPromiseRace(cx, iter, C, promiseCapability, &done);
++      break;
++  }
+ 
+     // Step 8.
+     if (!result) {
+         // Step 8.a.
+         if (!done)
+             iter.closeThrow();
+ 
+         // Step 8.b.
+         return AbruptRejectPromise(cx, args, promiseCapability);
+     }
+ 
+     // Step 9.
+     args.rval().setObject(*promiseCapability.promise());
+     return true;
+ }
+ 
++// ES2020 draft rev a09fc232c137800dbf51b6204f37fdede4ba1646
++// 25.6.4.1 Promise.all ( iterable )
++static bool Promise_static_all(JSContext* cx, unsigned argc, Value* vp) {
++  CallArgs args = CallArgsFromVp(argc, vp);
++  return CommonStaticAllRace(cx, args, IterationMode::All);
++}
++
+ static MOZ_MUST_USE bool
+ PerformPromiseThen(JSContext* cx, Handle<PromiseObject*> promise, HandleValue onFulfilled_,
+                    HandleValue onRejected_, Handle<PromiseCapability> resultCapability);
+ 
+ static MOZ_MUST_USE bool
+ PerformPromiseThenWithoutSettleHandlers(JSContext* cx, Handle<PromiseObject*> promise,
+                                         Handle<PromiseObject*> promiseToResolve,
+                                         Handle<PromiseCapability> resultCapability);
+@@ -2297,19 +2337,18 @@ static bool
+ IsPromiseSpecies(JSContext* cx, JSFunction* species);
+ 
+ // ES2019 draft rev dd269df67d37409a6f2099a842b8f5c75ee6fc24
+ // 25.6.4.1.1 Runtime Semantics: PerformPromiseAll, step 6.
+ // 25.6.4.3.1 Runtime Semantics: PerformPromiseRace, step 3.
+ template <typename T>
+ static MOZ_MUST_USE bool
+ CommonPerformPromiseAllRace(JSContext *cx, PromiseForOfIterator& iterator, HandleObject C,
+-                            Handle<PromiseCapability> resultCapability, bool* done,
+-                            bool resolveReturnsUndefined, T getResolveFun)
+-{
++    HandleObject resultPromise, bool* done, bool resolveReturnsUndefined,
++    T getResolveAndReject) {
+     RootedObject promiseCtor(cx, GlobalObject::getOrCreatePromiseConstructor(cx, cx->global()));
+     if (!promiseCtor)
+         return false;
+ 
+     // Optimized dense array iteration ensures no side-effects take place
+     // during the iteration.
+     bool iterationMayHaveSideEffects = !iterator.isOptimizedDenseArrayIteration();
+ 
+@@ -2317,19 +2356,19 @@ CommonPerformPromiseAllRace(JSContext *c
+     // with |C == promiseCtor| because we can only perform this optimization
+     // for the builtin Promise constructor.
+     bool isDefaultPromiseState = C == promiseCtor;
+     bool validatePromiseState = true;
+ 
+     PromiseLookup& promiseLookup = cx->realm()->promiseLookup;
+ 
+     RootedValue CVal(cx, ObjectValue(*C));
+-    HandleObject resultPromise = resultCapability.promise();
+-    RootedValue resolveFunVal(cx);
+-    RootedValue rejectFunVal(cx, ObjectValue(*resultCapability.reject()));
++  RootedValue resolveFunVal(cx);
++  RootedValue rejectFunVal(cx);
++
+ 
+     // We're reusing rooted variables in the loop below, so we don't need to
+     // declare a gazillion different rooted variables here. Rooted variables
+     // which are reused include "Or" in their name.
+     RootedValue nextValueOrNextPromise(cx);
+     RootedObject nextPromiseObj(cx);
+     RootedValue resolveOrThen(cx);
+     RootedObject thenSpeciesOrBlockedPromise(cx);
+@@ -2401,22 +2440,21 @@ CommonPerformPromiseAllRace(JSContext *c
+             RootedValue& staticResolve = resolveOrThen;
+             if (!GetProperty(cx, C, CVal, cx->names().resolve, &staticResolve))
+                 return false;
+ 
+             if (!Call(cx, staticResolve, CVal, nextValue, &nextPromise))
+                 return false;
+         }
+ 
+-        // Get the resolve function for this iteration.
++        // Get the resolving functions for this iteration.
+         // 25.6.4.1.1, steps 6.j-q.
+-        JSObject* resolveFun = getResolveFun();
+-        if (!resolveFun)
+-            return false;
+-        resolveFunVal.setObject(*resolveFun);
++    if (!getResolveAndReject(&resolveFunVal, &rejectFunVal)) {
++      return false;
++    }
+ 
+         // Call |nextPromise.then| with the provided hooks and add
+         // |resultPromise| to the list of dependent promises.
+         //
+         // If |nextPromise.then| is the original |Promise.prototype.then|
+         // function and the call to |nextPromise.then| would use the original
+         // |Promise| constructor to create the resulting promise, we skip the
+         // call to |nextPromise.then| and thus creating a new promise that
+@@ -2550,17 +2588,18 @@ CommonPerformPromiseAllRace(JSContext *c
+                 Handle<PromiseObject*> promise = nextPromiseObj.as<PromiseObject>();
+                 if (!AddDummyPromiseReactionForDebugger(cx, promise, blockedPromise))
+                     return false;
+             }
+         }
+     }
+ }
+ 
+-// ES2016, 25.4.4.1.1.
++// ES2020 draft rev a09fc232c137800dbf51b6204f37fdede4ba1646
++// 25.6.4.1.1 PerformPromiseAll (iteratorRecord, constructor, resultCapability)
+ static MOZ_MUST_USE bool
+ PerformPromiseAll(JSContext *cx, PromiseForOfIterator& iterator, HandleObject C,
+                   Handle<PromiseCapability> resultCapability, bool* done)
+ {
+     *done = false;
+ 
+     // Step 1.
+     MOZ_ASSERT(C->isConstructor());
+@@ -2620,55 +2659,61 @@ PerformPromiseAll(JSContext *cx, Promise
+     dataHolder = NewPromiseAllDataHolder(cx, resultCapability.promise(), valuesArrayVal,
+                                          resultCapability.resolve());
+     if (!dataHolder)
+         return false;
+ 
+     // Step 5.
+     uint32_t index = 0;
+ 
+-    auto getResolve = [cx, &valuesArray, &dataHolder, &index]() -> JSObject* {
++  auto getResolveAndReject = [cx, &resultCapability, &valuesArray, &dataHolder,
++                              &index](MutableHandleValue resolveFunVal,
++                                      MutableHandleValue rejectFunVal) {
+         // Step 6.h.
+         { // Scope for the AutoRealm we need to work with valuesArray.  We
+             // mostly do this for performance; we could go ahead and do the define via
+             // a cross-compartment proxy instead...
+             AutoRealm ar(cx, valuesArray);
+ 
+             if (!NewbornArrayPush(cx, valuesArray, UndefinedValue()))
+-                return nullptr;
++                return false;
+         }
+ 
+         // Steps 6.j-k.
+         JSFunction* resolveFunc = NewNativeFunction(cx, PromiseAllResolveElementFunction, 1,
+                                                     nullptr,gc::AllocKind::FUNCTION_EXTENDED,
+                                                     GenericObject);
+         if (!resolveFunc)
+-            return nullptr;
++            return false;
+ 
+         // Steps 6.l, 6.n-p.
+         resolveFunc->setExtendedSlot(PromiseAllResolveElementFunctionSlot_Data,
+                                      ObjectValue(*dataHolder));
+ 
+         // Step 6.m.
+         resolveFunc->setExtendedSlot(PromiseAllResolveElementFunctionSlot_ElementIndex,
+                                      Int32Value(index));
+ 
+         // Step 6.q.
+         dataHolder->increaseRemainingCount();
+ 
+         // Step 6.s.
+         index++;
+         MOZ_ASSERT(index > 0);
+ 
+-        return resolveFunc;
++    resolveFunVal.setObject(*resolveFunc);
++    rejectFunVal.setObject(*resultCapability.reject());
++    return true;
+     };
+ 
+     // Step 6.
+-    if (!CommonPerformPromiseAllRace(cx, iterator, C, resultCapability, done, true, getResolve))
+-        return false;
++  if (!CommonPerformPromiseAllRace(cx, iterator, C, resultCapability.promise(),
++                                   done, true, getResolveAndReject)) {
++    return false;
++  }
+ 
+     // Step 6.d.ii.
+     int32_t remainingCount = dataHolder->decreaseRemainingCount();
+ 
+     // Steps 6.d.iii-iv.
+     if (remainingCount == 0) {
+         return RunResolutionFunction(cx, resultCapability.resolve(), valuesArrayVal, ResolveMode,
+                                      resultCapability.promise());
+@@ -2748,76 +2793,27 @@ PromiseAllResolveElementFunction(JSConte
+             return false;
+     }
+ 
+     // Step 11.
+     args.rval().setUndefined();
+     return true;
+ }
+ 
+-static MOZ_MUST_USE bool
+-PerformPromiseRace(JSContext *cx, PromiseForOfIterator& iterator, HandleObject C,
+-                   Handle<PromiseCapability> resultCapability, bool* done);
+-
+-// ES2016, 25.4.4.3.
++// ES2020 draft rev a09fc232c137800dbf51b6204f37fdede4ba1646
++// 25.6.4.3 Promise.race ( iterable )
+ static bool
+ Promise_static_race(JSContext* cx, unsigned argc, Value* vp)
+ {
+     CallArgs args = CallArgsFromVp(argc, vp);
+-    HandleValue iterable = args.get(0);
+-
+-    // Step 2 (reordered).
+-    HandleValue CVal = args.thisv();
+-    if (!CVal.isObject()) {
+-        JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_NOT_NONNULL_OBJECT,
+-                                  "Receiver of Promise.race call");
+-        return false;
+-    }
+-
+-    // Step 1.
+-    RootedObject C(cx, &CVal.toObject());
+-
+-    // Step 3.
+-    Rooted<PromiseCapability> promiseCapability(cx);
+-    if (!NewPromiseCapability(cx, C, &promiseCapability, false))
+-        return false;
+-
+-    // Steps 4-5.
+-    PromiseForOfIterator iter(cx);
+-    if (!iter.init(iterable, JS::ForOfIterator::AllowNonIterable))
+-        return AbruptRejectPromise(cx, args, promiseCapability);
+-
+-    if (!iter.valueIsIterable()) {
+-        JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_NOT_ITERABLE,
+-                                  "Argument of Promise.race");
+-        return AbruptRejectPromise(cx, args, promiseCapability);
+-    }
+-
+-    // Step 6 (implicit).
+-
+-    // Step 7.
+-    bool done;
+-    bool result = PerformPromiseRace(cx, iter, C, promiseCapability, &done);
+-
+-    // Step 8.
+-    if (!result) {
+-        // Step 8.a.
+-        if (!done)
+-            iter.closeThrow();
+-
+-        // Step 8.b.
+-        return AbruptRejectPromise(cx, args, promiseCapability);
+-    }
+-
+-    // Step 9.
+-    args.rval().setObject(*promiseCapability.promise());
+-    return true;
++  return CommonStaticAllRace(cx, args, IterationMode::Race);
+ }
+ 
+-// ES2016, 25.4.4.3.1.
++// ES2020 draft rev a09fc232c137800dbf51b6204f37fdede4ba1646
++// 25.6.4.3.1 PerformPromiseRace (iteratorRecord, constructor, resultCapability)
+ static MOZ_MUST_USE bool
+ PerformPromiseRace(JSContext *cx, PromiseForOfIterator& iterator, HandleObject C,
+                    Handle<PromiseCapability> resultCapability, bool* done)
+ {
+     *done = false;
+ 
+     // Step 1.
+     MOZ_ASSERT(C->isConstructor());
+@@ -2825,23 +2821,28 @@ PerformPromiseRace(JSContext *cx, Promis
+     // Step 2 (omitted).
+ 
+     // BlockOnPromise fast path requires the passed onFulfilled function
+     // doesn't return an object value, because otherwise the skipped promise
+     // creation is detectable due to missing property lookups.
+     bool isDefaultResolveFn = IsNativeFunction(resultCapability.resolve(),
+                                                ResolvePromiseFunction);
+ 
+-    auto getResolve = [&resultCapability]() -> JSObject* {
+-        return resultCapability.resolve();
++  auto getResolveAndReject = [&resultCapability](
++                                 MutableHandleValue resolveFunVal,
++                                 MutableHandleValue rejectFunVal) {
++    resolveFunVal.setObject(*resultCapability.resolve());
++    rejectFunVal.setObject(*resultCapability.reject());
++    return true;
+     };
+ 
+     // Step 3.
+-    return CommonPerformPromiseAllRace(cx, iterator, C, resultCapability, done,
+-                                       isDefaultResolveFn, getResolve);
++  return CommonPerformPromiseAllRace(cx, iterator, C,
++                                     resultCapability.promise(), done,
++                                     isDefaultResolveFn, getResolveAndReject);
+ }
+ 
+ 
+ // ES2016, Sub-steps of 25.4.4.4 and 25.4.4.5.
+ static MOZ_MUST_USE JSObject*
+ CommonStaticResolveRejectImpl(JSContext* cx, HandleValue thisVal, HandleValue argVal,
+                               ResolutionMode mode)
+ {

frg/work-js/mozilla-release/patches/mozilla-central_469094.patch → frg/work-js/mozilla-release/patches/1539694-2-68a1.patch

@@ -3,7 +3,7 @@
 # Date 1555016800 0
 #      Thu Apr 11 21:06:40 2019 +0000
 # Node ID 9378daa99e07d9b353473b9fd4c0b7857d1ccb8d
-# Parent  af57f8ff4600757ecef6e5491f8e5d6e51df67ed
+# Parent  fea2c42cc2a4855630472e3706c2f796f4e61fa5
 Bug 1539694 - Part 2: Implement Promise.allSettled stage 3 proposal. r=jorendorff
 
 Nightly-only for now because the proposal only just reached stage 3.
@@ -26,13 +26,13 @@ Differential Revision: https://phabricator.services.mozilla.com/D25209
 diff --git a/js/src/builtin/Promise.cpp b/js/src/builtin/Promise.cpp
 --- a/js/src/builtin/Promise.cpp
 +++ b/js/src/builtin/Promise.cpp
-@@ -92,16 +92,21 @@ enum RejectFunctionSlots {
-   RejectFunctionSlot_ResolveFunction,
+@@ -83,16 +83,21 @@ enum RejectFunctionSlots {
+     RejectFunctionSlot_ResolveFunction,
  };
  
  enum PromiseAllResolveElementFunctionSlots {
-   PromiseAllResolveElementFunctionSlot_Data = 0,
-   PromiseAllResolveElementFunctionSlot_ElementIndex,
+     PromiseAllResolveElementFunctionSlot_Data = 0,
+     PromiseAllResolveElementFunctionSlot_ElementIndex,
  };
  
 +enum PromiseAllSettledElementFunctionSlots {
@@ -41,21 +41,21 @@ diff --git a/js/src/builtin/Promise.cpp b/js/src/builtin/Promise.cpp
 +};
 +
  enum ReactionJobSlots {
-   ReactionJobSlot_ReactionRecord = 0,
+     ReactionJobSlot_ReactionRecord = 0,
  };
  
  enum ThenableJobSlots {
-   // The handler to use as the Promise reaction. It is a callable object
-   // that's guaranteed to be from the same compartment as the
-   // PromiseReactionJob.
-@@ -2267,39 +2272,51 @@ class MOZ_STACK_CLASS PromiseForOfIterat
-     return index != NOT_ARRAY && IsPackedArray(iterator);
-   }
+     // The handler to use as the Promise reaction. It is a callable object
+     // that's guaranteed to be from the same compartment as the
+     // PromiseReactionJob.
+@@ -2058,39 +2063,51 @@ class MOZ_STACK_CLASS PromiseForOfIterat
+         return index != NOT_ARRAY && IsPackedArray(iterator);
+     }
  };
  
- static MOZ_MUST_USE bool PerformPromiseAll(
-     JSContext* cx, PromiseForOfIterator& iterator, HandleObject C,
-     Handle<PromiseCapability> resultCapability, bool* done);
+ static MOZ_MUST_USE bool
+ PerformPromiseAll(JSContext *cx, PromiseForOfIterator& iterator, HandleObject C,
+                   Handle<PromiseCapability> resultCapability, bool* done);
  
 +static MOZ_MUST_USE bool PerformPromiseAllSettled(
 +    JSContext* cx, PromiseForOfIterator& iterator, HandleObject C,
@@ -99,10 +99,10 @@ diff --git a/js/src/builtin/Promise.cpp b/js/src/builtin/Promise.cpp
      }
      JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
                                JSMSG_NOT_NONNULL_OBJECT, message);
-     return false;
-   }
-@@ -2320,16 +2337,19 @@ static MOZ_MUST_USE bool CommonStaticAll
-   }
+         return false;
+     }
+@@ -2109,16 +2126,19 @@ static MOZ_MUST_USE bool CommonStaticAll
+         return AbruptRejectPromise(cx, args, promiseCapability);
  
    if (!iter.valueIsIterable()) {
      const char* message;
@@ -121,10 +121,10 @@ diff --git a/js/src/builtin/Promise.cpp b/js/src/builtin/Promise.cpp
                                message);
      return AbruptRejectPromise(cx, args, promiseCapability);
    }
-@@ -2337,16 +2357,19 @@ static MOZ_MUST_USE bool CommonStaticAll
-   // Step 6 (implicit).
+@@ -2126,16 +2146,19 @@ static MOZ_MUST_USE bool CommonStaticAll
+     // Step 6 (implicit).
  
-   // Step 7.
+     // Step 7.
    bool done, result;
    switch (mode) {
      case IterationMode::All:
@@ -138,14 +138,14 @@ diff --git a/js/src/builtin/Promise.cpp b/js/src/builtin/Promise.cpp
        break;
    }
  
-   // Step 8.
-   if (!result) {
-     // Step 8.a.
-@@ -2578,16 +2601,20 @@ static MOZ_MUST_USE JSObject* CommonStat
-     JSContext* cx, HandleValue thisVal, HandleValue argVal,
-     ResolutionMode mode);
+     // Step 8.
+     if (!result) {
+         // Step 8.a.
+@@ -2334,16 +2357,20 @@ CommonStaticResolveRejectImpl(JSContext*
+                               ResolutionMode mode);
  
- static bool IsPromiseSpecies(JSContext* cx, JSFunction* species);
+ static bool
+ IsPromiseSpecies(JSContext* cx, JSFunction* species);
  
  // ES2019 draft rev dd269df67d37409a6f2099a842b8f5c75ee6fc24
  // 25.6.4.1.1 Runtime Semantics: PerformPromiseAll, step 6.
@@ -155,17 +155,17 @@ diff --git a/js/src/builtin/Promise.cpp b/js/src/builtin/Promise.cpp
 +// https://tc39.github.io/proposal-promise-allSettled/
 +// Runtime Semantics: PerformPromiseAllSettled, step 6.
  template <typename T>
- static MOZ_MUST_USE bool CommonPerformPromiseAllRace(
-     JSContext* cx, PromiseForOfIterator& iterator, HandleObject C,
+ static MOZ_MUST_USE bool
+ CommonPerformPromiseAllRace(JSContext *cx, PromiseForOfIterator& iterator, HandleObject C,
      HandleObject resultPromise, bool* done, bool resolveReturnsUndefined,
      T getResolveAndReject) {
-   RootedObject promiseCtor(
-       cx, GlobalObject::getOrCreatePromiseConstructor(cx, cx->global()));
-   if (!promiseCtor) {
-@@ -3112,16 +3139,295 @@ static MOZ_MUST_USE bool PerformPromiseR
-   };
+     RootedObject promiseCtor(cx, GlobalObject::getOrCreatePromiseConstructor(cx, cx->global()));
+     if (!promiseCtor)
+         return false;
+@@ -2835,16 +2862,294 @@ PerformPromiseRace(JSContext *cx, Promis
+     };
  
-   // Step 3.
+     // Step 3.
    return CommonPerformPromiseAllRace(cx, iterator, C,
                                       resultCapability.promise(), done,
                                       isDefaultResolveFn, getResolveAndReject);
@@ -449,21 +449,20 @@ diff --git a/js/src/builtin/Promise.cpp b/js/src/builtin/Promise.cpp
 +  args.rval().setUndefined();
 +  return true;
 +}
-+
- // https://tc39.github.io/ecma262/#sec-promise.reject
- //
- // Unified implementation of
- // 25.6.4.4 Promise.reject ( r )
- // 25.6.4.5 Promise.resolve ( x )
- // 25.6.4.5.1 PromiseResolve ( C, x )
- static MOZ_MUST_USE JSObject* CommonStaticResolveRejectImpl(
-     JSContext* cx, HandleValue thisVal, HandleValue argVal,
-@@ -5387,19 +5693,23 @@ static const JSFunctionSpec promise_meth
-     JS_FNINFO("catch", Promise_catch, &promise_catch_info, 1, 0),
-     JS_SELF_HOSTED_FN("finally", "Promise_finally", 1, 0), JS_FS_END};
+ 
+ // ES2016, Sub-steps of 25.4.4.4 and 25.4.4.5.
+ static MOZ_MUST_USE JSObject*
+ CommonStaticResolveRejectImpl(JSContext* cx, HandleValue thisVal, HandleValue argVal,
+                               ResolutionMode mode)
+ {
+     // Steps 1-2.
+     if (!thisVal.isObject()) {
+@@ -4658,21 +4963,23 @@ static const JSFunctionSpec promise_meth
  
  static const JSPropertySpec promise_properties[] = {
-     JS_STRING_SYM_PS(toStringTag, "Promise", JSPROP_READONLY), JS_PS_END};
+     JS_STRING_SYM_PS(toStringTag, "Promise", JSPROP_READONLY),
+     JS_PS_END
+ };
  
  static const JSFunctionSpec promise_static_methods[] = {
      JS_FN("all", Promise_static_all, 1, 0),
@@ -472,17 +471,18 @@ diff --git a/js/src/builtin/Promise.cpp b/js/src/builtin/Promise.cpp
 +#endif
      JS_FN("race", Promise_static_race, 1, 0),
      JS_FN("reject", Promise_reject, 1, 0),
--    JS_FN("resolve", Promise_static_resolve, 1, 0), JS_FS_END};
-+    JS_FN("resolve", Promise_static_resolve, 1, 0),
+     JS_FN("resolve", Promise_static_resolve, 1, 0),
+-    JS_FS_END
+-};
 +    JS_FS_END};
  
  static const JSPropertySpec promise_static_properties[] = {
-     JS_SYM_GET(species, Promise_static_species, 0), JS_PS_END};
+     JS_SYM_GET(species, Promise_static_species, 0),
+     JS_PS_END
+ };
  
  static const ClassSpec PromiseObjectClassSpec = {
      GenericCreateConstructor<PromiseConstructor, 1, gc::AllocKind::FUNCTION>,
-     GenericCreatePrototype<PromiseObject>,
-     promise_static_methods,
 diff --git a/js/src/tests/non262/Promise/allSettled.js b/js/src/tests/non262/Promise/allSettled.js
 new file mode 100644
 --- /dev/null
@@ -579,21 +579,21 @@ new file mode 100644
 diff --git a/js/src/vm/CommonPropertyNames.h b/js/src/vm/CommonPropertyNames.h
 --- a/js/src/vm/CommonPropertyNames.h
 +++ b/js/src/vm/CommonPropertyNames.h
-@@ -378,16 +378,17 @@
-   MACRO(source, source, "source")                                              \
-   MACRO(SpeciesConstructor, SpeciesConstructor, "SpeciesConstructor")          \
-   MACRO(stack, stack, "stack")                                                 \
-   MACRO(star, star, "*")                                                       \
-   MACRO(start, start, "start")                                                 \
-   MACRO(startTimestamp, startTimestamp, "startTimestamp")                      \
-   MACRO(state, state, "state")                                                 \
-   MACRO(static, static_, "static")                                             \
-+  MACRO(status, status, "status")                                              \
-   MACRO(std_Function_apply, std_Function_apply, "std_Function_apply")          \
-   MACRO(sticky, sticky, "sticky")                                              \
-   MACRO(StringIterator, StringIterator, "String Iterator")                     \
-   MACRO(strings, strings, "strings")                                           \
-   MACRO(StructType, StructType, "StructType")                                  \
-   MACRO(style, style, "style")                                                 \
-   MACRO(super, super, "super")                                                 \
-   MACRO(switch, switch_, "switch")                                             \
+@@ -382,16 +382,17 @@
+     macro(source, source, "source") \
+     macro(SpeciesConstructor, SpeciesConstructor, "SpeciesConstructor") \
+     macro(stack, stack, "stack") \
+     macro(star, star, "*") \
+     macro(start, start, "start") \
+     macro(startTimestamp, startTimestamp, "startTimestamp") \
+     macro(state, state, "state") \
+     macro(static, static_, "static") \
++    macro(status, status, "status")                                              \
+     macro(std_Function_apply, std_Function_apply, "std_Function_apply") \
+     macro(sticky, sticky, "sticky") \
+     macro(StringIterator, StringIterator, "String Iterator") \
+     macro(strings, strings, "strings") \
+     macro(StructType, StructType, "StructType") \
+     macro(style, style, "style") \
+     macro(super, super, "super") \
+     macro(switch, switch_, "switch") \

frg/work-js/mozilla-release/patches/mozilla-central_469095.patch → frg/work-js/mozilla-release/patches/1539694-3-68a1.patch

@@ -3,7 +3,7 @@
 # Date 1555016820 0
 #      Thu Apr 11 21:07:00 2019 +0000
 # Node ID 0b0a39e79b6e4c96aede5823b97ceb9b66e8e010
-# Parent  9378daa99e07d9b353473b9fd4c0b7857d1ccb8d
+# Parent  9e2c759fa4ef5cbeeaf7b1410d85b4edc0ec6983
 Bug 1539694 - Part 3: Update xray tests for Promise. r=peterv
 
 Differential Revision: https://phabricator.services.mozilla.com/D26144
@@ -11,7 +11,7 @@ Differential Revision: https://phabricator.services.mozilla.com/D26144
 diff --git a/js/xpconnect/tests/chrome/test_xrayToJS.xul b/js/xpconnect/tests/chrome/test_xrayToJS.xul
 --- a/js/xpconnect/tests/chrome/test_xrayToJS.xul
 +++ b/js/xpconnect/tests/chrome/test_xrayToJS.xul
-@@ -249,16 +249,19 @@ https://bugzilla.mozilla.org/show_bug.cg
+@@ -241,16 +241,19 @@ https://bugzilla.mozilla.org/show_bug.cg
                        "leftContext", "rightContext", "$1", "$2", "$3", "$4",
                        "$5", "$6", "$7", "$8", "$9", "$_", "$&", "$+",
                        "$`", "$'", Symbol.species])

frg/work-js/mozilla-release/patches/1543948-68a1.patch

@@ -0,0 +1,172 @@
+# HG changeset patch
+# User Andre Bargull <andre.bargull@gmail.com>
+# Date 1556131830 0
+# Node ID 4b550f29706aa5833edb64db3189fb7daeb9b298
+# Parent  b9332c06f4f1da1f07723bb009fb0860a973b5d7
+Bug 1543948: Add ifdef NIGHTLY_BUILD guards around all Promise.allSettled functions. r=jorendorff
+
+Differential Revision: https://phabricator.services.mozilla.com/D28479
+
+diff --git a/js/src/builtin/Promise.cpp b/js/src/builtin/Promise.cpp
+--- a/js/src/builtin/Promise.cpp
++++ b/js/src/builtin/Promise.cpp
+@@ -83,20 +83,22 @@ enum RejectFunctionSlots {
+     RejectFunctionSlot_ResolveFunction,
+ };
+ 
+ enum PromiseAllResolveElementFunctionSlots {
+     PromiseAllResolveElementFunctionSlot_Data = 0,
+     PromiseAllResolveElementFunctionSlot_ElementIndex,
+ };
+ 
++#ifdef NIGHTLY_BUILD
+ enum PromiseAllSettledElementFunctionSlots {
+   PromiseAllSettledElementFunctionSlot_Data = 0,
+   PromiseAllSettledElementFunctionSlot_ElementIndex,
+ };
++#endif
+ 
+ enum ReactionJobSlots {
+     ReactionJobSlot_ReactionRecord = 0,
+ };
+ 
+ enum ThenableJobSlots {
+     // The handler to use as the Promise reaction. It is a callable object
+     // that's guaranteed to be from the same compartment as the
+@@ -2063,25 +2065,33 @@ class MOZ_STACK_CLASS PromiseForOfIterat
+         return index != NOT_ARRAY && IsPackedArray(iterator);
+     }
+ };
+ 
+ static MOZ_MUST_USE bool
+ PerformPromiseAll(JSContext *cx, PromiseForOfIterator& iterator, HandleObject C,
+                   Handle<PromiseCapability> resultCapability, bool* done);
+ 
++#ifdef NIGHTLY_BUILD
+ static MOZ_MUST_USE bool PerformPromiseAllSettled(
+     JSContext* cx, PromiseForOfIterator& iterator, HandleObject C,
+     Handle<PromiseCapability> resultCapability, bool* done);
++#endif
+ 
+ static MOZ_MUST_USE bool PerformPromiseRace(
+     JSContext* cx, PromiseForOfIterator& iterator, HandleObject C,
+     Handle<PromiseCapability> resultCapability, bool* done);
+ 
+-enum class IterationMode { All, AllSettled, Race };
++enum class IterationMode {
++  All,
++#ifdef NIGHTLY_BUILD
++  AllSettled,
++#endif
++  Race
++};
+ 
+ // ES2020 draft rev a09fc232c137800dbf51b6204f37fdede4ba1646
+ //
+ // Unified implementation of
+ // 25.6.4.1 Promise.all ( iterable )
+ // 25.6.4.3 Promise.race ( iterable )
+ //
+ // Promise.allSettled (Stage 3 proposal)
+@@ -2095,19 +2105,21 @@ static MOZ_MUST_USE bool CommonStaticAll
+   // Step 2 (reordered).
+   HandleValue CVal = args.thisv();
+   if (!CVal.isObject()) {
+     const char* message;
+     switch (mode) {
+       case IterationMode::All:
+         message = "Receiver of Promise.all call";
+         break;
++#ifdef NIGHTLY_BUILD
+       case IterationMode::AllSettled:
+         message = "Receiver of Promise.allSettled call";
+         break;
++#endif
+       case IterationMode::Race:
+         message = "Receiver of Promise.race call";
+         break;
+     }
+     JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
+                               JSMSG_NOT_NONNULL_OBJECT, message);
+         return false;
+     }
+@@ -2126,19 +2138,21 @@ static MOZ_MUST_USE bool CommonStaticAll
+         return AbruptRejectPromise(cx, args, promiseCapability);
+ 
+   if (!iter.valueIsIterable()) {
+     const char* message;
+     switch (mode) {
+       case IterationMode::All:
+         message = "Argument of Promise.all";
+         break;
++#ifdef NIGHTLY_BUILD
+       case IterationMode::AllSettled:
+         message = "Argument of Promise.allSettled";
+         break;
++#endif
+       case IterationMode::Race:
+         message = "Argument of Promise.race";
+         break;
+     }
+     JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_NOT_ITERABLE,
+                               message);
+     return AbruptRejectPromise(cx, args, promiseCapability);
+   }
+@@ -2146,19 +2160,21 @@ static MOZ_MUST_USE bool CommonStaticAll
+     // Step 6 (implicit).
+ 
+     // Step 7.
+   bool done, result;
+   switch (mode) {
+     case IterationMode::All:
+       result = PerformPromiseAll(cx, iter, C, promiseCapability, &done);
+       break;
++#ifdef NIGHTLY_BUILD
+     case IterationMode::AllSettled:
+       result = PerformPromiseAllSettled(cx, iter, C, promiseCapability, &done);
+       break;
++#endif
+     case IterationMode::Race:
+       result = PerformPromiseRace(cx, iter, C, promiseCapability, &done);
+       break;
+   }
+ 
+     // Step 8.
+     if (!result) {
+         // Step 8.a.
+@@ -2862,16 +2878,17 @@ PerformPromiseRace(JSContext *cx, Promis
+     };
+ 
+     // Step 3.
+   return CommonPerformPromiseAllRace(cx, iterator, C,
+                                      resultCapability.promise(), done,
+                                      isDefaultResolveFn, getResolveAndReject);
+ }
+ 
++#ifdef NIGHTLY_BUILD
+ enum class PromiseAllSettledElementFunctionKind { Resolve, Reject };
+ 
+ // Promise.allSettled (Stage 3 proposal)
+ // https://tc39.github.io/proposal-promise-allSettled/
+ //
+ // Promise.allSettled Resolve Element Functions
+ // Promise.allSettled Reject Element Functions
+ template <PromiseAllSettledElementFunctionKind Kind>
+@@ -3140,16 +3157,17 @@ static bool PromiseAllSettledElementFunc
+       return false;
+     }
+   }
+ 
+   // Step 15.
+   args.rval().setUndefined();
+   return true;
+ }
++#endif  // NIGHTLY_BUILD
+ 
+ // ES2016, Sub-steps of 25.4.4.4 and 25.4.4.5.
+ static MOZ_MUST_USE JSObject*
+ CommonStaticResolveRejectImpl(JSContext* cx, HandleValue thisVal, HandleValue argVal,
+                               ResolutionMode mode)
+ {
+     // Steps 1-2.
+     if (!thisVal.isObject()) {

frg/work-js/mozilla-release/patches/1545354-68a1.patch

@@ -0,0 +1,47 @@
+# HG changeset patch
+# User Andre Bargull <andre.bargull@gmail.com>
+# Date 1556038418 0
+# Node ID a296a09b1ad10df66320e1726198e35b4ed99aef
+# Parent  437a062debf18e502b58782b07b3e79c87fa5a98
+Bug 1545354: Don't try to reject an already resolved async function promise on OOM. r=arai
+
+Differential Revision: https://phabricator.services.mozilla.com/D28476
+
+diff --git a/js/src/vm/AsyncFunction.cpp b/js/src/vm/AsyncFunction.cpp
+--- a/js/src/vm/AsyncFunction.cpp
++++ b/js/src/vm/AsyncFunction.cpp
+@@ -111,25 +111,26 @@ static bool AsyncFunctionResume(JSContex
+                                    : cx->names().AsyncFunctionThrow;
+   FixedInvokeArgs<1> args(cx);
+   args[0].set(valueOrReason);
+   RootedValue generatorOrValue(cx, ObjectValue(*generator));
+   if (!CallSelfHostedFunction(cx, funName, generatorOrValue, args,
+                               &generatorOrValue)) {
+     if (!generator->isClosed()) {
+       generator->setClosed();
++    }
+ 
+-      // Handle the OOM case mentioned above.
+-      if (cx->isExceptionPending()) {
+-        RootedValue exn(cx);
+-        if (!GetAndClearException(cx, &exn)) {
+-          return false;
+-        }
+-        return AsyncFunctionThrown(cx, resultPromise, exn);
++    // Handle the OOM case mentioned above.
++    if (resultPromise->state() == JS::PromiseState::Pending &&
++        cx->isExceptionPending()) {
++      RootedValue exn(cx);
++      if (!GetAndClearException(cx, &exn)) {
++        return false;
+       }
++      return AsyncFunctionThrown(cx, resultPromise, exn);
+     }
+     return false;
+   }
+ 
+   MOZ_ASSERT_IF(generator->isClosed(), generatorOrValue.isObject());
+   MOZ_ASSERT_IF(generator->isClosed(),
+                 &generatorOrValue.toObject() == resultPromise);
+   MOZ_ASSERT_IF(!generator->isClosed(), generator->isAfterAwait());
+

frg/work-js/mozilla-release/patches/1549176-1-71a1.patch

@@ -0,0 +1,285 @@
+# HG changeset patch
+# User Jason Orendorff <jorendorff@mozilla.com>
+# Date 1569888891 0
+# Node ID 0b0cd8ade305fa4940e52f3b1879094c7c910193
+# Parent  0225b0c4e6b36ba89f1e8e1ba8945cd03da45d8a
+Bug 1549176 - Part 1: Ship Promise.allSettled. r=jwalden
+
+Differential Revision: https://phabricator.services.mozilla.com/D46991
+
+diff --git a/js/src/builtin/Promise.cpp b/js/src/builtin/Promise.cpp
+--- a/js/src/builtin/Promise.cpp
++++ b/js/src/builtin/Promise.cpp
+@@ -83,22 +83,20 @@ enum RejectFunctionSlots {
+     RejectFunctionSlot_ResolveFunction,
+ };
+ 
+ enum PromiseAllResolveElementFunctionSlots {
+     PromiseAllResolveElementFunctionSlot_Data = 0,
+     PromiseAllResolveElementFunctionSlot_ElementIndex,
+ };
+ 
+-#ifdef NIGHTLY_BUILD
+ enum PromiseAllSettledElementFunctionSlots {
+   PromiseAllSettledElementFunctionSlot_Data = 0,
+   PromiseAllSettledElementFunctionSlot_ElementIndex,
+ };
+-#endif
+ 
+ enum ReactionJobSlots {
+     ReactionJobSlot_ReactionRecord = 0,
+ };
+ 
+ enum ThenableJobSlots {
+     // The handler to use as the Promise reaction. It is a callable object
+     // that's guaranteed to be from the same compartment as the
+@@ -2065,61 +2063,55 @@ class MOZ_STACK_CLASS PromiseForOfIterat
+         return index != NOT_ARRAY && IsPackedArray(iterator);
+     }
+ };
+ 
+ static MOZ_MUST_USE bool
+ PerformPromiseAll(JSContext *cx, PromiseForOfIterator& iterator, HandleObject C,
+                   Handle<PromiseCapability> resultCapability, bool* done);
+ 
+-#ifdef NIGHTLY_BUILD
+ static MOZ_MUST_USE bool PerformPromiseAllSettled(
+     JSContext* cx, PromiseForOfIterator& iterator, HandleObject C,
+     Handle<PromiseCapability> resultCapability, bool* done);
+-#endif
+ 
+ static MOZ_MUST_USE bool PerformPromiseRace(
+     JSContext* cx, PromiseForOfIterator& iterator, HandleObject C,
+     Handle<PromiseCapability> resultCapability, bool* done);
+ 
+ enum class IterationMode {
+   All,
+-#ifdef NIGHTLY_BUILD
+   AllSettled,
+-#endif
+   Race
+ };
+ 
+ // ES2020 draft rev a09fc232c137800dbf51b6204f37fdede4ba1646
+ //
+ // Unified implementation of
+ // 25.6.4.1 Promise.all ( iterable )
+ // 25.6.4.3 Promise.race ( iterable )
+ //
+-// Promise.allSettled (Stage 3 proposal)
++// Promise.allSettled (Stage 4 proposal)
+ // https://tc39.github.io/proposal-promise-allSettled/
+ //
+ // Promise.allSettled ( iterable )
+ static MOZ_MUST_USE bool CommonStaticAllRace(JSContext* cx, CallArgs& args,
+                                              IterationMode mode) {
+   HandleValue iterable = args.get(0);
+ 
+   // Step 2 (reordered).
+   HandleValue CVal = args.thisv();
+   if (!CVal.isObject()) {
+     const char* message;
+     switch (mode) {
+       case IterationMode::All:
+         message = "Receiver of Promise.all call";
+         break;
+-#ifdef NIGHTLY_BUILD
+       case IterationMode::AllSettled:
+         message = "Receiver of Promise.allSettled call";
+         break;
+-#endif
+       case IterationMode::Race:
+         message = "Receiver of Promise.race call";
+         break;
+     }
+     JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
+                               JSMSG_NOT_NONNULL_OBJECT, message);
+         return false;
+     }
+@@ -2138,21 +2130,19 @@ static MOZ_MUST_USE bool CommonStaticAll
+         return AbruptRejectPromise(cx, args, promiseCapability);
+ 
+   if (!iter.valueIsIterable()) {
+     const char* message;
+     switch (mode) {
+       case IterationMode::All:
+         message = "Argument of Promise.all";
+         break;
+-#ifdef NIGHTLY_BUILD
+       case IterationMode::AllSettled:
+         message = "Argument of Promise.allSettled";
+         break;
+-#endif
+       case IterationMode::Race:
+         message = "Argument of Promise.race";
+         break;
+     }
+     JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_NOT_ITERABLE,
+                               message);
+     return AbruptRejectPromise(cx, args, promiseCapability);
+   }
+@@ -2160,21 +2150,19 @@ static MOZ_MUST_USE bool CommonStaticAll
+     // Step 6 (implicit).
+ 
+     // Step 7.
+   bool done, result;
+   switch (mode) {
+     case IterationMode::All:
+       result = PerformPromiseAll(cx, iter, C, promiseCapability, &done);
+       break;
+-#ifdef NIGHTLY_BUILD
+     case IterationMode::AllSettled:
+       result = PerformPromiseAllSettled(cx, iter, C, promiseCapability, &done);
+       break;
+-#endif
+     case IterationMode::Race:
+       result = PerformPromiseRace(cx, iter, C, promiseCapability, &done);
+       break;
+   }
+ 
+     // Step 8.
+     if (!result) {
+         // Step 8.a.
+@@ -2374,17 +2362,17 @@ CommonStaticResolveRejectImpl(JSContext*
+ 
+ static bool
+ IsPromiseSpecies(JSContext* cx, JSFunction* species);
+ 
+ // ES2019 draft rev dd269df67d37409a6f2099a842b8f5c75ee6fc24
+ // 25.6.4.1.1 Runtime Semantics: PerformPromiseAll, step 6.
+ // 25.6.4.3.1 Runtime Semantics: PerformPromiseRace, step 3.
+ //
+-// Promise.allSettled (Stage 3 proposal)
++// Promise.allSettled (Stage 4 proposal)
+ // https://tc39.github.io/proposal-promise-allSettled/
+ // Runtime Semantics: PerformPromiseAllSettled, step 6.
+ template <typename T>
+ static MOZ_MUST_USE bool
+ CommonPerformPromiseAllRace(JSContext *cx, PromiseForOfIterator& iterator, HandleObject C,
+     HandleObject resultPromise, bool* done, bool resolveReturnsUndefined,
+     T getResolveAndReject) {
+     RootedObject promiseCtor(cx, GlobalObject::getOrCreatePromiseConstructor(cx, cx->global()));
+@@ -2878,38 +2866,37 @@ PerformPromiseRace(JSContext *cx, Promis
+     };
+ 
+     // Step 3.
+   return CommonPerformPromiseAllRace(cx, iterator, C,
+                                      resultCapability.promise(), done,
+                                      isDefaultResolveFn, getResolveAndReject);
+ }
+ 
+-#ifdef NIGHTLY_BUILD
+ enum class PromiseAllSettledElementFunctionKind { Resolve, Reject };
+ 
+-// Promise.allSettled (Stage 3 proposal)
++// Promise.allSettled (Stage 4 proposal)
+ // https://tc39.github.io/proposal-promise-allSettled/
+ //
+ // Promise.allSettled Resolve Element Functions
+ // Promise.allSettled Reject Element Functions
+ template <PromiseAllSettledElementFunctionKind Kind>
+ static bool PromiseAllSettledElementFunction(JSContext* cx, unsigned argc,
+                                              Value* vp);
+ 
+-// Promise.allSettled (Stage 3 proposal)
++// Promise.allSettled (Stage 4 proposal)
+ // https://tc39.github.io/proposal-promise-allSettled/
+ //
+ // Promise.allSettled ( iterable )
+ static bool Promise_static_allSettled(JSContext* cx, unsigned argc, Value* vp) {
+   CallArgs args = CallArgsFromVp(argc, vp);
+   return CommonStaticAllRace(cx, args, IterationMode::AllSettled);
+ }
+ 
+-// Promise.allSettled (Stage 3 proposal)
++// Promise.allSettled (Stage 4 proposal)
+ // https://tc39.github.io/proposal-promise-allSettled/
+ //
+ // PerformPromiseAllSettled ( iteratorRecord, constructor, resultCapability )
+ static MOZ_MUST_USE bool PerformPromiseAllSettled(
+     JSContext* cx, PromiseForOfIterator& iterator, HandleObject C,
+     Handle<PromiseCapability> resultCapability, bool* done) {
+   *done = false;
+ 
+@@ -3043,17 +3030,17 @@ static MOZ_MUST_USE bool PerformPromiseA
+   if (remainingCount == 0) {
+     return RunResolutionFunction(cx, resultCapability.resolve(), valuesArrayVal,
+                                  ResolveMode, resultCapability.promise());
+   }
+ 
+   return true;
+ }
+ 
+-// Promise.allSettled (Stage 3 proposal)
++// Promise.allSettled (Stage 4 proposal)
+ // https://tc39.github.io/proposal-promise-allSettled/
+ //
+ // Promise.allSettled Resolve Element Functions
+ // Promise.allSettled Reject Element Functions
+ template <PromiseAllSettledElementFunctionKind Kind>
+ static bool PromiseAllSettledElementFunction(JSContext* cx, unsigned argc,
+                                              Value* vp) {
+   CallArgs args = CallArgsFromVp(argc, vp);
+@@ -3157,17 +3144,16 @@ static bool PromiseAllSettledElementFunc
+       return false;
+     }
+   }
+ 
+   // Step 15.
+   args.rval().setUndefined();
+   return true;
+ }
+-#endif  // NIGHTLY_BUILD
+ 
+ // ES2016, Sub-steps of 25.4.4.4 and 25.4.4.5.
+ static MOZ_MUST_USE JSObject*
+ CommonStaticResolveRejectImpl(JSContext* cx, HandleValue thisVal, HandleValue argVal,
+                               ResolutionMode mode)
+ {
+     // Steps 1-2.
+     if (!thisVal.isObject()) {
+@@ -4981,19 +4967,17 @@ static const JSFunctionSpec promise_meth
+ 
+ static const JSPropertySpec promise_properties[] = {
+     JS_STRING_SYM_PS(toStringTag, "Promise", JSPROP_READONLY),
+     JS_PS_END
+ };
+ 
+ static const JSFunctionSpec promise_static_methods[] = {
+     JS_FN("all", Promise_static_all, 1, 0),
+-#ifdef NIGHTLY_BUILD
+     JS_FN("allSettled", Promise_static_allSettled, 1, 0),
+-#endif
+     JS_FN("race", Promise_static_race, 1, 0),
+     JS_FN("reject", Promise_reject, 1, 0),
+     JS_FN("resolve", Promise_static_resolve, 1, 0),
+     JS_FS_END};
+ 
+ static const JSPropertySpec promise_static_properties[] = {
+     JS_SYM_GET(species, Promise_static_species, 0),
+     JS_PS_END
+diff --git a/js/src/tests/test262-update.py.1549176.later b/js/src/tests/test262-update.py.1549176.later
+new file mode 100644
+--- /dev/null
++++ b/js/src/tests/test262-update.py.1549176.later
+@@ -0,0 +1,20 @@
++--- test262-update.py
+++++ test262-update.py
++@@ -44,17 +44,16 @@ UNSUPPORTED_FEATURES = set([
++ ])
++ FEATURE_CHECK_NEEDED = {
++     "Atomics": "!this.hasOwnProperty('Atomics')",
++     "SharedArrayBuffer": "!this.hasOwnProperty('SharedArrayBuffer')",
++ }
++ RELEASE_OR_BETA = set([
++     "Intl.NumberFormat-unified",
++     "Intl.DateTimeFormat-fractionalSecondDigits",
++-    "Promise.allSettled",
++ ])
++ 
++ 
++ @contextlib.contextmanager
++ def TemporaryDirectory():
++     tmpDir = tempfile.mkdtemp()
++     try:
++         yield tmpDir

frg/work-js/mozilla-release/patches/1586592-71a1.patch

@@ -0,0 +1,35 @@
+# HG changeset patch
+# User Tom Schuster <evilpies@gmail.com>
+# Date 1570569386 0
+# Node ID 9d9bdd86132ce89d1bd68d7548f0f9d43c5d85b1
+# Parent  2e23a503638ed73e0075eecec2eadd7b52bfff69
+Bug 1586592 - Promise.allSettled is now enabled everywhere, fix test. r=jorendorff
+
+Differential Revision: https://phabricator.services.mozilla.com/D48393
+
+diff --git a/js/xpconnect/tests/chrome/test_xrayToJS.xul b/js/xpconnect/tests/chrome/test_xrayToJS.xul
+--- a/js/xpconnect/tests/chrome/test_xrayToJS.xul
++++ b/js/xpconnect/tests/chrome/test_xrayToJS.xul
+@@ -241,20 +241,17 @@ https://bugzilla.mozilla.org/show_bug.cg
+     constructorProps(["input", "lastMatch", "lastParen",
+                       "leftContext", "rightContext", "$1", "$2", "$3", "$4",
+                       "$5", "$6", "$7", "$8", "$9", "$_", "$&", "$+",
+                       "$`", "$'", Symbol.species])
+ 
+   gPrototypeProperties['Promise'] =
+     ["constructor", "catch", "then", "finally", Symbol.toStringTag];
+   gConstructorProperties['Promise'] =
+-    constructorProps(["resolve", "reject", "all", "race", Symbol.species]);
+-  if (isNightlyBuild) {
+-    gConstructorProperties['Promise'].push("allSettled");
+-  }
++    constructorProps(["resolve", "reject", "all", "allSettled", "race", Symbol.species]);
+ 
+   gPrototypeProperties['ArrayBuffer'] =
+     ["constructor", "byteLength", "slice", Symbol.toStringTag];
+   gConstructorProperties['ArrayBuffer'] =
+     constructorProps(["isView", Symbol.species]);
+ 
+   is(typeof SharedArrayBuffer, "undefined", "Enable tests!");
+ 
+

frg/work-js/mozilla-release/patches/1773584-103a1.patch

@@ -2,7 +2,7 @@
 # User Jan de Mooij <jdemooij@mozilla.com>
 # Date 1655969322 0
 # Node ID 8873669c60146a7031db604709680c04cbb483ae
-# Parent  7b75d1cf8abe9c540a557512ea3d38c3cbb9f7f9
+# Parent  a7a8113a480505008be139d7d2b97f90ffbf840d
 Bug 1773584 - Remove MemoryProtectionExceptionHandler and PageProtectingVector. r=nbp
 
 `PageProtectingVector` has been unused since bug 1342023.
@@ -185,7 +185,7 @@ deleted file mode 100644
 -    // faults it sees are fatal. Just disable this handler in that case, as the
 -    // crash annotations provided here are not critical for ASan builds.
 -    return true;
--#elif defined(RELEASE_OR_BETA)
+-#elif !defined(MOZ_DIAGNOSTIC_ASSERT_ENABLED)
 -    // Disable the exception handler for Beta and Release builds.
 -    return true;
 -#else
@@ -1379,7 +1379,7 @@ deleted file mode 100644
 diff --git a/js/src/moz.build b/js/src/moz.build
 --- a/js/src/moz.build
 +++ b/js/src/moz.build
-@@ -201,17 +201,16 @@ UNIFIED_SOURCES += [
+@@ -202,17 +202,16 @@ UNIFIED_SOURCES += [
      'builtin/String.cpp',
      'builtin/Symbol.cpp',
      'builtin/TestingFunctions.cpp',

frg/work-js/mozilla-release/patches/L-1418236-63a1.patch

@@ -0,0 +1,1124 @@
+# HG changeset patch
+# User Andrea Marchesini <amarchesini@mozilla.com>
+# Date 1531237221 -7200
+# Node ID 1b3143e4ec831f400df95c1fef8ee87d6f3368d2
+# Parent  739eaa1fe6f719be1ba42093a799d781290ca2be
+Bug 1418236 - Correct EventTarget for CSP violation events, r=ckerschb
+
+diff --git a/caps/nsScriptSecurityManager.cpp b/caps/nsScriptSecurityManager.cpp
+--- a/caps/nsScriptSecurityManager.cpp
++++ b/caps/nsScriptSecurityManager.cpp
+@@ -436,16 +436,17 @@ nsScriptSecurityManager::ContentSecurity
+                                        &columnNum)) {
+             if (const char *file = scriptFilename.get()) {
+                 CopyUTF8toUTF16(nsDependentCString(file), fileName);
+             }
+         } else {
+             MOZ_ASSERT(!JS_IsExceptionPending(cx));
+         }
+         csp->LogViolationDetails(nsIContentSecurityPolicy::VIOLATION_TYPE_EVAL,
++                                 nullptr, // triggering element
+                                  fileName,
+                                  scriptSample,
+                                  lineNum,
+                                  columnNum,
+                                  EmptyString(),
+                                  EmptyString());
+     }
+ 
+diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
+--- a/dom/base/nsDocument.cpp
++++ b/dom/base/nsDocument.cpp
+@@ -12724,17 +12724,18 @@ nsIDocument::InlineScriptAllowedByCSP()
+   nsCOMPtr<nsIContentSecurityPolicy> csp;
+   nsresult rv = NodePrincipal()->GetCsp(getter_AddRefs(csp));
+   NS_ENSURE_SUCCESS(rv, true);
+   bool allowsInlineScript = true;
+   if (csp) {
+     nsresult rv = csp->GetAllowsInline(nsIContentPolicy::TYPE_SCRIPT,
+                                        EmptyString(), // aNonce
+                                        true,          // aParserCreated
+-                                       nullptr, // FIXME get script sample (bug 1314567)
++                                       nullptr,       // aTriggeringElement
++                                       EmptyString(), // FIXME get script sample (bug 1314567)
+                                        0,             // aLineNumber
+                                        0,             // aColumnNumber
+                                        &allowsInlineScript);
+     NS_ENSURE_SUCCESS(rv, true);
+   }
+   return allowsInlineScript;
+ }
+ 
+diff --git a/dom/base/nsJSTimeoutHandler.cpp b/dom/base/nsJSTimeoutHandler.cpp
+--- a/dom/base/nsJSTimeoutHandler.cpp
++++ b/dom/base/nsJSTimeoutHandler.cpp
+@@ -202,16 +202,17 @@ CheckCSPForEval(JSContext* aCx, nsGlobal
+     uint32_t columnNum = 0;
+     nsAutoString fileNameString;
+     if (!nsJSUtils::GetCallingLocation(aCx, fileNameString, &lineNum,
+                                        &columnNum)) {
+       fileNameString.AssignLiteral("unknown");
+     }
+ 
+     csp->LogViolationDetails(nsIContentSecurityPolicy::VIOLATION_TYPE_EVAL,
++                             nullptr, // triggering element
+                              fileNameString, scriptSample, lineNum, columnNum,
+                              EmptyString(), EmptyString());
+   }
+ 
+   return allowsEval;
+ }
+ 
+ nsJSScriptTimeoutHandler::nsJSScriptTimeoutHandler()
+diff --git a/dom/base/nsStyledElement.cpp b/dom/base/nsStyledElement.cpp
+--- a/dom/base/nsStyledElement.cpp
++++ b/dom/base/nsStyledElement.cpp
+@@ -183,17 +183,17 @@ nsStyledElement::ParseStyleAttribute(con
+                                      nsIPrincipal* aMaybeScriptedPrincipal,
+                                      nsAttrValue& aResult,
+                                      bool aForceInDataDoc)
+ {
+   nsIDocument* doc = OwnerDoc();
+   bool isNativeAnon = IsInNativeAnonymousSubtree();
+ 
+   if (!isNativeAnon &&
+-      !nsStyleUtil::CSPAllowsInlineStyle(nullptr, NodePrincipal(),
++      !nsStyleUtil::CSPAllowsInlineStyle(this, NodePrincipal(),
+                                          aMaybeScriptedPrincipal,
+                                          doc->GetDocumentURI(), 0, 0, aValue,
+                                          nullptr))
+     return;
+ 
+   if (aForceInDataDoc ||
+       !doc->IsLoadedAsData() ||
+       GetExistingStyle() ||
+diff --git a/dom/events/EventListenerManager.cpp b/dom/events/EventListenerManager.cpp
+--- a/dom/events/EventListenerManager.cpp
++++ b/dom/events/EventListenerManager.cpp
+@@ -839,26 +839,23 @@ EventListenerManager::SetEventHandler(ns
+       if (domNode) {
+         domNode->GetNodeName(tagName);
+       }
+       // build a "script sample" based on what we know about this element
+       scriptSample.Assign(attr);
+       scriptSample.AppendLiteral(" attribute on ");
+       scriptSample.Append(tagName);
+       scriptSample.AppendLiteral(" element");
+-      nsCOMPtr<nsISupportsString> sampleIString(do_CreateInstance(NS_SUPPORTS_STRING_CONTRACTID));
+-      if (sampleIString) {
+-        sampleIString->SetData(scriptSample);
+-      }
+ 
+       bool allowsInlineScript = true;
+       rv = csp->GetAllowsInline(nsIContentPolicy::TYPE_SCRIPT,
+                                 EmptyString(), // aNonce
+                                 true, // aParserCreated (true because attribute event handler)
+-                                sampleIString,
++                                aElement,
++                                scriptSample,
+                                 0,             // aLineNumber
+                                 0,             // aColumnNumber
+                                 &allowsInlineScript);
+       NS_ENSURE_SUCCESS(rv, rv);
+ 
+       // return early if CSP wants us to block inline scripts
+       if (!allowsInlineScript) {
+         return NS_OK;
+diff --git a/dom/html/HTMLFormElement.cpp b/dom/html/HTMLFormElement.cpp
+--- a/dom/html/HTMLFormElement.cpp
++++ b/dom/html/HTMLFormElement.cpp
+@@ -1695,17 +1695,18 @@ HTMLFormElement::GetActionURL(nsIURI** a
+   rv = NodePrincipal()->GetCsp(getter_AddRefs(csp));
+   NS_ENSURE_SUCCESS(rv, rv);
+   if (csp) {
+     bool permitsFormAction = true;
+ 
+     // form-action is only enforced if explicitly defined in the
+     // policy - do *not* consult default-src, see:
+     // http://www.w3.org/TR/CSP2/#directive-default-src
+-    rv = csp->Permits(actionURL, nsIContentSecurityPolicy::FORM_ACTION_DIRECTIVE,
++    rv = csp->Permits(this, actionURL,
++                      nsIContentSecurityPolicy::FORM_ACTION_DIRECTIVE,
+                       true, &permitsFormAction);
+     NS_ENSURE_SUCCESS(rv, rv);
+     if (!permitsFormAction) {
+       return NS_ERROR_CSP_FORM_ACTION_VIOLATION;
+     }
+   }
+ 
+   // Potentially the page uses the CSP directive 'upgrade-insecure-requests'. In
+diff --git a/dom/html/HTMLSharedElement.cpp b/dom/html/HTMLSharedElement.cpp
+--- a/dom/html/HTMLSharedElement.cpp
++++ b/dom/html/HTMLSharedElement.cpp
+@@ -151,17 +151,18 @@ SetBaseURIUsingFirstBaseWithHref(nsIDocu
+       if (NS_FAILED(rv)) {
+         newBaseURI = nullptr;
+       }
+       if (csp && newBaseURI) {
+         // base-uri is only enforced if explicitly defined in the
+         // policy - do *not* consult default-src, see:
+         // http://www.w3.org/TR/CSP2/#directive-default-src
+         bool cspPermitsBaseURI = true;
+-        rv = csp->Permits(newBaseURI, nsIContentSecurityPolicy::BASE_URI_DIRECTIVE,
++        rv = csp->Permits(child->AsElement(), newBaseURI,
++                          nsIContentSecurityPolicy::BASE_URI_DIRECTIVE,
+                           true, &cspPermitsBaseURI);
+         if (NS_FAILED(rv) || !cspPermitsBaseURI) {
+           newBaseURI = nullptr;
+         }
+       }
+       aDocument->SetBaseURI(newBaseURI);
+       aDocument->SetChromeXHRDocBaseURI(nullptr);
+       return;
+diff --git a/dom/interfaces/security/nsIContentSecurityPolicy.idl b/dom/interfaces/security/nsIContentSecurityPolicy.idl
+--- a/dom/interfaces/security/nsIContentSecurityPolicy.idl
++++ b/dom/interfaces/security/nsIContentSecurityPolicy.idl
+@@ -6,16 +6,18 @@
+ #include "nsIContentPolicy.idl"
+ 
+ interface nsIURI;
+ interface nsIDocShell;
+ interface nsIDOMDocument;
+ interface nsIEventTarget;
+ interface nsIPrincipal;
+ 
++webidl Element;
++
+ /**
+  * nsIContentSecurityPolicy
+  * Describes an XPCOM component used to model and enforce CSPs.  Instances of
+  * this class may have multiple policies within them, but there should only be
+  * one of these per document/principal.
+  */
+ 
+ typedef unsigned short CSPDirective;
+@@ -116,31 +118,34 @@ interface nsIContentSecurityPolicy : nsI
+                     in boolean reportOnly,
+                     in boolean deliveredViaMetaTag);
+ 
+   /*
+    * Whether this policy allows inline script or style.
+    * @param aContentPolicyType Either TYPE_SCRIPT or TYPE_STYLESHEET
+    * @param aNonce The nonce string to check against the policy
+    * @param aParserCreated If the script element was created by the HTML Parser
+-   * @param aElementOrContent The script element of the inline resource to hash
+-   *        or the content of the psuedo-script to compare to hash
+-   *        (and compare to the hashes listed in the policy)
++   * @param aTriggeringElement The script element of the inline resource to
++   *        hash. It can be null.
++   * @param aContentOfPseudoScript The content of the psuedo-script to compare
++   *                               to hash (and compare to the hashes listed in
++   *                               the policy)
+    * @param aLineNumber The line number of the inline resource
+    *        (used for reporting)
+    * @param aColumnNumber The column number of the inline resource
+    *        (used for reporting)
+    * @return
+    *     Whether or not the effects of the inline style should be allowed
+    *     (block the rules if false).
+    */
+   boolean getAllowsInline(in nsContentPolicyType aContentPolicyType,
+                           in AString aNonce,
+                           in boolean aParserCreated,
+-                          in nsISupports aElementOrContent,
++                          in Element aTriggeringElement,
++                          in AString aContentOfPseudoScript,
+                           in unsigned long aLineNumber,
+                           in unsigned long aColumnNumber);
+ 
+   /**
+    * whether this policy allows eval and eval-like functions
+    * such as setTimeout("code string", time).
+    * @param shouldReportViolations
+    *     Whether or not the use of eval should be reported.
+@@ -166,16 +171,18 @@ interface nsIContentSecurityPolicy : nsI
+ 
+   /**
+    * For each violated policy (of type violationType), log policy violation on
+    * the Error Console and send a report to report-uris present in the violated
+    * policies.
+    *
+    * @param violationType
+    *     one of the VIOLATION_TYPE_* constants, e.g. inline-script or eval
++   * @param triggeringElement
++   *     the element that triggers this CSP violation. It can be null.
+    * @param sourceFile
+    *     name of the source file containing the violation (if available)
+    * @param contentSample
+    *     sample of the violating content (to aid debugging)
+    * @param lineNum
+    *     source line number of the violation (if available)
+    * @param columnNum
+    *     source column number of the violation (if available)
+@@ -185,16 +192,17 @@ interface nsIContentSecurityPolicy : nsI
+    *     appropriate reports.
+    * @param aContent
+    *     (optional) If this is a hash violation, include contents of the inline
+    *     resource in the question so we can recheck the hash in order to
+    *     determine which policies were violated and send the appropriate
+    *     reports.
+    */
+   void logViolationDetails(in unsigned short violationType,
++                           in Element triggeringElement,
+                            in AString sourceFile,
+                            in AString scriptSample,
+                            in int32_t lineNum,
+                            in int32_t columnNum,
+                            [optional] in AString nonce,
+                            [optional] in AString content);
+ 
+   const unsigned short VIOLATION_TYPE_INLINE_SCRIPT          = 1;
+@@ -244,32 +252,37 @@ interface nsIContentSecurityPolicy : nsI
+ 
+ 
+   /**
+    * Checks if a specific directive permits loading of a URI.
+    *
+    * NOTE: Calls to this may trigger violation reports when queried, so the
+    * return value should not be cached.
+    *
++   * @param aTriggeringElement
++   *        The element that triggers this CSP check. It can be null.
+    * @param aURI
+    *    The URI about to be loaded or used.
+    * @param aDir
+    *    The CSPDirective to query (see above constants *_DIRECTIVE).
+    * @param aSpecific
+    *    If "true" and the directive is specified to fall back to "default-src"
+    *    when it's not explicitly provided, directivePermits will NOT try
+    *    default-src when the specific directive is not used.  Setting this to
+    *    "false" allows CSP to fall back to default-src.  This function
+    *    behaves the same for both values of canUseDefault when querying
+    *    directives that don't fall-back.
+    * @return
+    *    Whether or not the provided URI is allowed by CSP under the given
+    *    directive. (block the pending operation if false).
+    */
+-  boolean permits(in nsIURI aURI, in CSPDirective aDir, in boolean aSpecific);
++  boolean permits(in Element aTriggeringElement,
++                  in nsIURI aURI,
++                  in CSPDirective aDir,
++                  in boolean aSpecific);
+ 
+   /**
+    * Delegate method called by the service when sub-elements of the protected
+    * document are being loaded.  Given a bit of information about the request,
+    * decides whether or not the policy is satisfied.
+    *
+    * Calls to this may trigger violation reports when queried, so
+    * this value should not be cached.
+diff --git a/dom/jsurl/nsJSProtocolHandler.cpp b/dom/jsurl/nsJSProtocolHandler.cpp
+--- a/dom/jsurl/nsJSProtocolHandler.cpp
++++ b/dom/jsurl/nsJSProtocolHandler.cpp
+@@ -174,18 +174,19 @@ nsresult nsJSThunk::EvaluateScript(nsICh
+     // allowed.
+     nsCOMPtr<nsIContentSecurityPolicy> csp;
+     rv = principal->GetCsp(getter_AddRefs(csp));
+     NS_ENSURE_SUCCESS(rv, rv);
+     if (csp) {
+         bool allowsInlineScript = true;
+         rv = csp->GetAllowsInline(nsIContentPolicy::TYPE_SCRIPT,
+                                   EmptyString(), // aNonce
+-                                  true,         // aParserCreated
+-                                  nullptr, // aContent
++                                  true,          // aParserCreated
++                                  nullptr,       // aElement,
++                                  EmptyString(), // aContent
+                                   0,             // aLineNumber
+                                   0,             // aColumnNumber
+                                   &allowsInlineScript);
+ 
+         //return early if inline scripts are not allowed
+         if (!allowsInlineScript) {
+           return NS_ERROR_DOM_RETVAL_UNDEFINED;
+         }
+diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
+--- a/dom/script/ScriptLoader.cpp
++++ b/dom/script/ScriptLoader.cpp
+@@ -1167,17 +1167,17 @@ CSPAllowsInlineScript(nsIScriptElement* 
+   // query the nonce
+   nsCOMPtr<Element> scriptContent = do_QueryInterface(aElement);
+   nsAutoString nonce;
+   scriptContent->GetAttr(kNameSpaceID_None, nsGkAtoms::nonce, nonce);
+   bool parserCreated = aElement->GetParserCreated() != mozilla::dom::NOT_FROM_PARSER;
+ 
+   bool allowInlineScript = false;
+   rv = csp->GetAllowsInline(nsIContentPolicy::TYPE_SCRIPT,
+-                            nonce, parserCreated, aElement,
++                            nonce, parserCreated, scriptContent, EmptyString(),
+                             aElement->GetScriptLineNumber(),
+                             aElement->GetScriptColumnNumber(),
+                             &allowInlineScript);
+   return allowInlineScript;
+ }
+ 
+ ScriptLoadRequest*
+ ScriptLoader::CreateLoadRequest(ScriptKind aKind,
+@@ -2786,16 +2786,17 @@ ScriptLoader::VerifySRI(ScriptLoadReques
+       nsCOMPtr<nsIContentSecurityPolicy> csp;
+       loadInfo->LoadingPrincipal()->GetCsp(getter_AddRefs(csp));
+       nsAutoCString violationURISpec;
+       mDocument->GetDocumentURI()->GetAsciiSpec(violationURISpec);
+       uint32_t lineNo = aRequest->mElement ? aRequest->mElement->GetScriptLineNumber() : 0;
+       uint32_t columnNo = aRequest->mElement ? aRequest->mElement->GetScriptColumnNumber() : 0;
+       csp->LogViolationDetails(
+         nsIContentSecurityPolicy::VIOLATION_TYPE_REQUIRE_SRI_FOR_SCRIPT,
++        nullptr, // triggering element
+         NS_ConvertUTF8toUTF16(violationURISpec),
+         EmptyString(), lineNo, columnNo, EmptyString(), EmptyString());
+       rv = NS_ERROR_SRI_CORRUPT;
+     }
+   }
+ 
+   return rv;
+ }
+diff --git a/dom/security/nsCSPContext.cpp b/dom/security/nsCSPContext.cpp
+--- a/dom/security/nsCSPContext.cpp
++++ b/dom/security/nsCSPContext.cpp
+@@ -49,16 +49,17 @@
+ #include "nsINetworkInterceptController.h"
+ #include "nsSandboxFlags.h"
+ #include "nsIScriptElement.h"
+ #include "nsIEventTarget.h"
+ #include "mozilla/dom/DocGroup.h"
+ #include "nsXULAppAPI.h"
+ 
+ using namespace mozilla;
++using namespace mozilla::dom;
+ 
+ static LogModule*
+ GetCspContextLog()
+ {
+   static LazyLogModule gCspContextPRLog("CSPContext");
+   return gCspContextPRLog;
+ }
+ 
+@@ -203,16 +204,17 @@ nsCSPContext::ShouldLoad(nsContentPolicy
+   }
+ 
+   // aExtra holds the original URI of the channel if the
+   // channel got redirected (until we fix Bug 1332422).
+   nsCOMPtr<nsIURI> originalURI = do_QueryInterface(aExtra);
+   bool wasRedirected = originalURI;
+ 
+   bool permitted = permitsInternal(dir,
++                                   nullptr, // aTriggeringElement
+                                    aContentLocation,
+                                    originalURI,
+                                    nonce,
+                                    wasRedirected,
+                                    isPreload,
+                                    false,     // allow fallback to default-src
+                                    true,      // send violation reports
+                                    true,     // send blocked URI in violation reports
+@@ -232,16 +234,17 @@ nsCSPContext::ShouldLoad(nsContentPolicy
+                    *outDecision > 0 ? "load" : "deny",
+                    aContentLocation->GetSpecOrDefault().get()));
+   }
+   return NS_OK;
+ }
+ 
+ bool
+ nsCSPContext::permitsInternal(CSPDirective aDir,
++                              Element* aTriggeringElement,
+                               nsIURI* aContentLocation,
+                               nsIURI* aOriginalURI,
+                               const nsAString& aNonce,
+                               bool aWasRedirected,
+                               bool aIsPreload,
+                               bool aSpecific,
+                               bool aSendViolationReports,
+                               bool aSendContentLocationInViolationReports,
+@@ -264,26 +267,27 @@ nsCSPContext::permitsInternal(CSPDirecti
+         CSPCONTEXTLOG(("nsCSPContext::permitsInternal, false"));
+         permits = false;
+       }
+ 
+       // Do not send a report or notify observers if this is a preload - the
+       // decision may be wrong due to the inability to get the nonce, and will
+       // incorrectly fail the unit tests.
+       if (!aIsPreload && aSendViolationReports) {
+-        this->AsyncReportViolation((aSendContentLocationInViolationReports ?
+-                                    aContentLocation : nullptr),
+-                                   aOriginalURI,  /* in case of redirect originalURI is not null */
+-                                   violatedDirective,
+-                                   p,             /* policy index        */
+-                                   EmptyString(), /* no observer subject */
+-                                   EmptyString(), /* no source file      */
+-                                   EmptyString(), /* no script sample    */
+-                                   0,             /* no line number      */
+-                                   0);            /* no column number    */
++        AsyncReportViolation(aTriggeringElement,
++                             (aSendContentLocationInViolationReports ?
++                              aContentLocation : nullptr),
++                             aOriginalURI,  /* in case of redirect originalURI is not null */
++                             violatedDirective,
++                             p,             /* policy index        */
++                             EmptyString(), /* no observer subject */
++                             EmptyString(), /* no source file      */
++                             EmptyString(), /* no script sample    */
++                             0,             /* no line number      */
++                             0);            /* no column number    */
+       }
+     }
+   }
+ 
+   return permits;
+ }
+ 
+ 
+@@ -449,16 +453,17 @@ nsCSPContext::GetAllowsEval(bool* outSho
+     }
+   }
+   return NS_OK;
+ }
+ 
+ // Helper function to report inline violations
+ void
+ nsCSPContext::reportInlineViolation(nsContentPolicyType aContentType,
++                                    Element* aTriggeringElement,
+                                     const nsAString& aNonce,
+                                     const nsAString& aContent,
+                                     const nsAString& aViolatedDirective,
+                                     uint32_t aViolatedPolicyIndex, // TODO, use report only flag for that
+                                     uint32_t aLineNumber,
+                                     uint32_t aColumnNumber)
+ {
+   nsString observerSubject;
+@@ -489,32 +494,35 @@ nsCSPContext::reportInlineViolation(nsCo
+   }
+ 
+   nsAutoString codeSample(aContent);
+   // cap the length of the script sample
+   if (codeSample.Length() > ScriptSampleMaxLength()) {
+     codeSample.Truncate(ScriptSampleMaxLength());
+     codeSample.AppendLiteral("...");
+   }
+-  AsyncReportViolation(selfISupports,                      // aBlockedContentSource
++
++  AsyncReportViolation(aTriggeringElement,
++                       selfISupports,                      // aBlockedContentSource
+                        mSelfURI,                           // aOriginalURI
+                        aViolatedDirective,                 // aViolatedDirective
+                        aViolatedPolicyIndex,               // aViolatedPolicyIndex
+                        observerSubject,                    // aObserverSubject
+                        NS_ConvertUTF8toUTF16(sourceFile),  // aSourceFile
+                        codeSample,                         // aScriptSample
+                        aLineNumber,                        // aLineNum
+                        aColumnNumber);                     // aColumnNum
+ }
+ 
+ NS_IMETHODIMP
+ nsCSPContext::GetAllowsInline(nsContentPolicyType aContentType,
+                               const nsAString& aNonce,
+                               bool aParserCreated,
+-                              nsISupports* aElementOrContent,
++                              Element* aTriggeringElement,
++                              const nsAString& aContentOfPseudoScript,
+                               uint32_t aLineNumber,
+                               uint32_t aColumnNumber,
+                               bool* outAllowsInline)
+ {
+   *outAllowsInline = true;
+ 
+   MOZ_ASSERT(aContentType == nsContentUtils::InternalContentPolicyTypeToExternal(aContentType),
+              "We should only see external content policy types here.");
+@@ -538,41 +546,42 @@ nsCSPContext::GetAllowsInline(nsContentP
+     // unecessary strings
+     if (allowed) {
+       continue;
+     }
+ 
+     // Check the content length to ensure the content is not allocated more than
+     // once. Even though we are in a for loop, it is probable that there is only one
+     // policy, so this check may be unnecessary.
+-    if (content.Length() == 0) {
+-      // postpone the allocation until absolutely necessary.
+-      nsCOMPtr<nsISupportsString> stringContent = do_QueryInterface(aElementOrContent);
+-      nsCOMPtr<nsIScriptElement> element = do_QueryInterface(aElementOrContent);
+-      if (stringContent) {
+-        Unused << stringContent->GetData(content);
+-      } else if (element) {
++    if (content.IsEmpty() && aTriggeringElement) {
++      nsCOMPtr<nsIScriptElement> element = do_QueryInterface(aTriggeringElement);
++      if (element) {
+         element->GetScriptText(content);
+       }
+     }
+ 
++    if (content.IsEmpty()) {
++      content = aContentOfPseudoScript;
++    }
++
+     allowed = mPolicies[i]->allows(aContentType, CSP_HASH, content, aParserCreated);
+ 
+     if (!allowed) {
+       // policy is violoated: deny the load unless policy is report only and
+       // report the violation.
+       if (!mPolicies[i]->getReportOnlyFlag()) {
+         *outAllowsInline = false;
+       }
+       nsAutoString violatedDirective;
+       bool reportSample = false;
+       mPolicies[i]->getDirectiveStringAndReportSampleForContentType(aContentType,
+                                                                     violatedDirective,
+                                                                     &reportSample);
+       reportInlineViolation(aContentType,
++                            aTriggeringElement,
+                             aNonce,
+                             reportSample ? content : EmptyString(),
+                             violatedDirective,
+                             i,
+                             aLineNumber,
+                             aColumnNumber);
+     }
+   }
+@@ -615,22 +624,23 @@ nsCSPContext::GetAllowsInline(nsContentP
+     if (!mPolicies[p]->allows(nsIContentPolicy::TYPE_ ## contentPolicyType,    \
+                               keyword, nonceOrHash, false))                    \
+     {                                                                          \
+       nsAutoString violatedDirective;                                          \
+       bool reportSample = false;                                               \
+       mPolicies[p]->getDirectiveStringAndReportSampleForContentType(           \
+                         nsIContentPolicy::TYPE_ ## contentPolicyType,          \
+                         violatedDirective, &reportSample);                     \
+-      this->AsyncReportViolation(selfISupports, nullptr, violatedDirective, p, \
+-                                 NS_LITERAL_STRING(observerTopic),             \
+-                                 aSourceFile,                                  \
+-                                 reportSample                                  \
+-                                   ? aScriptSample : EmptyString(),            \
+-                                 aLineNum, aColumnNum);                        \
++      AsyncReportViolation(aTriggeringElement, selfISupports, nullptr,         \
++                           violatedDirective, p,                               \
++                           NS_LITERAL_STRING(observerTopic),                   \
++                           aSourceFile,                                        \
++                           reportSample                                        \
++                             ? aScriptSample : EmptyString(),                  \
++                           aLineNum, aColumnNum);                              \
+     }                                                                          \
+     PR_END_MACRO;                                                              \
+     break
+ 
+ /**
+  * For each policy, log any violation on the Error Console and send a report
+  * if a report-uri is present in the policy
+  *
+@@ -651,16 +661,17 @@ nsCSPContext::GetAllowsInline(nsContentP
+  * @param aContent
+  *     (optional) If this is a hash violation, include contents of the inline
+  *     resource in the question so we can recheck the hash in order to
+  *     determine which policies were violated and send the appropriate
+  *     reports.
+  */
+ NS_IMETHODIMP
+ nsCSPContext::LogViolationDetails(uint16_t aViolationType,
++                                  Element* aTriggeringElement,
+                                   const nsAString& aSourceFile,
+                                   const nsAString& aScriptSample,
+                                   int32_t aLineNum,
+                                   int32_t aColumnNum,
+                                   const nsAString& aNonce,
+                                   const nsAString& aContent)
+ {
+   for (uint32_t p = 0; p < mPolicies.Length(); p++) {
+@@ -1171,56 +1182,76 @@ nsCSPContext::SendReports(
+       CSPCONTEXTLOG(("Sent violation report to URI %s", reportURICstring.get()));
+     }
+   }
+   return NS_OK;
+ }
+ 
+ nsresult
+ nsCSPContext::FireViolationEvent(
++  Element* aTriggeringElement,
+   const mozilla::dom::SecurityPolicyViolationEventInit& aViolationEventInit)
+ {
+   if (!sViolationEventsEnabled) {
+     return NS_OK;
+   }
+ 
++  // 1. If target is not null, and global is a Window, and target’s
++  // shadow-including root is not global’s associated Document, set target to
++  // null.
++  RefPtr<EventTarget> eventTarget = aTriggeringElement;
++
+   nsCOMPtr<nsIDocument> doc = do_QueryReferent(mLoadingContext);
+-  if (!doc) {
++  if (doc && aTriggeringElement &&
++      aTriggeringElement->GetComposedDoc() != doc) {
++    eventTarget = nullptr;
++  }
++
++  if (!eventTarget) {
++    // If target is a Window, set target to target’s associated Document.
++    eventTarget = doc;
++  }
++
++  if (!eventTarget) {
++    // TODO: Set target be violation’s global object. If we are here, we are
++    // probably dealing with workers. See bug 1472927.
+     return NS_OK;
+   }
+ 
+   RefPtr<mozilla::dom::Event> event =
+     mozilla::dom::SecurityPolicyViolationEvent::Constructor(
+-      doc,
++      eventTarget,
+       NS_LITERAL_STRING("securitypolicyviolation"),
+       aViolationEventInit);
+   event->SetTrusted(true);
+ 
+   bool rv;
+-  return doc->DispatchEvent(event, &rv);
++  return eventTarget->DispatchEvent(*event, rv);
+ }
+ 
+ /**
+  * Dispatched from the main thread to send reports for one CSP violation.
+  */
+ class CSPReportSenderRunnable final : public Runnable
+ {
+   public:
+-    CSPReportSenderRunnable(nsISupports* aBlockedContentSource,
++    CSPReportSenderRunnable(Element* aTriggeringElement,
++                            nsISupports* aBlockedContentSource,
+                             nsIURI* aOriginalURI,
+                             uint32_t aViolatedPolicyIndex,
+                             bool aReportOnlyFlag,
+                             const nsAString& aViolatedDirective,
+                             const nsAString& aObserverSubject,
+                             const nsAString& aSourceFile,
+                             const nsAString& aScriptSample,
+                             uint32_t aLineNum,
+                             uint32_t aColumnNum,
+                             nsCSPContext* aCSPContext)
+       : mozilla::Runnable("CSPReportSenderRunnable")
++      , mTriggeringElement(aTriggeringElement)
+       , mBlockedContentSource(aBlockedContentSource)
+       , mOriginalURI(aOriginalURI)
+       , mViolatedPolicyIndex(aViolatedPolicyIndex)
+       , mReportOnlyFlag(aReportOnlyFlag)
+       , mViolatedDirective(aViolatedDirective)
+       , mSourceFile(aSourceFile)
+       , mScriptSample(aScriptSample)
+       , mLineNum(aLineNum)
+@@ -1296,22 +1327,23 @@ class CSPReportSenderRunnable final : pu
+                                      blockedDataChar16.get() };
+         mCSPContext->logToConsole(mReportOnlyFlag ? "CSPROViolationWithURI" :
+                                                     "CSPViolationWithURI",
+                                   params, ArrayLength(params), mSourceFile, mScriptSample,
+                                   mLineNum, mColumnNum, nsIScriptError::errorFlag);
+       }
+ 
+       // 4) fire violation event
+-      mCSPContext->FireViolationEvent(init);
++      mCSPContext->FireViolationEvent(mTriggeringElement, init);
+ 
+       return NS_OK;
+     }
+ 
+   private:
++    RefPtr<Element>         mTriggeringElement;
+     nsCOMPtr<nsISupports>   mBlockedContentSource;
+     nsCOMPtr<nsIURI>        mOriginalURI;
+     uint32_t                mViolatedPolicyIndex;
+     bool                    mReportOnlyFlag;
+     nsString                mViolatedDirective;
+     nsCOMPtr<nsISupports>   mObserverSubject;
+     nsString                mSourceFile;
+     nsString                mScriptSample;
+@@ -1320,16 +1352,18 @@ class CSPReportSenderRunnable final : pu
+     RefPtr<nsCSPContext>    mCSPContext;
+ };
+ 
+ /**
+  * Asynchronously notifies any nsIObservers listening to the CSP violation
+  * topic that a violation occurred.  Also triggers report sending and console
+  * logging.  All asynchronous on the main thread.
+  *
++ * @param aTriggeringElement
++ *        The element that triggered this report violation. It can be null.
+  * @param aBlockedContentSource
+  *        Either a CSP Source (like 'self', as string) or nsIURI: the source
+  *        of the violation.
+  * @param aOriginalUri
+  *        The original URI if the blocked content is a redirect, else null
+  * @param aViolatedDirective
+  *        the directive that was violated (string).
+  * @param aViolatedPolicyIndex
+@@ -1343,30 +1377,32 @@ class CSPReportSenderRunnable final : pu
+  * @param aScriptSample
+  *        a sample of the violating inline script
+  * @param aLineNum
+  *        source line number of the violation (if available)
+  * @param aColumnNum
+  *        source column number of the violation (if available)
+  */
+ nsresult
+-nsCSPContext::AsyncReportViolation(nsISupports* aBlockedContentSource,
++nsCSPContext::AsyncReportViolation(Element* aTriggeringElement,
++                                   nsISupports* aBlockedContentSource,
+                                    nsIURI* aOriginalURI,
+                                    const nsAString& aViolatedDirective,
+                                    uint32_t aViolatedPolicyIndex,
+                                    const nsAString& aObserverSubject,
+                                    const nsAString& aSourceFile,
+                                    const nsAString& aScriptSample,
+                                    uint32_t aLineNum,
+                                    uint32_t aColumnNum)
+ {
+   NS_ENSURE_ARG_MAX(aViolatedPolicyIndex, mPolicies.Length() - 1);
+ 
+   nsCOMPtr<nsIRunnable> task =
+-    new CSPReportSenderRunnable(aBlockedContentSource,
++    new CSPReportSenderRunnable(aTriggeringElement,
++                                aBlockedContentSource,
+                                 aOriginalURI,
+                                 aViolatedPolicyIndex,
+                                 mPolicies[aViolatedPolicyIndex]->getReportOnlyFlag(),
+                                 aViolatedDirective,
+                                 aObserverSubject,
+                                 aSourceFile,
+                                 aScriptSample,
+                                 aLineNum,
+@@ -1488,16 +1524,17 @@ nsCSPContext::PermitsAncestry(nsIDocShel
+                      ancestorsArray[a]->GetSpecOrDefault().get()));
+     }
+     // omit the ancestor URI in violation reports if cross-origin as per spec
+     // (it is a violation of the same-origin policy).
+     bool okToSendAncestor = NS_SecurityCompareURIs(ancestorsArray[a], mSelfURI, true);
+ 
+ 
+     bool permits = permitsInternal(nsIContentSecurityPolicy::FRAME_ANCESTORS_DIRECTIVE,
++                                   nullptr,
+                                    ancestorsArray[a],
+                                    nullptr, // no redirect here.
+                                    EmptyString(), // no nonce
+                                    false,   // no redirect here.
+                                    false,   // not a preload.
+                                    true,    // specific, do not use default-src
+                                    true,    // send violation reports
+                                    okToSendAncestor,
+@@ -1505,27 +1542,29 @@ nsCSPContext::PermitsAncestry(nsIDocShel
+     if (!permits) {
+       *outPermitsAncestry = false;
+     }
+   }
+   return NS_OK;
+ }
+ 
+ NS_IMETHODIMP
+-nsCSPContext::Permits(nsIURI* aURI,
++nsCSPContext::Permits(Element* aTriggeringElement,
++                      nsIURI* aURI,
+                       CSPDirective aDir,
+                       bool aSpecific,
+                       bool* outPermits)
+ {
+   // Can't perform check without aURI
+   if (aURI == nullptr) {
+     return NS_ERROR_FAILURE;
+   }
+ 
+   *outPermits = permitsInternal(aDir,
++                                aTriggeringElement,
+                                 aURI,
+                                 nullptr,  // no original (pre-redirect) URI
+                                 EmptyString(),  // no nonce
+                                 false,    // not redirected.
+                                 false,    // not a preload.
+                                 aSpecific,
+                                 true,     // send violation reports
+                                 true,     // send blocked URI in violation reports
+diff --git a/dom/security/nsCSPContext.h b/dom/security/nsCSPContext.h
+--- a/dom/security/nsCSPContext.h
++++ b/dom/security/nsCSPContext.h
+@@ -25,16 +25,22 @@
+ #define NS_CSPCONTEXT_CID \
+ { 0x09d9ed1a, 0xe5d4, 0x4004, \
+   { 0xbf, 0xe0, 0x27, 0xce, 0xb9, 0x23, 0xd9, 0xac } }
+ 
+ class nsINetworkInterceptController;
+ class nsIEventTarget;
+ struct ConsoleMsgQueueElem;
+ 
++namespace mozilla {
++namespace dom {
++class Element;
++}
++}
++
+ class nsCSPContext : public nsIContentSecurityPolicy
+ {
+   public:
+     NS_DECL_ISUPPORTS
+     NS_DECL_NSICONTENTSECURITYPOLICY
+     NS_DECL_NSISERIALIZABLE
+ 
+   protected:
+@@ -93,19 +99,21 @@ class nsCSPContext : public nsIContentSe
+       uint32_t aColumnNum,
+       mozilla::dom::SecurityPolicyViolationEventInit& aViolationEventInit);
+ 
+     nsresult SendReports(
+       const mozilla::dom::SecurityPolicyViolationEventInit& aViolationEventInit,
+       uint32_t aViolatedPolicyIndex);
+ 
+     nsresult FireViolationEvent(
++      mozilla::dom::Element* aTriggeringElement,
+       const mozilla::dom::SecurityPolicyViolationEventInit& aViolationEventInit);
+ 
+-    nsresult AsyncReportViolation(nsISupports* aBlockedContentSource,
++    nsresult AsyncReportViolation(mozilla::dom::Element* aTriggeringElement,
++                                  nsISupports* aBlockedContentSource,
+                                   nsIURI* aOriginalURI,
+                                   const nsAString& aViolatedDirective,
+                                   uint32_t aViolatedPolicyIndex,
+                                   const nsAString& aObserverSubject,
+                                   const nsAString& aSourceFile,
+                                   const nsAString& aScriptSample,
+                                   uint32_t aLineNum,
+                                   uint32_t aColumnNum);
+@@ -118,28 +126,30 @@ class nsCSPContext : public nsIContentSe
+     }
+ 
+     nsWeakPtr GetLoadingContext(){
+       return mLoadingContext;
+     }
+ 
+   private:
+     bool permitsInternal(CSPDirective aDir,
++                         mozilla::dom::Element* aTriggeringElement,
+                          nsIURI* aContentLocation,
+                          nsIURI* aOriginalURI,
+                          const nsAString& aNonce,
+                          bool aWasRedirected,
+                          bool aIsPreload,
+                          bool aSpecific,
+                          bool aSendViolationReports,
+                          bool aSendContentLocationInViolationReports,
+                          bool aParserCreated);
+ 
+     // helper to report inline script/style violations
+     void reportInlineViolation(nsContentPolicyType aContentType,
++                               mozilla::dom::Element* aTriggeringElement,
+                                const nsAString& aNonce,
+                                const nsAString& aContent,
+                                const nsAString& aViolatedDirective,
+                                uint32_t aViolatedPolicyIndex,
+                                uint32_t aLineNumber,
+                                uint32_t aColumnNumber);
+ 
+     static int32_t sScriptSampleMaxLength;
+diff --git a/dom/security/test/unit/test_csp_reports.js b/dom/security/test/unit/test_csp_reports.js
+--- a/dom/security/test/unit/test_csp_reports.js
++++ b/dom/security/test/unit/test_csp_reports.js
+@@ -97,27 +97,25 @@ function makeTest(id, expectedJSON, useR
+   callback(csp);
+ }
+ 
+ function run_test() {
+   var selfuri = NetUtil.newURI(REPORT_SERVER_URI +
+                                ":" + REPORT_SERVER_PORT +
+                                "/foo/self");
+ 
+-  let content = Cc["@mozilla.org/supports-string;1"].
+-                   createInstance(Ci.nsISupportsString);
+-  content.data = "";
+   // test that inline script violations cause a report.
+   makeTest(0, {"blocked-uri": "self"}, false,
+       function(csp) {
+         let inlineOK = true;
+         inlineOK = csp.getAllowsInline(Ci.nsIContentPolicy.TYPE_SCRIPT,
+                                        "", // aNonce
+                                        false, // aParserCreated
+-                                       content, // aContent
++                                       null, // aTriggeringElement
++                                       "", // aContentOfPseudoScript
+                                        0, // aLineNumber
+                                        0); // aColumnNumber
+ 
+         // this is not a report only policy, so it better block inline scripts
+         Assert.ok(!inlineOK);
+       });
+ 
+   // test that eval violations cause a report.
+@@ -133,16 +131,17 @@ function run_test() {
+         // this is not a report only policy, so it better block eval
+         Assert.ok(!evalOK);
+         // ... and cause reports to go out
+         Assert.ok(oReportViolation.value);
+ 
+         if (oReportViolation.value) {
+           // force the logging, since the getter doesn't.
+           csp.logViolationDetails(Ci.nsIContentSecurityPolicy.VIOLATION_TYPE_EVAL,
++                                  null, // aTriggeringElement
+                                   selfuri.asciiSpec,
+                                   // sending UTF-16 script sample to make sure
+                                   // csp report in JSON is not cut-off, please
+                                   // note that JSON is UTF8 encoded.
+                                   "\u00a3\u00a5\u00b5\u5317\ud841\udf79",
+                                   1, // line number
+                                   2); // column number
+         }
+@@ -155,23 +154,21 @@ function run_test() {
+                       NetUtil.newURI("http://blocked.test/foo.js"),
+                       null, null, null, null);
+       });
+ 
+   // test that inline script violations cause a report in report-only policy
+   makeTest(3, {"blocked-uri": "self"}, true,
+       function(csp) {
+         let inlineOK = true;
+-        let content = Cc["@mozilla.org/supports-string;1"].
+-                         createInstance(Ci.nsISupportsString);
+-        content.data = "";
+         inlineOK = csp.getAllowsInline(Ci.nsIContentPolicy.TYPE_SCRIPT,
+                                        "", // aNonce
+                                        false, // aParserCreated
+-                                       content, // aContent
++                                       null, // aTriggeringElement
++                                       "", // aContentOfPseudoScript
+                                        0, // aLineNumber
+                                        0); // aColumnNumber
+ 
+         // this is a report only policy, so it better allow inline scripts
+         Assert.ok(inlineOK);
+       });
+ 
+   // test that eval violations cause a report in report-only policy
+@@ -183,16 +180,17 @@ function run_test() {
+         // this is a report only policy, so it better allow eval
+         Assert.ok(evalOK);
+         // ... but still cause reports to go out
+         Assert.ok(oReportViolation.value);
+ 
+         if (oReportViolation.value) {
+           // force the logging, since the getter doesn't.
+           csp.logViolationDetails(Ci.nsIContentSecurityPolicy.VIOLATION_TYPE_INLINE_SCRIPT,
++                                  null, // aTriggeringElement
+                                   selfuri.asciiSpec,
+                                   "script sample",
+                                   4, // line number
+                                   5); // column number
+         }
+       });
+ 
+   // test that only the uri's scheme is reported for globally unique identifiers
+diff --git a/dom/workers/RuntimeService.cpp b/dom/workers/RuntimeService.cpp
+--- a/dom/workers/RuntimeService.cpp
++++ b/dom/workers/RuntimeService.cpp
+@@ -2835,16 +2835,17 @@ LogViolationDetailsRunnable::MainThreadR
+   AssertIsOnMainThread();
+ 
+   nsIContentSecurityPolicy* csp = mWorkerPrivate->GetCSP();
+   if (csp) {
+     NS_NAMED_LITERAL_STRING(scriptSample,
+         "Call to eval() or related function blocked by CSP.");
+     if (mWorkerPrivate->GetReportCSPViolations()) {
+       csp->LogViolationDetails(nsIContentSecurityPolicy::VIOLATION_TYPE_EVAL,
++                               nullptr, // triggering element
+                                mFileName, scriptSample, mLineNum, mColumnNum,
+                                EmptyString(), EmptyString());
+     }
+   }
+ 
+   return true;
+ }
+ 
+diff --git a/dom/workers/ScriptLoader.cpp b/dom/workers/ScriptLoader.cpp
+--- a/dom/workers/ScriptLoader.cpp
++++ b/dom/workers/ScriptLoader.cpp
+@@ -1168,16 +1168,17 @@ private:
+       MOZ_LOG(SRILogHelper::GetSriLog(), mozilla::LogLevel::Debug,
+             ("Scriptloader::Load, SRI required but not supported in workers"));
+       nsCOMPtr<nsIContentSecurityPolicy> wcsp;
+       chanLoadInfo->LoadingPrincipal()->GetCsp(getter_AddRefs(wcsp));
+       MOZ_ASSERT(wcsp, "We sould have a CSP for the worker here");
+       if (wcsp) {
+         wcsp->LogViolationDetails(
+             nsIContentSecurityPolicy::VIOLATION_TYPE_REQUIRE_SRI_FOR_SCRIPT,
++            nullptr, // triggering element
+             aLoadInfo.mURL, EmptyString(), 0, 0, EmptyString(), EmptyString());
+       }
+       return NS_ERROR_SRI_CORRUPT;
+     }
+ 
+     // Update the principal of the worker and its base URI if we just loaded the
+     // worker's primary script.
+     if (IsMainWorkerScript()) {
+diff --git a/layout/style/Loader.cpp b/layout/style/Loader.cpp
+--- a/layout/style/Loader.cpp
++++ b/layout/style/Loader.cpp
+@@ -810,16 +810,17 @@ SheetLoadData::VerifySheetReadyToParse(n
+       // log the failed load to web console
+       nsCOMPtr<nsIContentSecurityPolicy> csp;
+       loadInfo->LoadingPrincipal()->GetCsp(getter_AddRefs(csp));
+       nsAutoCString spec;
+       mLoader->mDocument->GetDocumentURI()->GetAsciiSpec(spec);
+       // line number unknown. mRequestingNode doesn't bear this info.
+       csp->LogViolationDetails(
+         nsIContentSecurityPolicy::VIOLATION_TYPE_REQUIRE_SRI_FOR_STYLE,
++        nullptr, // triggering element
+         NS_ConvertUTF8toUTF16(spec), EmptyString(),
+         0, 0, EmptyString(), EmptyString());
+       return NS_OK;
+     }
+   } else {
+     nsAutoCString sourceUri;
+     if (mLoader->mDocument && mLoader->mDocument->GetDocumentURI()) {
+       mLoader->mDocument->GetDocumentURI()->GetAsciiSpec(sourceUri);
+diff --git a/layout/style/nsStyleUtil.cpp b/layout/style/nsStyleUtil.cpp
+--- a/layout/style/nsStyleUtil.cpp
++++ b/layout/style/nsStyleUtil.cpp
+@@ -840,20 +840,16 @@ nsStyleUtil::CSPAllowsInlineStyle(Elemen
+                                   nsresult* aRv)
+ {
+   nsresult rv;
+ 
+   if (aRv) {
+     *aRv = NS_OK;
+   }
+ 
+-  MOZ_ASSERT(!aElement || aElement->NodeInfo()->NameAtom() == nsGkAtoms::style,
+-      "aElement passed to CSPAllowsInlineStyle "
+-      "for an element that is not <style>");
+-
+   nsIPrincipal* principal = aPrincipal;
+   if (aTriggeringPrincipal &&
+       BasePrincipal::Cast(aTriggeringPrincipal)->OverridesCSP(aPrincipal)) {
+     principal = aTriggeringPrincipal;
+   }
+ 
+   nsCOMPtr<nsIContentSecurityPolicy> csp;
+   rv = principal->GetCsp(getter_AddRefs(csp));
+@@ -866,27 +862,22 @@ nsStyleUtil::CSPAllowsInlineStyle(Elemen
+ 
+   if (!csp) {
+     // No CSP --> the style is allowed
+     return true;
+   }
+ 
+   // query the nonce
+   nsAutoString nonce;
+-  if (aElement) {
++  if (aElement && aElement->NodeInfo()->NameAtom() == nsGkAtoms::style) {
+     aElement->GetAttr(kNameSpaceID_None, nsGkAtoms::nonce, nonce);
+   }
+ 
+-  nsCOMPtr<nsISupportsString> styleText(do_CreateInstance(NS_SUPPORTS_STRING_CONTRACTID));
+-  if (styleText) {
+-    styleText->SetData(aStyleText);
+-  }
+-
+   bool allowInlineStyle = true;
+   rv = csp->GetAllowsInline(nsIContentPolicy::TYPE_STYLESHEET,
+                             nonce,
+                             false, // aParserCreated only applies to scripts
+-                            styleText, aLineNumber, aColumnNumber,
++                            aElement, aStyleText, aLineNumber, aColumnNumber,
+                             &allowInlineStyle);
+   NS_ENSURE_SUCCESS(rv, false);
+ 
+   return allowInlineStyle;
+ }

frg/work-js/mozilla-release/patches/mozilla-central-push_426453.patch → frg/work-js/mozilla-release/patches/NOBUG-20180710-floatregister-25319.patch

@@ -3,18 +3,18 @@
 # Date 1530922361 25200
 #      Fri Jul 06 17:12:41 2018 -0700
 # Node ID 3d61b1272eae89fa6b51ab45f74e2b9fb1f1f1cf
-# Parent  05ddefeeb59f56e6661389aefae6c5430dfdab66
+# Parent  53363d7fe4a91acc5b52131b5c528c5887e5805a
 Qualify a call to has(FloatRegister) inside SpecializedRegSet to avoid a gcc ICE that seems to randomly manifest from time to time.  No bug, r=me as trivial
 
 diff --git a/js/src/jit/RegisterSets.h b/js/src/jit/RegisterSets.h
 --- a/js/src/jit/RegisterSets.h
 +++ b/js/src/jit/RegisterSets.h
-@@ -915,17 +915,17 @@ class SpecializedRegSet<Accessors, Regis
-             takeUnchecked(reg.gpr());
-     }
- 
+@@ -918,17 +918,17 @@ class SpecializedRegSet<Accessors, Regis
      void take(Register reg) {
-         MOZ_ASSERT(this->has(reg));
+ #ifdef DEBUG
+         bool hasReg = this->has(reg);
+         MOZ_ASSERT(hasReg);
+ #endif
          takeUnchecked(reg);
      }
      void take(FloatRegister reg) {

frg/work-js/mozilla-release/patches/TOP-1539694-allsettled-68a1-25313.patch

@@ -1,453 +0,0 @@
-# HG changeset patch
-# User Moonchild <moonchild@palemoon.org>
-# Date 1536845287 0
-# Parent  f6172ccc8dd77f08e5b3a079a751b8e8ee3c76dd
-Bug 1539694 - Implement Promise.allSettled().
-
-Co-authored-by: athenian200 <19531193+athenian200@users.noreply.github.com>
-
-diff --git a/js/src/builtin/Promise.cpp b/js/src/builtin/Promise.cpp
---- a/js/src/builtin/Promise.cpp
-+++ b/js/src/builtin/Promise.cpp
-@@ -2024,28 +2024,79 @@ Promise_static_all(JSContext* cx, unsign
-         return AbruptRejectPromise(cx, args, resultPromise, reject);
-     }
- 
-     // Step 9.
-     args.rval().setObject(*resultPromise);
-     return true;
- }
- 
-+static MOZ_MUST_USE bool PerformPromiseAllSettled(JSContext *cx, JS::ForOfIterator& iterator,
-+                                                  HandleObject C, HandleObject promiseObj,
-+                                                  HandleObject resolve, HandleObject reject,
-+                                                  bool* done);
-+
-+// ES2020
-+static bool
-+Promise_static_allSettled(JSContext* cx, unsigned argc, Value* vp)
-+{
-+    CallArgs args = CallArgsFromVp(argc, vp);
-+    RootedValue iterable(cx, args.get(0));
-+    RootedValue CVal(cx, args.thisv());
-+    if (!CVal.isObject()) {
-+        JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_NOT_NONNULL_OBJECT,
-+                                  "Receiver of Promise.allSettled call");
-+        return false;
-+    }
-+
-+    RootedObject C(cx, &CVal.toObject());
-+    RootedObject resultPromise(cx);
-+    RootedObject resolve(cx);
-+    RootedObject reject(cx);
-+    if (!NewPromiseCapability(cx, C, &resultPromise, &resolve, &reject, false))
-+        return false;
-+
-+    JS::ForOfIterator iter(cx);
-+    if (!iter.init(iterable, JS::ForOfIterator::AllowNonIterable))
-+        return AbruptRejectPromise(cx, args, resultPromise, reject);
-+
-+    if (!iter.valueIsIterable()) {
-+        JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_NOT_ITERABLE,
-+                                  "Argument of Promise.allSettled");
-+        return AbruptRejectPromise(cx, args, resultPromise, reject);
-+    }
-+
-+    bool done;
-+    bool result = PerformPromiseAllSettled(cx, iter, C, resultPromise, resolve, reject, &done);
-+
-+    if (!result) {
-+        if (!done)
-+            iter.closeThrow();
-+
-+        return AbruptRejectPromise(cx, args, resultPromise, reject);
-+    }
-+
-+    args.rval().setObject(*resultPromise);
-+    return true;
-+}
-+
- static MOZ_MUST_USE bool PerformPromiseThen(JSContext* cx, Handle<PromiseObject*> promise,
-                                             HandleValue onFulfilled_, HandleValue onRejected_,
-                                             HandleObject resultPromise,
-                                             HandleObject resolve, HandleObject reject);
- 
- static MOZ_MUST_USE bool
- PerformPromiseThenWithoutSettleHandlers(JSContext* cx, Handle<PromiseObject*> promise,
-                                         Handle<PromiseObject*> promiseToResolve,
-                                         HandleObject resultPromise, HandleObject resolve,
-                                         HandleObject reject);
- 
- static bool PromiseAllResolveElementFunction(JSContext* cx, unsigned argc, Value* vp);
-+static bool PromiseAllSettledResolveElementFunction(JSContext* cx, unsigned argc, Value* vp);
-+static bool PromiseAllSettledRejectElementFunction(JSContext* cx, unsigned argc, Value* vp);
- 
- // Unforgeable version of ES2016, 25.4.4.1.
- MOZ_MUST_USE JSObject*
- js::GetWaitForAllPromise(JSContext* cx, const JS::AutoObjectVector& promises)
- {
- #ifdef DEBUG
-     for (size_t i = 0, len = promises.length(); i < len; i++) {
-         JSObject* obj = promises[i];
-@@ -2350,16 +2401,130 @@ PerformPromiseAll(JSContext *cx, JS::For
-             return false;
- 
-         // Step r.
-         index++;
-         MOZ_ASSERT(index > 0);
-     }
- }
- 
-+static MOZ_MUST_USE bool
-+PerformPromiseAllSettled(JSContext *cx, JS::ForOfIterator& iterator, HandleObject C,
-+                         HandleObject promiseObj, HandleObject resolve, HandleObject reject,
-+                         bool* done)
-+{
-+    *done = false;
-+
-+    RootedObject unwrappedPromiseObj(cx);
-+    if (IsWrapper(promiseObj)) {
-+        unwrappedPromiseObj = CheckedUnwrap(promiseObj);
-+        MOZ_ASSERT(unwrappedPromiseObj);
-+    }
-+
-+    RootedValue CVal(cx, ObjectValue(*C));
-+
-+    RootedObject valuesArray(cx);
-+    if (unwrappedPromiseObj) {
-+        JSAutoRealm ar(cx, unwrappedPromiseObj);
-+        valuesArray = NewDenseFullyAllocatedArray(cx, 0);
-+    } else {
-+        valuesArray = NewDenseFullyAllocatedArray(cx, 0);
-+    }
-+    if (!valuesArray)
-+        return false;
-+
-+    RootedValue valuesArrayVal(cx, ObjectValue(*valuesArray));
-+    if (!cx->compartment()->wrap(cx, &valuesArrayVal))
-+        return false;
-+
-+    Rooted<PromiseAllDataHolder*> dataHolder(cx, NewPromiseAllDataHolder(cx, promiseObj,
-+                                                                         valuesArrayVal, resolve));
-+    if (!dataHolder)
-+        return false;
-+    RootedValue dataHolderVal(cx, ObjectValue(*dataHolder));
-+
-+    uint32_t index = 0;
-+
-+    RootedValue nextValue(cx);
-+    RootedId indexId(cx);
-+
-+    while (true) {
-+        if (!iterator.next(&nextValue, done)) {
-+            *done = true;
-+            return false;
-+        }
-+
-+        if (*done) {
-+            int32_t remainingCount = dataHolder->decreaseRemainingCount();
-+            if (remainingCount == 0) {
-+                return RunResolutionFunction(cx, resolve, valuesArrayVal, ResolveMode,
-+                                             promiseObj);
-+            }
-+            return true;
-+        }
-+
-+        { // Scoped for AutoRealm
-+            JSAutoRealm ar(cx, valuesArray);
-+            indexId = INT_TO_JSID(index);
-+            if (!DefineDataProperty(cx, valuesArray, indexId, UndefinedHandleValue))
-+                return false;
-+        }
-+
-+        RootedValue nextPromise(cx);
-+        RootedValue staticResolve(cx);
-+        RootedValue staticReject(cx);
-+
-+        // Because Promise.allSettled can continue whether the promise is fulfilled or rejected, we
-+        // should only return false if neither condition is true.
-+
-+        if (!GetProperty(cx, CVal, cx->names().resolve, &staticResolve) &&
-+            !GetProperty(cx, CVal, cx->names().reject, &staticReject))
-+            return false;
-+
-+        FixedInvokeArgs<1> resolveArgs(cx);
-+        resolveArgs[0].set(nextValue);
-+        FixedInvokeArgs<1> rejectArgs(cx);
-+        rejectArgs[0].set(nextValue);
-+        if (!Call(cx, staticResolve, CVal, resolveArgs, &nextPromise) &&
-+            !Call(cx, staticReject, CVal, rejectArgs, &nextPromise))
-+            return false;
-+
-+
-+        RootedFunction resolveFunc(cx, NewNativeFunction(cx, PromiseAllSettledResolveElementFunction,
-+                                   1, nullptr,
-+                                   gc::AllocKind::FUNCTION_EXTENDED,
-+                                   GenericObject));
-+
-+        RootedFunction rejectFunc(cx, NewNativeFunction(cx, PromiseAllSettledRejectElementFunction,
-+                                  1, nullptr,
-+                                  gc::AllocKind::FUNCTION_EXTENDED,
-+                                  GenericObject));
-+        if (!resolveFunc && !rejectFunc) {
-+           return false;
-+        }
-+
-+        resolveFunc->setExtendedSlot(PromiseAllResolveElementFunctionSlot_Data, dataHolderVal);
-+        resolveFunc->setExtendedSlot(PromiseAllResolveElementFunctionSlot_ElementIndex,
-+                                     Int32Value(index));
-+        rejectFunc->setExtendedSlot(PromiseAllResolveElementFunctionSlot_Data, dataHolderVal);
-+        rejectFunc->setExtendedSlot(PromiseAllResolveElementFunctionSlot_ElementIndex,
-+                                    Int32Value(index));
-+
-+        dataHolder->increaseRemainingCount();
-+
-+        RootedValue resolveFunVal(cx, ObjectValue(*resolveFunc));
-+        RootedValue rejectFunVal(cx, ObjectValue(*rejectFunc));
-+        if (!BlockOnPromise(cx, nextPromise, promiseObj, resolveFunVal, rejectFunVal, true))
-+            return false;
-+
-+        index++;
-+        MOZ_ASSERT(index > 0);
-+    }
-+}
-+
- // ES2016, 25.4.4.1.2.
- static bool
- PromiseAllResolveElementFunction(JSContext* cx, unsigned argc, Value* vp)
- {
-     CallArgs args = CallArgsFromVp(argc, vp);
- 
-     RootedFunction resolve(cx, &args.callee().as<JSFunction>());
-     RootedValue xVal(cx, args.get(0));
-@@ -2427,16 +2592,169 @@ PromiseAllResolveElementFunction(JSConte
-             return false;
-     }
- 
-     // Step 11.
-     args.rval().setUndefined();
-     return true;
- }
- 
-+// ES2020.
-+static bool
-+PromiseAllSettledResolveElementFunction(JSContext* cx, unsigned argc, Value* vp)
-+{
-+    CallArgs args = CallArgsFromVp(argc, vp);
-+
-+    RootedFunction resolve(cx, &args.callee().as<JSFunction>());
-+    RootedValue xVal(cx, args.get(0));
-+    RootedValue dataVal(cx, resolve->getExtendedSlot(PromiseAllResolveElementFunctionSlot_Data));
-+
-+    if (dataVal.isUndefined()) {
-+        args.rval().setUndefined();
-+        return true;
-+    }
-+
-+    Rooted<PromiseAllDataHolder*> data(cx, &dataVal.toObject().as<PromiseAllDataHolder>());
-+
-+    resolve->setExtendedSlot(PromiseAllResolveElementFunctionSlot_Data, UndefinedValue());
-+
-+    int32_t index = resolve->getExtendedSlot(PromiseAllResolveElementFunctionSlot_ElementIndex)
-+                    .toInt32();
-+
-+    RootedValue valuesVal(cx, data->valuesArray());
-+    RootedObject valuesObj(cx, &valuesVal.toObject());
-+    bool valuesListIsWrapped = false;
-+    if (IsWrapper(valuesObj)) {
-+        valuesListIsWrapped = true;
-+        // See comment for PerformPromiseAll, step 3 for why we unwrap here.
-+        valuesObj = UncheckedUnwrap(valuesObj);
-+    }
-+    NativeObject* values = &valuesObj->as<NativeObject>();
-+
-+    // The index is guaranteed to be initialized to `undefined`.
-+    if (valuesListIsWrapped) {
-+        AutoRealm ar(cx, values);
-+        if (!cx->compartment()->wrap(cx, &xVal))
-+            return false;
-+    }
-+
-+    RootedPlainObject obj(cx, NewBuiltinClassInstance<PlainObject>(cx));
-+    if (!obj) {
-+        return false;
-+    }
-+    RootedId id(cx, NameToId(cx->names().status));
-+    RootedValue statusValue(cx);
-+    statusValue.setString(cx->names().fulfilled);
-+    if (!::JS_DefinePropertyById(cx, obj, id, statusValue, JSPROP_ENUMERATE)) {
-+      return false;
-+    }
-+    id = NameToId(cx->names().value);
-+    if (!::JS_DefinePropertyById(cx, obj, id, xVal, JSPROP_ENUMERATE)) {
-+      return false;
-+    }
-+
-+    RootedValue objVal(cx, ObjectValue(*obj));
-+/*  if (needsWrapping) {
-+        AutoRealm ar(cx, valuesObj);
-+        if (!cx->compartment()->wrap(cx, &objVal)) {
-+          return false;
-+        }
-+    }  */
-+    values->setDenseElement(index, objVal);
-+
-+    uint32_t remainingCount = data->decreaseRemainingCount();
-+
-+    if (remainingCount == 0) {
-+        RootedObject resolveAllFun(cx, data->resolveObj());
-+        RootedObject promiseObj(cx, data->promiseObj());
-+        if (!RunResolutionFunction(cx, resolveAllFun, valuesVal, ResolveMode, promiseObj))
-+            return false;
-+    }
-+
-+    args.rval().setUndefined();
-+    return true;
-+}
-+
-+static bool
-+PromiseAllSettledRejectElementFunction(JSContext* cx, unsigned argc, Value* vp)
-+{
-+    CallArgs args = CallArgsFromVp(argc, vp);
-+
-+    RootedFunction resolve(cx, &args.callee().as<JSFunction>());
-+    RootedValue xVal(cx, args.get(0));
-+    RootedValue dataVal(cx, resolve->getExtendedSlot(PromiseAllResolveElementFunctionSlot_Data));
-+
-+    if (dataVal.isUndefined()) {
-+        args.rval().setUndefined();
-+        return true;
-+    }
-+
-+    Rooted<PromiseAllDataHolder*> data(cx, &dataVal.toObject().as<PromiseAllDataHolder>());
-+
-+    resolve->setExtendedSlot(PromiseAllResolveElementFunctionSlot_Data, UndefinedValue());
-+
-+    int32_t index = resolve->getExtendedSlot(PromiseAllResolveElementFunctionSlot_ElementIndex)
-+                    .toInt32();
-+
-+    RootedValue valuesVal(cx, data->valuesArray());
-+    RootedObject valuesObj(cx, &valuesVal.toObject());
-+    bool valuesListIsWrapped = false;
-+    if (IsWrapper(valuesObj)) {
-+        valuesListIsWrapped = true;
-+        // See comment for PerformPromiseAll, step 3 for why we unwrap here.
-+        valuesObj = UncheckedUnwrap(valuesObj);
-+    }
-+    NativeObject* values = &valuesObj->as<NativeObject>();
-+
-+    // The index is guaranteed to be initialized to `undefined`.
-+    if (valuesListIsWrapped) {
-+        AutoRealm ar(cx, values);
-+        if (!cx->compartment()->wrap(cx, &xVal))
-+            return false;
-+    }
-+
-+    RootedPlainObject obj(cx, NewBuiltinClassInstance<PlainObject>(cx));
-+    if (!obj) {
-+        return false;
-+    }
-+    RootedId id(cx, NameToId(cx->names().status));
-+    RootedValue statusValue(cx);
-+    statusValue.setString(cx->names().rejected);
-+    if (!::JS_DefinePropertyById(cx, obj, id, statusValue, JSPROP_ENUMERATE)) {
-+      return false;
-+    }
-+    RootedValue resultValue(cx);
-+    id = NameToId(cx->names().reason);
-+    if (!::JS_DefinePropertyById(cx, obj, id, xVal, JSPROP_ENUMERATE)) {
-+      return false;
-+    }
-+
-+    RootedValue objVal(cx, ObjectValue(*obj));
-+/*  if (needsWrapping) {
-+    AutoRealm ar(cx, valuesObj);
-+    if (!cx->compartment()->wrap(cx, &objVal)) {
-+      return false;
-+    }
-+  }    */
-+    values->setDenseElement(index, objVal);
-+
-+
-+    uint32_t remainingCount = data->decreaseRemainingCount();
-+
-+    if (remainingCount == 0) {
-+        RootedObject resolveAllFun(cx, data->resolveObj());
-+        RootedObject promiseObj(cx, data->promiseObj());
-+        if (!RunResolutionFunction(cx, resolveAllFun, valuesVal, ResolveMode, promiseObj))
-+            return false;
-+    }
-+
-+    args.rval().setUndefined();
-+    return true;
-+}
-+
- static MOZ_MUST_USE bool PerformPromiseRace(JSContext *cx, JS::ForOfIterator& iterator,
-                                             HandleObject C, HandleObject promiseObj,
-                                             HandleObject resolve, HandleObject reject,
-                                             bool* done);
- 
- // ES2016, 25.4.4.3.
- static bool
- Promise_static_race(JSContext* cx, unsigned argc, Value* vp)
-@@ -4232,16 +4550,17 @@ static const JSFunctionSpec promise_meth
- 
- static const JSPropertySpec promise_properties[] = {
-     JS_STRING_SYM_PS(toStringTag, "Promise", JSPROP_READONLY),
-     JS_PS_END
- };
- 
- static const JSFunctionSpec promise_static_methods[] = {
-     JS_FN("all", Promise_static_all, 1, 0),
-+    JS_FN("allSettled", Promise_static_allSettled, 1, 0),
-     JS_FN("race", Promise_static_race, 1, 0),
-     JS_FN("reject", Promise_reject, 1, 0),
-     JS_FN("resolve", Promise_static_resolve, 1, 0),
-     JS_FS_END
- };
- 
- static const JSPropertySpec promise_static_properties[] = {
-     JS_SYM_GET(species, Promise_static_species, 0),
-diff --git a/js/src/vm/CommonPropertyNames.h b/js/src/vm/CommonPropertyNames.h
---- a/js/src/vm/CommonPropertyNames.h
-+++ b/js/src/vm/CommonPropertyNames.h
-@@ -379,16 +379,17 @@
-     macro(source, source, "source") \
-     macro(SpeciesConstructor, SpeciesConstructor, "SpeciesConstructor") \
-     macro(stack, stack, "stack") \
-     macro(star, star, "*") \
-     macro(start, start, "start") \
-     macro(startTimestamp, startTimestamp, "startTimestamp") \
-     macro(state, state, "state") \
-     macro(static, static_, "static") \
-+    macro(status, status, "status") \
-     macro(std_Function_apply, std_Function_apply, "std_Function_apply") \
-     macro(sticky, sticky, "sticky") \
-     macro(StringIterator, StringIterator, "String Iterator") \
-     macro(strings, strings, "strings") \
-     macro(StructType, StructType, "StructType") \
-     macro(style, style, "style") \
-     macro(super, super, "super") \
-     macro(switch, switch_, "switch") \
-diff --git a/js/xpconnect/tests/chrome/test_xrayToJS.xul b/js/xpconnect/tests/chrome/test_xrayToJS.xul
---- a/js/xpconnect/tests/chrome/test_xrayToJS.xul
-+++ b/js/xpconnect/tests/chrome/test_xrayToJS.xul
-@@ -240,17 +240,17 @@ https://bugzilla.mozilla.org/show_bug.cg
-     constructorProps(["input", "lastMatch", "lastParen",
-                       "leftContext", "rightContext", "$1", "$2", "$3", "$4",
-                       "$5", "$6", "$7", "$8", "$9", "$_", "$&", "$+",
-                       "$`", "$'", Symbol.species])
- 
-   gPrototypeProperties['Promise'] =
-     ["constructor", "catch", "then", "finally", Symbol.toStringTag];
-   gConstructorProperties['Promise'] =
--    constructorProps(["resolve", "reject", "all", "race", Symbol.species]);
-+    constructorProps(["resolve", "reject", "all", "allSettled", "race", Symbol.species]);
- 
-   gPrototypeProperties['ArrayBuffer'] =
-     ["constructor", "byteLength", "slice", Symbol.toStringTag];
-   gConstructorProperties['ArrayBuffer'] =
-     constructorProps(["isView", Symbol.species]);
- 
-   is(typeof SharedArrayBuffer, "undefined", "Enable tests!");
- 

frg/work-js/mozilla-release/patches/NOBUG-JSFIXUPS-25319.patch → frg/work-js/mozilla-release/patches/TOP-NOBUG-JSFIXUPS-25319.patch

@@ -1,7 +1,7 @@
 # HG changeset patch
 # User Frank-Rainer Grahl <frgrahl@gmx.net>
 # Date 1709405564 -3600
-# Parent  c641d0d627df0cd03c12a3bdeedc829ae9dc37a0
+# Parent  b897499da25827e88d19c778472a5f59c3641de6
 No Bug - Fix js compartment to realm stuff for legacy behavior and others. r=me a=me
 
  - Undo removing obj from SetExistingProperty in Bug 1471841.
@@ -10,7 +10,9 @@ No Bug - Fix js compartment to realm stuff for legacy behavior and others. r=me
    realms in a compartment later. Might be best to remove the add-on
    compartment after all.
  - nsFrameMessageManager global fixup needed pre Bug 888600.
-
+ - EventListenerManager fallout from Bug 1473587 because Bug 1418236 is missing.
+ - Promise CheckedUnwrapStatic missing Bug 1521907.
+ 
 diff --git a/dom/base/nsFrameMessageManager.cpp b/dom/base/nsFrameMessageManager.cpp
 --- a/dom/base/nsFrameMessageManager.cpp
 +++ b/dom/base/nsFrameMessageManager.cpp
@@ -46,6 +48,59 @@ diff --git a/dom/base/nsFrameMessageManager.cpp b/dom/base/nsFrameMessageManager
          JS::RootedValue rval(cx);
          JS::CloneAndExecuteScript(cx, script, &rval);
        } else {
+diff --git a/dom/events/EventListenerManager.cpp b/dom/events/EventListenerManager.cpp
+--- a/dom/events/EventListenerManager.cpp
++++ b/dom/events/EventListenerManager.cpp
+@@ -835,21 +835,26 @@ EventListenerManager::SetEventHandler(ns
+     unsigned columnNum = 0;
+ 
+     JSContext* cx = nsContentUtils::GetCurrentJSContext();
+     if (cx && !JS::DescribeScriptedCaller(cx, nullptr, &lineNum, &columnNum)) {
+       JS_ClearPendingException(cx);
+     }
+ 
+     if (csp) {
++      nsCOMPtr<nsISupportsString> sampleIString(do_CreateInstance(NS_SUPPORTS_STRING_CONTRACTID));
++      if (sampleIString) {
++        sampleIString->SetData(aBody);
++      }
++
+       bool allowsInlineScript = true;
+       rv = csp->GetAllowsInline(nsIContentPolicy::TYPE_SCRIPT,
+                                 EmptyString(), // aNonce
+                                 true, // aParserCreated (true because attribute event handler)
+-                                aBody,
++                                sampleIString,
+                                 lineNum,
+                                 columnNum,
+                                 &allowsInlineScript);
+       NS_ENSURE_SUCCESS(rv, rv);
+ 
+       // return early if CSP wants us to block inline scripts
+       if (!allowsInlineScript) {
+         return NS_OK;
+diff --git a/js/src/builtin/Promise.cpp b/js/src/builtin/Promise.cpp
+--- a/js/src/builtin/Promise.cpp
++++ b/js/src/builtin/Promise.cpp
+@@ -2907,17 +2907,17 @@ static MOZ_MUST_USE bool PerformPromiseA
+ 
+   // Step 3.
+   // See the big comment in PerformPromiseAll about which objects should be
+   // created in which compartments.
+   RootedArrayObject valuesArray(cx);
+   RootedValue valuesArrayVal(cx);
+   if (IsWrapper(resultCapability.promise())) {
+     JSObject* unwrappedPromiseObj =
+-        CheckedUnwrapStatic(resultCapability.promise());
++      CheckedUnwrap(resultCapability.promise());
+     MOZ_ASSERT(unwrappedPromiseObj);
+ 
+     {
+       AutoRealm ar(cx, unwrappedPromiseObj);
+       valuesArray = NewDenseEmptyArray(cx);
+       if (!valuesArray) {
+         return false;
+       }
 diff --git a/js/src/vm/NativeObject.cpp b/js/src/vm/NativeObject.cpp
 --- a/js/src/vm/NativeObject.cpp
 +++ b/js/src/vm/NativeObject.cpp

frg/work-js/mozilla-release/patches/TOP-NOBUG-REGEXP-04-1539690-68a1-25318.patch

@@ -1,7 +1,7 @@
 # HG changeset patch
 # User Dmitry Butskoy <buc@buc.me>
 # Date 1690629350 -7200
-# Parent  cfde5167fa857825d9c54b4351c2a65addd0f035
+# Parent  4712114dedc61b09037bb4c4bb5ae72a82129f08
 No Bug - Import new regexp V8 engine. r=frg a=frg
 
 diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp
@@ -573,7 +573,7 @@ diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctio
  
  // If disableOOMFunctions is set, disable functionality that causes artificial
  // OOM conditions.
-@@ -4760,17 +4763,17 @@ ParseRegExp(JSContext* cx, unsigned argc
+@@ -4765,17 +4768,17 @@ ParseRegExp(JSContext* cx, unsigned argc
          return false;
      }
  
@@ -592,7 +592,7 @@ diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctio
          RootedString flagStr(cx, args[1].toString());
          if (!ParseRegExpFlags(cx, flagStr, &flags))
              return false;
-@@ -4789,21 +4792,17 @@ ParseRegExp(JSContext* cx, unsigned argc
+@@ -4794,21 +4797,17 @@ ParseRegExp(JSContext* cx, unsigned argc
      if (!pattern)
          return false;
  
@@ -1221,7 +1221,7 @@ diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp
  IonBuilder::InliningResult
  IonBuilder::inlineNativeCall(CallInfo& callInfo, JSFunction* target)
  {
-@@ -405,26 +408,26 @@ IonBuilder::inlineNativeGetter(CallInfo&
+@@ -412,26 +415,26 @@ IonBuilder::inlineNativeGetter(CallInfo&
              return InliningStatus_NotInlined;
  
          MInstruction* length = addTypedArrayLength(thisArg);
@@ -1360,7 +1360,7 @@ diff --git a/js/src/jsapi-tests/tests.h b/js/src/jsapi-tests/tests.h
 diff --git a/js/src/moz.build b/js/src/moz.build
 --- a/js/src/moz.build
 +++ b/js/src/moz.build
-@@ -141,16 +141,17 @@ EXPORTS.js += [
+@@ -142,16 +142,17 @@ EXPORTS.js += [
      '../public/Printf.h',
      '../public/ProfilingFrameIterator.h',
      '../public/ProfilingStack.h',

frg/work-js/mozilla-release/patches/mozilla-central-push_426381.patch

@@ -1,487 +0,0 @@
-# HG changeset patch
-# User Matthew Gaudet <mgaudet@mozilla.com>
-# Date 1531166127 14400
-#      Mon Jul 09 15:55:27 2018 -0400
-# Node ID 58e93d58965c4f57f20625929d33e9cafb6e0777
-# Parent  13efb4f58614a7bb20ca3149b0ca50cf92c7a13d
-Bug 1469044: [Part 1] Remove caching from math_function helper r=jandem
-
-diff --git a/js/src/jsmath.cpp b/js/src/jsmath.cpp
---- a/js/src/jsmath.cpp
-+++ b/js/src/jsmath.cpp
-@@ -140,33 +140,29 @@ MathCache::MathCache() {
- }
- 
- size_t
- MathCache::sizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf)
- {
-     return mallocSizeOf(this);
- }
- 
--typedef double (*UnaryMathFunctionType)(MathCache* cache, double);
-+typedef double (*UnaryMathFunctionType)(double);
- 
- template <UnaryMathFunctionType F>
- static bool
- math_function(JSContext* cx, HandleValue val, MutableHandleValue res)
- {
-     double x;
-     if (!ToNumber(cx, val, &x))
-         return false;
- 
--    MathCache* mathCache = cx->caches().getMathCache(cx);
--    if (!mathCache)
--        return false;
--
-     // NB: Always stored as a double so the math function can be inlined
-     // through MMathFunction.
--    double z = F(mathCache, x);
-+    double z = F(x);
-     res.setDouble(z);
-     return true;
- }
- 
- template <UnaryMathFunctionType F>
- static bool
- math_function(JSContext* cx, unsigned argc, Value* vp)
- {
-@@ -222,17 +218,17 @@ js::math_acos_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::acos(x);
- }
- 
- bool
- js::math_acos(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_acos_impl>(cx, argc, vp);
-+    return math_function<math_acos_uncached>(cx, argc, vp);
- }
- 
- double
- js::math_asin_impl(MathCache* cache, double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return cache->lookup(fdlibm::asin, x, MathCache::Asin);
- }
-@@ -242,17 +238,17 @@ js::math_asin_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::asin(x);
- }
- 
- bool
- js::math_asin(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_asin_impl>(cx, argc, vp);
-+    return math_function<math_asin_uncached>(cx, argc, vp);
- }
- 
- double
- js::math_atan_impl(MathCache* cache, double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return cache->lookup(fdlibm::atan, x, MathCache::Atan);
- }
-@@ -262,17 +258,17 @@ js::math_atan_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::atan(x);
- }
- 
- bool
- js::math_atan(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_atan_impl>(cx, argc, vp);
-+    return math_function<math_atan_uncached>(cx, argc, vp);
- }
- 
- double
- js::ecmaAtan2(double y, double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::atan2(y, x);
- }
-@@ -368,17 +364,17 @@ js::math_cos_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return cos(x);
- }
- 
- bool
- js::math_cos(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_cos_impl>(cx, argc, vp);
-+    return math_function<math_cos_uncached>(cx, argc, vp);
- }
- 
- double
- js::math_exp_impl(MathCache* cache, double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return cache->lookup(fdlibm::exp, x, MathCache::Exp);
- }
-@@ -388,17 +384,17 @@ js::math_exp_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::exp(x);
- }
- 
- bool
- js::math_exp(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_exp_impl>(cx, argc, vp);
-+    return math_function<math_exp_uncached>(cx, argc, vp);
- }
- 
- double
- js::math_floor_impl(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::floor(x);
- }
-@@ -496,23 +492,23 @@ js::math_log_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::log(x);
- }
- 
- bool
- js::math_log_handle(JSContext* cx, HandleValue val, MutableHandleValue res)
- {
--    return math_function<math_log_impl>(cx, val, res);
-+    return math_function<math_log_uncached>(cx, val, res);
- }
- 
- bool
- js::math_log(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_log_impl>(cx, argc, vp);
-+    return math_function<math_log_uncached>(cx, argc, vp);
- }
- 
- double
- js::math_max_impl(double x, double y)
- {
-     AutoUnsafeCallWithABI unsafe;
- 
-     // Math.max(num, NaN) => NaN, Math.max(-0, +0) => +0
-@@ -822,23 +818,23 @@ js::math_sin_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return sin(x);
- }
- 
- bool
- js::math_sin_handle(JSContext* cx, HandleValue val, MutableHandleValue res)
- {
--    return math_function<math_sin_impl>(cx, val, res);
-+    return math_function<math_sin_uncached>(cx, val, res);
- }
- 
- bool
- js::math_sin(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_sin_impl>(cx, argc, vp);
-+    return math_function<math_sin_uncached>(cx, argc, vp);
- }
- 
- void
- js::math_sincos_uncached(double x, double *sin, double *cos)
- {
-     AutoUnsafeCallWithABI unsafe;
- #if defined(HAVE_SINCOS)
-     sincos(x, sin, cos);
-@@ -868,32 +864,39 @@ js::math_sincos_impl(MathCache* mathCach
-     if (!hasSin)
-         *sin = js::math_sin_impl(mathCache, x);
- 
-     if (!hasCos)
-         *cos = js::math_cos_impl(mathCache, x);
- }
- 
- double
-+js::math_sqrt_uncached(double x)
-+{
-+    AutoUnsafeCallWithABI unsafe;
-+    return sqrt(x);
-+}
-+
-+double
- js::math_sqrt_impl(MathCache* cache, double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return cache->lookup(sqrt, x, MathCache::Sqrt);
- }
- 
- bool
- js::math_sqrt_handle(JSContext* cx, HandleValue number, MutableHandleValue result)
- {
--    return math_function<math_sqrt_impl>(cx, number, result);
-+    return math_function<math_sqrt_uncached>(cx, number, result);
- }
- 
- bool
- js::math_sqrt(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_sqrt_impl>(cx, argc, vp);
-+    return math_function<math_sqrt_uncached>(cx, argc, vp);
- }
- 
- double
- js::math_tan_impl(MathCache* cache, double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return cache->lookup(tan, x, MathCache::Tan);
- }
-@@ -903,17 +906,17 @@ js::math_tan_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return tan(x);
- }
- 
- bool
- js::math_tan(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_tan_impl>(cx, argc, vp);
-+    return math_function<math_tan_uncached>(cx, argc, vp);
- }
- 
- double
- js::math_log10_impl(MathCache* cache, double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return cache->lookup(fdlibm::log10, x, MathCache::Log10);
- }
-@@ -923,17 +926,17 @@ js::math_log10_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::log10(x);
- }
- 
- bool
- js::math_log10(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_log10_impl>(cx, argc, vp);
-+    return math_function<math_log10_uncached>(cx, argc, vp);
- }
- 
- double
- js::math_log2_impl(MathCache* cache, double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return cache->lookup(fdlibm::log2, x, MathCache::Log2);
- }
-@@ -943,17 +946,17 @@ js::math_log2_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::log2(x);
- }
- 
- bool
- js::math_log2(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_log2_impl>(cx, argc, vp);
-+    return math_function<math_log2_uncached>(cx, argc, vp);
- }
- 
- double
- js::math_log1p_impl(MathCache* cache, double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return cache->lookup(fdlibm::log1p, x, MathCache::Log1p);
- }
-@@ -963,17 +966,17 @@ js::math_log1p_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::log1p(x);
- }
- 
- bool
- js::math_log1p(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_log1p_impl>(cx, argc, vp);
-+    return math_function<math_log1p_uncached>(cx, argc, vp);
- }
- 
- double
- js::math_expm1_impl(MathCache* cache, double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return cache->lookup(fdlibm::expm1, x, MathCache::Expm1);
- }
-@@ -983,17 +986,17 @@ js::math_expm1_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::expm1(x);
- }
- 
- bool
- js::math_expm1(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_expm1_impl>(cx, argc, vp);
-+    return math_function<math_expm1_uncached>(cx, argc, vp);
- }
- 
- double
- js::math_cosh_impl(MathCache* cache, double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return cache->lookup(fdlibm::cosh, x, MathCache::Cosh);
- }
-@@ -1003,17 +1006,17 @@ js::math_cosh_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::cosh(x);
- }
- 
- bool
- js::math_cosh(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_cosh_impl>(cx, argc, vp);
-+    return math_function<math_cosh_uncached>(cx, argc, vp);
- }
- 
- double
- js::math_sinh_impl(MathCache* cache, double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return cache->lookup(fdlibm::sinh, x, MathCache::Sinh);
- }
-@@ -1023,17 +1026,17 @@ js::math_sinh_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::sinh(x);
- }
- 
- bool
- js::math_sinh(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_sinh_impl>(cx, argc, vp);
-+    return math_function<math_sinh_uncached>(cx, argc, vp);
- }
- 
- double
- js::math_tanh_impl(MathCache* cache, double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return cache->lookup(fdlibm::tanh, x, MathCache::Tanh);
- }
-@@ -1043,17 +1046,17 @@ js::math_tanh_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::tanh(x);
- }
- 
- bool
- js::math_tanh(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_tanh_impl>(cx, argc, vp);
-+    return math_function<math_tanh_uncached>(cx, argc, vp);
- }
- 
- double
- js::math_acosh_impl(MathCache* cache, double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return cache->lookup(fdlibm::acosh, x, MathCache::Acosh);
- }
-@@ -1063,17 +1066,17 @@ js::math_acosh_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::acosh(x);
- }
- 
- bool
- js::math_acosh(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_acosh_impl>(cx, argc, vp);
-+    return math_function<math_acosh_uncached>(cx, argc, vp);
- }
- 
- double
- js::math_asinh_impl(MathCache* cache, double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return cache->lookup(fdlibm::asinh, x, MathCache::Asinh);
- }
-@@ -1083,17 +1086,17 @@ js::math_asinh_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::asinh(x);
- }
- 
- bool
- js::math_asinh(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_asinh_impl>(cx, argc, vp);
-+    return math_function<math_asinh_uncached>(cx, argc, vp);
- }
- 
- double
- js::math_atanh_impl(MathCache* cache, double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return cache->lookup(fdlibm::atanh, x, MathCache::Atanh);
- }
-@@ -1103,17 +1106,17 @@ js::math_atanh_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::atanh(x);
- }
- 
- bool
- js::math_atanh(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_atanh_impl>(cx, argc, vp);
-+    return math_function<math_atanh_uncached>(cx, argc, vp);
- }
- 
- double
- js::ecmaHypot(double x, double y)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::hypot(x, y);
- }
-@@ -1297,17 +1300,17 @@ js::math_cbrt_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::cbrt(x);
- }
- 
- bool
- js::math_cbrt(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_cbrt_impl>(cx, argc, vp);
-+    return math_function<math_cbrt_uncached>(cx, argc, vp);
- }
- 
- static bool
- math_toSource(JSContext* cx, unsigned argc, Value* vp)
- {
-     CallArgs args = CallArgsFromVp(argc, vp);
-     args.rval().setString(cx->names().Math);
-     return true;
-diff --git a/js/src/jsmath.h b/js/src/jsmath.h
---- a/js/src/jsmath.h
-+++ b/js/src/jsmath.h
-@@ -119,16 +119,19 @@ math_max(JSContext* cx, unsigned argc, j
- 
- extern double
- math_min_impl(double x, double y);
- 
- extern bool
- math_min(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern double
-+math_sqrt_uncached(double x);
-+
-+extern double
- math_sqrt_impl(MathCache* cache, double x);
- 
- extern bool
- math_sqrt_handle(JSContext* cx, js::HandleValue number, js::MutableHandleValue result);
- 
- extern bool
- math_sqrt(JSContext* cx, unsigned argc, js::Value* vp);
- 

frg/work-js/mozilla-release/patches/mozilla-central-push_426382.patch

@@ -1,1343 +0,0 @@
-# HG changeset patch
-# User Matthew Gaudet <mgaudet@mozilla.com>
-# Date 1531169536 14400
-#      Mon Jul 09 16:52:16 2018 -0400
-# Node ID 76ed6d31be85c63eab788714d65b8ae787660700
-# Parent  58e93d58965c4f57f20625929d33e9cafb6e0777
-Bug 1469044: [Part 2] Remove remainder of MathCache r=jandem
-
-diff --git a/js/public/MemoryMetrics.h b/js/public/MemoryMetrics.h
---- a/js/public/MemoryMetrics.h
-+++ b/js/public/MemoryMetrics.h
-@@ -555,17 +555,16 @@ struct RuntimeSizes
- {
- #define FOR_EACH_SIZE(macro) \
-     macro(_, MallocHeap, object) \
-     macro(_, MallocHeap, atomsTable) \
-     macro(_, MallocHeap, atomsMarkBitmaps) \
-     macro(_, MallocHeap, contexts) \
-     macro(_, MallocHeap, temporary) \
-     macro(_, MallocHeap, interpreterStack) \
--    macro(_, MallocHeap, mathCache) \
-     macro(_, MallocHeap, sharedImmutableStringsCache) \
-     macro(_, MallocHeap, sharedIntlData) \
-     macro(_, MallocHeap, uncompressedSourceCache) \
-     macro(_, MallocHeap, scriptData) \
-     macro(_, MallocHeap, tracelogger) \
-     macro(_, MallocHeap, wasmRuntime) \
-     macro(_, MallocHeap, jitLazyLink)
- 
-diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
---- a/js/src/jit/CodeGenerator.cpp
-+++ b/js/src/jit/CodeGenerator.cpp
-@@ -7584,86 +7584,79 @@ void
- CodeGenerator::visitMathFunctionD(LMathFunctionD* ins)
- {
-     Register temp = ToRegister(ins->temp());
-     FloatRegister input = ToFloatRegister(ins->input());
-     MOZ_ASSERT(ToFloatRegister(ins->output()) == ReturnDoubleReg);
- 
-     masm.setupUnalignedABICall(temp);
- 
--    const MathCache* mathCache = ins->mir()->cache();
--    if (mathCache) {
--        masm.movePtr(ImmPtr(mathCache), temp);
--        masm.passABIArg(temp);
--    }
-     masm.passABIArg(input, MoveOp::DOUBLE);
- 
--#   define MAYBE_CACHED(fcn) (mathCache ? (void*)fcn ## _impl : (void*)fcn ## _uncached)
--
-     void* funptr = nullptr;
-     switch (ins->mir()->function()) {
-       case MMathFunction::Log:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, MAYBE_CACHED(js::math_log));
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_log_uncached);
-         break;
-       case MMathFunction::Sin:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, MAYBE_CACHED(js::math_sin));
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_sin_uncached);
-         break;
-       case MMathFunction::Cos:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, MAYBE_CACHED(js::math_cos));
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_cos_uncached);
-         break;
-       case MMathFunction::Exp:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, MAYBE_CACHED(js::math_exp));
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_exp_uncached);
-         break;
-       case MMathFunction::Tan:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, MAYBE_CACHED(js::math_tan));
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_tan_uncached);
-         break;
-       case MMathFunction::ATan:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, MAYBE_CACHED(js::math_atan));
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_atan_uncached);
-         break;
-       case MMathFunction::ASin:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, MAYBE_CACHED(js::math_asin));
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_asin_uncached);
-         break;
-       case MMathFunction::ACos:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, MAYBE_CACHED(js::math_acos));
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_acos_uncached);
-         break;
-       case MMathFunction::Log10:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, MAYBE_CACHED(js::math_log10));
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_log10_uncached);
-         break;
-       case MMathFunction::Log2:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, MAYBE_CACHED(js::math_log2));
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_log2_uncached);
-         break;
-       case MMathFunction::Log1P:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, MAYBE_CACHED(js::math_log1p));
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_log1p_uncached);
-         break;
-       case MMathFunction::ExpM1:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, MAYBE_CACHED(js::math_expm1));
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_expm1_uncached);
-         break;
-       case MMathFunction::CosH:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, MAYBE_CACHED(js::math_cosh));
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_cosh_uncached);
-         break;
-       case MMathFunction::SinH:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, MAYBE_CACHED(js::math_sinh));
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_sinh_uncached);
-         break;
-       case MMathFunction::TanH:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, MAYBE_CACHED(js::math_tanh));
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_tanh_uncached);
-         break;
-       case MMathFunction::ACosH:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, MAYBE_CACHED(js::math_acosh));
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_acosh_uncached);
-         break;
-       case MMathFunction::ASinH:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, MAYBE_CACHED(js::math_asinh));
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_asinh_uncached);
-         break;
-       case MMathFunction::ATanH:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, MAYBE_CACHED(js::math_atanh));
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_atanh_uncached);
-         break;
-       case MMathFunction::Trunc:
-         funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_trunc_uncached);
-         break;
-       case MMathFunction::Cbrt:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, MAYBE_CACHED(js::math_cbrt));
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_cbrt_uncached);
-         break;
-       case MMathFunction::Floor:
-         funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_floor_impl);
-         break;
-       case MMathFunction::Ceil:
-         funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_ceil_impl);
-         break;
-       case MMathFunction::Round:
-@@ -8964,34 +8957,25 @@ CodeGenerator::visitSinCos(LSinCos *lir)
-     Register params = ToRegister(lir->temp2());
-     FloatRegister input = ToFloatRegister(lir->input());
-     FloatRegister outputSin = ToFloatRegister(lir->outputSin());
-     FloatRegister outputCos = ToFloatRegister(lir->outputCos());
- 
-     masm.reserveStack(sizeof(double) * 2);
-     masm.moveStackPtrTo(params);
- 
--    const MathCache* mathCache = lir->mir()->cache();
--
-     masm.setupUnalignedABICall(temp);
--    if (mathCache) {
--        masm.movePtr(ImmPtr(mathCache), temp);
--        masm.passABIArg(temp);
--    }
--
--#define MAYBE_CACHED_(fcn) (mathCache ? (void*)fcn ## _impl : (void*)fcn ## _uncached)
- 
-     masm.passABIArg(input, MoveOp::DOUBLE);
-     masm.passABIArg(MoveOperand(params, sizeof(double), MoveOperand::EFFECTIVE_ADDRESS),
-                                 MoveOp::GENERAL);
-     masm.passABIArg(MoveOperand(params, 0, MoveOperand::EFFECTIVE_ADDRESS),
-                                 MoveOp::GENERAL);
- 
--    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, MAYBE_CACHED_(js::math_sincos)));
--#undef MAYBE_CACHED_
-+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, js::math_sincos_uncached));
- 
-     masm.loadDouble(Address(masm.getStackPointer(), 0), outputCos);
-     masm.loadDouble(Address(masm.getStackPointer(), sizeof(double)), outputSin);
-     masm.freeStack(sizeof(double) * 2);
- }
- 
- typedef ArrayObject* (*StringSplitFn)(JSContext*, HandleObjectGroup, HandleString, HandleString, uint32_t);
- static const VMFunction StringSplitInfo =
-diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
---- a/js/src/jit/Ion.cpp
-+++ b/js/src/jit/Ion.cpp
-@@ -1314,18 +1314,17 @@ OptimizeSinCos(MIRGraph &graph)
-                 continue;
-             }
- 
-             JitSpew(JitSpew_Sincos, "Found, at least, a pair sin/cos. Adding sincos in block %d",
-                     block->id());
-             // Adding the MSinCos and replacing the parameters of the
-             // sin(x)/cos(x) to sin(sincos(x))/cos(sincos(x)).
-             MSinCos *insSinCos = MSinCos::New(graph.alloc(),
--                                              insFunc->input(),
--                                              insFunc->toMathFunction()->cache());
-+                                              insFunc->input());
-             insSinCos->setImplicitlyUsedUnchecked();
-             block->insertBefore(insFunc, insSinCos);
-             for (MUseDefIterator uses(insFunc->input()); uses; )
-             {
-                 MDefinition* def = uses.def();
-                 uses++;
-                 if (!def->isInstruction())
-                     continue;
-diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp
---- a/js/src/jit/MCallOptimize.cpp
-+++ b/js/src/jit/MCallOptimize.cpp
-@@ -507,22 +507,20 @@ IonBuilder::inlineMathFunction(CallInfo&
-     if (callInfo.argc() != 1)
-         return InliningStatus_NotInlined;
- 
-     if (getInlineReturnType() != MIRType::Double)
-         return InliningStatus_NotInlined;
-     if (!IsNumberType(callInfo.getArg(0)->type()))
-         return InliningStatus_NotInlined;
- 
--    const MathCache* cache = TlsContext.get()->caches().maybeGetMathCache();
--
-     callInfo.fun()->setImplicitlyUsedUnchecked();
-     callInfo.thisArg()->setImplicitlyUsedUnchecked();
- 
--    MMathFunction* ins = MMathFunction::New(alloc(), callInfo.getArg(0), function, cache);
-+    MMathFunction* ins = MMathFunction::New(alloc(), callInfo.getArg(0), function);
-     current->add(ins);
-     current->push(ins);
-     return InliningStatus_Inlined;
- }
- 
- IonBuilder::InliningResult
- IonBuilder::inlineArray(CallInfo& callInfo)
- {
-@@ -1150,18 +1148,17 @@ IonBuilder::inlineMathFloor(CallInfo& ca
- 
-         if (returnType == MIRType::Double) {
-             callInfo.setImplicitlyUsedUnchecked();
- 
-             MInstruction* ins = nullptr;
-             if (MNearbyInt::HasAssemblerSupport(RoundingMode::Down)) {
-                 ins = MNearbyInt::New(alloc(), callInfo.getArg(0), argType, RoundingMode::Down);
-             } else {
--                ins = MMathFunction::New(alloc(), callInfo.getArg(0), MMathFunction::Floor,
--                                         /* cache */ nullptr);
-+                ins = MMathFunction::New(alloc(), callInfo.getArg(0), MMathFunction::Floor);
-             }
- 
-             current->add(ins);
-             current->push(ins);
-             return InliningStatus_Inlined;
-         }
-     }
- 
-@@ -1204,18 +1201,17 @@ IonBuilder::inlineMathCeil(CallInfo& cal
- 
-         if (returnType == MIRType::Double) {
-             callInfo.setImplicitlyUsedUnchecked();
- 
-             MInstruction* ins = nullptr;
-             if (MNearbyInt::HasAssemblerSupport(RoundingMode::Up)) {
-                 ins = MNearbyInt::New(alloc(), callInfo.getArg(0), argType, RoundingMode::Up);
-             } else {
--                ins = MMathFunction::New(alloc(), callInfo.getArg(0), MMathFunction::Ceil,
--                                         /* cache */ nullptr);
-+                ins = MMathFunction::New(alloc(), callInfo.getArg(0), MMathFunction::Ceil);
-             }
- 
-             current->add(ins);
-             current->push(ins);
-             return InliningStatus_Inlined;
-         }
-     }
- 
-@@ -1276,18 +1272,17 @@ IonBuilder::inlineMathRound(CallInfo& ca
-         MRound* ins = MRound::New(alloc(), callInfo.getArg(0));
-         current->add(ins);
-         current->push(ins);
-         return InliningStatus_Inlined;
-     }
- 
-     if (IsFloatingPointType(argType) && returnType == MIRType::Double) {
-         callInfo.setImplicitlyUsedUnchecked();
--        MMathFunction* ins = MMathFunction::New(alloc(), callInfo.getArg(0), MMathFunction::Round,
--                                                /* cache */ nullptr);
-+        MMathFunction* ins = MMathFunction::New(alloc(), callInfo.getArg(0), MMathFunction::Round);
-         current->add(ins);
-         current->push(ins);
-         return InliningStatus_Inlined;
-     }
- 
-     return InliningStatus_NotInlined;
- }
- 
-@@ -1521,18 +1516,17 @@ IonBuilder::inlineMathTrunc(CallInfo& ca
-         if (returnType == MIRType::Double) {
-             callInfo.setImplicitlyUsedUnchecked();
- 
-             MInstruction* ins = nullptr;
-             if (MNearbyInt::HasAssemblerSupport(RoundingMode::TowardsZero)) {
-                 ins = MNearbyInt::New(alloc(), callInfo.getArg(0), argType,
-                                       RoundingMode::TowardsZero);
-             } else {
--                ins = MMathFunction::New(alloc(), callInfo.getArg(0), MMathFunction::Trunc,
--                                         /* cache */ nullptr);
-+                ins = MMathFunction::New(alloc(), callInfo.getArg(0), MMathFunction::Trunc);
-             }
- 
-             current->add(ins);
-             current->push(ins);
-             return InliningStatus_Inlined;
-         }
-     }
- 
-diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
---- a/js/src/jit/MIR.h
-+++ b/js/src/jit/MIR.h
-@@ -7130,37 +7130,34 @@ class MMathFunction
-         Cbrt,
-         Floor,
-         Ceil,
-         Round
-     };
- 
-   private:
-     Function function_;
--    const MathCache* cache_;
- 
-     // A nullptr cache means this function will neither access nor update the cache.
--    MMathFunction(MDefinition* input, Function function, const MathCache* cache)
--      : MUnaryInstruction(classOpcode, input), function_(function), cache_(cache)
-+    MMathFunction(MDefinition* input, Function function)
-+      : MUnaryInstruction(classOpcode, input), function_(function)
-     {
-         setResultType(MIRType::Double);
-         specialization_ = MIRType::Double;
-         setMovable();
-     }
- 
-   public:
-     INSTRUCTION_HEADER(MathFunction)
-     TRIVIAL_NEW_WRAPPERS
- 
-     Function function() const {
-         return function_;
-     }
--    const MathCache* cache() const {
--        return cache_;
--    }
-+
-     bool congruentTo(const MDefinition* ins) const override {
-         if (!ins->isMathFunction())
-             return false;
-         if (ins->toMathFunction()->function() != function())
-             return false;
-         return congruentIfOperandsEqual(ins);
-     }
- 
-@@ -7810,46 +7807,41 @@ class MStringConvertCase
-         return mode_;
-     }
- };
- 
- class MSinCos
-   : public MUnaryInstruction,
-     public FloatingPointPolicy<0>::Data
- {
--    const MathCache* cache_;
--
--    MSinCos(MDefinition *input, const MathCache *cache)
--      : MUnaryInstruction(classOpcode, input),
--        cache_(cache)
-+
-+    explicit MSinCos(MDefinition *input)
-+      : MUnaryInstruction(classOpcode, input)
-     {
-         setResultType(MIRType::SinCosDouble);
-         specialization_ = MIRType::Double;
-         setMovable();
-     }
- 
-   public:
-     INSTRUCTION_HEADER(SinCos)
- 
--    static MSinCos *New(TempAllocator &alloc, MDefinition *input, const MathCache *cache)
--    {
--        return new (alloc) MSinCos(input, cache);
-+    static MSinCos *New(TempAllocator &alloc, MDefinition *input)
-+    {
-+        return new (alloc) MSinCos(input);
-     }
-     AliasSet getAliasSet() const override {
-         return AliasSet::None();
-     }
-     bool congruentTo(const MDefinition *ins) const override {
-         return congruentIfOperandsEqual(ins);
-     }
-     bool possiblyCalls() const override {
-         return true;
-     }
--    const MathCache* cache() const {
--        return cache_;
--    }
- };
- 
- class MStringSplit
-   : public MBinaryInstruction,
-     public MixPolicy<StringPolicy<0>, StringPolicy<1> >::Data
- {
-     CompilerObjectGroup group_;
- 
-diff --git a/js/src/jsapi-tests/testJitRangeAnalysis.cpp b/js/src/jsapi-tests/testJitRangeAnalysis.cpp
---- a/js/src/jsapi-tests/testJitRangeAnalysis.cpp
-+++ b/js/src/jsapi-tests/testJitRangeAnalysis.cpp
-@@ -106,17 +106,16 @@ BEGIN_TEST(testJitRangeAnalysis_MathSign
- 
-     return true;
- }
- END_TEST(testJitRangeAnalysis_MathSign)
- 
- BEGIN_TEST(testJitRangeAnalysis_MathSignBeta)
- {
-     MinimalFunc func;
--    MathCache cache;
- 
-     MBasicBlock* entry = func.createEntryBlock();
-     MBasicBlock* thenBlock = func.createBlock(entry);
-     MBasicBlock* elseBlock = func.createBlock(entry);
-     MBasicBlock* elseThenBlock = func.createBlock(elseBlock);
-     MBasicBlock* elseElseBlock = func.createBlock(elseBlock);
- 
-     // if (p < 0)
-diff --git a/js/src/jsmath.cpp b/js/src/jsmath.cpp
---- a/js/src/jsmath.cpp
-+++ b/js/src/jsmath.cpp
-@@ -125,31 +125,16 @@ static const JSConstDoubleSpec math_cons
-     {"LN2"    ,  M_LN2     },
-     {"LN10"   ,  M_LN10    },
-     {"PI"     ,  M_PI      },
-     {"SQRT2"  ,  M_SQRT2   },
-     {"SQRT1_2",  M_SQRT1_2 },
-     {nullptr  ,  0         }
- };
- 
--MathCache::MathCache() {
--    memset(table, 0, sizeof(table));
--
--    /* See comments in lookup(). */
--    MOZ_ASSERT(IsNegativeZero(-0.0));
--    MOZ_ASSERT(!IsNegativeZero(+0.0));
--    MOZ_ASSERT(hash(-0.0, MathCache::Sin) != hash(+0.0, MathCache::Sin));
--}
--
--size_t
--MathCache::sizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf)
--{
--    return mallocSizeOf(this);
--}
--
- typedef double (*UnaryMathFunctionType)(double);
- 
- template <UnaryMathFunctionType F>
- static bool
- math_function(JSContext* cx, HandleValue val, MutableHandleValue res)
- {
-     double x;
-     if (!ToNumber(cx, val, &x))
-@@ -202,63 +187,42 @@ js::math_abs(JSContext* cx, unsigned arg
-         args.rval().setNaN();
-         return true;
-     }
- 
-     return math_abs_handle(cx, args[0], args.rval());
- }
- 
- double
--js::math_acos_impl(MathCache* cache, double x)
--{
--    AutoUnsafeCallWithABI unsafe;
--    return cache->lookup(fdlibm::acos, x, MathCache::Acos);
--}
--
--double
- js::math_acos_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::acos(x);
- }
- 
- bool
- js::math_acos(JSContext* cx, unsigned argc, Value* vp)
- {
-     return math_function<math_acos_uncached>(cx, argc, vp);
- }
- 
- double
--js::math_asin_impl(MathCache* cache, double x)
--{
--    AutoUnsafeCallWithABI unsafe;
--    return cache->lookup(fdlibm::asin, x, MathCache::Asin);
--}
--
--double
- js::math_asin_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::asin(x);
- }
- 
- bool
- js::math_asin(JSContext* cx, unsigned argc, Value* vp)
- {
-     return math_function<math_asin_uncached>(cx, argc, vp);
- }
- 
- double
--js::math_atan_impl(MathCache* cache, double x)
--{
--    AutoUnsafeCallWithABI unsafe;
--    return cache->lookup(fdlibm::atan, x, MathCache::Atan);
--}
--
--double
- js::math_atan_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::atan(x);
- }
- 
- bool
- js::math_atan(JSContext* cx, unsigned argc, Value* vp)
-@@ -348,43 +312,29 @@ js::math_clz32(JSContext* cx, unsigned a
-         return true;
-     }
- 
-     args.rval().setInt32(mozilla::CountLeadingZeroes32(n));
-     return true;
- }
- 
- double
--js::math_cos_impl(MathCache* cache, double x)
--{
--    AutoUnsafeCallWithABI unsafe;
--    return cache->lookup(cos, x, MathCache::Cos);
--}
--
--double
- js::math_cos_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return cos(x);
- }
- 
- bool
- js::math_cos(JSContext* cx, unsigned argc, Value* vp)
- {
-     return math_function<math_cos_uncached>(cx, argc, vp);
- }
- 
- double
--js::math_exp_impl(MathCache* cache, double x)
--{
--    AutoUnsafeCallWithABI unsafe;
--    return cache->lookup(fdlibm::exp, x, MathCache::Exp);
--}
--
--double
- js::math_exp_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::exp(x);
- }
- 
- bool
- js::math_exp(JSContext* cx, unsigned argc, Value* vp)
-@@ -475,22 +425,16 @@ js::math_fround(JSContext* cx, unsigned 
-     if (args.length() == 0) {
-         args.rval().setNaN();
-         return true;
-     }
- 
-     return RoundFloat32(cx, args[0], args.rval());
- }
- 
--double
--js::math_log_impl(MathCache* cache, double x)
--{
--    AutoUnsafeCallWithABI unsafe;
--    return cache->lookup(fdlibm::log, x, MathCache::Log);
--}
- 
- double
- js::math_log_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::log(x);
- }
- 
-@@ -802,23 +746,16 @@ js::math_round(JSContext* cx, unsigned a
-         args.rval().setNaN();
-         return true;
-     }
- 
-     return math_round_handle(cx, args[0], args.rval());
- }
- 
- double
--js::math_sin_impl(MathCache* cache, double x)
--{
--    AutoUnsafeCallWithABI unsafe;
--    return cache->lookup(sin, x, MathCache::Sin);
--}
--
--double
- js::math_sin_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return sin(x);
- }
- 
- bool
- js::math_sin_handle(JSContext* cx, HandleValue val, MutableHandleValue res)
-@@ -841,272 +778,167 @@ js::math_sincos_uncached(double x, doubl
- #elif defined(HAVE___SINCOS)
-     __sincos(x, sin, cos);
- #else
-     *sin = js::math_sin_uncached(x);
-     *cos = js::math_cos_uncached(x);
- #endif
- }
- 
--void
--js::math_sincos_impl(MathCache* mathCache, double x, double *sin, double *cos)
--{
--    AutoUnsafeCallWithABI unsafe;
--    unsigned indexSin;
--    unsigned indexCos;
--    bool hasSin = mathCache->isCached(x, MathCache::Sin, sin, &indexSin);
--    bool hasCos = mathCache->isCached(x, MathCache::Cos, cos, &indexCos);
--    if (!(hasSin || hasCos)) {
--        js::math_sincos_uncached(x, sin, cos);
--        mathCache->store(MathCache::Sin, x, *sin, indexSin);
--        mathCache->store(MathCache::Cos, x, *cos, indexCos);
--        return;
--    }
--
--    if (!hasSin)
--        *sin = js::math_sin_impl(mathCache, x);
--
--    if (!hasCos)
--        *cos = js::math_cos_impl(mathCache, x);
--}
--
- double
- js::math_sqrt_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return sqrt(x);
- }
- 
--double
--js::math_sqrt_impl(MathCache* cache, double x)
--{
--    AutoUnsafeCallWithABI unsafe;
--    return cache->lookup(sqrt, x, MathCache::Sqrt);
--}
--
- bool
- js::math_sqrt_handle(JSContext* cx, HandleValue number, MutableHandleValue result)
- {
-     return math_function<math_sqrt_uncached>(cx, number, result);
- }
- 
- bool
- js::math_sqrt(JSContext* cx, unsigned argc, Value* vp)
- {
-     return math_function<math_sqrt_uncached>(cx, argc, vp);
- }
- 
- double
--js::math_tan_impl(MathCache* cache, double x)
--{
--    AutoUnsafeCallWithABI unsafe;
--    return cache->lookup(tan, x, MathCache::Tan);
--}
--
--double
- js::math_tan_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return tan(x);
- }
- 
- bool
- js::math_tan(JSContext* cx, unsigned argc, Value* vp)
- {
-     return math_function<math_tan_uncached>(cx, argc, vp);
- }
- 
- double
--js::math_log10_impl(MathCache* cache, double x)
--{
--    AutoUnsafeCallWithABI unsafe;
--    return cache->lookup(fdlibm::log10, x, MathCache::Log10);
--}
--
--double
- js::math_log10_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::log10(x);
- }
- 
- bool
- js::math_log10(JSContext* cx, unsigned argc, Value* vp)
- {
-     return math_function<math_log10_uncached>(cx, argc, vp);
- }
- 
- double
--js::math_log2_impl(MathCache* cache, double x)
--{
--    AutoUnsafeCallWithABI unsafe;
--    return cache->lookup(fdlibm::log2, x, MathCache::Log2);
--}
--
--double
- js::math_log2_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::log2(x);
- }
- 
- bool
- js::math_log2(JSContext* cx, unsigned argc, Value* vp)
- {
-     return math_function<math_log2_uncached>(cx, argc, vp);
- }
- 
- double
--js::math_log1p_impl(MathCache* cache, double x)
--{
--    AutoUnsafeCallWithABI unsafe;
--    return cache->lookup(fdlibm::log1p, x, MathCache::Log1p);
--}
--
--double
- js::math_log1p_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::log1p(x);
- }
- 
- bool
- js::math_log1p(JSContext* cx, unsigned argc, Value* vp)
- {
-     return math_function<math_log1p_uncached>(cx, argc, vp);
- }
- 
- double
--js::math_expm1_impl(MathCache* cache, double x)
--{
--    AutoUnsafeCallWithABI unsafe;
--    return cache->lookup(fdlibm::expm1, x, MathCache::Expm1);
--}
--
--double
- js::math_expm1_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::expm1(x);
- }
- 
- bool
- js::math_expm1(JSContext* cx, unsigned argc, Value* vp)
- {
-     return math_function<math_expm1_uncached>(cx, argc, vp);
- }
- 
- double
--js::math_cosh_impl(MathCache* cache, double x)
--{
--    AutoUnsafeCallWithABI unsafe;
--    return cache->lookup(fdlibm::cosh, x, MathCache::Cosh);
--}
--
--double
- js::math_cosh_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::cosh(x);
- }
- 
- bool
- js::math_cosh(JSContext* cx, unsigned argc, Value* vp)
- {
-     return math_function<math_cosh_uncached>(cx, argc, vp);
- }
- 
- double
--js::math_sinh_impl(MathCache* cache, double x)
--{
--    AutoUnsafeCallWithABI unsafe;
--    return cache->lookup(fdlibm::sinh, x, MathCache::Sinh);
--}
--
--double
- js::math_sinh_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::sinh(x);
- }
- 
- bool
- js::math_sinh(JSContext* cx, unsigned argc, Value* vp)
- {
-     return math_function<math_sinh_uncached>(cx, argc, vp);
- }
- 
--double
--js::math_tanh_impl(MathCache* cache, double x)
--{
--    AutoUnsafeCallWithABI unsafe;
--    return cache->lookup(fdlibm::tanh, x, MathCache::Tanh);
--}
- 
- double
- js::math_tanh_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::tanh(x);
- }
- 
- bool
- js::math_tanh(JSContext* cx, unsigned argc, Value* vp)
- {
-     return math_function<math_tanh_uncached>(cx, argc, vp);
- }
- 
- double
--js::math_acosh_impl(MathCache* cache, double x)
--{
--    AutoUnsafeCallWithABI unsafe;
--    return cache->lookup(fdlibm::acosh, x, MathCache::Acosh);
--}
--
--double
- js::math_acosh_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::acosh(x);
- }
- 
- bool
- js::math_acosh(JSContext* cx, unsigned argc, Value* vp)
- {
-     return math_function<math_acosh_uncached>(cx, argc, vp);
- }
- 
- double
--js::math_asinh_impl(MathCache* cache, double x)
--{
--    AutoUnsafeCallWithABI unsafe;
--    return cache->lookup(fdlibm::asinh, x, MathCache::Asinh);
--}
--
--double
- js::math_asinh_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::asinh(x);
- }
- 
- bool
- js::math_asinh(JSContext* cx, unsigned argc, Value* vp)
- {
-     return math_function<math_asinh_uncached>(cx, argc, vp);
- }
- 
- double
--js::math_atanh_impl(MathCache* cache, double x)
--{
--    AutoUnsafeCallWithABI unsafe;
--    return cache->lookup(fdlibm::atanh, x, MathCache::Atanh);
--}
--
--double
- js::math_atanh_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::atanh(x);
- }
- 
- bool
- js::math_atanh(JSContext* cx, unsigned argc, Value* vp)
-@@ -1284,23 +1116,16 @@ js::math_sign(JSContext* cx, unsigned ar
-         args.rval().setNaN();
-         return true;
-     }
- 
-     return math_sign_handle(cx, args[0], args.rval());
- }
- 
- double
--js::math_cbrt_impl(MathCache* cache, double x)
--{
--    AutoUnsafeCallWithABI unsafe;
--    return cache->lookup(fdlibm::cbrt, x, MathCache::Cbrt);
--}
--
--double
- js::math_cbrt_uncached(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::cbrt(x);
- }
- 
- bool
- js::math_cbrt(JSContext* cx, unsigned argc, Value* vp)
-diff --git a/js/src/jsmath.h b/js/src/jsmath.h
---- a/js/src/jsmath.h
-+++ b/js/src/jsmath.h
-@@ -15,78 +15,16 @@
- 
- namespace js {
- 
- struct Class;
- class GlobalObject;
- 
- typedef double (*UnaryFunType)(double);
- 
--class MathCache
--{
--  public:
--    enum MathFuncId {
--        Zero,
--        Sin, Cos, Tan, Sinh, Cosh, Tanh, Asin, Acos, Atan, Asinh, Acosh, Atanh,
--        Sqrt, Log, Log10, Log2, Log1p, Exp, Expm1, Cbrt
--    };
--
--  private:
--    static const unsigned SizeLog2 = 12;
--    static const unsigned Size = 1 << SizeLog2;
--    struct Entry { double in; MathFuncId id; double out; };
--    Entry table[Size];
--
--  public:
--    MathCache();
--
--    unsigned hash(double x, MathFuncId id) {
--        union { double d; struct { uint32_t one, two; } s; } u = { x };
--        uint32_t hash32 = u.s.one ^ u.s.two;
--        hash32 += uint32_t(id) << 8;
--        uint16_t hash16 = uint16_t(hash32 ^ (hash32 >> 16));
--        return (hash16 & (Size - 1)) ^ (hash16 >> (16 - SizeLog2));
--    }
--
--    /*
--     * N.B. lookup uses double-equality. This is only safe if hash() maps +0
--     * and -0 to different table entries, which is asserted in MathCache().
--     */
--    double lookup(UnaryFunType f, double x, MathFuncId id) {
--        unsigned index = hash(x, id);
--        Entry& e = table[index];
--        if (e.in == x && e.id == id)
--            return e.out;
--        e.in = x;
--        e.id = id;
--        return e.out = f(x);
--    }
--
--    bool isCached(double x, MathFuncId id, double *r, unsigned *index) {
--        *index = hash(x, id);
--        Entry& e = table[*index];
--        if (e.in == x && e.id == id) {
--            *r = e.out;
--            return true;
--        }
--        return false;
--    }
--
--    void store(MathFuncId id, double x, double v, unsigned index) {
--        Entry &e = table[index];
--        if (e.in == x && e.id == id)
--            return;
--        e.in = x;
--        e.id = id;
--        e.out = v;
--    }
--
--    size_t sizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf);
--};
--
- /*
-  * JS math functions.
-  */
- 
- extern const Class MathClass;
- 
- extern JSObject*
- InitMathClass(JSContext* cx, Handle<GlobalObject*> global);
-@@ -121,38 +59,32 @@ extern double
- math_min_impl(double x, double y);
- 
- extern bool
- math_min(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern double
- math_sqrt_uncached(double x);
- 
--extern double
--math_sqrt_impl(MathCache* cache, double x);
--
- extern bool
- math_sqrt_handle(JSContext* cx, js::HandleValue number, js::MutableHandleValue result);
- 
- extern bool
- math_sqrt(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern bool
- math_pow(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern bool
- minmax_impl(JSContext* cx, bool max, js::HandleValue a, js::HandleValue b,
-             js::MutableHandleValue res);
- 
- extern void
- math_sincos_uncached(double x, double *sin, double *cos);
- 
--extern void
--math_sincos_impl(MathCache* mathCache, double x, double *sin, double *cos);
--
- extern bool
- math_imul_handle(JSContext* cx, HandleValue lhs, HandleValue rhs, MutableHandleValue res);
- 
- extern bool
- math_imul(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern bool
- RoundFloat32(JSContext* cx, HandleValue v, float* out);
-@@ -162,61 +94,46 @@ RoundFloat32(JSContext* cx, HandleValue 
- 
- extern bool
- math_fround(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern bool
- math_log(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern double
--math_log_impl(MathCache* cache, double x);
--
--extern double
- math_log_uncached(double x);
- 
- extern bool
- math_log_handle(JSContext* cx, HandleValue val, MutableHandleValue res);
- 
- extern bool
- math_sin(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern double
--math_sin_impl(MathCache* cache, double x);
--
--extern double
- math_sin_uncached(double x);
- 
- extern bool
- math_sin_handle(JSContext* cx, HandleValue val, MutableHandleValue res);
- 
- extern bool
- math_cos(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern double
--math_cos_impl(MathCache* cache, double x);
--
--extern double
- math_cos_uncached(double x);
- 
- extern bool
- math_exp(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern double
--math_exp_impl(MathCache* cache, double x);
--
--extern double
- math_exp_uncached(double x);
- 
- extern bool
- math_tan(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern double
--math_tan_impl(MathCache* cache, double x);
--
--extern double
- math_tan_uncached(double x);
- 
- extern bool
- math_log10(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern bool
- math_log2(JSContext* cx, unsigned argc, js::Value* vp);
- 
-@@ -282,37 +199,28 @@ math_atan2_handle(JSContext* cx, HandleV
- 
- extern bool
- math_atan2(JSContext* cx, unsigned argc, Value* vp);
- 
- extern double
- ecmaAtan2(double x, double y);
- 
- extern double
--math_atan_impl(MathCache* cache, double x);
--
--extern double
- math_atan_uncached(double x);
- 
- extern bool
- math_atan(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern double
--math_asin_impl(MathCache* cache, double x);
--
--extern double
- math_asin_uncached(double x);
- 
- extern bool
- math_asin(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern double
--math_acos_impl(MathCache* cache, double x);
--
--extern double
- math_acos_uncached(double x);
- 
- extern bool
- math_acos(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern bool
- math_ceil_handle(JSContext* cx, HandleValue value, MutableHandleValue res);
- 
-@@ -351,73 +259,43 @@ math_roundf_impl(float x);
- 
- extern double
- powi(double x, int32_t y);
- 
- extern double
- ecmaPow(double x, double y);
- 
- extern double
--math_log10_impl(MathCache* cache, double x);
--
--extern double
- math_log10_uncached(double x);
- 
- extern double
--math_log2_impl(MathCache* cache, double x);
--
--extern double
- math_log2_uncached(double x);
- 
- extern double
--math_log1p_impl(MathCache* cache, double x);
--
--extern double
- math_log1p_uncached(double x);
- 
- extern double
--math_expm1_impl(MathCache* cache, double x);
--
--extern double
- math_expm1_uncached(double x);
- 
- extern double
--math_cosh_impl(MathCache* cache, double x);
--
--extern double
- math_cosh_uncached(double x);
- 
- extern double
--math_sinh_impl(MathCache* cache, double x);
--
--extern double
- math_sinh_uncached(double x);
- 
- extern double
--math_tanh_impl(MathCache* cache, double x);
--
--extern double
- math_tanh_uncached(double x);
- 
- extern double
--math_acosh_impl(MathCache* cache, double x);
--
--extern double
- math_acosh_uncached(double x);
- 
- extern double
--math_asinh_impl(MathCache* cache, double x);
--
--extern double
- math_asinh_uncached(double x);
- 
- extern double
--math_atanh_impl(MathCache* cache, double x);
--
--extern double
- math_atanh_uncached(double x);
- 
- extern double
- math_trunc_uncached(double x);
- 
- extern float
- math_truncf_impl(float x);
- 
-@@ -426,16 +304,13 @@ math_trunc_handle(JSContext* cx, HandleV
- 
- extern double
- math_sign_uncached(double x);
- 
- extern bool
- math_sign_handle(JSContext* cx, HandleValue v, MutableHandleValue r);
- 
- extern double
--math_cbrt_impl(MathCache* cache, double x);
--
--extern double
- math_cbrt_uncached(double x);
- 
- } /* namespace js */
- 
- #endif /* jsmath_h */
-diff --git a/js/src/vm/Caches.cpp b/js/src/vm/Caches.cpp
---- a/js/src/vm/Caches.cpp
-+++ b/js/src/vm/Caches.cpp
-@@ -7,31 +7,16 @@
- #include "vm/Caches-inl.h"
- 
- #include "mozilla/PodOperations.h"
- 
- using namespace js;
- 
- using mozilla::PodZero;
- 
--MathCache*
--RuntimeCaches::createMathCache(JSContext* cx)
--{
--    MOZ_ASSERT(!mathCache_);
--
--    auto newMathCache = MakeUnique<MathCache>();
--    if (!newMathCache) {
--        ReportOutOfMemory(cx);
--        return nullptr;
--    }
--
--    mathCache_ = std::move(newMathCache);
--    return mathCache_.get();
--}
--
- bool
- RuntimeCaches::init()
- {
-     if (!evalCache.init())
-         return false;
- 
-     return true;
- }
-diff --git a/js/src/vm/Caches.h b/js/src/vm/Caches.h
---- a/js/src/vm/Caches.h
-+++ b/js/src/vm/Caches.h
-@@ -235,36 +235,25 @@ class NewObjectCache
-         // Initialize with barriers
-         dst->initGroup(src->group());
-         dst->initShape(src->shape());
-     }
- };
- 
- class RuntimeCaches
- {
--    UniquePtr<js::MathCache> mathCache_;
--
--    js::MathCache* createMathCache(JSContext* cx);
--
-   public:
-     js::GSNCache gsnCache;
-     js::EnvironmentCoordinateNameCache envCoordinateNameCache;
-     js::NewObjectCache newObjectCache;
-     js::UncompressedSourceCache uncompressedSourceCache;
-     js::EvalCache evalCache;
- 
-     bool init();
- 
--    js::MathCache* getMathCache(JSContext* cx) {
--        return mathCache_ ? mathCache_.get() : createMathCache(cx);
--    }
--    js::MathCache* maybeGetMathCache() {
--        return mathCache_.get();
--    }
--
-     void purgeForMinorGC(JSRuntime* rt) {
-         newObjectCache.clearNurseryObjects(rt);
-         evalCache.sweep();
-     }
- 
-     void purgeForCompaction() {
-         newObjectCache.purge();
-         if (evalCache.initialized())
-diff --git a/js/src/vm/Runtime.cpp b/js/src/vm/Runtime.cpp
---- a/js/src/vm/Runtime.cpp
-+++ b/js/src/vm/Runtime.cpp
-@@ -370,19 +370,16 @@ JSRuntime::addSizeOfIncludingThis(mozill
-     rtSizes->contexts += cx->sizeOfExcludingThis(mallocSizeOf);
-     rtSizes->temporary += cx->tempLifoAlloc().sizeOfExcludingThis(mallocSizeOf);
-     rtSizes->interpreterStack += cx->interpreterStack().sizeOfExcludingThis(mallocSizeOf);
- #ifdef JS_TRACE_LOGGING
-     if (cx->traceLogger)
-         rtSizes->tracelogger += cx->traceLogger->sizeOfIncludingThis(mallocSizeOf);
- #endif
- 
--    if (MathCache* cache = caches().maybeGetMathCache())
--        rtSizes->mathCache += cache->sizeOfIncludingThis(mallocSizeOf);
--
-     rtSizes->uncompressedSourceCache +=
-         caches().uncompressedSourceCache.sizeOfExcludingThis(mallocSizeOf);
- 
-     rtSizes->gc.nurseryCommitted += gc.nursery().sizeOfHeapCommitted();
-     rtSizes->gc.nurseryMallocedBuffers += gc.nursery().sizeOfMallocedBuffers(mallocSizeOf);
-     gc.storeBuffer().addSizeOfExcludingThis(mallocSizeOf, &rtSizes->gc);
- 
-     if (sharedImmutableStrings_) {
-diff --git a/js/xpconnect/src/XPCJSRuntime.cpp b/js/xpconnect/src/XPCJSRuntime.cpp
---- a/js/xpconnect/src/XPCJSRuntime.cpp
-+++ b/js/xpconnect/src/XPCJSRuntime.cpp
-@@ -1882,20 +1882,16 @@ ReportJSRuntimeExplicitTreeStats(const J
-         KIND_HEAP, rtStats.runtime.temporary,
-         "Transient data (mostly parse nodes) held by the JSRuntime during "
-         "compilation.");
- 
-     RREPORT_BYTES(rtPath + NS_LITERAL_CSTRING("runtime/interpreter-stack"),
-         KIND_HEAP, rtStats.runtime.interpreterStack,
-         "JS interpreter frames.");
- 
--    RREPORT_BYTES(rtPath + NS_LITERAL_CSTRING("runtime/math-cache"),
--        KIND_HEAP, rtStats.runtime.mathCache,
--        "The math cache.");
--
-     RREPORT_BYTES(rtPath + NS_LITERAL_CSTRING("runtime/shared-immutable-strings-cache"),
-         KIND_HEAP, rtStats.runtime.sharedImmutableStringsCache,
-         "Immutable strings (such as JS scripts' source text) shared across all JSRuntimes.");
- 
-     RREPORT_BYTES(rtPath + NS_LITERAL_CSTRING("runtime/shared-intl-data"),
-         KIND_HEAP, rtStats.runtime.sharedIntlData,
-         "Shared internationalization data.");
- 

frg/work-js/mozilla-release/patches/mozilla-central-push_426383.patch

@@ -1,969 +0,0 @@
-# HG changeset patch
-# User Matthew Gaudet <mgaudet@mozilla.com>
-# Date 1531171258 14400
-#      Mon Jul 09 17:20:58 2018 -0400
-# Node ID c980318f4f82e2175a1f23c6c4d301f01dbd4ed1
-# Parent  76ed6d31be85c63eab788714d65b8ae787660700
-Bug 1469044: [Part 3] Rename 'uncached' to 'impl' r=jandem
-
-diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
---- a/js/src/jit/CodeGenerator.cpp
-+++ b/js/src/jit/CodeGenerator.cpp
-@@ -7589,74 +7589,74 @@ CodeGenerator::visitMathFunctionD(LMathF
- 
-     masm.setupUnalignedABICall(temp);
- 
-     masm.passABIArg(input, MoveOp::DOUBLE);
- 
-     void* funptr = nullptr;
-     switch (ins->mir()->function()) {
-       case MMathFunction::Log:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_log_uncached);
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_log_impl);
-         break;
-       case MMathFunction::Sin:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_sin_uncached);
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_sin_impl);
-         break;
-       case MMathFunction::Cos:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_cos_uncached);
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_cos_impl);
-         break;
-       case MMathFunction::Exp:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_exp_uncached);
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_exp_impl);
-         break;
-       case MMathFunction::Tan:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_tan_uncached);
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_tan_impl);
-         break;
-       case MMathFunction::ATan:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_atan_uncached);
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_atan_impl);
-         break;
-       case MMathFunction::ASin:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_asin_uncached);
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_asin_impl);
-         break;
-       case MMathFunction::ACos:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_acos_uncached);
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_acos_impl);
-         break;
-       case MMathFunction::Log10:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_log10_uncached);
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_log10_impl);
-         break;
-       case MMathFunction::Log2:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_log2_uncached);
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_log2_impl);
-         break;
-       case MMathFunction::Log1P:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_log1p_uncached);
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_log1p_impl);
-         break;
-       case MMathFunction::ExpM1:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_expm1_uncached);
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_expm1_impl);
-         break;
-       case MMathFunction::CosH:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_cosh_uncached);
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_cosh_impl);
-         break;
-       case MMathFunction::SinH:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_sinh_uncached);
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_sinh_impl);
-         break;
-       case MMathFunction::TanH:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_tanh_uncached);
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_tanh_impl);
-         break;
-       case MMathFunction::ACosH:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_acosh_uncached);
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_acosh_impl);
-         break;
-       case MMathFunction::ASinH:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_asinh_uncached);
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_asinh_impl);
-         break;
-       case MMathFunction::ATanH:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_atanh_uncached);
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_atanh_impl);
-         break;
-       case MMathFunction::Trunc:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_trunc_uncached);
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_trunc_impl);
-         break;
-       case MMathFunction::Cbrt:
--        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_cbrt_uncached);
-+        funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_cbrt_impl);
-         break;
-       case MMathFunction::Floor:
-         funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_floor_impl);
-         break;
-       case MMathFunction::Ceil:
-         funptr = JS_FUNC_TO_DATA_PTR(void*, js::math_ceil_impl);
-         break;
-       case MMathFunction::Round:
-@@ -8965,17 +8965,17 @@ CodeGenerator::visitSinCos(LSinCos *lir)
-     masm.setupUnalignedABICall(temp);
- 
-     masm.passABIArg(input, MoveOp::DOUBLE);
-     masm.passABIArg(MoveOperand(params, sizeof(double), MoveOperand::EFFECTIVE_ADDRESS),
-                                 MoveOp::GENERAL);
-     masm.passABIArg(MoveOperand(params, 0, MoveOperand::EFFECTIVE_ADDRESS),
-                                 MoveOp::GENERAL);
- 
--    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, js::math_sincos_uncached));
-+    masm.callWithABI(JS_FUNC_TO_DATA_PTR(void*, js::math_sincos_impl));
- 
-     masm.loadDouble(Address(masm.getStackPointer(), 0), outputCos);
-     masm.loadDouble(Address(masm.getStackPointer(), sizeof(double)), outputSin);
-     masm.freeStack(sizeof(double) * 2);
- }
- 
- typedef ArrayObject* (*StringSplitFn)(JSContext*, HandleObjectGroup, HandleString, HandleString, uint32_t);
- static const VMFunction StringSplitInfo =
-diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp
---- a/js/src/jit/MIR.cpp
-+++ b/js/src/jit/MIR.cpp
-@@ -1894,17 +1894,17 @@ void MNearbyInt::printOpcode(GenericPrin
- MDefinition*
- MSign::foldsTo(TempAllocator& alloc)
- {
-     MDefinition* input = getOperand(0);
-     if (!input->isConstant() || !input->toConstant()->isTypeRepresentableAsDouble())
-         return this;
- 
-     double in = input->toConstant()->numberToDouble();
--    double out = js::math_sign_uncached(in);
-+    double out = js::math_sign_impl(in);
- 
-     if (type() == MIRType::Int32) {
-         // Decline folding if this is an int32 operation, but the result type
-         // isn't an int32.
-         Value outValue = NumberValue(out);
-         if (!outValue.isInt32())
-             return this;
- 
-@@ -1961,74 +1961,74 @@ MMathFunction::foldsTo(TempAllocator& al
-     MDefinition* input = getOperand(0);
-     if (!input->isConstant() || !input->toConstant()->isTypeRepresentableAsDouble())
-         return this;
- 
-     double in = input->toConstant()->numberToDouble();
-     double out;
-     switch (function_) {
-       case Log:
--        out = js::math_log_uncached(in);
-+        out = js::math_log_impl(in);
-         break;
-       case Sin:
--        out = js::math_sin_uncached(in);
-+        out = js::math_sin_impl(in);
-         break;
-       case Cos:
--        out = js::math_cos_uncached(in);
-+        out = js::math_cos_impl(in);
-         break;
-       case Exp:
--        out = js::math_exp_uncached(in);
-+        out = js::math_exp_impl(in);
-         break;
-       case Tan:
--        out = js::math_tan_uncached(in);
-+        out = js::math_tan_impl(in);
-         break;
-       case ACos:
--        out = js::math_acos_uncached(in);
-+        out = js::math_acos_impl(in);
-         break;
-       case ASin:
--        out = js::math_asin_uncached(in);
-+        out = js::math_asin_impl(in);
-         break;
-       case ATan:
--        out = js::math_atan_uncached(in);
-+        out = js::math_atan_impl(in);
-         break;
-       case Log10:
--        out = js::math_log10_uncached(in);
-+        out = js::math_log10_impl(in);
-         break;
-       case Log2:
--        out = js::math_log2_uncached(in);
-+        out = js::math_log2_impl(in);
-         break;
-       case Log1P:
--        out = js::math_log1p_uncached(in);
-+        out = js::math_log1p_impl(in);
-         break;
-       case ExpM1:
--        out = js::math_expm1_uncached(in);
-+        out = js::math_expm1_impl(in);
-         break;
-       case CosH:
--        out = js::math_cosh_uncached(in);
-+        out = js::math_cosh_impl(in);
-         break;
-       case SinH:
--        out = js::math_sinh_uncached(in);
-+        out = js::math_sinh_impl(in);
-         break;
-       case TanH:
--        out = js::math_tanh_uncached(in);
-+        out = js::math_tanh_impl(in);
-         break;
-       case ACosH:
--        out = js::math_acosh_uncached(in);
-+        out = js::math_acosh_impl(in);
-         break;
-       case ASinH:
--        out = js::math_asinh_uncached(in);
-+        out = js::math_asinh_impl(in);
-         break;
-       case ATanH:
--        out = js::math_atanh_uncached(in);
-+        out = js::math_atanh_impl(in);
-         break;
-       case Trunc:
--        out = js::math_trunc_uncached(in);
-+        out = js::math_trunc_impl(in);
-         break;
-       case Cbrt:
--        out = js::math_cbrt_uncached(in);
-+        out = js::math_cbrt_impl(in);
-         break;
-       case Floor:
-         out = js::math_floor_impl(in);
-         break;
-       case Ceil:
-         out = js::math_ceil_impl(in);
-         break;
-       case Round:
-diff --git a/js/src/jsmath.cpp b/js/src/jsmath.cpp
---- a/js/src/jsmath.cpp
-+++ b/js/src/jsmath.cpp
-@@ -187,52 +187,52 @@ js::math_abs(JSContext* cx, unsigned arg
-         args.rval().setNaN();
-         return true;
-     }
- 
-     return math_abs_handle(cx, args[0], args.rval());
- }
- 
- double
--js::math_acos_uncached(double x)
-+js::math_acos_impl(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::acos(x);
- }
- 
- bool
- js::math_acos(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_acos_uncached>(cx, argc, vp);
-+    return math_function<math_acos_impl>(cx, argc, vp);
- }
- 
- double
--js::math_asin_uncached(double x)
-+js::math_asin_impl(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::asin(x);
- }
- 
- bool
- js::math_asin(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_asin_uncached>(cx, argc, vp);
-+    return math_function<math_asin_impl>(cx, argc, vp);
- }
- 
- double
--js::math_atan_uncached(double x)
-+js::math_atan_impl(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::atan(x);
- }
- 
- bool
- js::math_atan(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_atan_uncached>(cx, argc, vp);
-+    return math_function<math_atan_impl>(cx, argc, vp);
- }
- 
- double
- js::ecmaAtan2(double y, double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::atan2(y, x);
- }
-@@ -312,39 +312,39 @@ js::math_clz32(JSContext* cx, unsigned a
-         return true;
-     }
- 
-     args.rval().setInt32(mozilla::CountLeadingZeroes32(n));
-     return true;
- }
- 
- double
--js::math_cos_uncached(double x)
-+js::math_cos_impl(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return cos(x);
- }
- 
- bool
- js::math_cos(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_cos_uncached>(cx, argc, vp);
-+    return math_function<math_cos_impl>(cx, argc, vp);
- }
- 
- double
--js::math_exp_uncached(double x)
-+js::math_exp_impl(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::exp(x);
- }
- 
- bool
- js::math_exp(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_exp_uncached>(cx, argc, vp);
-+    return math_function<math_exp_impl>(cx, argc, vp);
- }
- 
- double
- js::math_floor_impl(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::floor(x);
- }
-@@ -427,32 +427,32 @@ js::math_fround(JSContext* cx, unsigned 
-         return true;
-     }
- 
-     return RoundFloat32(cx, args[0], args.rval());
- }
- 
- 
- double
--js::math_log_uncached(double x)
-+js::math_log_impl(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::log(x);
- }
- 
- bool
- js::math_log_handle(JSContext* cx, HandleValue val, MutableHandleValue res)
- {
--    return math_function<math_log_uncached>(cx, val, res);
-+    return math_function<math_log_impl>(cx, val, res);
- }
- 
- bool
- js::math_log(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_log_uncached>(cx, argc, vp);
-+    return math_function<math_log_impl>(cx, argc, vp);
- }
- 
- double
- js::math_max_impl(double x, double y)
- {
-     AutoUnsafeCallWithABI unsafe;
- 
-     // Math.max(num, NaN) => NaN, Math.max(-0, +0) => +0
-@@ -746,209 +746,209 @@ js::math_round(JSContext* cx, unsigned a
-         args.rval().setNaN();
-         return true;
-     }
- 
-     return math_round_handle(cx, args[0], args.rval());
- }
- 
- double
--js::math_sin_uncached(double x)
-+js::math_sin_impl(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return sin(x);
- }
- 
- bool
- js::math_sin_handle(JSContext* cx, HandleValue val, MutableHandleValue res)
- {
--    return math_function<math_sin_uncached>(cx, val, res);
-+    return math_function<math_sin_impl>(cx, val, res);
- }
- 
- bool
- js::math_sin(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_sin_uncached>(cx, argc, vp);
-+    return math_function<math_sin_impl>(cx, argc, vp);
- }
- 
- void
--js::math_sincos_uncached(double x, double *sin, double *cos)
-+js::math_sincos_impl(double x, double *sin, double *cos)
- {
-     AutoUnsafeCallWithABI unsafe;
- #if defined(HAVE_SINCOS)
-     sincos(x, sin, cos);
- #elif defined(HAVE___SINCOS)
-     __sincos(x, sin, cos);
- #else
--    *sin = js::math_sin_uncached(x);
--    *cos = js::math_cos_uncached(x);
-+    *sin = js::math_sin_impl(x);
-+    *cos = js::math_cos_impl(x);
- #endif
- }
- 
- double
--js::math_sqrt_uncached(double x)
-+js::math_sqrt_impl(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return sqrt(x);
- }
- 
- bool
- js::math_sqrt_handle(JSContext* cx, HandleValue number, MutableHandleValue result)
- {
--    return math_function<math_sqrt_uncached>(cx, number, result);
-+    return math_function<math_sqrt_impl>(cx, number, result);
- }
- 
- bool
- js::math_sqrt(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_sqrt_uncached>(cx, argc, vp);
-+    return math_function<math_sqrt_impl>(cx, argc, vp);
- }
- 
- double
--js::math_tan_uncached(double x)
-+js::math_tan_impl(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return tan(x);
- }
- 
- bool
- js::math_tan(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_tan_uncached>(cx, argc, vp);
-+    return math_function<math_tan_impl>(cx, argc, vp);
- }
- 
- double
--js::math_log10_uncached(double x)
-+js::math_log10_impl(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::log10(x);
- }
- 
- bool
- js::math_log10(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_log10_uncached>(cx, argc, vp);
-+    return math_function<math_log10_impl>(cx, argc, vp);
- }
- 
- double
--js::math_log2_uncached(double x)
-+js::math_log2_impl(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::log2(x);
- }
- 
- bool
- js::math_log2(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_log2_uncached>(cx, argc, vp);
-+    return math_function<math_log2_impl>(cx, argc, vp);
- }
- 
- double
--js::math_log1p_uncached(double x)
-+js::math_log1p_impl(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::log1p(x);
- }
- 
- bool
- js::math_log1p(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_log1p_uncached>(cx, argc, vp);
-+    return math_function<math_log1p_impl>(cx, argc, vp);
- }
- 
- double
--js::math_expm1_uncached(double x)
-+js::math_expm1_impl(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::expm1(x);
- }
- 
- bool
- js::math_expm1(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_expm1_uncached>(cx, argc, vp);
-+    return math_function<math_expm1_impl>(cx, argc, vp);
- }
- 
- double
--js::math_cosh_uncached(double x)
-+js::math_cosh_impl(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::cosh(x);
- }
- 
- bool
- js::math_cosh(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_cosh_uncached>(cx, argc, vp);
-+    return math_function<math_cosh_impl>(cx, argc, vp);
- }
- 
- double
--js::math_sinh_uncached(double x)
-+js::math_sinh_impl(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::sinh(x);
- }
- 
- bool
- js::math_sinh(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_sinh_uncached>(cx, argc, vp);
-+    return math_function<math_sinh_impl>(cx, argc, vp);
- }
- 
- 
- double
--js::math_tanh_uncached(double x)
-+js::math_tanh_impl(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::tanh(x);
- }
- 
- bool
- js::math_tanh(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_tanh_uncached>(cx, argc, vp);
-+    return math_function<math_tanh_impl>(cx, argc, vp);
- }
- 
- double
--js::math_acosh_uncached(double x)
-+js::math_acosh_impl(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::acosh(x);
- }
- 
- bool
- js::math_acosh(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_acosh_uncached>(cx, argc, vp);
-+    return math_function<math_acosh_impl>(cx, argc, vp);
- }
- 
- double
--js::math_asinh_uncached(double x)
-+js::math_asinh_impl(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::asinh(x);
- }
- 
- bool
- js::math_asinh(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_asinh_uncached>(cx, argc, vp);
-+    return math_function<math_asinh_impl>(cx, argc, vp);
- }
- 
- double
--js::math_atanh_uncached(double x)
-+js::math_atanh_impl(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::atanh(x);
- }
- 
- bool
- js::math_atanh(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_atanh_uncached>(cx, argc, vp);
-+    return math_function<math_atanh_impl>(cx, argc, vp);
- }
- 
- double
- js::ecmaHypot(double x, double y)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::hypot(x, y);
- }
-@@ -1045,17 +1045,17 @@ js::math_hypot_handle(JSContext* cx, Han
-     double result = isInfinite ? PositiveInfinity<double>() :
-                     isNaN ? GenericNaN() :
-                     scale * sqrt(sumsq);
-     res.setDouble(result);
-     return true;
- }
- 
- double
--js::math_trunc_uncached(double x)
-+js::math_trunc_impl(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::trunc(x);
- }
- 
- float
- js::math_truncf_impl(float x)
- {
-@@ -1065,77 +1065,77 @@ js::math_truncf_impl(float x)
- 
- bool
- js::math_trunc_handle(JSContext* cx, HandleValue v, MutableHandleValue r)
- {
-     double x;
-     if (!ToNumber(cx, v, &x))
-         return false;
- 
--    r.setNumber(math_trunc_uncached(x));
-+    r.setNumber(math_trunc_impl(x));
-     return true;
- }
- 
- bool
- js::math_trunc(JSContext* cx, unsigned argc, Value* vp)
- {
-     CallArgs args = CallArgsFromVp(argc, vp);
-     if (args.length() == 0) {
-         args.rval().setNaN();
-         return true;
-     }
- 
-     return math_trunc_handle(cx, args[0], args.rval());
- }
- 
- double
--js::math_sign_uncached(double x)
-+js::math_sign_impl(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
- 
-     if (mozilla::IsNaN(x))
-         return GenericNaN();
- 
-     return x == 0 ? x : x < 0 ? -1 : 1;
- }
- 
- bool
- js::math_sign_handle(JSContext* cx, HandleValue v, MutableHandleValue r)
- {
-     double x;
-     if (!ToNumber(cx, v, &x))
-         return false;
- 
--    r.setNumber(math_sign_uncached(x));
-+    r.setNumber(math_sign_impl(x));
-     return true;
- }
- 
- bool
- js::math_sign(JSContext* cx, unsigned argc, Value* vp)
- {
-     CallArgs args = CallArgsFromVp(argc, vp);
-     if (args.length() == 0) {
-         args.rval().setNaN();
-         return true;
-     }
- 
-     return math_sign_handle(cx, args[0], args.rval());
- }
- 
- double
--js::math_cbrt_uncached(double x)
-+js::math_cbrt_impl(double x)
- {
-     AutoUnsafeCallWithABI unsafe;
-     return fdlibm::cbrt(x);
- }
- 
- bool
- js::math_cbrt(JSContext* cx, unsigned argc, Value* vp)
- {
--    return math_function<math_cbrt_uncached>(cx, argc, vp);
-+    return math_function<math_cbrt_impl>(cx, argc, vp);
- }
- 
- static bool
- math_toSource(JSContext* cx, unsigned argc, Value* vp)
- {
-     CallArgs args = CallArgsFromVp(argc, vp);
-     args.rval().setString(cx->names().Math);
-     return true;
-diff --git a/js/src/jsmath.h b/js/src/jsmath.h
---- a/js/src/jsmath.h
-+++ b/js/src/jsmath.h
-@@ -57,33 +57,33 @@ math_max(JSContext* cx, unsigned argc, j
- 
- extern double
- math_min_impl(double x, double y);
- 
- extern bool
- math_min(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern double
--math_sqrt_uncached(double x);
-+math_sqrt_impl(double x);
- 
- extern bool
- math_sqrt_handle(JSContext* cx, js::HandleValue number, js::MutableHandleValue result);
- 
- extern bool
- math_sqrt(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern bool
- math_pow(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern bool
- minmax_impl(JSContext* cx, bool max, js::HandleValue a, js::HandleValue b,
-             js::MutableHandleValue res);
- 
- extern void
--math_sincos_uncached(double x, double *sin, double *cos);
-+math_sincos_impl(double x, double *sin, double *cos);
- 
- extern bool
- math_imul_handle(JSContext* cx, HandleValue lhs, HandleValue rhs, MutableHandleValue res);
- 
- extern bool
- math_imul(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern bool
-@@ -94,47 +94,47 @@ RoundFloat32(JSContext* cx, HandleValue 
- 
- extern bool
- math_fround(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern bool
- math_log(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern double
--math_log_uncached(double x);
-+math_log_impl(double x);
- 
- extern bool
- math_log_handle(JSContext* cx, HandleValue val, MutableHandleValue res);
- 
- extern bool
- math_sin(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern double
--math_sin_uncached(double x);
-+math_sin_impl(double x);
- 
- extern bool
- math_sin_handle(JSContext* cx, HandleValue val, MutableHandleValue res);
- 
- extern bool
- math_cos(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern double
--math_cos_uncached(double x);
-+math_cos_impl(double x);
- 
- extern bool
- math_exp(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern double
--math_exp_uncached(double x);
-+math_exp_impl(double x);
- 
- extern bool
- math_tan(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern double
--math_tan_uncached(double x);
-+math_tan_impl(double x);
- 
- extern bool
- math_log10(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern bool
- math_log2(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern bool
-@@ -199,29 +199,29 @@ math_atan2_handle(JSContext* cx, HandleV
- 
- extern bool
- math_atan2(JSContext* cx, unsigned argc, Value* vp);
- 
- extern double
- ecmaAtan2(double x, double y);
- 
- extern double
--math_atan_uncached(double x);
-+math_atan_impl(double x);
- 
- extern bool
- math_atan(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern double
--math_asin_uncached(double x);
-+math_asin_impl(double x);
- 
- extern bool
- math_asin(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern double
--math_acos_uncached(double x);
-+math_acos_impl(double x);
- 
- extern bool
- math_acos(JSContext* cx, unsigned argc, js::Value* vp);
- 
- extern bool
- math_ceil_handle(JSContext* cx, HandleValue value, MutableHandleValue res);
- 
- extern bool
-@@ -259,58 +259,58 @@ math_roundf_impl(float x);
- 
- extern double
- powi(double x, int32_t y);
- 
- extern double
- ecmaPow(double x, double y);
- 
- extern double
--math_log10_uncached(double x);
-+math_log10_impl(double x);
- 
- extern double
--math_log2_uncached(double x);
-+math_log2_impl(double x);
- 
- extern double
--math_log1p_uncached(double x);
-+math_log1p_impl(double x);
- 
- extern double
--math_expm1_uncached(double x);
-+math_expm1_impl(double x);
- 
- extern double
--math_cosh_uncached(double x);
-+math_cosh_impl(double x);
- 
- extern double
--math_sinh_uncached(double x);
-+math_sinh_impl(double x);
- 
- extern double
--math_tanh_uncached(double x);
-+math_tanh_impl(double x);
- 
- extern double
--math_acosh_uncached(double x);
-+math_acosh_impl(double x);
- 
- extern double
--math_asinh_uncached(double x);
-+math_asinh_impl(double x);
- 
- extern double
--math_atanh_uncached(double x);
-+math_atanh_impl(double x);
- 
- extern double
--math_trunc_uncached(double x);
-+math_trunc_impl(double x);
- 
- extern float
- math_truncf_impl(float x);
- 
- extern bool
- math_trunc_handle(JSContext* cx, HandleValue v, MutableHandleValue r);
- 
- extern double
--math_sign_uncached(double x);
-+math_sign_impl(double x);
- 
- extern bool
- math_sign_handle(JSContext* cx, HandleValue v, MutableHandleValue r);
- 
- extern double
--math_cbrt_uncached(double x);
-+math_cbrt_impl(double x);
- 
- } /* namespace js */
- 
- #endif /* jsmath_h */
-diff --git a/js/src/wasm/WasmBuiltins.cpp b/js/src/wasm/WasmBuiltins.cpp
---- a/js/src/wasm/WasmBuiltins.cpp
-+++ b/js/src/wasm/WasmBuiltins.cpp
-@@ -806,18 +806,18 @@ wasm::NeedsBuiltinThunk(SymbolicAddress 
-     _(math_cbrt, MathCbrt)
- 
- #define FOR_EACH_BINARY_NATIVE(_)  \
-     _(ecmaAtan2, MathATan2)        \
-     _(ecmaHypot, MathHypot)        \
-     _(ecmaPow, MathPow)            \
- 
- #define DEFINE_UNARY_FLOAT_WRAPPER(func, _)        \
--    static float func##_uncached_f32(float x) {    \
--        return float(func##_uncached(double(x)));  \
-+    static float func##_impl_f32(float x) {    \
-+        return float(func##_impl(double(x)));  \
-     }
- 
- #define DEFINE_BINARY_FLOAT_WRAPPER(func, _)       \
-     static float func##_f32(float x, float y) {    \
-         return float(func(double(x), double(y)));  \
-     }
- 
- FOR_EACH_UNARY_NATIVE(DEFINE_UNARY_FLOAT_WRAPPER)
-@@ -855,18 +855,18 @@ PopulateTypedNatives(TypedNativeToFuncPt
-         return false;
- 
- #define ADD_OVERLOAD(funcName, native, abiType)                                           \
-     if (!typedNatives->putNew(TypedNative(InlinableNative::native, abiType),              \
-                               FuncCast(funcName, abiType)))                               \
-         return false;
- 
- #define ADD_UNARY_OVERLOADS(funcName, native)                                             \
--    ADD_OVERLOAD(funcName##_uncached, native, Args_Double_Double)                         \
--    ADD_OVERLOAD(funcName##_uncached_f32, native, Args_Float32_Float32)
-+    ADD_OVERLOAD(funcName##_impl, native, Args_Double_Double)                         \
-+    ADD_OVERLOAD(funcName##_impl_f32, native, Args_Float32_Float32)
- 
- #define ADD_BINARY_OVERLOADS(funcName, native)                                            \
-     ADD_OVERLOAD(funcName, native, Args_Double_DoubleDouble)                              \
-     ADD_OVERLOAD(funcName##_f32, native, Args_Float32_Float32Float32)
- 
-     FOR_EACH_UNARY_NATIVE(ADD_UNARY_OVERLOADS)
-     FOR_EACH_BINARY_NATIVE(ADD_BINARY_OVERLOADS)
- 

frg/work-js/mozilla-release/patches/mozilla-central-push_426517.patch

@@ -1,415 +0,0 @@
-# HG changeset patch
-# User Masayuki Nakano <masayuki@d-toybox.com>
-# Date 1531476113 -32400
-#      Fri Jul 13 19:01:53 2018 +0900
-# Node ID de078de9ee987f4931f40ac8d5d9e8633a14748a
-# Parent  9f8a3c2f65288f91b94223b69c63da6612ebee55
-Bug 1475461 - part 2: Make callers of PLDHashTable::Search() const methods if possible r=Ehsan
-
-Some callers of PLDHashTable::Search() use const_cast, some others are not
-const methods due to non-const PLDHashTable::Search().
-
-This patch removes const_cast from the former and mark some methods of the
-latter const.
-
-MozReview-Commit-ID: C8ayoi7mXc1
-
-diff --git a/dom/commandhandler/nsCommandParams.cpp b/dom/commandhandler/nsCommandParams.cpp
---- a/dom/commandhandler/nsCommandParams.cpp
-+++ b/dom/commandhandler/nsCommandParams.cpp
-@@ -290,18 +290,17 @@ nsCommandParams::RemoveValue(const char*
- {
-   mValuesHash.Remove((void*)aName);
-   return NS_OK;
- }
- 
- nsCommandParams::HashEntry*
- nsCommandParams::GetNamedEntry(const char* aName) const
- {
--  return static_cast<HashEntry*>(
--           const_cast<PLDHashTable&>(mValuesHash).Search((void*)aName));
-+  return static_cast<HashEntry*>(mValuesHash.Search((void*)aName));
- }
- 
- nsCommandParams::HashEntry*
- nsCommandParams::GetOrMakeEntry(const char* aName, uint8_t aEntryType)
- {
-   auto foundEntry = static_cast<HashEntry*>(mValuesHash.Search((void*)aName));
-   if (foundEntry) { // reuse existing entry
-     foundEntry->Reset(aEntryType);
-diff --git a/js/xpconnect/src/XPCMaps.h b/js/xpconnect/src/XPCMaps.h
---- a/js/xpconnect/src/XPCMaps.h
-+++ b/js/xpconnect/src/XPCMaps.h
-@@ -107,17 +107,17 @@ public:
-     struct Entry : public PLDHashEntryHdr
-     {
-         nsISupports*      key;
-         XPCWrappedNative* value;
-     };
- 
-     static Native2WrappedNativeMap* newMap(int length);
- 
--    inline XPCWrappedNative* Find(nsISupports* Obj)
-+    inline XPCWrappedNative* Find(nsISupports* Obj) const
-     {
-         MOZ_ASSERT(Obj,"bad param");
-         auto entry = static_cast<Entry*>(mTable.Search(Obj));
-         return entry ? entry->value : nullptr;
-     }
- 
-     inline XPCWrappedNative* Add(XPCWrappedNative* wrapper)
-     {
-@@ -173,17 +173,17 @@ public:
-         const nsIID*         key;
-         nsXPCWrappedJSClass* value;
- 
-         static const struct PLDHashTableOps sOps;
-     };
- 
-     static IID2WrappedJSClassMap* newMap(int length);
- 
--    inline nsXPCWrappedJSClass* Find(REFNSIID iid)
-+    inline nsXPCWrappedJSClass* Find(REFNSIID iid) const
-     {
-         auto entry = static_cast<Entry*>(mTable.Search(&iid));
-         return entry ? entry->value : nullptr;
-     }
- 
-     inline nsXPCWrappedJSClass* Add(nsXPCWrappedJSClass* clazz)
-     {
-         MOZ_ASSERT(clazz,"bad param");
-@@ -227,17 +227,17 @@ public:
-         const nsIID*        key;
-         XPCNativeInterface* value;
- 
-         static const struct PLDHashTableOps sOps;
-     };
- 
-     static IID2NativeInterfaceMap* newMap(int length);
- 
--    inline XPCNativeInterface* Find(REFNSIID iid)
-+    inline XPCNativeInterface* Find(REFNSIID iid) const
-     {
-         auto entry = static_cast<Entry*>(mTable.Search(&iid));
-         return entry ? entry->value : nullptr;
-     }
- 
-     inline XPCNativeInterface* Add(XPCNativeInterface* iface)
-     {
-         MOZ_ASSERT(iface,"bad param");
-@@ -285,17 +285,17 @@ public:
- 
-     private:
-         static bool Match(const PLDHashEntryHdr* aEntry, const void* aKey);
-         static void Clear(PLDHashTable* aTable, PLDHashEntryHdr* aEntry);
-     };
- 
-     static ClassInfo2NativeSetMap* newMap(int length);
- 
--    inline XPCNativeSet* Find(nsIClassInfo* info)
-+    inline XPCNativeSet* Find(nsIClassInfo* info) const
-     {
-         auto entry = static_cast<Entry*>(mTable.Search(info));
-         return entry ? entry->value : nullptr;
-     }
- 
-     inline XPCNativeSet* Add(nsIClassInfo* info, XPCNativeSet* set)
-     {
-         MOZ_ASSERT(info,"bad param");
-@@ -338,17 +338,17 @@ public:
-     struct Entry : public PLDHashEntryHdr
-     {
-         nsIClassInfo*          key;
-         XPCWrappedNativeProto* value;
-     };
- 
-     static ClassInfo2WrappedNativeProtoMap* newMap(int length);
- 
--    inline XPCWrappedNativeProto* Find(nsIClassInfo* info)
-+    inline XPCWrappedNativeProto* Find(nsIClassInfo* info) const
-     {
-         auto entry = static_cast<Entry*>(mTable.Search(info));
-         return entry ? entry->value : nullptr;
-     }
- 
-     inline XPCWrappedNativeProto* Add(nsIClassInfo* info, XPCWrappedNativeProto* proto)
-     {
-         MOZ_ASSERT(info,"bad param");
-@@ -396,17 +396,17 @@ public:
-         static bool
-         Match(const PLDHashEntryHdr* entry, const void* key);
- 
-         static const struct PLDHashTableOps sOps;
-     };
- 
-     static NativeSetMap* newMap(int length);
- 
--    inline XPCNativeSet* Find(XPCNativeSetKey* key)
-+    inline XPCNativeSet* Find(XPCNativeSetKey* key) const
-     {
-         auto entry = static_cast<Entry*>(mTable.Search(key));
-         return entry ? entry->key_value : nullptr;
-     }
- 
-     inline XPCNativeSet* Add(const XPCNativeSetKey* key, XPCNativeSet* set)
-     {
-         MOZ_ASSERT(key, "bad param");
-diff --git a/netwerk/cache/nsCacheEntry.cpp b/netwerk/cache/nsCacheEntry.cpp
---- a/netwerk/cache/nsCacheEntry.cpp
-+++ b/netwerk/cache/nsCacheEntry.cpp
-@@ -417,17 +417,17 @@ nsCacheEntryHashTable::Shutdown()
-     if (initialized) {
-         table.ClearAndPrepareForLength(kInitialTableLength);
-         initialized = false;
-     }
- }
- 
- 
- nsCacheEntry *
--nsCacheEntryHashTable::GetEntry( const nsCString * key)
-+nsCacheEntryHashTable::GetEntry( const nsCString * key) const
- {
-     NS_ASSERTION(initialized, "nsCacheEntryHashTable not initialized");
-     if (!initialized)  return nullptr;
- 
-     PLDHashEntryHdr *hashEntry = table.Search(key);
-     return hashEntry ? ((nsCacheEntryHashTableEntry *)hashEntry)->cacheEntry
-                      : nullptr;
- }
-diff --git a/netwerk/cache/nsCacheEntry.h b/netwerk/cache/nsCacheEntry.h
---- a/netwerk/cache/nsCacheEntry.h
-+++ b/netwerk/cache/nsCacheEntry.h
-@@ -265,17 +265,17 @@ class nsCacheEntryHashTable
- {
- public:
-     nsCacheEntryHashTable();
-     ~nsCacheEntryHashTable();
- 
-     void          Init();
-     void          Shutdown();
- 
--    nsCacheEntry *GetEntry( const nsCString * key);
-+    nsCacheEntry *GetEntry( const nsCString * key) const;
-     nsresult      AddEntry( nsCacheEntry *entry);
-     void          RemoveEntry( nsCacheEntry *entry);
- 
-     PLDHashTable::Iterator Iter();
- 
- private:
-     // PLDHashTable operation callbacks
-     static PLDHashNumber  HashKey(const void *key);
-diff --git a/netwerk/cache/nsDiskCacheBinding.cpp b/netwerk/cache/nsDiskCacheBinding.cpp
---- a/netwerk/cache/nsDiskCacheBinding.cpp
-+++ b/netwerk/cache/nsDiskCacheBinding.cpp
-@@ -187,17 +187,17 @@ nsDiskCacheBindery::CreateBinding(nsCach
-     return binding;
- }
- 
- 
- /**
-  *  FindActiveEntry :  to find active colliding entry so we can doom it
-  */
- nsDiskCacheBinding *
--nsDiskCacheBindery::FindActiveBinding(uint32_t  hashNumber)
-+nsDiskCacheBindery::FindActiveBinding(uint32_t  hashNumber) const
- {
-     NS_ASSERTION(initialized, "nsDiskCacheBindery not initialized");
-     // find hash entry for key
-     auto hashEntry = static_cast<HashTableEntry*>
-         (table.Search((void*)(uintptr_t)hashNumber));
-     if (!hashEntry) return nullptr;
- 
-     // walk list looking for active entry
-diff --git a/netwerk/cache/nsDiskCacheBinding.h b/netwerk/cache/nsDiskCacheBinding.h
---- a/netwerk/cache/nsDiskCacheBinding.h
-+++ b/netwerk/cache/nsDiskCacheBinding.h
-@@ -98,17 +98,17 @@ public:
-     ~nsDiskCacheBindery();
- 
-     void                    Init();
-     void                    Reset();
- 
-     nsDiskCacheBinding *    CreateBinding(nsCacheEntry *       entry,
-                                           nsDiskCacheRecord *  record);
- 
--    nsDiskCacheBinding *    FindActiveBinding(uint32_t  hashNumber);
-+    nsDiskCacheBinding *    FindActiveBinding(uint32_t  hashNumber) const;
-     void                    RemoveBinding(nsDiskCacheBinding * binding);
-     bool                    ActiveBindings();
- 
-     size_t                 SizeOfExcludingThis(mozilla::MallocSizeOf aMallocSizeOf);
- 
- private:
-     nsresult                AddBinding(nsDiskCacheBinding * binding);
- 
-diff --git a/uriloader/base/nsDocLoader.cpp b/uriloader/base/nsDocLoader.cpp
---- a/uriloader/base/nsDocLoader.cpp
-+++ b/uriloader/base/nsDocLoader.cpp
-@@ -1391,17 +1391,18 @@ nsresult nsDocLoader::AddRequestInfo(nsI
-   return NS_OK;
- }
- 
- void nsDocLoader::RemoveRequestInfo(nsIRequest *aRequest)
- {
-   mRequestInfoHash.Remove(aRequest);
- }
- 
--nsDocLoader::nsRequestInfo* nsDocLoader::GetRequestInfo(nsIRequest* aRequest)
-+nsDocLoader::nsRequestInfo*
-+nsDocLoader::GetRequestInfo(nsIRequest* aRequest) const
- {
-   return static_cast<nsRequestInfo*>(mRequestInfoHash.Search(aRequest));
- }
- 
- void nsDocLoader::ClearRequestInfoHash(void)
- {
-   mRequestInfoHash.Clear();
- }
-diff --git a/uriloader/base/nsDocLoader.h b/uriloader/base/nsDocLoader.h
---- a/uriloader/base/nsDocLoader.h
-+++ b/uriloader/base/nsDocLoader.h
-@@ -320,17 +320,17 @@ private:
-     // loadgroup has no active requests before checking for "real" emptiness if
-     // aFlushLayout is true.
-     void DocLoaderIsEmpty(bool aFlushLayout);
- 
-     int64_t GetMaxTotalProgress();
- 
-     nsresult AddRequestInfo(nsIRequest* aRequest);
-     void RemoveRequestInfo(nsIRequest* aRequest);
--    nsRequestInfo *GetRequestInfo(nsIRequest* aRequest);
-+    nsRequestInfo *GetRequestInfo(nsIRequest* aRequest) const;
-     void ClearRequestInfoHash();
-     int64_t CalculateMaxProgress();
- ///    void DumpChannelInfo(void);
- 
-     // used to clear our internal progress state between loads...
-     void ClearInternalProgress();
- };
- 
-diff --git a/xpcom/base/nsCycleCollector.cpp b/xpcom/base/nsCycleCollector.cpp
---- a/xpcom/base/nsCycleCollector.cpp
-+++ b/xpcom/base/nsCycleCollector.cpp
-@@ -951,17 +951,17 @@ public:
-     n += mWeakMaps.ShallowSizeOfExcludingThis(aMallocSizeOf);
- 
-     n += mPtrToNodeMap.ShallowSizeOfExcludingThis(aMallocSizeOf);
- 
-     return n;
-   }
- 
- private:
--  PtrToNodeEntry* FindNodeEntry(void* aPtr)
-+  PtrToNodeEntry* FindNodeEntry(void* aPtr) const
-   {
-     return static_cast<PtrToNodeEntry*>(mPtrToNodeMap.Search(aPtr));
-   }
- };
- 
- PtrInfo*
- CCGraph::FindNode(void* aPtr)
- {
-diff --git a/xpcom/ds/nsAtomTable.cpp b/xpcom/ds/nsAtomTable.cpp
---- a/xpcom/ds/nsAtomTable.cpp
-+++ b/xpcom/ds/nsAtomTable.cpp
-@@ -238,17 +238,17 @@ class nsAtomSubTable
-   friend class nsAtomTable;
-   Mutex mLock;
-   PLDHashTable mTable;
-   nsAtomSubTable();
-   void GCLocked(GCKind aKind);
-   void AddSizeOfExcludingThisLocked(MallocSizeOf aMallocSizeOf,
-                                     AtomsSizes& aSizes);
- 
--  AtomTableEntry* Search(AtomTableKey& aKey)
-+  AtomTableEntry* Search(AtomTableKey& aKey) const
-   {
-     mLock.AssertCurrentThreadOwns();
-     return static_cast<AtomTableEntry*>(mTable.Search(&aKey));
-   }
- 
-   AtomTableEntry* Add(AtomTableKey& aKey)
-   {
-     mLock.AssertCurrentThreadOwns();
-diff --git a/xpcom/ds/nsStaticNameTable.cpp b/xpcom/ds/nsStaticNameTable.cpp
---- a/xpcom/ds/nsStaticNameTable.cpp
-+++ b/xpcom/ds/nsStaticNameTable.cpp
-@@ -158,30 +158,30 @@ nsStaticCaseInsensitiveNameTable::~nsSta
-   for (uint32_t index = 0; index < mNameTable.EntryCount(); index++) {
-     mNameArray[index].~nsDependentCString();
-   }
-   free((void*)mNameArray);
-   MOZ_COUNT_DTOR(nsStaticCaseInsensitiveNameTable);
- }
- 
- int32_t
--nsStaticCaseInsensitiveNameTable::Lookup(const nsACString& aName)
-+nsStaticCaseInsensitiveNameTable::Lookup(const nsACString& aName) const
- {
-   NS_ASSERTION(mNameArray, "not inited");
- 
-   const nsCString& str = PromiseFlatCString(aName);
- 
-   NameTableKey key(mNameArray, &str);
-   auto entry = static_cast<NameTableEntry*>(mNameTable.Search(&key));
- 
-   return entry ? entry->mIndex : nsStaticCaseInsensitiveNameTable::NOT_FOUND;
- }
- 
- int32_t
--nsStaticCaseInsensitiveNameTable::Lookup(const nsAString& aName)
-+nsStaticCaseInsensitiveNameTable::Lookup(const nsAString& aName) const
- {
-   NS_ASSERTION(mNameArray, "not inited");
- 
-   const nsString& str = PromiseFlatString(aName);
- 
-   NameTableKey key(mNameArray, &str);
-   auto entry = static_cast<NameTableEntry*>(mNameTable.Search(&key));
- 
-diff --git a/xpcom/ds/nsStaticNameTable.h b/xpcom/ds/nsStaticNameTable.h
---- a/xpcom/ds/nsStaticNameTable.h
-+++ b/xpcom/ds/nsStaticNameTable.h
-@@ -28,18 +28,18 @@
-  *    as long as this table object - typically a static string array.
-  */
- 
- class nsStaticCaseInsensitiveNameTable
- {
- public:
-   enum { NOT_FOUND = -1 };
- 
--  int32_t          Lookup(const nsACString& aName);
--  int32_t          Lookup(const nsAString& aName);
-+  int32_t          Lookup(const nsACString& aName) const;
-+  int32_t          Lookup(const nsAString& aName) const;
-   const nsCString& GetStringValue(int32_t aIndex);
- 
-   nsStaticCaseInsensitiveNameTable(const char* const aNames[], int32_t aLength);
-   ~nsStaticCaseInsensitiveNameTable();
- 
- private:
-   nsDependentCString*   mNameArray;
-   PLDHashTable          mNameTable;
-diff --git a/xpcom/ds/nsTHashtable.h b/xpcom/ds/nsTHashtable.h
---- a/xpcom/ds/nsTHashtable.h
-+++ b/xpcom/ds/nsTHashtable.h
-@@ -127,17 +127,17 @@ public:
-    * Get the entry associated with a key.
-    * @param     aKey the key to retrieve
-    * @return    pointer to the entry class, if the key exists; nullptr if the
-    *            key doesn't exist
-    */
-   EntryType* GetEntry(KeyType aKey) const
-   {
-     return static_cast<EntryType*>(
--      const_cast<PLDHashTable*>(&mTable)->Search(EntryType::KeyToPointer(aKey)));
-+      mTable.Search(EntryType::KeyToPointer(aKey)));
-   }
- 
-   /**
-    * Return true if an entry for the given key exists, false otherwise.
-    * @param     aKey the key to retrieve
-    * @return    true if the key exists, false if the key doesn't exist
-    */
-   bool Contains(KeyType aKey) const { return !!GetEntry(aKey); }

frg/work-js/mozilla-release/patches/mozilla-central-push_426724.patch

@@ -1,72 +0,0 @@
-# HG changeset patch
-# User David Major <dmajor@mozilla.com>
-# Date 1531750203 14400
-#      Mon Jul 16 10:10:03 2018 -0400
-# Node ID 79c65f8a1a07050b577f1c43ff6aef8eb638bf49
-# Parent  b6233f4d899c3da8143461b19201baf69e63595f
-Bug 1475650: Use llvm-lib when linking with lld-link. r=froydnj
-
-diff --git a/js/src/old-configure.in b/js/src/old-configure.in
---- a/js/src/old-configure.in
-+++ b/js/src/old-configure.in
-@@ -672,18 +672,26 @@ case "$target" in
-         WIN32_GUI_EXE_LDFLAGS=-mwindows
-     else
-         TARGET_COMPILER_ABI=msvc
-         HOST_CC='$(CC)'
-         HOST_CXX='$(CXX)'
-         if test "$AS_BIN"; then
-             AS="$(basename "$AS_BIN")"
-         fi
--        AR='lib'
--        AR_FLAGS='-NOLOGO -OUT:$@'
-+        case "$LINKER" in
-+        *lld*)
-+            AR='llvm-lib'
-+            AR_FLAGS='-llvmlibthin -out:$@'
-+            ;;
-+        *)
-+            AR='lib'
-+            AR_FLAGS='-NOLOGO -OUT:$@'
-+            ;;
-+        esac
-         AR_EXTRACT=
-         RANLIB='echo not_ranlib'
-         STRIP='echo not_strip'
-         PKG_SKIP_STRIP=1
-         MKSHLIB='$(LINKER) -NOLOGO -DLL -OUT:$@ -PDB:$(LINK_PDBFILE) $(DSO_LDOPTS)'
-         MKCSHLIB='$(LINKER) -NOLOGO -DLL -OUT:$@ -PDB:$(LINK_PDBFILE) $(DSO_LDOPTS)'
-         WIN32_SUBSYSTEM_VERSION=6.01
-         WIN32_CONSOLE_EXE_LDFLAGS=-SUBSYSTEM:CONSOLE,$WIN32_SUBSYSTEM_VERSION
-diff --git a/old-configure.in b/old-configure.in
---- a/old-configure.in
-+++ b/old-configure.in
-@@ -884,18 +884,26 @@ case "$target" in
-             # Silence problematic clang warnings
-             CXXFLAGS="$CXXFLAGS -Wno-incompatible-ms-struct"
-         fi
-     else
-         TARGET_COMPILER_ABI=msvc
-         if test "$AS_BIN"; then
-             AS="$(basename "$AS_BIN")"
-         fi
--        AR='lib'
--        AR_FLAGS='-NOLOGO -OUT:$@'
-+        case "$LINKER" in
-+        *lld*)
-+            AR='llvm-lib'
-+            AR_FLAGS='-llvmlibthin -out:$@'
-+            ;;
-+        *)
-+            AR='lib'
-+            AR_FLAGS='-NOLOGO -OUT:$@'
-+            ;;
-+        esac
-         AR_EXTRACT=
-         RANLIB='echo not_ranlib'
-         STRIP='echo not_strip'
-         PKG_SKIP_STRIP=1
-         MKSHLIB='$(LINKER) -NOLOGO -DLL -OUT:$@ -PDB:$(LINK_PDBFILE) $(DSO_LDOPTS)'
-         MKCSHLIB='$(LINKER) -NOLOGO -DLL -OUT:$@ -PDB:$(LINK_PDBFILE) $(DSO_LDOPTS)'
-         WIN32_SUBSYSTEM_VERSION=6.01
-         WIN32_CONSOLE_EXE_LDFLAGS=-SUBSYSTEM:CONSOLE,$WIN32_SUBSYSTEM_VERSION

frg/work-js/mozilla-release/patches/mozilla-central-push_426726.patch

@@ -1,76 +0,0 @@
-# HG changeset patch
-# User Benjamin Bouvier <benj@benj.me>
-# Date 1531491927 -7200
-#      Fri Jul 13 16:25:27 2018 +0200
-# Node ID 05c90ce07575bbaa9311d772240f43ff016aada7
-# Parent  4f6dddb432dae4dae41036ec23eb911f09200e09
-Bug 1473956: Report OOM when a wasm Global's cell couldn't be allocated; r=jseward
-
-diff --git a/js/src/wasm/WasmJS.cpp b/js/src/wasm/WasmJS.cpp
---- a/js/src/wasm/WasmJS.cpp
-+++ b/js/src/wasm/WasmJS.cpp
-@@ -2170,37 +2170,41 @@ WasmGlobalObject::trace(JSTracer* trc, J
-         MOZ_CRASH("Ref NYI");
-     }
- }
- 
- /* static */ void
- WasmGlobalObject::finalize(FreeOp*, JSObject* obj)
- {
-     WasmGlobalObject* global = reinterpret_cast<WasmGlobalObject*>(obj);
--    js_delete(global->cell());
-+    if (!global->isNewborn())
-+        js_delete(global->cell());
- }
- 
- /* static */ WasmGlobalObject*
- WasmGlobalObject::create(JSContext* cx, HandleVal hval, bool isMutable)
- {
-     RootedObject proto(cx, &cx->global()->getPrototype(JSProto_WasmGlobal).toObject());
- 
-     AutoSetNewObjectMetadata metadata(cx);
-     RootedWasmGlobalObject obj(cx, NewObjectWithGivenProto<WasmGlobalObject>(cx, proto));
-     if (!obj)
-         return nullptr;
- 
-+    MOZ_ASSERT(obj->isNewborn());
-     MOZ_ASSERT(obj->isTenured(), "assumed by set_global post barriers");
- 
-     // It's simpler to initialize the cell after the object has been created,
-     // to avoid needing to root the cell before the object creation.
- 
-     Cell* cell = js_new<Cell>();
--    if (!cell)
-+    if (!cell) {
-+        ReportOutOfMemory(cx);
-         return nullptr;
-+    }
- 
-     const Val& val = hval.get();
-     switch (val.type().code()) {
-       case ValType::I32:
-         cell->i32 = val.i32();
-         break;
-       case ValType::I64:
-         cell->i64 = val.i64();
-diff --git a/js/src/wasm/WasmJS.h b/js/src/wasm/WasmJS.h
---- a/js/src/wasm/WasmJS.h
-+++ b/js/src/wasm/WasmJS.h
-@@ -149,16 +149,17 @@ class WasmGlobalObject : public NativeOb
-     static const unsigned RESERVED_SLOTS = 3;
-     static const Class class_;
-     static const JSPropertySpec properties[];
-     static const JSFunctionSpec methods[];
-     static const JSFunctionSpec static_methods[];
-     static bool construct(JSContext*, unsigned, Value*);
- 
-     static WasmGlobalObject* create(JSContext* cx, wasm::HandleVal value, bool isMutable);
-+    bool isNewborn() { return getReservedSlot(CELL_SLOT).isUndefined(); }
- 
-     wasm::ValType type() const;
-     void val(wasm::MutableHandleVal outval) const;
-     bool isMutable() const;
-     // value() will MOZ_CRASH if the type is int64
-     Value value(JSContext* cx) const;
-     Cell* cell() const;
- };

frg/work-js/mozilla-release/patches/mozilla-central-push_426937.patch

@@ -1,104 +0,0 @@
-# HG changeset patch
-# User Jon Coppeard <jcoppeard@mozilla.com>
-# Date 1531829142 -3600
-#      Tue Jul 17 13:05:42 2018 +0100
-# Node ID 2513d9eaeed829ee70f6fc75de67fb58da241708
-# Parent  14374e92fb0ec4ae5fdbbdbda4889b3de6bf5fc5
-Bug 1476012 - Remove dependency of jit/IonAnalysis.h on jit/MIR.h r=nbp
-
-diff --git a/js/src/jit/IonAnalysis.h b/js/src/jit/IonAnalysis.h
---- a/js/src/jit/IonAnalysis.h
-+++ b/js/src/jit/IonAnalysis.h
-@@ -5,23 +5,26 @@
-  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
- 
- #ifndef jit_IonAnalysis_h
- #define jit_IonAnalysis_h
- 
- // This file declares various analysis passes that operate on MIR.
- 
- #include "jit/JitAllocPolicy.h"
--#include "jit/MIR.h"
- 
- namespace js {
- namespace jit {
- 
-+class MBasicBlock;
-+class MCompare;
-+class MDefinition;
- class MIRGenerator;
- class MIRGraph;
-+class MTest;
- 
- MOZ_MUST_USE bool
- PruneUnusedBranches(MIRGenerator* mir, MIRGraph& graph);
- 
- MOZ_MUST_USE bool
- FoldTests(MIRGraph& graph);
- 
- MOZ_MUST_USE bool
-@@ -94,18 +97,16 @@ void
- AssertExtendedGraphCoherency(MIRGraph& graph, bool underValueNumberer = false, bool force = false);
- 
- MOZ_MUST_USE bool
- EliminateRedundantChecks(MIRGraph& graph);
- 
- MOZ_MUST_USE bool
- AddKeepAliveInstructions(MIRGraph& graph);
- 
--class MDefinition;
--
- // Simple linear sum of the form 'n' or 'x + n'.
- struct SimpleLinearSum
- {
-     MDefinition* term;
-     int32_t constant;
- 
-     SimpleLinearSum(MDefinition* term, int32_t constant)
-         : term(term), constant(constant)
-diff --git a/js/src/jit/IonTypes.h b/js/src/jit/IonTypes.h
---- a/js/src/jit/IonTypes.h
-+++ b/js/src/jit/IonTypes.h
-@@ -929,12 +929,17 @@ enum class RoundingMode {
- // limit has a generous buffer before the real end of the native stack.
- static const uint32_t MAX_UNCHECKED_LEAF_FRAME_SIZE = 64;
- 
- // Truncating conversion modifiers.
- typedef uint32_t TruncFlags;
- static const TruncFlags TRUNC_UNSIGNED   = TruncFlags(1) << 0;
- static const TruncFlags TRUNC_SATURATING = TruncFlags(1) << 1;
- 
-+enum BranchDirection {
-+    FALSE_BRANCH,
-+    TRUE_BRANCH
-+};
-+
- } // namespace jit
- } // namespace js
- 
- #endif /* jit_IonTypes_h */
-diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
---- a/js/src/jit/MIR.h
-+++ b/js/src/jit/MIR.h
-@@ -3149,21 +3149,16 @@ class MGoto
-     MBasicBlock* target() {
-         return getSuccessor(0);
-     }
-     AliasSet getAliasSet() const override {
-         return AliasSet::None();
-     }
- };
- 
--enum BranchDirection {
--    FALSE_BRANCH,
--    TRUE_BRANCH
--};
--
- static inline BranchDirection
- NegateBranchDirection(BranchDirection dir)
- {
-     return (dir == FALSE_BRANCH) ? TRUE_BRANCH : FALSE_BRANCH;
- }
- 
- // Tests if the input instruction evaluates to true or false, and jumps to the
- // start of a corresponding basic block.

frg/work-js/mozilla-release/patches/mozilla-central-push_426938.patch

@@ -1,177 +0,0 @@
-# HG changeset patch
-# User Jon Coppeard <jcoppeard@mozilla.com>
-# Date 1531829163 -3600
-#      Tue Jul 17 13:06:03 2018 +0100
-# Node ID 01ab0200841fb028d3579f19996e9f16081657d4
-# Parent  2513d9eaeed829ee70f6fc75de67fb58da241708
-Bug 1476012 - Remove dependency of jit/BaselineJit.h on jit/MacroAssembler.h r=nbp
-
-diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctions.cpp
---- a/js/src/builtin/TestingFunctions.cpp
-+++ b/js/src/builtin/TestingFunctions.cpp
-@@ -33,16 +33,17 @@
- #include "frontend/TokenStream.h"
- #include "irregexp/RegExpAST.h"
- #include "irregexp/RegExpEngine.h"
- #include "irregexp/RegExpParser.h"
- #endif
- #include "gc/Heap.h"
- #include "jit/BaselineJIT.h"
- #include "jit/InlinableNatives.h"
-+#include "jit/JitRealm.h"
- #include "js/Debug.h"
- #include "js/HashTable.h"
- #include "js/StructuredClone.h"
- #include "js/UbiNode.h"
- #include "js/UbiNodeBreadthFirst.h"
- #include "js/UbiNodeShortestPaths.h"
- #include "js/UniquePtr.h"
- #include "js/Vector.h"
-diff --git a/js/src/gc/Nursery.cpp b/js/src/gc/Nursery.cpp
---- a/js/src/gc/Nursery.cpp
-+++ b/js/src/gc/Nursery.cpp
-@@ -14,16 +14,17 @@
- 
- #include "jsutil.h"
- 
- #include "gc/FreeOp.h"
- #include "gc/GCInternals.h"
- #include "gc/Memory.h"
- #include "gc/PublicIterators.h"
- #include "jit/JitFrames.h"
-+#include "jit/JitRealm.h"
- #include "vm/ArrayObject.h"
- #include "vm/Debugger.h"
- #if defined(DEBUG)
- #include "vm/EnvironmentObject.h"
- #endif
- #include "vm/JSONPrinter.h"
- #include "vm/Realm.h"
- #include "vm/Time.h"
-diff --git a/js/src/jit/BaselineJIT.h b/js/src/jit/BaselineJIT.h
---- a/js/src/jit/BaselineJIT.h
-+++ b/js/src/jit/BaselineJIT.h
-@@ -7,17 +7,17 @@
- #ifndef jit_BaselineJIT_h
- #define jit_BaselineJIT_h
- 
- #include "mozilla/MemoryReporting.h"
- 
- #include "ds/LifoAlloc.h"
- #include "jit/Bailouts.h"
- #include "jit/IonCode.h"
--#include "jit/MacroAssembler.h"
-+#include "vm/EnvironmentObject.h"
- #include "vm/JSContext.h"
- #include "vm/Realm.h"
- #include "vm/TraceLogging.h"
- 
- namespace js {
- namespace jit {
- 
- class StackValue;
-diff --git a/js/src/jit/Jit.cpp b/js/src/jit/Jit.cpp
---- a/js/src/jit/Jit.cpp
-+++ b/js/src/jit/Jit.cpp
-@@ -4,16 +4,17 @@
-  * License, v. 2.0. If a copy of the MPL was not distributed with this
-  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
- 
- #include "jit/Jit.h"
- 
- #include "jit/BaselineJIT.h"
- #include "jit/Ion.h"
- #include "jit/JitCommon.h"
-+#include "jit/JitRealm.h"
- #include "vm/Interpreter.h"
- 
- #include "vm/Stack-inl.h"
- 
- using namespace js;
- using namespace js::jit;
- 
- static EnterJitStatus
-diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
---- a/js/src/jsapi.cpp
-+++ b/js/src/jsapi.cpp
-@@ -52,16 +52,17 @@
- #include "frontend/FullParseHandler.h"  // for JS_BufferIsCompileableUnit
- #include "frontend/Parser.h" // for JS_BufferIsCompileableUnit
- #include "gc/FreeOp.h"
- #include "gc/Marking.h"
- #include "gc/Policy.h"
- #include "gc/PublicIterators.h"
- #include "gc/WeakMap.h"
- #include "jit/JitCommon.h"
-+#include "jit/JitSpewer.h"
- #include "js/CharacterEncoding.h"
- #include "js/Conversions.h"
- #include "js/Date.h"
- #include "js/Initialization.h"
- #include "js/Proxy.h"
- #include "js/SliceBudget.h"
- #include "js/StructuredClone.h"
- #include "js/Utility.h"
-diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
---- a/js/src/vm/JSScript.cpp
-+++ b/js/src/vm/JSScript.cpp
-@@ -30,16 +30,17 @@
- 
- #include "frontend/BytecodeCompiler.h"
- #include "frontend/BytecodeEmitter.h"
- #include "frontend/SharedContext.h"
- #include "gc/FreeOp.h"
- #include "jit/BaselineJIT.h"
- #include "jit/Ion.h"
- #include "jit/IonCode.h"
-+#include "jit/JitRealm.h"
- #include "js/MemoryMetrics.h"
- #include "js/Printf.h"
- #include "js/UniquePtr.h"
- #include "js/Utility.h"
- #include "js/Wrapper.h"
- #include "util/StringBuffer.h"
- #include "util/Text.h"
- #include "vm/ArgumentsObject.h"
-diff --git a/js/src/vm/RegExpObject.cpp b/js/src/vm/RegExpObject.cpp
---- a/js/src/vm/RegExpObject.cpp
-+++ b/js/src/vm/RegExpObject.cpp
-@@ -16,16 +16,17 @@
- 
- #include "builtin/RegExp.h"
- #include "frontend/TokenStream.h"
- #include "gc/HashUtil.h"
- #ifdef DEBUG
- #include "irregexp/RegExpBytecode.h"
- #endif
- #include "irregexp/RegExpParser.h"
-+#include "jit/VMFunctions.h"
- #include "util/StringBuffer.h"
- #include "vm/MatchPairs.h"
- #include "vm/RegExpStatics.h"
- #include "vm/StringType.h"
- #include "vm/TraceLogging.h"
- #ifdef DEBUG
- #include "util/Unicode.h"
- #endif
-diff --git a/js/src/wasm/WasmInstance.cpp b/js/src/wasm/WasmInstance.cpp
---- a/js/src/wasm/WasmInstance.cpp
-+++ b/js/src/wasm/WasmInstance.cpp
-@@ -17,16 +17,17 @@
-  */
- 
- #include "wasm/WasmInstance.h"
- 
- #include "jit/AtomicOperations.h"
- #include "jit/BaselineJIT.h"
- #include "jit/InlinableNatives.h"
- #include "jit/JitCommon.h"
-+#include "jit/JitRealm.h"
- #include "wasm/WasmBuiltins.h"
- #include "wasm/WasmModule.h"
- 
- #include "gc/StoreBuffer-inl.h"
- #include "vm/ArrayBufferObject-inl.h"
- #include "vm/JSObject-inl.h"
- 
- using namespace js;

frg/work-js/mozilla-release/patches/mozilla-central-push_426939.patch

@@ -1,2086 +0,0 @@
-# HG changeset patch
-# User Jon Coppeard <jcoppeard@mozilla.com>
-# Date 1531829193 -3600
-#      Tue Jul 17 13:06:33 2018 +0100
-# Node ID bedc90c72ee31e496b2aa178b159026941b08613
-# Parent  01ab0200841fb028d3579f19996e9f16081657d4
-Bug 1476012 - Split SIMD constant definitions out into builtin/SIMDConstants.h r=bbouvier
-
-diff --git a/js/src/builtin/SIMD.h b/js/src/builtin/SIMD.h
---- a/js/src/builtin/SIMD.h
-+++ b/js/src/builtin/SIMD.h
-@@ -5,953 +5,30 @@
-  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
- 
- #ifndef builtin_SIMD_h
- #define builtin_SIMD_h
- 
- #include "jsapi.h"
- #include "NamespaceImports.h"
- 
--#include "builtin/TypedObjectConstants.h"
-+#include "builtin/SIMDConstants.h"
- #include "jit/IonTypes.h"
- #include "js/Conversions.h"
- 
- /*
-  * JS SIMD functions.
-  * Spec matching polyfill:
-  * https://github.com/tc39/ecmascript_simd/blob/master/src/ecmascript_simd.js
-  */
- 
--// Bool8x16.
--#define BOOL8X16_UNARY_FUNCTION_LIST(V)                                               \
--  V(not, (UnaryFunc<Bool8x16, LogicalNot, Bool8x16>), 1)                              \
--  V(check, (UnaryFunc<Bool8x16, Identity, Bool8x16>), 1)                              \
--  V(splat, (FuncSplat<Bool8x16>), 1)                                                  \
--  V(allTrue, (AllTrue<Bool8x16>), 1)                                                  \
--  V(anyTrue, (AnyTrue<Bool8x16>), 1)
--
--#define BOOL8X16_BINARY_FUNCTION_LIST(V)                                              \
--  V(extractLane, (ExtractLane<Bool8x16>), 2)                                          \
--  V(and, (BinaryFunc<Bool8x16, And, Bool8x16>), 2)                                    \
--  V(or, (BinaryFunc<Bool8x16, Or, Bool8x16>), 2)                                      \
--  V(xor, (BinaryFunc<Bool8x16, Xor, Bool8x16>), 2)                                    \
--
--#define BOOL8X16_TERNARY_FUNCTION_LIST(V)                                             \
--  V(replaceLane, (ReplaceLane<Bool8x16>), 3)
--
--#define BOOL8X16_FUNCTION_LIST(V)                                                     \
--  BOOL8X16_UNARY_FUNCTION_LIST(V)                                                     \
--  BOOL8X16_BINARY_FUNCTION_LIST(V)                                                    \
--  BOOL8X16_TERNARY_FUNCTION_LIST(V)
--
--// Bool 16x8.
--#define BOOL16X8_UNARY_FUNCTION_LIST(V)                                               \
--  V(not, (UnaryFunc<Bool16x8, LogicalNot, Bool16x8>), 1)                              \
--  V(check, (UnaryFunc<Bool16x8, Identity, Bool16x8>), 1)                              \
--  V(splat, (FuncSplat<Bool16x8>), 1)                                                  \
--  V(allTrue, (AllTrue<Bool16x8>), 1)                                                  \
--  V(anyTrue, (AnyTrue<Bool16x8>), 1)
--
--#define BOOL16X8_BINARY_FUNCTION_LIST(V)                                              \
--  V(extractLane, (ExtractLane<Bool16x8>), 2)                                          \
--  V(and, (BinaryFunc<Bool16x8, And, Bool16x8>), 2)                                    \
--  V(or, (BinaryFunc<Bool16x8, Or, Bool16x8>), 2)                                      \
--  V(xor, (BinaryFunc<Bool16x8, Xor, Bool16x8>), 2)                                    \
--
--#define BOOL16X8_TERNARY_FUNCTION_LIST(V)                                             \
--  V(replaceLane, (ReplaceLane<Bool16x8>), 3)
--
--#define BOOL16X8_FUNCTION_LIST(V)                                                     \
--  BOOL16X8_UNARY_FUNCTION_LIST(V)                                                     \
--  BOOL16X8_BINARY_FUNCTION_LIST(V)                                                    \
--  BOOL16X8_TERNARY_FUNCTION_LIST(V)
--
--// Bool32x4.
--#define BOOL32X4_UNARY_FUNCTION_LIST(V)                                               \
--  V(not, (UnaryFunc<Bool32x4, LogicalNot, Bool32x4>), 1)                              \
--  V(check, (UnaryFunc<Bool32x4, Identity, Bool32x4>), 1)                              \
--  V(splat, (FuncSplat<Bool32x4>), 1)                                                  \
--  V(allTrue, (AllTrue<Bool32x4>), 1)                                                  \
--  V(anyTrue, (AnyTrue<Bool32x4>), 1)
--
--#define BOOL32X4_BINARY_FUNCTION_LIST(V)                                              \
--  V(extractLane, (ExtractLane<Bool32x4>), 2)                                          \
--  V(and, (BinaryFunc<Bool32x4, And, Bool32x4>), 2)                                    \
--  V(or, (BinaryFunc<Bool32x4, Or, Bool32x4>), 2)                                      \
--  V(xor, (BinaryFunc<Bool32x4, Xor, Bool32x4>), 2)                                    \
--
--#define BOOL32X4_TERNARY_FUNCTION_LIST(V)                                             \
--  V(replaceLane, (ReplaceLane<Bool32x4>), 3)
--
--#define BOOL32X4_FUNCTION_LIST(V)                                                     \
--  BOOL32X4_UNARY_FUNCTION_LIST(V)                                                     \
--  BOOL32X4_BINARY_FUNCTION_LIST(V)                                                    \
--  BOOL32X4_TERNARY_FUNCTION_LIST(V)
--
--// Bool64x2.
--#define BOOL64X2_UNARY_FUNCTION_LIST(V)                                               \
--  V(not, (UnaryFunc<Bool64x2, LogicalNot, Bool64x2>), 1)                              \
--  V(check, (UnaryFunc<Bool64x2, Identity, Bool64x2>), 1)                              \
--  V(splat, (FuncSplat<Bool64x2>), 1)                                                  \
--  V(allTrue, (AllTrue<Bool64x2>), 1)                                                  \
--  V(anyTrue, (AnyTrue<Bool64x2>), 1)
--
--#define BOOL64X2_BINARY_FUNCTION_LIST(V)                                              \
--  V(extractLane, (ExtractLane<Bool64x2>), 2)                                          \
--  V(and, (BinaryFunc<Bool64x2, And, Bool64x2>), 2)                                    \
--  V(or, (BinaryFunc<Bool64x2, Or, Bool64x2>), 2)                                      \
--  V(xor, (BinaryFunc<Bool64x2, Xor, Bool64x2>), 2)                                    \
--
--#define BOOL64X2_TERNARY_FUNCTION_LIST(V)                                             \
--  V(replaceLane, (ReplaceLane<Bool64x2>), 3)
--
--#define BOOL64X2_FUNCTION_LIST(V)                                                     \
--  BOOL64X2_UNARY_FUNCTION_LIST(V)                                                     \
--  BOOL64X2_BINARY_FUNCTION_LIST(V)                                                    \
--  BOOL64X2_TERNARY_FUNCTION_LIST(V)
--
--// Float32x4.
--#define FLOAT32X4_UNARY_FUNCTION_LIST(V)                                              \
--  V(abs, (UnaryFunc<Float32x4, Abs, Float32x4>), 1)                                   \
--  V(check, (UnaryFunc<Float32x4, Identity, Float32x4>), 1)                            \
--  V(fromFloat64x2Bits, (FuncConvertBits<Float64x2, Float32x4>), 1)                    \
--  V(fromInt8x16Bits,   (FuncConvertBits<Int8x16,   Float32x4>), 1)                    \
--  V(fromInt16x8Bits,   (FuncConvertBits<Int16x8,   Float32x4>), 1)                    \
--  V(fromInt32x4,       (FuncConvert<Int32x4,       Float32x4>), 1)                    \
--  V(fromInt32x4Bits,   (FuncConvertBits<Int32x4,   Float32x4>), 1)                    \
--  V(fromUint8x16Bits,  (FuncConvertBits<Uint8x16,  Float32x4>), 1)                    \
--  V(fromUint16x8Bits,  (FuncConvertBits<Uint16x8,  Float32x4>), 1)                    \
--  V(fromUint32x4,      (FuncConvert<Uint32x4,      Float32x4>), 1)                    \
--  V(fromUint32x4Bits,  (FuncConvertBits<Uint32x4,  Float32x4>), 1)                    \
--  V(neg, (UnaryFunc<Float32x4, Neg, Float32x4>), 1)                                   \
--  V(reciprocalApproximation, (UnaryFunc<Float32x4, RecApprox, Float32x4>), 1)         \
--  V(reciprocalSqrtApproximation, (UnaryFunc<Float32x4, RecSqrtApprox, Float32x4>), 1) \
--  V(splat, (FuncSplat<Float32x4>), 1)                                                 \
--  V(sqrt, (UnaryFunc<Float32x4, Sqrt, Float32x4>), 1)
--
--#define FLOAT32X4_BINARY_FUNCTION_LIST(V)                                             \
--  V(add, (BinaryFunc<Float32x4, Add, Float32x4>), 2)                                  \
--  V(div, (BinaryFunc<Float32x4, Div, Float32x4>), 2)                                  \
--  V(equal, (CompareFunc<Float32x4, Equal, Bool32x4>), 2)                              \
--  V(extractLane, (ExtractLane<Float32x4>), 2)                                         \
--  V(greaterThan, (CompareFunc<Float32x4, GreaterThan, Bool32x4>), 2)                  \
--  V(greaterThanOrEqual, (CompareFunc<Float32x4, GreaterThanOrEqual, Bool32x4>), 2)    \
--  V(lessThan, (CompareFunc<Float32x4, LessThan, Bool32x4>), 2)                        \
--  V(lessThanOrEqual, (CompareFunc<Float32x4, LessThanOrEqual, Bool32x4>), 2)          \
--  V(load,  (Load<Float32x4, 4>), 2)                                                   \
--  V(load3, (Load<Float32x4, 3>), 2)                                                   \
--  V(load2, (Load<Float32x4, 2>), 2)                                                   \
--  V(load1, (Load<Float32x4, 1>), 2)                                                   \
--  V(max, (BinaryFunc<Float32x4, Maximum, Float32x4>), 2)                              \
--  V(maxNum, (BinaryFunc<Float32x4, MaxNum, Float32x4>), 2)                            \
--  V(min, (BinaryFunc<Float32x4, Minimum, Float32x4>), 2)                              \
--  V(minNum, (BinaryFunc<Float32x4, MinNum, Float32x4>), 2)                            \
--  V(mul, (BinaryFunc<Float32x4, Mul, Float32x4>), 2)                                  \
--  V(notEqual, (CompareFunc<Float32x4, NotEqual, Bool32x4>), 2)                        \
--  V(sub, (BinaryFunc<Float32x4, Sub, Float32x4>), 2)
--
--#define FLOAT32X4_TERNARY_FUNCTION_LIST(V)                                            \
--  V(replaceLane, (ReplaceLane<Float32x4>), 3)                                         \
--  V(select, (Select<Float32x4, Bool32x4>), 3)                                         \
--  V(store,  (Store<Float32x4, 4>), 3)                                                 \
--  V(store3, (Store<Float32x4, 3>), 3)                                                 \
--  V(store2, (Store<Float32x4, 2>), 3)                                                 \
--  V(store1, (Store<Float32x4, 1>), 3)
--
--#define FLOAT32X4_SHUFFLE_FUNCTION_LIST(V)                                            \
--  V(swizzle, Swizzle<Float32x4>, 5)                                                   \
--  V(shuffle, Shuffle<Float32x4>, 6)
--
--#define FLOAT32X4_FUNCTION_LIST(V)                                                    \
--  FLOAT32X4_UNARY_FUNCTION_LIST(V)                                                    \
--  FLOAT32X4_BINARY_FUNCTION_LIST(V)                                                   \
--  FLOAT32X4_TERNARY_FUNCTION_LIST(V)                                                  \
--  FLOAT32X4_SHUFFLE_FUNCTION_LIST(V)
--
--// Float64x2.
--#define FLOAT64X2_UNARY_FUNCTION_LIST(V)                                              \
--  V(abs, (UnaryFunc<Float64x2, Abs, Float64x2>), 1)                                   \
--  V(check, (UnaryFunc<Float64x2, Identity, Float64x2>), 1)                            \
--  V(fromFloat32x4Bits, (FuncConvertBits<Float32x4, Float64x2>), 1)                    \
--  V(fromInt8x16Bits,   (FuncConvertBits<Int8x16,   Float64x2>), 1)                    \
--  V(fromInt16x8Bits,   (FuncConvertBits<Int16x8,   Float64x2>), 1)                    \
--  V(fromInt32x4Bits,   (FuncConvertBits<Int32x4,   Float64x2>), 1)                    \
--  V(fromUint8x16Bits,  (FuncConvertBits<Uint8x16,  Float64x2>), 1)                    \
--  V(fromUint16x8Bits,  (FuncConvertBits<Uint16x8,  Float64x2>), 1)                    \
--  V(fromUint32x4Bits,  (FuncConvertBits<Uint32x4,  Float64x2>), 1)                    \
--  V(neg, (UnaryFunc<Float64x2, Neg, Float64x2>), 1)                                   \
--  V(reciprocalApproximation, (UnaryFunc<Float64x2, RecApprox, Float64x2>), 1)         \
--  V(reciprocalSqrtApproximation, (UnaryFunc<Float64x2, RecSqrtApprox, Float64x2>), 1) \
--  V(splat, (FuncSplat<Float64x2>), 1)                                                 \
--  V(sqrt, (UnaryFunc<Float64x2, Sqrt, Float64x2>), 1)
--
--#define FLOAT64X2_BINARY_FUNCTION_LIST(V)                                             \
--  V(add, (BinaryFunc<Float64x2, Add, Float64x2>), 2)                                  \
--  V(div, (BinaryFunc<Float64x2, Div, Float64x2>), 2)                                  \
--  V(equal, (CompareFunc<Float64x2, Equal, Bool64x2>), 2)                              \
--  V(extractLane, (ExtractLane<Float64x2>), 2)                                         \
--  V(greaterThan, (CompareFunc<Float64x2, GreaterThan, Bool64x2>), 2)                  \
--  V(greaterThanOrEqual, (CompareFunc<Float64x2, GreaterThanOrEqual, Bool64x2>), 2)    \
--  V(lessThan, (CompareFunc<Float64x2, LessThan, Bool64x2>), 2)                        \
--  V(lessThanOrEqual, (CompareFunc<Float64x2, LessThanOrEqual, Bool64x2>), 2)          \
--  V(load,  (Load<Float64x2, 2>), 2)                                                   \
--  V(load1, (Load<Float64x2, 1>), 2)                                                   \
--  V(max, (BinaryFunc<Float64x2, Maximum, Float64x2>), 2)                              \
--  V(maxNum, (BinaryFunc<Float64x2, MaxNum, Float64x2>), 2)                            \
--  V(min, (BinaryFunc<Float64x2, Minimum, Float64x2>), 2)                              \
--  V(minNum, (BinaryFunc<Float64x2, MinNum, Float64x2>), 2)                            \
--  V(mul, (BinaryFunc<Float64x2, Mul, Float64x2>), 2)                                  \
--  V(notEqual, (CompareFunc<Float64x2, NotEqual, Bool64x2>), 2)                        \
--  V(sub, (BinaryFunc<Float64x2, Sub, Float64x2>), 2)
--
--#define FLOAT64X2_TERNARY_FUNCTION_LIST(V)                                            \
--  V(replaceLane, (ReplaceLane<Float64x2>), 3)                                         \
--  V(select, (Select<Float64x2, Bool64x2>), 3)                                         \
--  V(store,  (Store<Float64x2, 2>), 3)                                                 \
--  V(store1, (Store<Float64x2, 1>), 3)
--
--#define FLOAT64X2_SHUFFLE_FUNCTION_LIST(V)                                            \
--  V(swizzle, Swizzle<Float64x2>, 3)                                                   \
--  V(shuffle, Shuffle<Float64x2>, 4)
--
--#define FLOAT64X2_FUNCTION_LIST(V)                                                    \
--  FLOAT64X2_UNARY_FUNCTION_LIST(V)                                                    \
--  FLOAT64X2_BINARY_FUNCTION_LIST(V)                                                   \
--  FLOAT64X2_TERNARY_FUNCTION_LIST(V)                                                  \
--  FLOAT64X2_SHUFFLE_FUNCTION_LIST(V)
--
--// Int8x16.
--#define INT8X16_UNARY_FUNCTION_LIST(V)                                                \
--  V(check, (UnaryFunc<Int8x16, Identity, Int8x16>), 1)                                \
--  V(fromFloat32x4Bits, (FuncConvertBits<Float32x4, Int8x16>), 1)                      \
--  V(fromFloat64x2Bits, (FuncConvertBits<Float64x2, Int8x16>), 1)                      \
--  V(fromInt16x8Bits,   (FuncConvertBits<Int16x8,   Int8x16>), 1)                      \
--  V(fromInt32x4Bits,   (FuncConvertBits<Int32x4,   Int8x16>), 1)                      \
--  V(fromUint8x16Bits,  (FuncConvertBits<Uint8x16,  Int8x16>), 1)                      \
--  V(fromUint16x8Bits,  (FuncConvertBits<Uint16x8,  Int8x16>), 1)                      \
--  V(fromUint32x4Bits,  (FuncConvertBits<Uint32x4,  Int8x16>), 1)                      \
--  V(neg, (UnaryFunc<Int8x16, Neg, Int8x16>), 1)                                       \
--  V(not, (UnaryFunc<Int8x16, Not, Int8x16>), 1)                                       \
--  V(splat, (FuncSplat<Int8x16>), 1)
--
--#define INT8X16_BINARY_FUNCTION_LIST(V)                                               \
--  V(add, (BinaryFunc<Int8x16, Add, Int8x16>), 2)                                      \
--  V(addSaturate, (BinaryFunc<Int8x16, AddSaturate, Int8x16>), 2)                      \
--  V(and, (BinaryFunc<Int8x16, And, Int8x16>), 2)                                      \
--  V(equal, (CompareFunc<Int8x16, Equal, Bool8x16>), 2)                                \
--  V(extractLane, (ExtractLane<Int8x16>), 2)                                           \
--  V(greaterThan, (CompareFunc<Int8x16, GreaterThan, Bool8x16>), 2)                    \
--  V(greaterThanOrEqual, (CompareFunc<Int8x16, GreaterThanOrEqual, Bool8x16>), 2)      \
--  V(lessThan, (CompareFunc<Int8x16, LessThan, Bool8x16>), 2)                          \
--  V(lessThanOrEqual, (CompareFunc<Int8x16, LessThanOrEqual, Bool8x16>), 2)            \
--  V(load, (Load<Int8x16, 16>), 2)                                                     \
--  V(mul, (BinaryFunc<Int8x16, Mul, Int8x16>), 2)                                      \
--  V(notEqual, (CompareFunc<Int8x16, NotEqual, Bool8x16>), 2)                          \
--  V(or, (BinaryFunc<Int8x16, Or, Int8x16>), 2)                                        \
--  V(sub, (BinaryFunc<Int8x16, Sub, Int8x16>), 2)                                      \
--  V(subSaturate, (BinaryFunc<Int8x16, SubSaturate, Int8x16>), 2)                      \
--  V(shiftLeftByScalar, (BinaryScalar<Int8x16, ShiftLeft>), 2)                         \
--  V(shiftRightByScalar, (BinaryScalar<Int8x16, ShiftRightArithmetic>), 2)             \
--  V(xor, (BinaryFunc<Int8x16, Xor, Int8x16>), 2)
--
--#define INT8X16_TERNARY_FUNCTION_LIST(V)                                              \
--  V(replaceLane, (ReplaceLane<Int8x16>), 3)                                           \
--  V(select, (Select<Int8x16, Bool8x16>), 3)                                           \
--  V(store, (Store<Int8x16, 16>), 3)
--
--#define INT8X16_SHUFFLE_FUNCTION_LIST(V)                                              \
--  V(swizzle, Swizzle<Int8x16>, 17)                                                    \
--  V(shuffle, Shuffle<Int8x16>, 18)
--
--#define INT8X16_FUNCTION_LIST(V)                                                      \
--  INT8X16_UNARY_FUNCTION_LIST(V)                                                      \
--  INT8X16_BINARY_FUNCTION_LIST(V)                                                     \
--  INT8X16_TERNARY_FUNCTION_LIST(V)                                                    \
--  INT8X16_SHUFFLE_FUNCTION_LIST(V)
--
--// Uint8x16.
--#define UINT8X16_UNARY_FUNCTION_LIST(V)                                               \
--  V(check, (UnaryFunc<Uint8x16, Identity, Uint8x16>), 1)                              \
--  V(fromFloat32x4Bits, (FuncConvertBits<Float32x4, Uint8x16>), 1)                     \
--  V(fromFloat64x2Bits, (FuncConvertBits<Float64x2, Uint8x16>), 1)                     \
--  V(fromInt8x16Bits,   (FuncConvertBits<Int8x16,   Uint8x16>), 1)                     \
--  V(fromInt16x8Bits,   (FuncConvertBits<Int16x8,   Uint8x16>), 1)                     \
--  V(fromInt32x4Bits,   (FuncConvertBits<Int32x4,   Uint8x16>), 1)                     \
--  V(fromUint16x8Bits,  (FuncConvertBits<Uint16x8,  Uint8x16>), 1)                     \
--  V(fromUint32x4Bits,  (FuncConvertBits<Uint32x4,  Uint8x16>), 1)                     \
--  V(neg, (UnaryFunc<Uint8x16, Neg, Uint8x16>), 1)                                     \
--  V(not, (UnaryFunc<Uint8x16, Not, Uint8x16>), 1)                                     \
--  V(splat, (FuncSplat<Uint8x16>), 1)
--
--#define UINT8X16_BINARY_FUNCTION_LIST(V)                                              \
--  V(add, (BinaryFunc<Uint8x16, Add, Uint8x16>), 2)                                    \
--  V(addSaturate, (BinaryFunc<Uint8x16, AddSaturate, Uint8x16>), 2)                    \
--  V(and, (BinaryFunc<Uint8x16, And, Uint8x16>), 2)                                    \
--  V(equal, (CompareFunc<Uint8x16, Equal, Bool8x16>), 2)                               \
--  V(extractLane, (ExtractLane<Uint8x16>), 2)                                          \
--  V(greaterThan, (CompareFunc<Uint8x16, GreaterThan, Bool8x16>), 2)                   \
--  V(greaterThanOrEqual, (CompareFunc<Uint8x16, GreaterThanOrEqual, Bool8x16>), 2)     \
--  V(lessThan, (CompareFunc<Uint8x16, LessThan, Bool8x16>), 2)                         \
--  V(lessThanOrEqual, (CompareFunc<Uint8x16, LessThanOrEqual, Bool8x16>), 2)           \
--  V(load, (Load<Uint8x16, 16>), 2)                                                    \
--  V(mul, (BinaryFunc<Uint8x16, Mul, Uint8x16>), 2)                                    \
--  V(notEqual, (CompareFunc<Uint8x16, NotEqual, Bool8x16>), 2)                         \
--  V(or, (BinaryFunc<Uint8x16, Or, Uint8x16>), 2)                                      \
--  V(sub, (BinaryFunc<Uint8x16, Sub, Uint8x16>), 2)                                    \
--  V(subSaturate, (BinaryFunc<Uint8x16, SubSaturate, Uint8x16>), 2)                    \
--  V(shiftLeftByScalar, (BinaryScalar<Uint8x16, ShiftLeft>), 2)                        \
--  V(shiftRightByScalar, (BinaryScalar<Uint8x16, ShiftRightLogical>), 2)               \
--  V(xor, (BinaryFunc<Uint8x16, Xor, Uint8x16>), 2)
--
--#define UINT8X16_TERNARY_FUNCTION_LIST(V)                                             \
--  V(replaceLane, (ReplaceLane<Uint8x16>), 3)                                          \
--  V(select, (Select<Uint8x16, Bool8x16>), 3)                                          \
--  V(store, (Store<Uint8x16, 16>), 3)
--
--#define UINT8X16_SHUFFLE_FUNCTION_LIST(V)                                             \
--  V(swizzle, Swizzle<Uint8x16>, 17)                                                   \
--  V(shuffle, Shuffle<Uint8x16>, 18)
--
--#define UINT8X16_FUNCTION_LIST(V)                                                     \
--  UINT8X16_UNARY_FUNCTION_LIST(V)                                                     \
--  UINT8X16_BINARY_FUNCTION_LIST(V)                                                    \
--  UINT8X16_TERNARY_FUNCTION_LIST(V)                                                   \
--  UINT8X16_SHUFFLE_FUNCTION_LIST(V)
--
--// Int16x8.
--#define INT16X8_UNARY_FUNCTION_LIST(V)                                                \
--  V(check, (UnaryFunc<Int16x8, Identity, Int16x8>), 1)                                \
--  V(fromFloat32x4Bits, (FuncConvertBits<Float32x4, Int16x8>), 1)                      \
--  V(fromFloat64x2Bits, (FuncConvertBits<Float64x2, Int16x8>), 1)                      \
--  V(fromInt8x16Bits,   (FuncConvertBits<Int8x16,   Int16x8>), 1)                      \
--  V(fromInt32x4Bits,   (FuncConvertBits<Int32x4,   Int16x8>), 1)                      \
--  V(fromUint8x16Bits,  (FuncConvertBits<Uint8x16,  Int16x8>), 1)                      \
--  V(fromUint16x8Bits,  (FuncConvertBits<Uint16x8,  Int16x8>), 1)                      \
--  V(fromUint32x4Bits,  (FuncConvertBits<Uint32x4,  Int16x8>), 1)                      \
--  V(neg, (UnaryFunc<Int16x8, Neg, Int16x8>), 1)                                       \
--  V(not, (UnaryFunc<Int16x8, Not, Int16x8>), 1)                                       \
--  V(splat, (FuncSplat<Int16x8>), 1)
--
--#define INT16X8_BINARY_FUNCTION_LIST(V)                                               \
--  V(add, (BinaryFunc<Int16x8, Add, Int16x8>), 2)                                      \
--  V(addSaturate, (BinaryFunc<Int16x8, AddSaturate, Int16x8>), 2)                      \
--  V(and, (BinaryFunc<Int16x8, And, Int16x8>), 2)                                      \
--  V(equal, (CompareFunc<Int16x8, Equal, Bool16x8>), 2)                                \
--  V(extractLane, (ExtractLane<Int16x8>), 2)                                           \
--  V(greaterThan, (CompareFunc<Int16x8, GreaterThan, Bool16x8>), 2)                    \
--  V(greaterThanOrEqual, (CompareFunc<Int16x8, GreaterThanOrEqual, Bool16x8>), 2)      \
--  V(lessThan, (CompareFunc<Int16x8, LessThan, Bool16x8>), 2)                          \
--  V(lessThanOrEqual, (CompareFunc<Int16x8, LessThanOrEqual, Bool16x8>), 2)            \
--  V(load, (Load<Int16x8, 8>), 2)                                                      \
--  V(mul, (BinaryFunc<Int16x8, Mul, Int16x8>), 2)                                      \
--  V(notEqual, (CompareFunc<Int16x8, NotEqual, Bool16x8>), 2)                          \
--  V(or, (BinaryFunc<Int16x8, Or, Int16x8>), 2)                                        \
--  V(sub, (BinaryFunc<Int16x8, Sub, Int16x8>), 2)                                      \
--  V(subSaturate, (BinaryFunc<Int16x8, SubSaturate, Int16x8>), 2)                      \
--  V(shiftLeftByScalar, (BinaryScalar<Int16x8, ShiftLeft>), 2)                         \
--  V(shiftRightByScalar, (BinaryScalar<Int16x8, ShiftRightArithmetic>), 2)             \
--  V(xor, (BinaryFunc<Int16x8, Xor, Int16x8>), 2)
--
--#define INT16X8_TERNARY_FUNCTION_LIST(V)                                              \
--  V(replaceLane, (ReplaceLane<Int16x8>), 3)                                           \
--  V(select, (Select<Int16x8, Bool16x8>), 3)                                           \
--  V(store, (Store<Int16x8, 8>), 3)
--
--#define INT16X8_SHUFFLE_FUNCTION_LIST(V)                                              \
--  V(swizzle, Swizzle<Int16x8>, 9)                                                     \
--  V(shuffle, Shuffle<Int16x8>, 10)
--
--#define INT16X8_FUNCTION_LIST(V)                                                      \
--  INT16X8_UNARY_FUNCTION_LIST(V)                                                      \
--  INT16X8_BINARY_FUNCTION_LIST(V)                                                     \
--  INT16X8_TERNARY_FUNCTION_LIST(V)                                                    \
--  INT16X8_SHUFFLE_FUNCTION_LIST(V)
--
--// Uint16x8.
--#define UINT16X8_UNARY_FUNCTION_LIST(V)                                               \
--  V(check, (UnaryFunc<Uint16x8, Identity, Uint16x8>), 1)                              \
--  V(fromFloat32x4Bits, (FuncConvertBits<Float32x4, Uint16x8>), 1)                     \
--  V(fromFloat64x2Bits, (FuncConvertBits<Float64x2, Uint16x8>), 1)                     \
--  V(fromInt8x16Bits,   (FuncConvertBits<Int8x16,   Uint16x8>), 1)                     \
--  V(fromInt16x8Bits,   (FuncConvertBits<Int16x8,   Uint16x8>), 1)                     \
--  V(fromInt32x4Bits,   (FuncConvertBits<Int32x4,   Uint16x8>), 1)                     \
--  V(fromUint8x16Bits,  (FuncConvertBits<Uint8x16,  Uint16x8>), 1)                     \
--  V(fromUint32x4Bits,  (FuncConvertBits<Uint32x4,  Uint16x8>), 1)                     \
--  V(neg, (UnaryFunc<Uint16x8, Neg, Uint16x8>), 1)                                     \
--  V(not, (UnaryFunc<Uint16x8, Not, Uint16x8>), 1)                                     \
--  V(splat, (FuncSplat<Uint16x8>), 1)
--
--#define UINT16X8_BINARY_FUNCTION_LIST(V)                                              \
--  V(add, (BinaryFunc<Uint16x8, Add, Uint16x8>), 2)                                    \
--  V(addSaturate, (BinaryFunc<Uint16x8, AddSaturate, Uint16x8>), 2)                    \
--  V(and, (BinaryFunc<Uint16x8, And, Uint16x8>), 2)                                    \
--  V(equal, (CompareFunc<Uint16x8, Equal, Bool16x8>), 2)                               \
--  V(extractLane, (ExtractLane<Uint16x8>), 2)                                          \
--  V(greaterThan, (CompareFunc<Uint16x8, GreaterThan, Bool16x8>), 2)                   \
--  V(greaterThanOrEqual, (CompareFunc<Uint16x8, GreaterThanOrEqual, Bool16x8>), 2)     \
--  V(lessThan, (CompareFunc<Uint16x8, LessThan, Bool16x8>), 2)                         \
--  V(lessThanOrEqual, (CompareFunc<Uint16x8, LessThanOrEqual, Bool16x8>), 2)           \
--  V(load, (Load<Uint16x8, 8>), 2)                                                     \
--  V(mul, (BinaryFunc<Uint16x8, Mul, Uint16x8>), 2)                                    \
--  V(notEqual, (CompareFunc<Uint16x8, NotEqual, Bool16x8>), 2)                         \
--  V(or, (BinaryFunc<Uint16x8, Or, Uint16x8>), 2)                                      \
--  V(sub, (BinaryFunc<Uint16x8, Sub, Uint16x8>), 2)                                    \
--  V(subSaturate, (BinaryFunc<Uint16x8, SubSaturate, Uint16x8>), 2)                    \
--  V(shiftLeftByScalar, (BinaryScalar<Uint16x8, ShiftLeft>), 2)                        \
--  V(shiftRightByScalar, (BinaryScalar<Uint16x8, ShiftRightLogical>), 2)               \
--  V(xor, (BinaryFunc<Uint16x8, Xor, Uint16x8>), 2)
--
--#define UINT16X8_TERNARY_FUNCTION_LIST(V)                                             \
--  V(replaceLane, (ReplaceLane<Uint16x8>), 3)                                          \
--  V(select, (Select<Uint16x8, Bool16x8>), 3)                                          \
--  V(store, (Store<Uint16x8, 8>), 3)
--
--#define UINT16X8_SHUFFLE_FUNCTION_LIST(V)                                             \
--  V(swizzle, Swizzle<Uint16x8>, 9)                                                    \
--  V(shuffle, Shuffle<Uint16x8>, 10)
--
--#define UINT16X8_FUNCTION_LIST(V)                                                     \
--  UINT16X8_UNARY_FUNCTION_LIST(V)                                                     \
--  UINT16X8_BINARY_FUNCTION_LIST(V)                                                    \
--  UINT16X8_TERNARY_FUNCTION_LIST(V)                                                   \
--  UINT16X8_SHUFFLE_FUNCTION_LIST(V)
--
--// Int32x4.
--#define INT32X4_UNARY_FUNCTION_LIST(V)                                                \
--  V(check, (UnaryFunc<Int32x4, Identity, Int32x4>), 1)                                \
--  V(fromFloat32x4,     (FuncConvert<Float32x4,     Int32x4>), 1)                      \
--  V(fromFloat32x4Bits, (FuncConvertBits<Float32x4, Int32x4>), 1)                      \
--  V(fromFloat64x2Bits, (FuncConvertBits<Float64x2, Int32x4>), 1)                      \
--  V(fromInt8x16Bits,   (FuncConvertBits<Int8x16,   Int32x4>), 1)                      \
--  V(fromInt16x8Bits,   (FuncConvertBits<Int16x8,   Int32x4>), 1)                      \
--  V(fromUint8x16Bits,  (FuncConvertBits<Uint8x16,  Int32x4>), 1)                      \
--  V(fromUint16x8Bits,  (FuncConvertBits<Uint16x8,  Int32x4>), 1)                      \
--  V(fromUint32x4Bits,  (FuncConvertBits<Uint32x4,  Int32x4>), 1)                      \
--  V(neg, (UnaryFunc<Int32x4, Neg, Int32x4>), 1)                                       \
--  V(not, (UnaryFunc<Int32x4, Not, Int32x4>), 1)                                       \
--  V(splat, (FuncSplat<Int32x4>), 0)
--
--#define INT32X4_BINARY_FUNCTION_LIST(V)                                               \
--  V(add, (BinaryFunc<Int32x4, Add, Int32x4>), 2)                                      \
--  V(and, (BinaryFunc<Int32x4, And, Int32x4>), 2)                                      \
--  V(equal, (CompareFunc<Int32x4, Equal, Bool32x4>), 2)                                \
--  V(extractLane, (ExtractLane<Int32x4>), 2)                                           \
--  V(greaterThan, (CompareFunc<Int32x4, GreaterThan, Bool32x4>), 2)                    \
--  V(greaterThanOrEqual, (CompareFunc<Int32x4, GreaterThanOrEqual, Bool32x4>), 2)      \
--  V(lessThan, (CompareFunc<Int32x4, LessThan, Bool32x4>), 2)                          \
--  V(lessThanOrEqual, (CompareFunc<Int32x4, LessThanOrEqual, Bool32x4>), 2)            \
--  V(load,  (Load<Int32x4, 4>), 2)                                                     \
--  V(load3, (Load<Int32x4, 3>), 2)                                                     \
--  V(load2, (Load<Int32x4, 2>), 2)                                                     \
--  V(load1, (Load<Int32x4, 1>), 2)                                                     \
--  V(mul, (BinaryFunc<Int32x4, Mul, Int32x4>), 2)                                      \
--  V(notEqual, (CompareFunc<Int32x4, NotEqual, Bool32x4>), 2)                          \
--  V(or, (BinaryFunc<Int32x4, Or, Int32x4>), 2)                                        \
--  V(sub, (BinaryFunc<Int32x4, Sub, Int32x4>), 2)                                      \
--  V(shiftLeftByScalar, (BinaryScalar<Int32x4, ShiftLeft>), 2)                         \
--  V(shiftRightByScalar, (BinaryScalar<Int32x4, ShiftRightArithmetic>), 2)             \
--  V(xor, (BinaryFunc<Int32x4, Xor, Int32x4>), 2)
--
--#define INT32X4_TERNARY_FUNCTION_LIST(V)                                              \
--  V(replaceLane, (ReplaceLane<Int32x4>), 3)                                           \
--  V(select, (Select<Int32x4, Bool32x4>), 3)                                           \
--  V(store,  (Store<Int32x4, 4>), 3)                                                   \
--  V(store3, (Store<Int32x4, 3>), 3)                                                   \
--  V(store2, (Store<Int32x4, 2>), 3)                                                   \
--  V(store1, (Store<Int32x4, 1>), 3)
--
--#define INT32X4_SHUFFLE_FUNCTION_LIST(V)                                              \
--  V(swizzle, Swizzle<Int32x4>, 5)                                                     \
--  V(shuffle, Shuffle<Int32x4>, 6)
--
--#define INT32X4_FUNCTION_LIST(V)                                                      \
--  INT32X4_UNARY_FUNCTION_LIST(V)                                                      \
--  INT32X4_BINARY_FUNCTION_LIST(V)                                                     \
--  INT32X4_TERNARY_FUNCTION_LIST(V)                                                    \
--  INT32X4_SHUFFLE_FUNCTION_LIST(V)
--
--// Uint32x4.
--#define UINT32X4_UNARY_FUNCTION_LIST(V)                                               \
--  V(check, (UnaryFunc<Uint32x4, Identity, Uint32x4>), 1)                              \
--  V(fromFloat32x4,     (FuncConvert<Float32x4,     Uint32x4>), 1)                     \
--  V(fromFloat32x4Bits, (FuncConvertBits<Float32x4, Uint32x4>), 1)                     \
--  V(fromFloat64x2Bits, (FuncConvertBits<Float64x2, Uint32x4>), 1)                     \
--  V(fromInt8x16Bits,   (FuncConvertBits<Int8x16,   Uint32x4>), 1)                     \
--  V(fromInt16x8Bits,   (FuncConvertBits<Int16x8,   Uint32x4>), 1)                     \
--  V(fromInt32x4Bits,   (FuncConvertBits<Int32x4,   Uint32x4>), 1)                     \
--  V(fromUint8x16Bits,  (FuncConvertBits<Uint8x16,  Uint32x4>), 1)                     \
--  V(fromUint16x8Bits,  (FuncConvertBits<Uint16x8,  Uint32x4>), 1)                     \
--  V(neg, (UnaryFunc<Uint32x4, Neg, Uint32x4>), 1)                                     \
--  V(not, (UnaryFunc<Uint32x4, Not, Uint32x4>), 1)                                     \
--  V(splat, (FuncSplat<Uint32x4>), 0)
--
--#define UINT32X4_BINARY_FUNCTION_LIST(V)                                              \
--  V(add, (BinaryFunc<Uint32x4, Add, Uint32x4>), 2)                                    \
--  V(and, (BinaryFunc<Uint32x4, And, Uint32x4>), 2)                                    \
--  V(equal, (CompareFunc<Uint32x4, Equal, Bool32x4>), 2)                               \
--  V(extractLane, (ExtractLane<Uint32x4>), 2)                                          \
--  V(greaterThan, (CompareFunc<Uint32x4, GreaterThan, Bool32x4>), 2)                   \
--  V(greaterThanOrEqual, (CompareFunc<Uint32x4, GreaterThanOrEqual, Bool32x4>), 2)     \
--  V(lessThan, (CompareFunc<Uint32x4, LessThan, Bool32x4>), 2)                         \
--  V(lessThanOrEqual, (CompareFunc<Uint32x4, LessThanOrEqual, Bool32x4>), 2)           \
--  V(load,  (Load<Uint32x4, 4>), 2)                                                    \
--  V(load3, (Load<Uint32x4, 3>), 2)                                                    \
--  V(load2, (Load<Uint32x4, 2>), 2)                                                    \
--  V(load1, (Load<Uint32x4, 1>), 2)                                                    \
--  V(mul, (BinaryFunc<Uint32x4, Mul, Uint32x4>), 2)                                    \
--  V(notEqual, (CompareFunc<Uint32x4, NotEqual, Bool32x4>), 2)                         \
--  V(or, (BinaryFunc<Uint32x4, Or, Uint32x4>), 2)                                      \
--  V(sub, (BinaryFunc<Uint32x4, Sub, Uint32x4>), 2)                                    \
--  V(shiftLeftByScalar, (BinaryScalar<Uint32x4, ShiftLeft>), 2)                        \
--  V(shiftRightByScalar, (BinaryScalar<Uint32x4, ShiftRightLogical>), 2)               \
--  V(xor, (BinaryFunc<Uint32x4, Xor, Uint32x4>), 2)
--
--#define UINT32X4_TERNARY_FUNCTION_LIST(V)                                             \
--  V(replaceLane, (ReplaceLane<Uint32x4>), 3)                                          \
--  V(select, (Select<Uint32x4, Bool32x4>), 3)                                          \
--  V(store,  (Store<Uint32x4, 4>), 3)                                                  \
--  V(store3, (Store<Uint32x4, 3>), 3)                                                  \
--  V(store2, (Store<Uint32x4, 2>), 3)                                                  \
--  V(store1, (Store<Uint32x4, 1>), 3)
--
--#define UINT32X4_SHUFFLE_FUNCTION_LIST(V)                                             \
--  V(swizzle, Swizzle<Uint32x4>, 5)                                                    \
--  V(shuffle, Shuffle<Uint32x4>, 6)
--
--#define UINT32X4_FUNCTION_LIST(V)                                                     \
--  UINT32X4_UNARY_FUNCTION_LIST(V)                                                     \
--  UINT32X4_BINARY_FUNCTION_LIST(V)                                                    \
--  UINT32X4_TERNARY_FUNCTION_LIST(V)                                                   \
--  UINT32X4_SHUFFLE_FUNCTION_LIST(V)
--
--/*
-- * The FOREACH macros below partition all of the SIMD operations into disjoint
-- * sets.
-- */
--
--// Operations available on all SIMD types. Mixed arity.
--#define FOREACH_COMMON_SIMD_OP(_)     \
--    _(extractLane)                    \
--    _(replaceLane)                    \
--    _(check)                          \
--    _(splat)
--
--// Lanewise operations available on numeric SIMD types.
--// Include lane-wise select here since it is not arithmetic and defined on
--// numeric types too.
--#define FOREACH_LANE_SIMD_OP(_)       \
--    _(select)                         \
--    _(swizzle)                        \
--    _(shuffle)
--
--// Memory operations available on numeric SIMD types.
--#define FOREACH_MEMORY_SIMD_OP(_)     \
--    _(load)                           \
--    _(store)
--
--// Memory operations available on numeric X4 SIMD types.
--#define FOREACH_MEMORY_X4_SIMD_OP(_)  \
--    _(load1)                          \
--    _(load2)                          \
--    _(load3)                          \
--    _(store1)                         \
--    _(store2)                         \
--    _(store3)
--
--// Unary operations on Bool vectors.
--#define FOREACH_BOOL_SIMD_UNOP(_)     \
--    _(allTrue)                        \
--    _(anyTrue)
--
--// Unary bitwise SIMD operators defined on all integer and boolean SIMD types.
--#define FOREACH_BITWISE_SIMD_UNOP(_)  \
--    _(not)
--
--// Binary bitwise SIMD operators defined on all integer and boolean SIMD types.
--#define FOREACH_BITWISE_SIMD_BINOP(_) \
--    _(and)                            \
--    _(or)                             \
--    _(xor)
--
--// Bitwise shifts defined on integer SIMD types.
--#define FOREACH_SHIFT_SIMD_OP(_)      \
--    _(shiftLeftByScalar)              \
--    _(shiftRightByScalar)
--
--// Unary arithmetic operators defined on numeric SIMD types.
--#define FOREACH_NUMERIC_SIMD_UNOP(_)  \
--    _(neg)
--
--// Binary arithmetic operators defined on numeric SIMD types.
--#define FOREACH_NUMERIC_SIMD_BINOP(_) \
--    _(add)                            \
--    _(sub)                            \
--    _(mul)
--
--// Unary arithmetic operators defined on floating point SIMD types.
--#define FOREACH_FLOAT_SIMD_UNOP(_)    \
--    _(abs)                            \
--    _(sqrt)                           \
--    _(reciprocalApproximation)        \
--    _(reciprocalSqrtApproximation)
--
--// Binary arithmetic operators defined on floating point SIMD types.
--#define FOREACH_FLOAT_SIMD_BINOP(_)   \
--    _(div)                            \
--    _(max)                            \
--    _(min)                            \
--    _(maxNum)                         \
--    _(minNum)
--
--// Binary operations on small integer (< 32 bits) vectors.
--#define FOREACH_SMINT_SIMD_BINOP(_)   \
--    _(addSaturate)                    \
--    _(subSaturate)
--
--// Comparison operators defined on numeric SIMD types.
--#define FOREACH_COMP_SIMD_OP(_)       \
--    _(lessThan)                       \
--    _(lessThanOrEqual)                \
--    _(equal)                          \
--    _(notEqual)                       \
--    _(greaterThan)                    \
--    _(greaterThanOrEqual)
--
--/*
-- * All SIMD operations, excluding casts.
-- */
--#define FORALL_SIMD_NONCAST_OP(_)     \
--    FOREACH_COMMON_SIMD_OP(_)         \
--    FOREACH_LANE_SIMD_OP(_)           \
--    FOREACH_MEMORY_SIMD_OP(_)         \
--    FOREACH_MEMORY_X4_SIMD_OP(_)      \
--    FOREACH_BOOL_SIMD_UNOP(_)         \
--    FOREACH_BITWISE_SIMD_UNOP(_)      \
--    FOREACH_BITWISE_SIMD_BINOP(_)     \
--    FOREACH_SHIFT_SIMD_OP(_)          \
--    FOREACH_NUMERIC_SIMD_UNOP(_)      \
--    FOREACH_NUMERIC_SIMD_BINOP(_)     \
--    FOREACH_FLOAT_SIMD_UNOP(_)        \
--    FOREACH_FLOAT_SIMD_BINOP(_)       \
--    FOREACH_SMINT_SIMD_BINOP(_)       \
--    FOREACH_COMP_SIMD_OP(_)
--
--/*
-- * All operations on integer SIMD types, excluding casts and
-- * FOREACH_MEMORY_X4_OP.
-- */
--#define FORALL_INT_SIMD_OP(_)         \
--    FOREACH_COMMON_SIMD_OP(_)         \
--    FOREACH_LANE_SIMD_OP(_)           \
--    FOREACH_MEMORY_SIMD_OP(_)         \
--    FOREACH_BITWISE_SIMD_UNOP(_)      \
--    FOREACH_BITWISE_SIMD_BINOP(_)     \
--    FOREACH_SHIFT_SIMD_OP(_)          \
--    FOREACH_NUMERIC_SIMD_UNOP(_)      \
--    FOREACH_NUMERIC_SIMD_BINOP(_)     \
--    FOREACH_COMP_SIMD_OP(_)
--
--/*
-- * All operations on floating point SIMD types, excluding casts and
-- * FOREACH_MEMORY_X4_OP.
-- */
--#define FORALL_FLOAT_SIMD_OP(_)       \
--    FOREACH_COMMON_SIMD_OP(_)         \
--    FOREACH_LANE_SIMD_OP(_)           \
--    FOREACH_MEMORY_SIMD_OP(_)         \
--    FOREACH_NUMERIC_SIMD_UNOP(_)      \
--    FOREACH_NUMERIC_SIMD_BINOP(_)     \
--    FOREACH_FLOAT_SIMD_UNOP(_)        \
--    FOREACH_FLOAT_SIMD_BINOP(_)       \
--    FOREACH_COMP_SIMD_OP(_)
--
--/*
-- * All operations on Bool SIMD types.
-- *
-- * These types don't have casts, so no need to specialize.
-- */
--#define FORALL_BOOL_SIMD_OP(_)        \
--    FOREACH_COMMON_SIMD_OP(_)         \
--    FOREACH_BOOL_SIMD_UNOP(_)         \
--    FOREACH_BITWISE_SIMD_UNOP(_)      \
--    FOREACH_BITWISE_SIMD_BINOP(_)
--
--/*
-- * The sets of cast operations are listed per type below.
-- *
-- * These sets are not disjoint.
-- */
--
--#define FOREACH_INT8X16_SIMD_CAST(_)  \
--    _(fromFloat32x4Bits)              \
--    _(fromFloat64x2Bits)              \
--    _(fromInt16x8Bits)                \
--    _(fromInt32x4Bits)
--
--#define FOREACH_INT16X8_SIMD_CAST(_)  \
--    _(fromFloat32x4Bits)              \
--    _(fromFloat64x2Bits)              \
--    _(fromInt8x16Bits)                \
--    _(fromInt32x4Bits)
--
--#define FOREACH_INT32X4_SIMD_CAST(_)  \
--    _(fromFloat32x4)                  \
--    _(fromFloat32x4Bits)              \
--    _(fromFloat64x2Bits)              \
--    _(fromInt8x16Bits)                \
--    _(fromInt16x8Bits)
--
--#define FOREACH_FLOAT32X4_SIMD_CAST(_)\
--    _(fromFloat64x2Bits)              \
--    _(fromInt8x16Bits)                \
--    _(fromInt16x8Bits)                \
--    _(fromInt32x4)                    \
--    _(fromInt32x4Bits)
--
--#define FOREACH_FLOAT64X2_SIMD_CAST(_)\
--    _(fromFloat32x4Bits)              \
--    _(fromInt8x16Bits)                \
--    _(fromInt16x8Bits)                \
--    _(fromInt32x4Bits)
--
--// All operations on Int32x4.
--#define FORALL_INT32X4_SIMD_OP(_)     \
--    FORALL_INT_SIMD_OP(_)             \
--    FOREACH_MEMORY_X4_SIMD_OP(_)      \
--    FOREACH_INT32X4_SIMD_CAST(_)
--
--// All operations on Float32X4
--#define FORALL_FLOAT32X4_SIMD_OP(_)   \
--    FORALL_FLOAT_SIMD_OP(_)           \
--    FOREACH_MEMORY_X4_SIMD_OP(_)      \
--    FOREACH_FLOAT32X4_SIMD_CAST(_)
--
--/*
-- * All SIMD operations assuming only 32x4 types exist.
-- * This is used in the current asm.js impl.
-- */
--#define FORALL_SIMD_ASMJS_OP(_)       \
--    FORALL_SIMD_NONCAST_OP(_)         \
--    _(fromFloat32x4)                  \
--    _(fromFloat32x4Bits)              \
--    _(fromInt8x16Bits)                \
--    _(fromInt16x8Bits)                \
--    _(fromInt32x4)                    \
--    _(fromInt32x4Bits)                \
--    _(fromUint8x16Bits)               \
--    _(fromUint16x8Bits)               \
--    _(fromUint32x4)                   \
--    _(fromUint32x4Bits)
--
--// All operations on Int8x16 or Uint8x16 in the asm.js world.
--// Note: this does not include conversions and casts to/from Uint8x16 because
--// this list is shared between Int8x16 and Uint8x16.
--#define FORALL_INT8X16_ASMJS_OP(_)    \
--    FORALL_INT_SIMD_OP(_)             \
--    FOREACH_SMINT_SIMD_BINOP(_)       \
--    _(fromInt16x8Bits)                \
--    _(fromInt32x4Bits)                \
--    _(fromFloat32x4Bits)
--
--// All operations on Int16x8 or Uint16x8 in the asm.js world.
--// Note: this does not include conversions and casts to/from Uint16x8 because
--// this list is shared between Int16x8 and Uint16x8.
--#define FORALL_INT16X8_ASMJS_OP(_)    \
--    FORALL_INT_SIMD_OP(_)             \
--    FOREACH_SMINT_SIMD_BINOP(_)       \
--    _(fromInt8x16Bits)                \
--    _(fromInt32x4Bits)                \
--    _(fromFloat32x4Bits)
--
--// All operations on Int32x4 or Uint32x4 in the asm.js world.
--// Note: this does not include conversions and casts to/from Uint32x4 because
--// this list is shared between Int32x4 and Uint32x4.
--#define FORALL_INT32X4_ASMJS_OP(_)    \
--    FORALL_INT_SIMD_OP(_)             \
--    FOREACH_MEMORY_X4_SIMD_OP(_)      \
--    _(fromInt8x16Bits)                \
--    _(fromInt16x8Bits)                \
--    _(fromFloat32x4)                  \
--    _(fromFloat32x4Bits)
--
--// All operations on Float32X4 in the asm.js world.
--#define FORALL_FLOAT32X4_ASMJS_OP(_)  \
--    FORALL_FLOAT_SIMD_OP(_)           \
--    FOREACH_MEMORY_X4_SIMD_OP(_)      \
--    _(fromInt8x16Bits)                \
--    _(fromInt16x8Bits)                \
--    _(fromInt32x4Bits)                \
--    _(fromInt32x4)                    \
--    _(fromUint32x4)
--
- namespace js {
- 
- class GlobalObject;
- 
--// Complete set of SIMD types.
--// It must be kept in sync with the enumeration of values in
--// TypedObjectConstants.h; in particular we need to ensure that Count is
--// appropriately set with respect to the number of actual types.
--enum class SimdType {
--    Int8x16   = JS_SIMDTYPEREPR_INT8X16,
--    Int16x8   = JS_SIMDTYPEREPR_INT16X8,
--    Int32x4   = JS_SIMDTYPEREPR_INT32X4,
--    Uint8x16  = JS_SIMDTYPEREPR_UINT8X16,
--    Uint16x8  = JS_SIMDTYPEREPR_UINT16X8,
--    Uint32x4  = JS_SIMDTYPEREPR_UINT32X4,
--    Float32x4 = JS_SIMDTYPEREPR_FLOAT32X4,
--    Float64x2 = JS_SIMDTYPEREPR_FLOAT64X2,
--    Bool8x16  = JS_SIMDTYPEREPR_BOOL8X16,
--    Bool16x8  = JS_SIMDTYPEREPR_BOOL16X8,
--    Bool32x4  = JS_SIMDTYPEREPR_BOOL32X4,
--    Bool64x2  = JS_SIMDTYPEREPR_BOOL64X2,
--    Count
--};
--
--// The integer SIMD types have a lot of operations that do the exact same thing
--// for signed and unsigned integer types. Sometimes it is simpler to treat
--// signed and unsigned integer SIMD types as the same type, using a SimdSign to
--// distinguish the few cases where there is a difference.
--enum class SimdSign {
--    // Signedness is not applicable to this type. (i.e., Float or Bool).
--    NotApplicable,
--    // Treat as an unsigned integer with a range 0 .. 2^N-1.
--    Unsigned,
--    // Treat as a signed integer in two's complement encoding.
--    Signed,
--};
--
--// Get the signedness of a SIMD type.
--inline SimdSign
--GetSimdSign(SimdType t)
--{
--    switch(t) {
--      case SimdType::Int8x16:
--      case SimdType::Int16x8:
--      case SimdType::Int32x4:
--        return SimdSign::Signed;
--
--      case SimdType::Uint8x16:
--      case SimdType::Uint16x8:
--      case SimdType::Uint32x4:
--        return SimdSign::Unsigned;
--
--      default:
--        return SimdSign::NotApplicable;
--    }
--}
--
--inline bool
--IsSignedIntSimdType(SimdType type)
--{
--    return GetSimdSign(type) == SimdSign::Signed;
--}
--
--// Get the boolean SIMD type with the same shape as t.
--//
--// This is the result type of a comparison operation, and it can also be used to
--// identify the geometry of a SIMD type.
--inline SimdType
--GetBooleanSimdType(SimdType t)
--{
--    switch(t) {
--      case SimdType::Int8x16:
--      case SimdType::Uint8x16:
--      case SimdType::Bool8x16:
--        return SimdType::Bool8x16;
--
--      case SimdType::Int16x8:
--      case SimdType::Uint16x8:
--      case SimdType::Bool16x8:
--        return SimdType::Bool16x8;
--
--      case SimdType::Int32x4:
--      case SimdType::Uint32x4:
--      case SimdType::Float32x4:
--      case SimdType::Bool32x4:
--        return SimdType::Bool32x4;
--
--      case SimdType::Float64x2:
--      case SimdType::Bool64x2:
--        return SimdType::Bool64x2;
--
--      case SimdType::Count:
--        break;
--    }
--    MOZ_MAKE_COMPILER_ASSUME_IS_UNREACHABLE("Bad SIMD type");
--}
--
--// Get the number of lanes in a SIMD type.
--inline unsigned
--GetSimdLanes(SimdType t)
--{
--    switch(t) {
--      case SimdType::Int8x16:
--      case SimdType::Uint8x16:
--      case SimdType::Bool8x16:
--        return 16;
--
--      case SimdType::Int16x8:
--      case SimdType::Uint16x8:
--      case SimdType::Bool16x8:
--        return 8;
--
--      case SimdType::Int32x4:
--      case SimdType::Uint32x4:
--      case SimdType::Float32x4:
--      case SimdType::Bool32x4:
--        return 4;
--
--      case SimdType::Float64x2:
--      case SimdType::Bool64x2:
--        return 2;
--
--      case SimdType::Count:
--        break;
--    }
--    MOZ_MAKE_COMPILER_ASSUME_IS_UNREACHABLE("Bad SIMD type");
--}
--
--// Complete set of SIMD operations.
--//
--// No SIMD types implement all of these operations.
--//
--// C++ defines keywords and/or/xor/not, so prepend Fn_ to all named functions to
--// avoid clashes.
--//
--// Note: because of a gcc < v4.8's compiler bug, uint8_t can't be used as the
--// storage class here. See bug 1243810. See also
--// https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64037 .
--enum class SimdOperation {
--    // The constructor call. No Fn_ prefix here.
--    Constructor,
--
--    // All the operations, except for casts.
--#define DEFOP(x) Fn_##x,
--    FORALL_SIMD_NONCAST_OP(DEFOP)
--#undef DEFOP
--
--    // Int <-> Float conversions.
--    Fn_fromInt32x4,
--    Fn_fromUint32x4,
--    Fn_fromFloat32x4,
--
--    // Bitcasts. One for each type with a memory representation.
--    Fn_fromInt8x16Bits,
--    Fn_fromInt16x8Bits,
--    Fn_fromInt32x4Bits,
--    Fn_fromUint8x16Bits,
--    Fn_fromUint16x8Bits,
--    Fn_fromUint32x4Bits,
--    Fn_fromFloat32x4Bits,
--    Fn_fromFloat64x2Bits,
--
--    Last = Fn_fromFloat64x2Bits
--};
--
- // These classes implement the concept containing the following constraints:
- // - requires typename Elem: this is the scalar lane type, stored in each lane
- // of the SIMD vector.
- // - requires static const unsigned lanes: this is the number of lanes (length)
- // of the SIMD vector.
- // - requires static const SimdType type: this is the SimdType enum value
- // corresponding to the SIMD type.
- // - requires static bool Cast(JSContext*, JS::HandleValue, Elem*): casts a
-diff --git a/js/src/builtin/SIMDConstants.h b/js/src/builtin/SIMDConstants.h
-new file mode 100644
---- /dev/null
-+++ b/js/src/builtin/SIMDConstants.h
-@@ -0,0 +1,941 @@
-+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
-+ * vim: set ts=8 sts=4 et sw=4 tw=99:
-+ * This Source Code Form is subject to the terms of the Mozilla Public
-+ * License, v. 2.0. If a copy of the MPL was not distributed with this
-+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-+
-+#ifndef builtin_SIMDConstants_h
-+#define builtin_SIMDConstants_h
-+
-+#include "mozilla/Assertions.h"
-+
-+#include "builtin/TypedObjectConstants.h"
-+
-+// Bool8x16.
-+#define BOOL8X16_UNARY_FUNCTION_LIST(V)                                               \
-+  V(not, (UnaryFunc<Bool8x16, LogicalNot, Bool8x16>), 1)                              \
-+  V(check, (UnaryFunc<Bool8x16, Identity, Bool8x16>), 1)                              \
-+  V(splat, (FuncSplat<Bool8x16>), 1)                                                  \
-+  V(allTrue, (AllTrue<Bool8x16>), 1)                                                  \
-+  V(anyTrue, (AnyTrue<Bool8x16>), 1)
-+
-+#define BOOL8X16_BINARY_FUNCTION_LIST(V)                                              \
-+  V(extractLane, (ExtractLane<Bool8x16>), 2)                                          \
-+  V(and, (BinaryFunc<Bool8x16, And, Bool8x16>), 2)                                    \
-+  V(or, (BinaryFunc<Bool8x16, Or, Bool8x16>), 2)                                      \
-+  V(xor, (BinaryFunc<Bool8x16, Xor, Bool8x16>), 2)                                    \
-+
-+#define BOOL8X16_TERNARY_FUNCTION_LIST(V)                                             \
-+  V(replaceLane, (ReplaceLane<Bool8x16>), 3)
-+
-+#define BOOL8X16_FUNCTION_LIST(V)                                                     \
-+  BOOL8X16_UNARY_FUNCTION_LIST(V)                                                     \
-+  BOOL8X16_BINARY_FUNCTION_LIST(V)                                                    \
-+  BOOL8X16_TERNARY_FUNCTION_LIST(V)
-+
-+// Bool 16x8.
-+#define BOOL16X8_UNARY_FUNCTION_LIST(V)                                               \
-+  V(not, (UnaryFunc<Bool16x8, LogicalNot, Bool16x8>), 1)                              \
-+  V(check, (UnaryFunc<Bool16x8, Identity, Bool16x8>), 1)                              \
-+  V(splat, (FuncSplat<Bool16x8>), 1)                                                  \
-+  V(allTrue, (AllTrue<Bool16x8>), 1)                                                  \
-+  V(anyTrue, (AnyTrue<Bool16x8>), 1)
-+
-+#define BOOL16X8_BINARY_FUNCTION_LIST(V)                                              \
-+  V(extractLane, (ExtractLane<Bool16x8>), 2)                                          \
-+  V(and, (BinaryFunc<Bool16x8, And, Bool16x8>), 2)                                    \
-+  V(or, (BinaryFunc<Bool16x8, Or, Bool16x8>), 2)                                      \
-+  V(xor, (BinaryFunc<Bool16x8, Xor, Bool16x8>), 2)                                    \
-+
-+#define BOOL16X8_TERNARY_FUNCTION_LIST(V)                                             \
-+  V(replaceLane, (ReplaceLane<Bool16x8>), 3)
-+
-+#define BOOL16X8_FUNCTION_LIST(V)                                                     \
-+  BOOL16X8_UNARY_FUNCTION_LIST(V)                                                     \
-+  BOOL16X8_BINARY_FUNCTION_LIST(V)                                                    \
-+  BOOL16X8_TERNARY_FUNCTION_LIST(V)
-+
-+// Bool32x4.
-+#define BOOL32X4_UNARY_FUNCTION_LIST(V)                                               \
-+  V(not, (UnaryFunc<Bool32x4, LogicalNot, Bool32x4>), 1)                              \
-+  V(check, (UnaryFunc<Bool32x4, Identity, Bool32x4>), 1)                              \
-+  V(splat, (FuncSplat<Bool32x4>), 1)                                                  \
-+  V(allTrue, (AllTrue<Bool32x4>), 1)                                                  \
-+  V(anyTrue, (AnyTrue<Bool32x4>), 1)
-+
-+#define BOOL32X4_BINARY_FUNCTION_LIST(V)                                              \
-+  V(extractLane, (ExtractLane<Bool32x4>), 2)                                          \
-+  V(and, (BinaryFunc<Bool32x4, And, Bool32x4>), 2)                                    \
-+  V(or, (BinaryFunc<Bool32x4, Or, Bool32x4>), 2)                                      \
-+  V(xor, (BinaryFunc<Bool32x4, Xor, Bool32x4>), 2)                                    \
-+
-+#define BOOL32X4_TERNARY_FUNCTION_LIST(V)                                             \
-+  V(replaceLane, (ReplaceLane<Bool32x4>), 3)
-+
-+#define BOOL32X4_FUNCTION_LIST(V)                                                     \
-+  BOOL32X4_UNARY_FUNCTION_LIST(V)                                                     \
-+  BOOL32X4_BINARY_FUNCTION_LIST(V)                                                    \
-+  BOOL32X4_TERNARY_FUNCTION_LIST(V)
-+
-+// Bool64x2.
-+#define BOOL64X2_UNARY_FUNCTION_LIST(V)                                               \
-+  V(not, (UnaryFunc<Bool64x2, LogicalNot, Bool64x2>), 1)                              \
-+  V(check, (UnaryFunc<Bool64x2, Identity, Bool64x2>), 1)                              \
-+  V(splat, (FuncSplat<Bool64x2>), 1)                                                  \
-+  V(allTrue, (AllTrue<Bool64x2>), 1)                                                  \
-+  V(anyTrue, (AnyTrue<Bool64x2>), 1)
-+
-+#define BOOL64X2_BINARY_FUNCTION_LIST(V)                                              \
-+  V(extractLane, (ExtractLane<Bool64x2>), 2)                                          \
-+  V(and, (BinaryFunc<Bool64x2, And, Bool64x2>), 2)                                    \
-+  V(or, (BinaryFunc<Bool64x2, Or, Bool64x2>), 2)                                      \
-+  V(xor, (BinaryFunc<Bool64x2, Xor, Bool64x2>), 2)                                    \
-+
-+#define BOOL64X2_TERNARY_FUNCTION_LIST(V)                                             \
-+  V(replaceLane, (ReplaceLane<Bool64x2>), 3)
-+
-+#define BOOL64X2_FUNCTION_LIST(V)                                                     \
-+  BOOL64X2_UNARY_FUNCTION_LIST(V)                                                     \
-+  BOOL64X2_BINARY_FUNCTION_LIST(V)                                                    \
-+  BOOL64X2_TERNARY_FUNCTION_LIST(V)
-+
-+// Float32x4.
-+#define FLOAT32X4_UNARY_FUNCTION_LIST(V)                                              \
-+  V(abs, (UnaryFunc<Float32x4, Abs, Float32x4>), 1)                                   \
-+  V(check, (UnaryFunc<Float32x4, Identity, Float32x4>), 1)                            \
-+  V(fromFloat64x2Bits, (FuncConvertBits<Float64x2, Float32x4>), 1)                    \
-+  V(fromInt8x16Bits,   (FuncConvertBits<Int8x16,   Float32x4>), 1)                    \
-+  V(fromInt16x8Bits,   (FuncConvertBits<Int16x8,   Float32x4>), 1)                    \
-+  V(fromInt32x4,       (FuncConvert<Int32x4,       Float32x4>), 1)                    \
-+  V(fromInt32x4Bits,   (FuncConvertBits<Int32x4,   Float32x4>), 1)                    \
-+  V(fromUint8x16Bits,  (FuncConvertBits<Uint8x16,  Float32x4>), 1)                    \
-+  V(fromUint16x8Bits,  (FuncConvertBits<Uint16x8,  Float32x4>), 1)                    \
-+  V(fromUint32x4,      (FuncConvert<Uint32x4,      Float32x4>), 1)                    \
-+  V(fromUint32x4Bits,  (FuncConvertBits<Uint32x4,  Float32x4>), 1)                    \
-+  V(neg, (UnaryFunc<Float32x4, Neg, Float32x4>), 1)                                   \
-+  V(reciprocalApproximation, (UnaryFunc<Float32x4, RecApprox, Float32x4>), 1)         \
-+  V(reciprocalSqrtApproximation, (UnaryFunc<Float32x4, RecSqrtApprox, Float32x4>), 1) \
-+  V(splat, (FuncSplat<Float32x4>), 1)                                                 \
-+  V(sqrt, (UnaryFunc<Float32x4, Sqrt, Float32x4>), 1)
-+
-+#define FLOAT32X4_BINARY_FUNCTION_LIST(V)                                             \
-+  V(add, (BinaryFunc<Float32x4, Add, Float32x4>), 2)                                  \
-+  V(div, (BinaryFunc<Float32x4, Div, Float32x4>), 2)                                  \
-+  V(equal, (CompareFunc<Float32x4, Equal, Bool32x4>), 2)                              \
-+  V(extractLane, (ExtractLane<Float32x4>), 2)                                         \
-+  V(greaterThan, (CompareFunc<Float32x4, GreaterThan, Bool32x4>), 2)                  \
-+  V(greaterThanOrEqual, (CompareFunc<Float32x4, GreaterThanOrEqual, Bool32x4>), 2)    \
-+  V(lessThan, (CompareFunc<Float32x4, LessThan, Bool32x4>), 2)                        \
-+  V(lessThanOrEqual, (CompareFunc<Float32x4, LessThanOrEqual, Bool32x4>), 2)          \
-+  V(load,  (Load<Float32x4, 4>), 2)                                                   \
-+  V(load3, (Load<Float32x4, 3>), 2)                                                   \
-+  V(load2, (Load<Float32x4, 2>), 2)                                                   \
-+  V(load1, (Load<Float32x4, 1>), 2)                                                   \
-+  V(max, (BinaryFunc<Float32x4, Maximum, Float32x4>), 2)                              \
-+  V(maxNum, (BinaryFunc<Float32x4, MaxNum, Float32x4>), 2)                            \
-+  V(min, (BinaryFunc<Float32x4, Minimum, Float32x4>), 2)                              \
-+  V(minNum, (BinaryFunc<Float32x4, MinNum, Float32x4>), 2)                            \
-+  V(mul, (BinaryFunc<Float32x4, Mul, Float32x4>), 2)                                  \
-+  V(notEqual, (CompareFunc<Float32x4, NotEqual, Bool32x4>), 2)                        \
-+  V(sub, (BinaryFunc<Float32x4, Sub, Float32x4>), 2)
-+
-+#define FLOAT32X4_TERNARY_FUNCTION_LIST(V)                                            \
-+  V(replaceLane, (ReplaceLane<Float32x4>), 3)                                         \
-+  V(select, (Select<Float32x4, Bool32x4>), 3)                                         \
-+  V(store,  (Store<Float32x4, 4>), 3)                                                 \
-+  V(store3, (Store<Float32x4, 3>), 3)                                                 \
-+  V(store2, (Store<Float32x4, 2>), 3)                                                 \
-+  V(store1, (Store<Float32x4, 1>), 3)
-+
-+#define FLOAT32X4_SHUFFLE_FUNCTION_LIST(V)                                            \
-+  V(swizzle, Swizzle<Float32x4>, 5)                                                   \
-+  V(shuffle, Shuffle<Float32x4>, 6)
-+
-+#define FLOAT32X4_FUNCTION_LIST(V)                                                    \
-+  FLOAT32X4_UNARY_FUNCTION_LIST(V)                                                    \
-+  FLOAT32X4_BINARY_FUNCTION_LIST(V)                                                   \
-+  FLOAT32X4_TERNARY_FUNCTION_LIST(V)                                                  \
-+  FLOAT32X4_SHUFFLE_FUNCTION_LIST(V)
-+
-+// Float64x2.
-+#define FLOAT64X2_UNARY_FUNCTION_LIST(V)                                              \
-+  V(abs, (UnaryFunc<Float64x2, Abs, Float64x2>), 1)                                   \
-+  V(check, (UnaryFunc<Float64x2, Identity, Float64x2>), 1)                            \
-+  V(fromFloat32x4Bits, (FuncConvertBits<Float32x4, Float64x2>), 1)                    \
-+  V(fromInt8x16Bits,   (FuncConvertBits<Int8x16,   Float64x2>), 1)                    \
-+  V(fromInt16x8Bits,   (FuncConvertBits<Int16x8,   Float64x2>), 1)                    \
-+  V(fromInt32x4Bits,   (FuncConvertBits<Int32x4,   Float64x2>), 1)                    \
-+  V(fromUint8x16Bits,  (FuncConvertBits<Uint8x16,  Float64x2>), 1)                    \
-+  V(fromUint16x8Bits,  (FuncConvertBits<Uint16x8,  Float64x2>), 1)                    \
-+  V(fromUint32x4Bits,  (FuncConvertBits<Uint32x4,  Float64x2>), 1)                    \
-+  V(neg, (UnaryFunc<Float64x2, Neg, Float64x2>), 1)                                   \
-+  V(reciprocalApproximation, (UnaryFunc<Float64x2, RecApprox, Float64x2>), 1)         \
-+  V(reciprocalSqrtApproximation, (UnaryFunc<Float64x2, RecSqrtApprox, Float64x2>), 1) \
-+  V(splat, (FuncSplat<Float64x2>), 1)                                                 \
-+  V(sqrt, (UnaryFunc<Float64x2, Sqrt, Float64x2>), 1)
-+
-+#define FLOAT64X2_BINARY_FUNCTION_LIST(V)                                             \
-+  V(add, (BinaryFunc<Float64x2, Add, Float64x2>), 2)                                  \
-+  V(div, (BinaryFunc<Float64x2, Div, Float64x2>), 2)                                  \
-+  V(equal, (CompareFunc<Float64x2, Equal, Bool64x2>), 2)                              \
-+  V(extractLane, (ExtractLane<Float64x2>), 2)                                         \
-+  V(greaterThan, (CompareFunc<Float64x2, GreaterThan, Bool64x2>), 2)                  \
-+  V(greaterThanOrEqual, (CompareFunc<Float64x2, GreaterThanOrEqual, Bool64x2>), 2)    \
-+  V(lessThan, (CompareFunc<Float64x2, LessThan, Bool64x2>), 2)                        \
-+  V(lessThanOrEqual, (CompareFunc<Float64x2, LessThanOrEqual, Bool64x2>), 2)          \
-+  V(load,  (Load<Float64x2, 2>), 2)                                                   \
-+  V(load1, (Load<Float64x2, 1>), 2)                                                   \
-+  V(max, (BinaryFunc<Float64x2, Maximum, Float64x2>), 2)                              \
-+  V(maxNum, (BinaryFunc<Float64x2, MaxNum, Float64x2>), 2)                            \
-+  V(min, (BinaryFunc<Float64x2, Minimum, Float64x2>), 2)                              \
-+  V(minNum, (BinaryFunc<Float64x2, MinNum, Float64x2>), 2)                            \
-+  V(mul, (BinaryFunc<Float64x2, Mul, Float64x2>), 2)                                  \
-+  V(notEqual, (CompareFunc<Float64x2, NotEqual, Bool64x2>), 2)                        \
-+  V(sub, (BinaryFunc<Float64x2, Sub, Float64x2>), 2)
-+
-+#define FLOAT64X2_TERNARY_FUNCTION_LIST(V)                                            \
-+  V(replaceLane, (ReplaceLane<Float64x2>), 3)                                         \
-+  V(select, (Select<Float64x2, Bool64x2>), 3)                                         \
-+  V(store,  (Store<Float64x2, 2>), 3)                                                 \
-+  V(store1, (Store<Float64x2, 1>), 3)
-+
-+#define FLOAT64X2_SHUFFLE_FUNCTION_LIST(V)                                            \
-+  V(swizzle, Swizzle<Float64x2>, 3)                                                   \
-+  V(shuffle, Shuffle<Float64x2>, 4)
-+
-+#define FLOAT64X2_FUNCTION_LIST(V)                                                    \
-+  FLOAT64X2_UNARY_FUNCTION_LIST(V)                                                    \
-+  FLOAT64X2_BINARY_FUNCTION_LIST(V)                                                   \
-+  FLOAT64X2_TERNARY_FUNCTION_LIST(V)                                                  \
-+  FLOAT64X2_SHUFFLE_FUNCTION_LIST(V)
-+
-+// Int8x16.
-+#define INT8X16_UNARY_FUNCTION_LIST(V)                                                \
-+  V(check, (UnaryFunc<Int8x16, Identity, Int8x16>), 1)                                \
-+  V(fromFloat32x4Bits, (FuncConvertBits<Float32x4, Int8x16>), 1)                      \
-+  V(fromFloat64x2Bits, (FuncConvertBits<Float64x2, Int8x16>), 1)                      \
-+  V(fromInt16x8Bits,   (FuncConvertBits<Int16x8,   Int8x16>), 1)                      \
-+  V(fromInt32x4Bits,   (FuncConvertBits<Int32x4,   Int8x16>), 1)                      \
-+  V(fromUint8x16Bits,  (FuncConvertBits<Uint8x16,  Int8x16>), 1)                      \
-+  V(fromUint16x8Bits,  (FuncConvertBits<Uint16x8,  Int8x16>), 1)                      \
-+  V(fromUint32x4Bits,  (FuncConvertBits<Uint32x4,  Int8x16>), 1)                      \
-+  V(neg, (UnaryFunc<Int8x16, Neg, Int8x16>), 1)                                       \
-+  V(not, (UnaryFunc<Int8x16, Not, Int8x16>), 1)                                       \
-+  V(splat, (FuncSplat<Int8x16>), 1)
-+
-+#define INT8X16_BINARY_FUNCTION_LIST(V)                                               \
-+  V(add, (BinaryFunc<Int8x16, Add, Int8x16>), 2)                                      \
-+  V(addSaturate, (BinaryFunc<Int8x16, AddSaturate, Int8x16>), 2)                      \
-+  V(and, (BinaryFunc<Int8x16, And, Int8x16>), 2)                                      \
-+  V(equal, (CompareFunc<Int8x16, Equal, Bool8x16>), 2)                                \
-+  V(extractLane, (ExtractLane<Int8x16>), 2)                                           \
-+  V(greaterThan, (CompareFunc<Int8x16, GreaterThan, Bool8x16>), 2)                    \
-+  V(greaterThanOrEqual, (CompareFunc<Int8x16, GreaterThanOrEqual, Bool8x16>), 2)      \
-+  V(lessThan, (CompareFunc<Int8x16, LessThan, Bool8x16>), 2)                          \
-+  V(lessThanOrEqual, (CompareFunc<Int8x16, LessThanOrEqual, Bool8x16>), 2)            \
-+  V(load, (Load<Int8x16, 16>), 2)                                                     \
-+  V(mul, (BinaryFunc<Int8x16, Mul, Int8x16>), 2)                                      \
-+  V(notEqual, (CompareFunc<Int8x16, NotEqual, Bool8x16>), 2)                          \
-+  V(or, (BinaryFunc<Int8x16, Or, Int8x16>), 2)                                        \
-+  V(sub, (BinaryFunc<Int8x16, Sub, Int8x16>), 2)                                      \
-+  V(subSaturate, (BinaryFunc<Int8x16, SubSaturate, Int8x16>), 2)                      \
-+  V(shiftLeftByScalar, (BinaryScalar<Int8x16, ShiftLeft>), 2)                         \
-+  V(shiftRightByScalar, (BinaryScalar<Int8x16, ShiftRightArithmetic>), 2)             \
-+  V(xor, (BinaryFunc<Int8x16, Xor, Int8x16>), 2)
-+
-+#define INT8X16_TERNARY_FUNCTION_LIST(V)                                              \
-+  V(replaceLane, (ReplaceLane<Int8x16>), 3)                                           \
-+  V(select, (Select<Int8x16, Bool8x16>), 3)                                           \
-+  V(store, (Store<Int8x16, 16>), 3)
-+
-+#define INT8X16_SHUFFLE_FUNCTION_LIST(V)                                              \
-+  V(swizzle, Swizzle<Int8x16>, 17)                                                    \
-+  V(shuffle, Shuffle<Int8x16>, 18)
-+
-+#define INT8X16_FUNCTION_LIST(V)                                                      \
-+  INT8X16_UNARY_FUNCTION_LIST(V)                                                      \
-+  INT8X16_BINARY_FUNCTION_LIST(V)                                                     \
-+  INT8X16_TERNARY_FUNCTION_LIST(V)                                                    \
-+  INT8X16_SHUFFLE_FUNCTION_LIST(V)
-+
-+// Uint8x16.
-+#define UINT8X16_UNARY_FUNCTION_LIST(V)                                               \
-+  V(check, (UnaryFunc<Uint8x16, Identity, Uint8x16>), 1)                              \
-+  V(fromFloat32x4Bits, (FuncConvertBits<Float32x4, Uint8x16>), 1)                     \
-+  V(fromFloat64x2Bits, (FuncConvertBits<Float64x2, Uint8x16>), 1)                     \
-+  V(fromInt8x16Bits,   (FuncConvertBits<Int8x16,   Uint8x16>), 1)                     \
-+  V(fromInt16x8Bits,   (FuncConvertBits<Int16x8,   Uint8x16>), 1)                     \
-+  V(fromInt32x4Bits,   (FuncConvertBits<Int32x4,   Uint8x16>), 1)                     \
-+  V(fromUint16x8Bits,  (FuncConvertBits<Uint16x8,  Uint8x16>), 1)                     \
-+  V(fromUint32x4Bits,  (FuncConvertBits<Uint32x4,  Uint8x16>), 1)                     \
-+  V(neg, (UnaryFunc<Uint8x16, Neg, Uint8x16>), 1)                                     \
-+  V(not, (UnaryFunc<Uint8x16, Not, Uint8x16>), 1)                                     \
-+  V(splat, (FuncSplat<Uint8x16>), 1)
-+
-+#define UINT8X16_BINARY_FUNCTION_LIST(V)                                              \
-+  V(add, (BinaryFunc<Uint8x16, Add, Uint8x16>), 2)                                    \
-+  V(addSaturate, (BinaryFunc<Uint8x16, AddSaturate, Uint8x16>), 2)                    \
-+  V(and, (BinaryFunc<Uint8x16, And, Uint8x16>), 2)                                    \
-+  V(equal, (CompareFunc<Uint8x16, Equal, Bool8x16>), 2)                               \
-+  V(extractLane, (ExtractLane<Uint8x16>), 2)                                          \
-+  V(greaterThan, (CompareFunc<Uint8x16, GreaterThan, Bool8x16>), 2)                   \
-+  V(greaterThanOrEqual, (CompareFunc<Uint8x16, GreaterThanOrEqual, Bool8x16>), 2)     \
-+  V(lessThan, (CompareFunc<Uint8x16, LessThan, Bool8x16>), 2)                         \
-+  V(lessThanOrEqual, (CompareFunc<Uint8x16, LessThanOrEqual, Bool8x16>), 2)           \
-+  V(load, (Load<Uint8x16, 16>), 2)                                                    \
-+  V(mul, (BinaryFunc<Uint8x16, Mul, Uint8x16>), 2)                                    \
-+  V(notEqual, (CompareFunc<Uint8x16, NotEqual, Bool8x16>), 2)                         \
-+  V(or, (BinaryFunc<Uint8x16, Or, Uint8x16>), 2)                                      \
-+  V(sub, (BinaryFunc<Uint8x16, Sub, Uint8x16>), 2)                                    \
-+  V(subSaturate, (BinaryFunc<Uint8x16, SubSaturate, Uint8x16>), 2)                    \
-+  V(shiftLeftByScalar, (BinaryScalar<Uint8x16, ShiftLeft>), 2)                        \
-+  V(shiftRightByScalar, (BinaryScalar<Uint8x16, ShiftRightLogical>), 2)               \
-+  V(xor, (BinaryFunc<Uint8x16, Xor, Uint8x16>), 2)
-+
-+#define UINT8X16_TERNARY_FUNCTION_LIST(V)                                             \
-+  V(replaceLane, (ReplaceLane<Uint8x16>), 3)                                          \
-+  V(select, (Select<Uint8x16, Bool8x16>), 3)                                          \
-+  V(store, (Store<Uint8x16, 16>), 3)
-+
-+#define UINT8X16_SHUFFLE_FUNCTION_LIST(V)                                             \
-+  V(swizzle, Swizzle<Uint8x16>, 17)                                                   \
-+  V(shuffle, Shuffle<Uint8x16>, 18)
-+
-+#define UINT8X16_FUNCTION_LIST(V)                                                     \
-+  UINT8X16_UNARY_FUNCTION_LIST(V)                                                     \
-+  UINT8X16_BINARY_FUNCTION_LIST(V)                                                    \
-+  UINT8X16_TERNARY_FUNCTION_LIST(V)                                                   \
-+  UINT8X16_SHUFFLE_FUNCTION_LIST(V)
-+
-+// Int16x8.
-+#define INT16X8_UNARY_FUNCTION_LIST(V)                                                \
-+  V(check, (UnaryFunc<Int16x8, Identity, Int16x8>), 1)                                \
-+  V(fromFloat32x4Bits, (FuncConvertBits<Float32x4, Int16x8>), 1)                      \
-+  V(fromFloat64x2Bits, (FuncConvertBits<Float64x2, Int16x8>), 1)                      \
-+  V(fromInt8x16Bits,   (FuncConvertBits<Int8x16,   Int16x8>), 1)                      \
-+  V(fromInt32x4Bits,   (FuncConvertBits<Int32x4,   Int16x8>), 1)                      \
-+  V(fromUint8x16Bits,  (FuncConvertBits<Uint8x16,  Int16x8>), 1)                      \
-+  V(fromUint16x8Bits,  (FuncConvertBits<Uint16x8,  Int16x8>), 1)                      \
-+  V(fromUint32x4Bits,  (FuncConvertBits<Uint32x4,  Int16x8>), 1)                      \
-+  V(neg, (UnaryFunc<Int16x8, Neg, Int16x8>), 1)                                       \
-+  V(not, (UnaryFunc<Int16x8, Not, Int16x8>), 1)                                       \
-+  V(splat, (FuncSplat<Int16x8>), 1)
-+
-+#define INT16X8_BINARY_FUNCTION_LIST(V)                                               \
-+  V(add, (BinaryFunc<Int16x8, Add, Int16x8>), 2)                                      \
-+  V(addSaturate, (BinaryFunc<Int16x8, AddSaturate, Int16x8>), 2)                      \
-+  V(and, (BinaryFunc<Int16x8, And, Int16x8>), 2)                                      \
-+  V(equal, (CompareFunc<Int16x8, Equal, Bool16x8>), 2)                                \
-+  V(extractLane, (ExtractLane<Int16x8>), 2)                                           \
-+  V(greaterThan, (CompareFunc<Int16x8, GreaterThan, Bool16x8>), 2)                    \
-+  V(greaterThanOrEqual, (CompareFunc<Int16x8, GreaterThanOrEqual, Bool16x8>), 2)      \
-+  V(lessThan, (CompareFunc<Int16x8, LessThan, Bool16x8>), 2)                          \
-+  V(lessThanOrEqual, (CompareFunc<Int16x8, LessThanOrEqual, Bool16x8>), 2)            \
-+  V(load, (Load<Int16x8, 8>), 2)                                                      \
-+  V(mul, (BinaryFunc<Int16x8, Mul, Int16x8>), 2)                                      \
-+  V(notEqual, (CompareFunc<Int16x8, NotEqual, Bool16x8>), 2)                          \
-+  V(or, (BinaryFunc<Int16x8, Or, Int16x8>), 2)                                        \
-+  V(sub, (BinaryFunc<Int16x8, Sub, Int16x8>), 2)                                      \
-+  V(subSaturate, (BinaryFunc<Int16x8, SubSaturate, Int16x8>), 2)                      \
-+  V(shiftLeftByScalar, (BinaryScalar<Int16x8, ShiftLeft>), 2)                         \
-+  V(shiftRightByScalar, (BinaryScalar<Int16x8, ShiftRightArithmetic>), 2)             \
-+  V(xor, (BinaryFunc<Int16x8, Xor, Int16x8>), 2)
-+
-+#define INT16X8_TERNARY_FUNCTION_LIST(V)                                              \
-+  V(replaceLane, (ReplaceLane<Int16x8>), 3)                                           \
-+  V(select, (Select<Int16x8, Bool16x8>), 3)                                           \
-+  V(store, (Store<Int16x8, 8>), 3)
-+
-+#define INT16X8_SHUFFLE_FUNCTION_LIST(V)                                              \
-+  V(swizzle, Swizzle<Int16x8>, 9)                                                     \
-+  V(shuffle, Shuffle<Int16x8>, 10)
-+
-+#define INT16X8_FUNCTION_LIST(V)                                                      \
-+  INT16X8_UNARY_FUNCTION_LIST(V)                                                      \
-+  INT16X8_BINARY_FUNCTION_LIST(V)                                                     \
-+  INT16X8_TERNARY_FUNCTION_LIST(V)                                                    \
-+  INT16X8_SHUFFLE_FUNCTION_LIST(V)
-+
-+// Uint16x8.
-+#define UINT16X8_UNARY_FUNCTION_LIST(V)                                               \
-+  V(check, (UnaryFunc<Uint16x8, Identity, Uint16x8>), 1)                              \
-+  V(fromFloat32x4Bits, (FuncConvertBits<Float32x4, Uint16x8>), 1)                     \
-+  V(fromFloat64x2Bits, (FuncConvertBits<Float64x2, Uint16x8>), 1)                     \
-+  V(fromInt8x16Bits,   (FuncConvertBits<Int8x16,   Uint16x8>), 1)                     \
-+  V(fromInt16x8Bits,   (FuncConvertBits<Int16x8,   Uint16x8>), 1)                     \
-+  V(fromInt32x4Bits,   (FuncConvertBits<Int32x4,   Uint16x8>), 1)                     \
-+  V(fromUint8x16Bits,  (FuncConvertBits<Uint8x16,  Uint16x8>), 1)                     \
-+  V(fromUint32x4Bits,  (FuncConvertBits<Uint32x4,  Uint16x8>), 1)                     \
-+  V(neg, (UnaryFunc<Uint16x8, Neg, Uint16x8>), 1)                                     \
-+  V(not, (UnaryFunc<Uint16x8, Not, Uint16x8>), 1)                                     \
-+  V(splat, (FuncSplat<Uint16x8>), 1)
-+
-+#define UINT16X8_BINARY_FUNCTION_LIST(V)                                              \
-+  V(add, (BinaryFunc<Uint16x8, Add, Uint16x8>), 2)                                    \
-+  V(addSaturate, (BinaryFunc<Uint16x8, AddSaturate, Uint16x8>), 2)                    \
-+  V(and, (BinaryFunc<Uint16x8, And, Uint16x8>), 2)                                    \
-+  V(equal, (CompareFunc<Uint16x8, Equal, Bool16x8>), 2)                               \
-+  V(extractLane, (ExtractLane<Uint16x8>), 2)                                          \
-+  V(greaterThan, (CompareFunc<Uint16x8, GreaterThan, Bool16x8>), 2)                   \
-+  V(greaterThanOrEqual, (CompareFunc<Uint16x8, GreaterThanOrEqual, Bool16x8>), 2)     \
-+  V(lessThan, (CompareFunc<Uint16x8, LessThan, Bool16x8>), 2)                         \
-+  V(lessThanOrEqual, (CompareFunc<Uint16x8, LessThanOrEqual, Bool16x8>), 2)           \
-+  V(load, (Load<Uint16x8, 8>), 2)                                                     \
-+  V(mul, (BinaryFunc<Uint16x8, Mul, Uint16x8>), 2)                                    \
-+  V(notEqual, (CompareFunc<Uint16x8, NotEqual, Bool16x8>), 2)                         \
-+  V(or, (BinaryFunc<Uint16x8, Or, Uint16x8>), 2)                                      \
-+  V(sub, (BinaryFunc<Uint16x8, Sub, Uint16x8>), 2)                                    \
-+  V(subSaturate, (BinaryFunc<Uint16x8, SubSaturate, Uint16x8>), 2)                    \
-+  V(shiftLeftByScalar, (BinaryScalar<Uint16x8, ShiftLeft>), 2)                        \
-+  V(shiftRightByScalar, (BinaryScalar<Uint16x8, ShiftRightLogical>), 2)               \
-+  V(xor, (BinaryFunc<Uint16x8, Xor, Uint16x8>), 2)
-+
-+#define UINT16X8_TERNARY_FUNCTION_LIST(V)                                             \
-+  V(replaceLane, (ReplaceLane<Uint16x8>), 3)                                          \
-+  V(select, (Select<Uint16x8, Bool16x8>), 3)                                          \
-+  V(store, (Store<Uint16x8, 8>), 3)
-+
-+#define UINT16X8_SHUFFLE_FUNCTION_LIST(V)                                             \
-+  V(swizzle, Swizzle<Uint16x8>, 9)                                                    \
-+  V(shuffle, Shuffle<Uint16x8>, 10)
-+
-+#define UINT16X8_FUNCTION_LIST(V)                                                     \
-+  UINT16X8_UNARY_FUNCTION_LIST(V)                                                     \
-+  UINT16X8_BINARY_FUNCTION_LIST(V)                                                    \
-+  UINT16X8_TERNARY_FUNCTION_LIST(V)                                                   \
-+  UINT16X8_SHUFFLE_FUNCTION_LIST(V)
-+
-+// Int32x4.
-+#define INT32X4_UNARY_FUNCTION_LIST(V)                                                \
-+  V(check, (UnaryFunc<Int32x4, Identity, Int32x4>), 1)                                \
-+  V(fromFloat32x4,     (FuncConvert<Float32x4,     Int32x4>), 1)                      \
-+  V(fromFloat32x4Bits, (FuncConvertBits<Float32x4, Int32x4>), 1)                      \
-+  V(fromFloat64x2Bits, (FuncConvertBits<Float64x2, Int32x4>), 1)                      \
-+  V(fromInt8x16Bits,   (FuncConvertBits<Int8x16,   Int32x4>), 1)                      \
-+  V(fromInt16x8Bits,   (FuncConvertBits<Int16x8,   Int32x4>), 1)                      \
-+  V(fromUint8x16Bits,  (FuncConvertBits<Uint8x16,  Int32x4>), 1)                      \
-+  V(fromUint16x8Bits,  (FuncConvertBits<Uint16x8,  Int32x4>), 1)                      \
-+  V(fromUint32x4Bits,  (FuncConvertBits<Uint32x4,  Int32x4>), 1)                      \
-+  V(neg, (UnaryFunc<Int32x4, Neg, Int32x4>), 1)                                       \
-+  V(not, (UnaryFunc<Int32x4, Not, Int32x4>), 1)                                       \
-+  V(splat, (FuncSplat<Int32x4>), 0)
-+
-+#define INT32X4_BINARY_FUNCTION_LIST(V)                                               \
-+  V(add, (BinaryFunc<Int32x4, Add, Int32x4>), 2)                                      \
-+  V(and, (BinaryFunc<Int32x4, And, Int32x4>), 2)                                      \
-+  V(equal, (CompareFunc<Int32x4, Equal, Bool32x4>), 2)                                \
-+  V(extractLane, (ExtractLane<Int32x4>), 2)                                           \
-+  V(greaterThan, (CompareFunc<Int32x4, GreaterThan, Bool32x4>), 2)                    \
-+  V(greaterThanOrEqual, (CompareFunc<Int32x4, GreaterThanOrEqual, Bool32x4>), 2)      \
-+  V(lessThan, (CompareFunc<Int32x4, LessThan, Bool32x4>), 2)                          \
-+  V(lessThanOrEqual, (CompareFunc<Int32x4, LessThanOrEqual, Bool32x4>), 2)            \
-+  V(load,  (Load<Int32x4, 4>), 2)                                                     \
-+  V(load3, (Load<Int32x4, 3>), 2)                                                     \
-+  V(load2, (Load<Int32x4, 2>), 2)                                                     \
-+  V(load1, (Load<Int32x4, 1>), 2)                                                     \
-+  V(mul, (BinaryFunc<Int32x4, Mul, Int32x4>), 2)                                      \
-+  V(notEqual, (CompareFunc<Int32x4, NotEqual, Bool32x4>), 2)                          \
-+  V(or, (BinaryFunc<Int32x4, Or, Int32x4>), 2)                                        \
-+  V(sub, (BinaryFunc<Int32x4, Sub, Int32x4>), 2)                                      \
-+  V(shiftLeftByScalar, (BinaryScalar<Int32x4, ShiftLeft>), 2)                         \
-+  V(shiftRightByScalar, (BinaryScalar<Int32x4, ShiftRightArithmetic>), 2)             \
-+  V(xor, (BinaryFunc<Int32x4, Xor, Int32x4>), 2)
-+
-+#define INT32X4_TERNARY_FUNCTION_LIST(V)                                              \
-+  V(replaceLane, (ReplaceLane<Int32x4>), 3)                                           \
-+  V(select, (Select<Int32x4, Bool32x4>), 3)                                           \
-+  V(store,  (Store<Int32x4, 4>), 3)                                                   \
-+  V(store3, (Store<Int32x4, 3>), 3)                                                   \
-+  V(store2, (Store<Int32x4, 2>), 3)                                                   \
-+  V(store1, (Store<Int32x4, 1>), 3)
-+
-+#define INT32X4_SHUFFLE_FUNCTION_LIST(V)                                              \
-+  V(swizzle, Swizzle<Int32x4>, 5)                                                     \
-+  V(shuffle, Shuffle<Int32x4>, 6)
-+
-+#define INT32X4_FUNCTION_LIST(V)                                                      \
-+  INT32X4_UNARY_FUNCTION_LIST(V)                                                      \
-+  INT32X4_BINARY_FUNCTION_LIST(V)                                                     \
-+  INT32X4_TERNARY_FUNCTION_LIST(V)                                                    \
-+  INT32X4_SHUFFLE_FUNCTION_LIST(V)
-+
-+// Uint32x4.
-+#define UINT32X4_UNARY_FUNCTION_LIST(V)                                               \
-+  V(check, (UnaryFunc<Uint32x4, Identity, Uint32x4>), 1)                              \
-+  V(fromFloat32x4,     (FuncConvert<Float32x4,     Uint32x4>), 1)                     \
-+  V(fromFloat32x4Bits, (FuncConvertBits<Float32x4, Uint32x4>), 1)                     \
-+  V(fromFloat64x2Bits, (FuncConvertBits<Float64x2, Uint32x4>), 1)                     \
-+  V(fromInt8x16Bits,   (FuncConvertBits<Int8x16,   Uint32x4>), 1)                     \
-+  V(fromInt16x8Bits,   (FuncConvertBits<Int16x8,   Uint32x4>), 1)                     \
-+  V(fromInt32x4Bits,   (FuncConvertBits<Int32x4,   Uint32x4>), 1)                     \
-+  V(fromUint8x16Bits,  (FuncConvertBits<Uint8x16,  Uint32x4>), 1)                     \
-+  V(fromUint16x8Bits,  (FuncConvertBits<Uint16x8,  Uint32x4>), 1)                     \
-+  V(neg, (UnaryFunc<Uint32x4, Neg, Uint32x4>), 1)                                     \
-+  V(not, (UnaryFunc<Uint32x4, Not, Uint32x4>), 1)                                     \
-+  V(splat, (FuncSplat<Uint32x4>), 0)
-+
-+#define UINT32X4_BINARY_FUNCTION_LIST(V)                                              \
-+  V(add, (BinaryFunc<Uint32x4, Add, Uint32x4>), 2)                                    \
-+  V(and, (BinaryFunc<Uint32x4, And, Uint32x4>), 2)                                    \
-+  V(equal, (CompareFunc<Uint32x4, Equal, Bool32x4>), 2)                               \
-+  V(extractLane, (ExtractLane<Uint32x4>), 2)                                          \
-+  V(greaterThan, (CompareFunc<Uint32x4, GreaterThan, Bool32x4>), 2)                   \
-+  V(greaterThanOrEqual, (CompareFunc<Uint32x4, GreaterThanOrEqual, Bool32x4>), 2)     \
-+  V(lessThan, (CompareFunc<Uint32x4, LessThan, Bool32x4>), 2)                         \
-+  V(lessThanOrEqual, (CompareFunc<Uint32x4, LessThanOrEqual, Bool32x4>), 2)           \
-+  V(load,  (Load<Uint32x4, 4>), 2)                                                    \
-+  V(load3, (Load<Uint32x4, 3>), 2)                                                    \
-+  V(load2, (Load<Uint32x4, 2>), 2)                                                    \
-+  V(load1, (Load<Uint32x4, 1>), 2)                                                    \
-+  V(mul, (BinaryFunc<Uint32x4, Mul, Uint32x4>), 2)                                    \
-+  V(notEqual, (CompareFunc<Uint32x4, NotEqual, Bool32x4>), 2)                         \
-+  V(or, (BinaryFunc<Uint32x4, Or, Uint32x4>), 2)                                      \
-+  V(sub, (BinaryFunc<Uint32x4, Sub, Uint32x4>), 2)                                    \
-+  V(shiftLeftByScalar, (BinaryScalar<Uint32x4, ShiftLeft>), 2)                        \
-+  V(shiftRightByScalar, (BinaryScalar<Uint32x4, ShiftRightLogical>), 2)               \
-+  V(xor, (BinaryFunc<Uint32x4, Xor, Uint32x4>), 2)
-+
-+#define UINT32X4_TERNARY_FUNCTION_LIST(V)                                             \
-+  V(replaceLane, (ReplaceLane<Uint32x4>), 3)                                          \
-+  V(select, (Select<Uint32x4, Bool32x4>), 3)                                          \
-+  V(store,  (Store<Uint32x4, 4>), 3)                                                  \
-+  V(store3, (Store<Uint32x4, 3>), 3)                                                  \
-+  V(store2, (Store<Uint32x4, 2>), 3)                                                  \
-+  V(store1, (Store<Uint32x4, 1>), 3)
-+
-+#define UINT32X4_SHUFFLE_FUNCTION_LIST(V)                                             \
-+  V(swizzle, Swizzle<Uint32x4>, 5)                                                    \
-+  V(shuffle, Shuffle<Uint32x4>, 6)
-+
-+#define UINT32X4_FUNCTION_LIST(V)                                                     \
-+  UINT32X4_UNARY_FUNCTION_LIST(V)                                                     \
-+  UINT32X4_BINARY_FUNCTION_LIST(V)                                                    \
-+  UINT32X4_TERNARY_FUNCTION_LIST(V)                                                   \
-+  UINT32X4_SHUFFLE_FUNCTION_LIST(V)
-+
-+/*
-+ * The FOREACH macros below partition all of the SIMD operations into disjoint
-+ * sets.
-+ */
-+
-+// Operations available on all SIMD types. Mixed arity.
-+#define FOREACH_COMMON_SIMD_OP(_)     \
-+    _(extractLane)                    \
-+    _(replaceLane)                    \
-+    _(check)                          \
-+    _(splat)
-+
-+// Lanewise operations available on numeric SIMD types.
-+// Include lane-wise select here since it is not arithmetic and defined on
-+// numeric types too.
-+#define FOREACH_LANE_SIMD_OP(_)       \
-+    _(select)                         \
-+    _(swizzle)                        \
-+    _(shuffle)
-+
-+// Memory operations available on numeric SIMD types.
-+#define FOREACH_MEMORY_SIMD_OP(_)     \
-+    _(load)                           \
-+    _(store)
-+
-+// Memory operations available on numeric X4 SIMD types.
-+#define FOREACH_MEMORY_X4_SIMD_OP(_)  \
-+    _(load1)                          \
-+    _(load2)                          \
-+    _(load3)                          \
-+    _(store1)                         \
-+    _(store2)                         \
-+    _(store3)
-+
-+// Unary operations on Bool vectors.
-+#define FOREACH_BOOL_SIMD_UNOP(_)     \
-+    _(allTrue)                        \
-+    _(anyTrue)
-+
-+// Unary bitwise SIMD operators defined on all integer and boolean SIMD types.
-+#define FOREACH_BITWISE_SIMD_UNOP(_)  \
-+    _(not)
-+
-+// Binary bitwise SIMD operators defined on all integer and boolean SIMD types.
-+#define FOREACH_BITWISE_SIMD_BINOP(_) \
-+    _(and)                            \
-+    _(or)                             \
-+    _(xor)
-+
-+// Bitwise shifts defined on integer SIMD types.
-+#define FOREACH_SHIFT_SIMD_OP(_)      \
-+    _(shiftLeftByScalar)              \
-+    _(shiftRightByScalar)
-+
-+// Unary arithmetic operators defined on numeric SIMD types.
-+#define FOREACH_NUMERIC_SIMD_UNOP(_)  \
-+    _(neg)
-+
-+// Binary arithmetic operators defined on numeric SIMD types.
-+#define FOREACH_NUMERIC_SIMD_BINOP(_) \
-+    _(add)                            \
-+    _(sub)                            \
-+    _(mul)
-+
-+// Unary arithmetic operators defined on floating point SIMD types.
-+#define FOREACH_FLOAT_SIMD_UNOP(_)    \
-+    _(abs)                            \
-+    _(sqrt)                           \
-+    _(reciprocalApproximation)        \
-+    _(reciprocalSqrtApproximation)
-+
-+// Binary arithmetic operators defined on floating point SIMD types.
-+#define FOREACH_FLOAT_SIMD_BINOP(_)   \
-+    _(div)                            \
-+    _(max)                            \
-+    _(min)                            \
-+    _(maxNum)                         \
-+    _(minNum)
-+
-+// Binary operations on small integer (< 32 bits) vectors.
-+#define FOREACH_SMINT_SIMD_BINOP(_)   \
-+    _(addSaturate)                    \
-+    _(subSaturate)
-+
-+// Comparison operators defined on numeric SIMD types.
-+#define FOREACH_COMP_SIMD_OP(_)       \
-+    _(lessThan)                       \
-+    _(lessThanOrEqual)                \
-+    _(equal)                          \
-+    _(notEqual)                       \
-+    _(greaterThan)                    \
-+    _(greaterThanOrEqual)
-+
-+/*
-+ * All SIMD operations, excluding casts.
-+ */
-+#define FORALL_SIMD_NONCAST_OP(_)     \
-+    FOREACH_COMMON_SIMD_OP(_)         \
-+    FOREACH_LANE_SIMD_OP(_)           \
-+    FOREACH_MEMORY_SIMD_OP(_)         \
-+    FOREACH_MEMORY_X4_SIMD_OP(_)      \
-+    FOREACH_BOOL_SIMD_UNOP(_)         \
-+    FOREACH_BITWISE_SIMD_UNOP(_)      \
-+    FOREACH_BITWISE_SIMD_BINOP(_)     \
-+    FOREACH_SHIFT_SIMD_OP(_)          \
-+    FOREACH_NUMERIC_SIMD_UNOP(_)      \
-+    FOREACH_NUMERIC_SIMD_BINOP(_)     \
-+    FOREACH_FLOAT_SIMD_UNOP(_)        \
-+    FOREACH_FLOAT_SIMD_BINOP(_)       \
-+    FOREACH_SMINT_SIMD_BINOP(_)       \
-+    FOREACH_COMP_SIMD_OP(_)
-+
-+/*
-+ * All operations on integer SIMD types, excluding casts and
-+ * FOREACH_MEMORY_X4_OP.
-+ */
-+#define FORALL_INT_SIMD_OP(_)         \
-+    FOREACH_COMMON_SIMD_OP(_)         \
-+    FOREACH_LANE_SIMD_OP(_)           \
-+    FOREACH_MEMORY_SIMD_OP(_)         \
-+    FOREACH_BITWISE_SIMD_UNOP(_)      \
-+    FOREACH_BITWISE_SIMD_BINOP(_)     \
-+    FOREACH_SHIFT_SIMD_OP(_)          \
-+    FOREACH_NUMERIC_SIMD_UNOP(_)      \
-+    FOREACH_NUMERIC_SIMD_BINOP(_)     \
-+    FOREACH_COMP_SIMD_OP(_)
-+
-+/*
-+ * All operations on floating point SIMD types, excluding casts and
-+ * FOREACH_MEMORY_X4_OP.
-+ */
-+#define FORALL_FLOAT_SIMD_OP(_)       \
-+    FOREACH_COMMON_SIMD_OP(_)         \
-+    FOREACH_LANE_SIMD_OP(_)           \
-+    FOREACH_MEMORY_SIMD_OP(_)         \
-+    FOREACH_NUMERIC_SIMD_UNOP(_)      \
-+    FOREACH_NUMERIC_SIMD_BINOP(_)     \
-+    FOREACH_FLOAT_SIMD_UNOP(_)        \
-+    FOREACH_FLOAT_SIMD_BINOP(_)       \
-+    FOREACH_COMP_SIMD_OP(_)
-+
-+/*
-+ * All operations on Bool SIMD types.
-+ *
-+ * These types don't have casts, so no need to specialize.
-+ */
-+#define FORALL_BOOL_SIMD_OP(_)        \
-+    FOREACH_COMMON_SIMD_OP(_)         \
-+    FOREACH_BOOL_SIMD_UNOP(_)         \
-+    FOREACH_BITWISE_SIMD_UNOP(_)      \
-+    FOREACH_BITWISE_SIMD_BINOP(_)
-+
-+/*
-+ * The sets of cast operations are listed per type below.
-+ *
-+ * These sets are not disjoint.
-+ */
-+
-+#define FOREACH_INT8X16_SIMD_CAST(_)  \
-+    _(fromFloat32x4Bits)              \
-+    _(fromFloat64x2Bits)              \
-+    _(fromInt16x8Bits)                \
-+    _(fromInt32x4Bits)
-+
-+#define FOREACH_INT16X8_SIMD_CAST(_)  \
-+    _(fromFloat32x4Bits)              \
-+    _(fromFloat64x2Bits)              \
-+    _(fromInt8x16Bits)                \
-+    _(fromInt32x4Bits)
-+
-+#define FOREACH_INT32X4_SIMD_CAST(_)  \
-+    _(fromFloat32x4)                  \
-+    _(fromFloat32x4Bits)              \
-+    _(fromFloat64x2Bits)              \
-+    _(fromInt8x16Bits)                \
-+    _(fromInt16x8Bits)
-+
-+#define FOREACH_FLOAT32X4_SIMD_CAST(_)\
-+    _(fromFloat64x2Bits)              \
-+    _(fromInt8x16Bits)                \
-+    _(fromInt16x8Bits)                \
-+    _(fromInt32x4)                    \
-+    _(fromInt32x4Bits)
-+
-+#define FOREACH_FLOAT64X2_SIMD_CAST(_)\
-+    _(fromFloat32x4Bits)              \
-+    _(fromInt8x16Bits)                \
-+    _(fromInt16x8Bits)                \
-+    _(fromInt32x4Bits)
-+
-+// All operations on Int32x4.
-+#define FORALL_INT32X4_SIMD_OP(_)     \
-+    FORALL_INT_SIMD_OP(_)             \
-+    FOREACH_MEMORY_X4_SIMD_OP(_)      \
-+    FOREACH_INT32X4_SIMD_CAST(_)
-+
-+// All operations on Float32X4
-+#define FORALL_FLOAT32X4_SIMD_OP(_)   \
-+    FORALL_FLOAT_SIMD_OP(_)           \
-+    FOREACH_MEMORY_X4_SIMD_OP(_)      \
-+    FOREACH_FLOAT32X4_SIMD_CAST(_)
-+
-+/*
-+ * All SIMD operations assuming only 32x4 types exist.
-+ * This is used in the current asm.js impl.
-+ */
-+#define FORALL_SIMD_ASMJS_OP(_)       \
-+    FORALL_SIMD_NONCAST_OP(_)         \
-+    _(fromFloat32x4)                  \
-+    _(fromFloat32x4Bits)              \
-+    _(fromInt8x16Bits)                \
-+    _(fromInt16x8Bits)                \
-+    _(fromInt32x4)                    \
-+    _(fromInt32x4Bits)                \
-+    _(fromUint8x16Bits)               \
-+    _(fromUint16x8Bits)               \
-+    _(fromUint32x4)                   \
-+    _(fromUint32x4Bits)
-+
-+// All operations on Int8x16 or Uint8x16 in the asm.js world.
-+// Note: this does not include conversions and casts to/from Uint8x16 because
-+// this list is shared between Int8x16 and Uint8x16.
-+#define FORALL_INT8X16_ASMJS_OP(_)    \
-+    FORALL_INT_SIMD_OP(_)             \
-+    FOREACH_SMINT_SIMD_BINOP(_)       \
-+    _(fromInt16x8Bits)                \
-+    _(fromInt32x4Bits)                \
-+    _(fromFloat32x4Bits)
-+
-+// All operations on Int16x8 or Uint16x8 in the asm.js world.
-+// Note: this does not include conversions and casts to/from Uint16x8 because
-+// this list is shared between Int16x8 and Uint16x8.
-+#define FORALL_INT16X8_ASMJS_OP(_)    \
-+    FORALL_INT_SIMD_OP(_)             \
-+    FOREACH_SMINT_SIMD_BINOP(_)       \
-+    _(fromInt8x16Bits)                \
-+    _(fromInt32x4Bits)                \
-+    _(fromFloat32x4Bits)
-+
-+// All operations on Int32x4 or Uint32x4 in the asm.js world.
-+// Note: this does not include conversions and casts to/from Uint32x4 because
-+// this list is shared between Int32x4 and Uint32x4.
-+#define FORALL_INT32X4_ASMJS_OP(_)    \
-+    FORALL_INT_SIMD_OP(_)             \
-+    FOREACH_MEMORY_X4_SIMD_OP(_)      \
-+    _(fromInt8x16Bits)                \
-+    _(fromInt16x8Bits)                \
-+    _(fromFloat32x4)                  \
-+    _(fromFloat32x4Bits)
-+
-+// All operations on Float32X4 in the asm.js world.
-+#define FORALL_FLOAT32X4_ASMJS_OP(_)  \
-+    FORALL_FLOAT_SIMD_OP(_)           \
-+    FOREACH_MEMORY_X4_SIMD_OP(_)      \
-+    _(fromInt8x16Bits)                \
-+    _(fromInt16x8Bits)                \
-+    _(fromInt32x4Bits)                \
-+    _(fromInt32x4)                    \
-+    _(fromUint32x4)
-+
-+namespace js {
-+
-+// Complete set of SIMD types.
-+// It must be kept in sync with the enumeration of values in
-+// TypedObjectConstants.h; in particular we need to ensure that Count is
-+// appropriately set with respect to the number of actual types.
-+enum class SimdType {
-+    Int8x16   = JS_SIMDTYPEREPR_INT8X16,
-+    Int16x8   = JS_SIMDTYPEREPR_INT16X8,
-+    Int32x4   = JS_SIMDTYPEREPR_INT32X4,
-+    Uint8x16  = JS_SIMDTYPEREPR_UINT8X16,
-+    Uint16x8  = JS_SIMDTYPEREPR_UINT16X8,
-+    Uint32x4  = JS_SIMDTYPEREPR_UINT32X4,
-+    Float32x4 = JS_SIMDTYPEREPR_FLOAT32X4,
-+    Float64x2 = JS_SIMDTYPEREPR_FLOAT64X2,
-+    Bool8x16  = JS_SIMDTYPEREPR_BOOL8X16,
-+    Bool16x8  = JS_SIMDTYPEREPR_BOOL16X8,
-+    Bool32x4  = JS_SIMDTYPEREPR_BOOL32X4,
-+    Bool64x2  = JS_SIMDTYPEREPR_BOOL64X2,
-+    Count
-+};
-+
-+// The integer SIMD types have a lot of operations that do the exact same thing
-+// for signed and unsigned integer types. Sometimes it is simpler to treat
-+// signed and unsigned integer SIMD types as the same type, using a SimdSign to
-+// distinguish the few cases where there is a difference.
-+enum class SimdSign {
-+    // Signedness is not applicable to this type. (i.e., Float or Bool).
-+    NotApplicable,
-+    // Treat as an unsigned integer with a range 0 .. 2^N-1.
-+    Unsigned,
-+    // Treat as a signed integer in two's complement encoding.
-+    Signed,
-+};
-+
-+// Get the signedness of a SIMD type.
-+inline SimdSign
-+GetSimdSign(SimdType t)
-+{
-+    switch(t) {
-+      case SimdType::Int8x16:
-+      case SimdType::Int16x8:
-+      case SimdType::Int32x4:
-+        return SimdSign::Signed;
-+
-+      case SimdType::Uint8x16:
-+      case SimdType::Uint16x8:
-+      case SimdType::Uint32x4:
-+        return SimdSign::Unsigned;
-+
-+      default:
-+        return SimdSign::NotApplicable;
-+    }
-+}
-+
-+inline bool
-+IsSignedIntSimdType(SimdType type)
-+{
-+    return GetSimdSign(type) == SimdSign::Signed;
-+}
-+
-+// Get the boolean SIMD type with the same shape as t.
-+//
-+// This is the result type of a comparison operation, and it can also be used to
-+// identify the geometry of a SIMD type.
-+inline SimdType
-+GetBooleanSimdType(SimdType t)
-+{
-+    switch(t) {
-+      case SimdType::Int8x16:
-+      case SimdType::Uint8x16:
-+      case SimdType::Bool8x16:
-+        return SimdType::Bool8x16;
-+
-+      case SimdType::Int16x8:
-+      case SimdType::Uint16x8:
-+      case SimdType::Bool16x8:
-+        return SimdType::Bool16x8;
-+
-+      case SimdType::Int32x4:
-+      case SimdType::Uint32x4:
-+      case SimdType::Float32x4:
-+      case SimdType::Bool32x4:
-+        return SimdType::Bool32x4;
-+
-+      case SimdType::Float64x2:
-+      case SimdType::Bool64x2:
-+        return SimdType::Bool64x2;
-+
-+      case SimdType::Count:
-+        break;
-+    }
-+    MOZ_MAKE_COMPILER_ASSUME_IS_UNREACHABLE("Bad SIMD type");
-+}
-+
-+// Get the number of lanes in a SIMD type.
-+inline unsigned
-+GetSimdLanes(SimdType t)
-+{
-+    switch(t) {
-+      case SimdType::Int8x16:
-+      case SimdType::Uint8x16:
-+      case SimdType::Bool8x16:
-+        return 16;
-+
-+      case SimdType::Int16x8:
-+      case SimdType::Uint16x8:
-+      case SimdType::Bool16x8:
-+        return 8;
-+
-+      case SimdType::Int32x4:
-+      case SimdType::Uint32x4:
-+      case SimdType::Float32x4:
-+      case SimdType::Bool32x4:
-+        return 4;
-+
-+      case SimdType::Float64x2:
-+      case SimdType::Bool64x2:
-+        return 2;
-+
-+      case SimdType::Count:
-+        break;
-+    }
-+    MOZ_MAKE_COMPILER_ASSUME_IS_UNREACHABLE("Bad SIMD type");
-+}
-+
-+// Complete set of SIMD operations.
-+//
-+// No SIMD types implement all of these operations.
-+//
-+// C++ defines keywords and/or/xor/not, so prepend Fn_ to all named functions to
-+// avoid clashes.
-+//
-+// Note: because of a gcc < v4.8's compiler bug, uint8_t can't be used as the
-+// storage class here. See bug 1243810. See also
-+// https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64037 .
-+enum class SimdOperation {
-+    // The constructor call. No Fn_ prefix here.
-+    Constructor,
-+
-+    // All the operations, except for casts.
-+#define DEFOP(x) Fn_##x,
-+    FORALL_SIMD_NONCAST_OP(DEFOP)
-+#undef DEFOP
-+
-+    // Int <-> Float conversions.
-+    Fn_fromInt32x4,
-+    Fn_fromUint32x4,
-+    Fn_fromFloat32x4,
-+
-+    // Bitcasts. One for each type with a memory representation.
-+    Fn_fromInt8x16Bits,
-+    Fn_fromInt16x8Bits,
-+    Fn_fromInt32x4Bits,
-+    Fn_fromUint8x16Bits,
-+    Fn_fromUint16x8Bits,
-+    Fn_fromUint32x4Bits,
-+    Fn_fromFloat32x4Bits,
-+    Fn_fromFloat64x2Bits,
-+
-+    Last = Fn_fromFloat64x2Bits
-+};
-+
-+} // namespace js
-+
-+#endif /* builtin_SIMDConstants_h */
-diff --git a/js/src/builtin/TypedObject.cpp b/js/src/builtin/TypedObject.cpp
---- a/js/src/builtin/TypedObject.cpp
-+++ b/js/src/builtin/TypedObject.cpp
-@@ -6,17 +6,17 @@
- 
- #include "builtin/TypedObject-inl.h"
- 
- #include "mozilla/Casting.h"
- #include "mozilla/CheckedInt.h"
- 
- #include "jsutil.h"
- 
--#include "builtin/SIMD.h"
-+#include "builtin/SIMDConstants.h"
- #include "gc/Marking.h"
- #include "js/Vector.h"
- #include "util/StringBuffer.h"
- #include "vm/GlobalObject.h"
- #include "vm/JSFunction.h"
- #include "vm/Realm.h"
- #include "vm/SelfHosting.h"
- #include "vm/StringType.h"
-diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
---- a/js/src/jit/BaselineIC.cpp
-+++ b/js/src/jit/BaselineIC.cpp
-@@ -9,17 +9,17 @@
- #include "mozilla/DebugOnly.h"
- #include "mozilla/TemplateLib.h"
- 
- #include "jsfriendapi.h"
- #include "jslibmath.h"
- #include "jstypes.h"
- 
- #include "builtin/Eval.h"
--#include "builtin/SIMD.h"
-+#include "builtin/SIMDConstants.h"
- #include "gc/Policy.h"
- #include "jit/BaselineCacheIRCompiler.h"
- #include "jit/BaselineDebugModeOSR.h"
- #include "jit/BaselineJIT.h"
- #include "jit/InlinableNatives.h"
- #include "jit/JitSpewer.h"
- #include "jit/Linker.h"
- #include "jit/Lowering.h"
-diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp
---- a/js/src/jit/MCallOptimize.cpp
-+++ b/js/src/jit/MCallOptimize.cpp
-@@ -10,17 +10,17 @@
- 
- #include "builtin/AtomicsObject.h"
- #include "builtin/intl/Collator.h"
- #include "builtin/intl/DateTimeFormat.h"
- #include "builtin/intl/NumberFormat.h"
- #include "builtin/intl/PluralRules.h"
- #include "builtin/intl/RelativeTimeFormat.h"
- #include "builtin/MapObject.h"
--#include "builtin/SIMD.h"
-+#include "builtin/SIMDConstants.h"
- #include "builtin/String.h"
- #include "builtin/TestingFunctions.h"
- #include "builtin/TypedObject.h"
- #include "jit/BaselineInspector.h"
- #include "jit/InlinableNatives.h"
- #include "jit/IonBuilder.h"
- #include "jit/Lowering.h"
- #include "jit/MIR.h"
-diff --git a/js/src/jit/MIR.cpp b/js/src/jit/MIR.cpp
---- a/js/src/jit/MIR.cpp
-+++ b/js/src/jit/MIR.cpp
-@@ -12,16 +12,17 @@
- #include "mozilla/IntegerPrintfMacros.h"
- #include "mozilla/MathAlgorithms.h"
- 
- #include <ctype.h>
- 
- #include "jslibmath.h"
- 
- #include "builtin/RegExp.h"
-+#include "builtin/SIMD.h"
- #include "builtin/String.h"
- #include "jit/AtomicOperations.h"
- #include "jit/BaselineInspector.h"
- #include "jit/IonBuilder.h"
- #include "jit/JitSpewer.h"
- #include "jit/MIRGraph.h"
- #include "jit/RangeAnalysis.h"
- #include "js/Conversions.h"
-diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
---- a/js/src/jit/MIR.h
-+++ b/js/src/jit/MIR.h
-@@ -12,17 +12,17 @@
- #ifndef jit_MIR_h
- #define jit_MIR_h
- 
- #include "mozilla/Alignment.h"
- #include "mozilla/Array.h"
- #include "mozilla/Attributes.h"
- #include "mozilla/MacroForEach.h"
- 
--#include "builtin/SIMD.h"
-+#include "builtin/SIMDConstants.h"
- #include "jit/AtomicOp.h"
- #include "jit/BaselineIC.h"
- #include "jit/FixedList.h"
- #include "jit/InlineList.h"
- #include "jit/JitAllocPolicy.h"
- #include "jit/MacroAssembler.h"
- #include "jit/MOpcodes.h"
- #include "jit/TypedObjectPrediction.h"
-diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
---- a/js/src/jsapi.cpp
-+++ b/js/src/jsapi.cpp
-@@ -38,17 +38,17 @@
- #include "builtin/JSON.h"
- #include "builtin/MapObject.h"
- #include "builtin/Promise.h"
- #include "builtin/RegExp.h"
- #include "builtin/Stream.h"
- #include "builtin/String.h"
- #include "builtin/Symbol.h"
- #ifdef ENABLE_SIMD
--# include "builtin/SIMD.h"
-+# include "builtin/SIMDConstants.h"
- #endif
- #ifdef ENABLE_BINARYDATA
- # include "builtin/TypedObject.h"
- #endif
- #include "frontend/BytecodeCompiler.h"
- #include "frontend/FullParseHandler.h"  // for JS_BufferIsCompileableUnit
- #include "frontend/Parser.h" // for JS_BufferIsCompileableUnit
- #include "gc/FreeOp.h"
-diff --git a/js/src/wasm/WasmBinaryConstants.h b/js/src/wasm/WasmBinaryConstants.h
---- a/js/src/wasm/WasmBinaryConstants.h
-+++ b/js/src/wasm/WasmBinaryConstants.h
-@@ -14,17 +14,17 @@
-  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  * See the License for the specific language governing permissions and
-  * limitations under the License.
-  */
- 
- #ifndef wasm_binary_h
- #define wasm_binary_h
- 
--#include "builtin/SIMD.h"
-+#include "builtin/SIMDConstants.h"
- 
- namespace js {
- namespace wasm {
- 
- static const uint32_t MagicNumber        = 0x6d736100; // "\0asm"
- static const uint32_t EncodingVersion    = 0x01;
- 
- enum class SectionId
-diff --git a/js/src/wasm/WasmInstance.cpp b/js/src/wasm/WasmInstance.cpp
---- a/js/src/wasm/WasmInstance.cpp
-+++ b/js/src/wasm/WasmInstance.cpp
-@@ -13,16 +13,17 @@
-  * distributed under the License is distributed on an "AS IS" BASIS,
-  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  * See the License for the specific language governing permissions and
-  * limitations under the License.
-  */
- 
- #include "wasm/WasmInstance.h"
- 
-+#include "builtin/SIMD.h"
- #include "jit/AtomicOperations.h"
- #include "jit/BaselineJIT.h"
- #include "jit/InlinableNatives.h"
- #include "jit/JitCommon.h"
- #include "jit/JitRealm.h"
- #include "wasm/WasmBuiltins.h"
- #include "wasm/WasmModule.h"
- 

frg/work-js/mozilla-release/patches/mozilla-central-push_426940.patch

@@ -1,401 +0,0 @@
-# HG changeset patch
-# User Jon Coppeard <jcoppeard@mozilla.com>
-# Date 1531829234 -3600
-#      Tue Jul 17 13:07:14 2018 +0100
-# Node ID dc942361448ddd7af5e31213f3e4b45343b8f9ab
-# Parent  bedc90c72ee31e496b2aa178b159026941b08613
-Bug 1476012 - Remove the dependency of JitcodeMap.h on CodeGenerator-shared.h r=nbp
-
-diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
---- a/js/src/gc/GC.cpp
-+++ b/js/src/gc/GC.cpp
-@@ -218,16 +218,17 @@
- #include "gc/GCInternals.h"
- #include "gc/GCTrace.h"
- #include "gc/Memory.h"
- #include "gc/Policy.h"
- #include "gc/WeakMap.h"
- #include "jit/BaselineJIT.h"
- #include "jit/IonCode.h"
- #include "jit/JitcodeMap.h"
-+#include "jit/JitRealm.h"
- #include "js/SliceBudget.h"
- #include "proxy/DeadObjectProxy.h"
- #include "util/Windows.h"
- #ifdef ENABLE_BIGINT
- #include "vm/BigIntType.h"
- #endif
- #include "vm/Debugger.h"
- #include "vm/GeckoProfiler.h"
-diff --git a/js/src/jit/JitcodeMap.cpp b/js/src/jit/JitcodeMap.cpp
---- a/js/src/jit/JitcodeMap.cpp
-+++ b/js/src/jit/JitcodeMap.cpp
-@@ -9,16 +9,17 @@
- #include "mozilla/ArrayUtils.h"
- #include "mozilla/MathAlgorithms.h"
- #include "mozilla/Maybe.h"
- #include "mozilla/Sprintf.h"
- 
- #include "gc/Marking.h"
- #include "gc/Statistics.h"
- #include "jit/BaselineJIT.h"
-+#include "jit/JitRealm.h"
- #include "jit/JitSpewer.h"
- #include "js/Vector.h"
- #include "vm/GeckoProfiler.h"
- 
- #include "vm/GeckoProfiler-inl.h"
- #include "vm/JSScript-inl.h"
- #include "vm/TypeInference-inl.h"
- 
-@@ -1195,18 +1196,18 @@ JitcodeRegionEntry::ReadDelta(CompactBuf
-         pcDeltaU |= ~ENC4_PC_DELTA_MAX;
-     *pcDelta = pcDeltaU;
- 
-     MOZ_ASSERT(*pcDelta != 0);
-     MOZ_ASSERT_IF(*nativeDelta == 0, *pcDelta <= 0);
- }
- 
- /* static */ uint32_t
--JitcodeRegionEntry::ExpectedRunLength(const CodeGeneratorShared::NativeToBytecode* entry,
--                                      const CodeGeneratorShared::NativeToBytecode* end)
-+JitcodeRegionEntry::ExpectedRunLength(const NativeToBytecode* entry,
-+                                      const NativeToBytecode* end)
- {
-     MOZ_ASSERT(entry < end);
- 
-     // We always use the first entry, so runLength starts at 1
-     uint32_t runLength = 1;
- 
-     uint32_t curNativeOffset = entry->nativeOffset.offset();
-     uint32_t curBytecodeOffset = entry->tree->script()->pcToOffset(entry->pc);
-@@ -1283,17 +1284,17 @@ struct JitcodeMapBufferWriteSpewer
-     void spewAndAdvance(const char* name) {}
- #endif // JS_JITSPEW
- };
- 
- // Write a run, starting at the given NativeToBytecode entry, into the given buffer writer.
- /* static */ bool
- JitcodeRegionEntry::WriteRun(CompactBufferWriter& writer,
-                              JSScript** scriptList, uint32_t scriptListSize,
--                             uint32_t runLength, const CodeGeneratorShared::NativeToBytecode* entry)
-+                             uint32_t runLength, const NativeToBytecode* entry)
- {
-     MOZ_ASSERT(runLength > 0);
-     MOZ_ASSERT(runLength <= MAX_RUN_LENGTH);
- 
-     // Calculate script depth.
-     MOZ_ASSERT(entry->tree->depth() <= 0xff);
-     uint8_t scriptDepth = entry->tree->depth();
-     uint32_t regionNativeOffset = entry->nativeOffset.offset();
-@@ -1533,18 +1534,18 @@ JitcodeIonTable::findRegionEntry(uint32_
-         }
-     }
-     return idx;
- }
- 
- /* static */ bool
- JitcodeIonTable::WriteIonTable(CompactBufferWriter& writer,
-                                JSScript** scriptList, uint32_t scriptListSize,
--                               const CodeGeneratorShared::NativeToBytecode* start,
--                               const CodeGeneratorShared::NativeToBytecode* end,
-+                               const NativeToBytecode* start,
-+                               const NativeToBytecode* end,
-                                uint32_t* tableOffsetOut, uint32_t* numRegionsOut)
- {
-     MOZ_ASSERT(tableOffsetOut != nullptr);
-     MOZ_ASSERT(numRegionsOut != nullptr);
-     MOZ_ASSERT(writer.length() == 0);
-     MOZ_ASSERT(scriptListSize > 0);
- 
-     JitSpew(JitSpew_Profiling, "Writing native to bytecode map for %s:%u (%zu entries)",
-@@ -1554,17 +1555,17 @@ JitcodeIonTable::WriteIonTable(CompactBu
-     JitSpew(JitSpew_Profiling, "  ScriptList of size %d", int(scriptListSize));
-     for (uint32_t i = 0; i < scriptListSize; i++) {
-         JitSpew(JitSpew_Profiling, "  Script %d - %s:%u",
-                 int(i), scriptList[i]->filename(), scriptList[i]->lineno());
-     }
- 
-     // Write out runs first.  Keep a vector tracking the positive offsets from payload
-     // start to the run.
--    const CodeGeneratorShared::NativeToBytecode* curEntry = start;
-+    const NativeToBytecode* curEntry = start;
-     js::Vector<uint32_t, 32, SystemAllocPolicy> runOffsets;
- 
-     while (curEntry != end) {
-         // Calculate the length of the next run.
-         uint32_t runLength = JitcodeRegionEntry::ExpectedRunLength(curEntry, end);
-         MOZ_ASSERT(runLength > 0);
-         MOZ_ASSERT(runLength <= uintptr_t(end - curEntry));
-         JitSpew(JitSpew_Profiling, "  Run at entry %d, length %d, buffer offset %d",
-diff --git a/js/src/jit/JitcodeMap.h b/js/src/jit/JitcodeMap.h
---- a/js/src/jit/JitcodeMap.h
-+++ b/js/src/jit/JitcodeMap.h
-@@ -6,17 +6,16 @@
- 
- #ifndef jit_JitcodeMap_h
- #define jit_JitcodeMap_h
- 
- #include "jit/CompactBuffer.h"
- #include "jit/CompileInfo.h"
- #include "jit/ExecutableAllocator.h"
- #include "jit/OptimizationTracking.h"
--#include "jit/shared/CodeGenerator-shared.h"
- 
- namespace js {
- namespace jit {
- 
- /*
-  * The Ion jitcode map implements tables to allow mapping from addresses in ion jitcode
-  * to the list of (JSScript*, jsbytecode*) pairs that are implicitly active in the frame at
-  * that point in the native code.
-@@ -32,16 +31,22 @@ namespace jit {
-  */
- 
- class JitcodeGlobalTable;
- class JitcodeIonTable;
- class JitcodeRegionEntry;
- 
- class JitcodeGlobalEntry;
- 
-+struct NativeToBytecode {
-+    CodeOffset nativeOffset;
-+    InlineScriptTree* tree;
-+    jsbytecode* pc;
-+};
-+
- class JitcodeSkiplistTower
- {
-   public:
-     static const unsigned MAX_HEIGHT = 32;
- 
-   private:
-     uint8_t height_;
-     bool isFree_;
-@@ -1257,23 +1262,23 @@ class JitcodeRegionEntry
-     static void ReadScriptPc(CompactBufferReader& reader, uint32_t* scriptIdx, uint32_t* pcOffset);
- 
-     static void WriteDelta(CompactBufferWriter& writer, uint32_t nativeDelta, int32_t pcDelta);
-     static void ReadDelta(CompactBufferReader& reader, uint32_t* nativeDelta, int32_t* pcDelta);
- 
-     // Given a pointer into an array of NativeToBytecode (and a pointer to the end of the array),
-     // compute the number of entries that would be consume by outputting a run starting
-     // at this one.
--    static uint32_t ExpectedRunLength(const CodeGeneratorShared::NativeToBytecode* entry,
--                                      const CodeGeneratorShared::NativeToBytecode* end);
-+    static uint32_t ExpectedRunLength(const NativeToBytecode* entry,
-+                                      const NativeToBytecode* end);
- 
-     // Write a run, starting at the given NativeToBytecode entry, into the given buffer writer.
-     static MOZ_MUST_USE bool WriteRun(CompactBufferWriter& writer, JSScript** scriptList,
-                                       uint32_t scriptListSize, uint32_t runLength,
--                                      const CodeGeneratorShared::NativeToBytecode* entry);
-+                                      const NativeToBytecode* entry);
- 
-     // Delta Run entry formats are encoded little-endian:
-     //
-     //  byte 0
-     //  NNNN-BBB0
-     //      Single byte format.  nativeDelta in [0, 15], pcDelta in [0, 7]
-     //
-     static const uint32_t ENC1_MASK = 0x1;
-@@ -1519,18 +1524,18 @@ class JitcodeIonTable
- 
-     const uint8_t* payloadStart() const {
-         // The beginning of the payload the beginning of the first region are the same.
-         return payloadEnd() - regionOffset(0);
-     }
- 
-     static MOZ_MUST_USE bool WriteIonTable(CompactBufferWriter& writer,
-                                            JSScript** scriptList, uint32_t scriptListSize,
--                                           const CodeGeneratorShared::NativeToBytecode* start,
--                                           const CodeGeneratorShared::NativeToBytecode* end,
-+                                           const NativeToBytecode* start,
-+                                           const NativeToBytecode* end,
-                                            uint32_t* tableOffsetOut, uint32_t* numRegionsOut);
- };
- 
- 
- } // namespace jit
- } // namespace js
- 
- #endif /* jit_JitcodeMap_h */
-diff --git a/js/src/jit/OptimizationTracking.h b/js/src/jit/OptimizationTracking.h
---- a/js/src/jit/OptimizationTracking.h
-+++ b/js/src/jit/OptimizationTracking.h
-@@ -15,17 +15,23 @@
- #include "jit/JitSpewer.h"
- #include "js/TrackedOptimizationInfo.h"
- #include "vm/TypeInference.h"
- 
- namespace js {
- 
- namespace jit {
- 
--struct NativeToTrackedOptimizations;
-+struct NativeToTrackedOptimizations
-+{
-+    // [startOffset, endOffset]
-+    CodeOffset startOffset;
-+    CodeOffset endOffset;
-+    const TrackedOptimizations* optimizations;
-+};
- 
- class OptimizationAttempt
- {
-     JS::TrackedStrategy strategy_;
-     JS::TrackedOutcome outcome_;
- 
-   public:
-     OptimizationAttempt(JS::TrackedStrategy strategy, JS::TrackedOutcome outcome)
-diff --git a/js/src/jit/shared/CodeGenerator-shared.h b/js/src/jit/shared/CodeGenerator-shared.h
---- a/js/src/jit/shared/CodeGenerator-shared.h
-+++ b/js/src/jit/shared/CodeGenerator-shared.h
-@@ -6,16 +6,17 @@
- 
- #ifndef jit_shared_CodeGenerator_shared_h
- #define jit_shared_CodeGenerator_shared_h
- 
- #include "mozilla/Alignment.h"
- #include "mozilla/Move.h"
- #include "mozilla/TypeTraits.h"
- 
-+#include "jit/JitcodeMap.h"
- #include "jit/JitFrames.h"
- #include "jit/LIR.h"
- #include "jit/MacroAssembler.h"
- #include "jit/MIRGenerator.h"
- #include "jit/MIRGraph.h"
- #include "jit/OptimizationTracking.h"
- #include "jit/Safepoints.h"
- #include "jit/Snapshots.h"
-@@ -34,27 +35,16 @@ class OutOfLineCallVM;
- 
- class OutOfLineTruncateSlow;
- 
- struct ReciprocalMulConstants {
-     int64_t multiplier;
-     int32_t shiftAmount;
- };
- 
--// This should be nested in CodeGeneratorShared, but it is used in
--// optimization tracking implementation and nested classes cannot be
--// forward-declared.
--struct NativeToTrackedOptimizations
--{
--    // [startOffset, endOffset]
--    CodeOffset startOffset;
--    CodeOffset endOffset;
--    const TrackedOptimizations* optimizations;
--};
--
- class CodeGeneratorShared : public LElementVisitor
- {
-     js::Vector<OutOfLineCode*, 0, SystemAllocPolicy> outOfLineCode_;
- 
-     MacroAssembler& ensureMasm(MacroAssembler* masm);
-     mozilla::Maybe<IonHeapMacroAssembler> maybeMasm_;
- 
-   public:
-@@ -106,23 +96,16 @@ class CodeGeneratorShared : public LElem
-         PatchableTLEvent(CodeOffset offset, const char* event)
-             : offset(offset), event(event)
-         {}
-     };
-     js::Vector<PatchableTLEvent, 0, SystemAllocPolicy> patchableTLEvents_;
-     js::Vector<CodeOffset, 0, SystemAllocPolicy> patchableTLScripts_;
- #endif
- 
--  public:
--    struct NativeToBytecode {
--        CodeOffset nativeOffset;
--        InlineScriptTree* tree;
--        jsbytecode* pc;
--    };
--
-   protected:
-     js::Vector<NativeToBytecode, 0, SystemAllocPolicy> nativeToBytecodeList_;
-     uint8_t* nativeToBytecodeMap_;
-     uint32_t nativeToBytecodeMapSize_;
-     uint32_t nativeToBytecodeTableOffset_;
-     uint32_t nativeToBytecodeNumRegions_;
- 
-     JSScript** nativeToBytecodeScriptList_;
-diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
---- a/js/src/shell/js.cpp
-+++ b/js/src/shell/js.cpp
-@@ -70,24 +70,24 @@
- # include "frontend/BinSource.h"
- #endif // defined(JS_BUILD_BINAST)
- #include "frontend/Parser.h"
- #include "gc/PublicIterators.h"
- #include "jit/arm/Simulator-arm.h"
- #include "jit/InlinableNatives.h"
- #include "jit/Ion.h"
- #include "jit/JitcodeMap.h"
--#include "jit/OptimizationTracking.h"
-+#include "jit/JitRealm.h"
-+#include "jit/shared/CodeGenerator-shared.h"
- #include "js/Debug.h"
- #include "js/GCVector.h"
- #include "js/Initialization.h"
- #include "js/Printf.h"
- #include "js/StructuredClone.h"
- #include "js/SweepingAPI.h"
--#include "js/TrackedOptimizationInfo.h"
- #include "js/Wrapper.h"
- #include "perf/jsperf.h"
- #include "shell/jsoptparse.h"
- #include "shell/jsshell.h"
- #include "shell/OSObject.h"
- #include "threading/ConditionVariable.h"
- #include "threading/ExclusiveData.h"
- #include "threading/LockGuard.h"
-diff --git a/js/src/vm/GeckoProfiler.cpp b/js/src/vm/GeckoProfiler.cpp
---- a/js/src/vm/GeckoProfiler.cpp
-+++ b/js/src/vm/GeckoProfiler.cpp
-@@ -5,21 +5,23 @@
-  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
- 
- #include "vm/GeckoProfiler-inl.h"
- 
- #include "mozilla/DebugOnly.h"
- 
- #include "jsnum.h"
- 
-+#include "gc/GC.h"
- #include "gc/PublicIterators.h"
- #include "jit/BaselineFrame.h"
- #include "jit/BaselineJIT.h"
- #include "jit/JitcodeMap.h"
- #include "jit/JitFrames.h"
-+#include "jit/JitRealm.h"
- #include "jit/JSJitFrameIter.h"
- #include "util/StringBuffer.h"
- #include "vm/JSScript.h"
- 
- #include "gc/Marking-inl.h"
- 
- using namespace js;
- 
-diff --git a/js/src/vm/Stack.cpp b/js/src/vm/Stack.cpp
---- a/js/src/vm/Stack.cpp
-+++ b/js/src/vm/Stack.cpp
-@@ -7,16 +7,17 @@
- #include "vm/Stack-inl.h"
- 
- #include <utility>
- 
- #include "gc/Marking.h"
- #include "jit/BaselineFrame.h"
- #include "jit/JitcodeMap.h"
- #include "jit/JitRealm.h"
-+#include "jit/shared/CodeGenerator-shared.h"
- #include "vm/Debugger.h"
- #include "vm/JSContext.h"
- #include "vm/Opcodes.h"
- 
- #include "jit/JSJitFrameIter-inl.h"
- #include "vm/Compartment-inl.h"
- #include "vm/EnvironmentObject-inl.h"
- #include "vm/Interpreter-inl.h"

frg/work-js/mozilla-release/patches/mozilla-central-push_426941.patch

@@ -1,107 +0,0 @@
-# HG changeset patch
-# User Jon Coppeard <jcoppeard@mozilla.com>
-# Date 1531829267 -3600
-#      Tue Jul 17 13:07:47 2018 +0100
-# Node ID c67b560d92a6920b8254adb5fee6fe25a43e8c4b
-# Parent  dc942361448ddd7af5e31213f3e4b45343b8f9ab
-Bug 1476012 - Remove the dependency of JitFrames.h on Safepoints.h r=nbp
-
-diff --git a/js/src/jit/BaselineJIT.h b/js/src/jit/BaselineJIT.h
---- a/js/src/jit/BaselineJIT.h
-+++ b/js/src/jit/BaselineJIT.h
-@@ -7,16 +7,17 @@
- #ifndef jit_BaselineJIT_h
- #define jit_BaselineJIT_h
- 
- #include "mozilla/MemoryReporting.h"
- 
- #include "ds/LifoAlloc.h"
- #include "jit/Bailouts.h"
- #include "jit/IonCode.h"
-+#include "jit/shared/Assembler-shared.h"
- #include "vm/EnvironmentObject.h"
- #include "vm/JSContext.h"
- #include "vm/Realm.h"
- #include "vm/TraceLogging.h"
- 
- namespace js {
- namespace jit {
- 
-diff --git a/js/src/jit/JSJitFrameIter.cpp b/js/src/jit/JSJitFrameIter.cpp
---- a/js/src/jit/JSJitFrameIter.cpp
-+++ b/js/src/jit/JSJitFrameIter.cpp
-@@ -5,16 +5,17 @@
-  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
- 
- #include "jit/JSJitFrameIter-inl.h"
- 
- #include "jit/BaselineDebugModeOSR.h"
- #include "jit/BaselineIC.h"
- #include "jit/JitcodeMap.h"
- #include "jit/JitFrames.h"
-+#include "jit/Safepoints.h"
- 
- using namespace js;
- using namespace js::jit;
- 
- JSJitFrameIter::JSJitFrameIter(const JitActivation* activation)
-   : current_(activation->jsExitFP()),
-     type_(JitFrame_Exit),
-     returnAddressToFp_(nullptr),
-diff --git a/js/src/jit/JitFrames.h b/js/src/jit/JitFrames.h
---- a/js/src/jit/JitFrames.h
-+++ b/js/src/jit/JitFrames.h
-@@ -5,30 +5,31 @@
-  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
- 
- #ifndef jit_JitFrames_h
- #define jit_JitFrames_h
- 
- #include <stdint.h>
- 
- #include "jit/JSJitFrameIter.h"
--#include "jit/Safepoints.h"
- #include "vm/JSContext.h"
- #include "vm/JSFunction.h"
- 
- namespace js {
- namespace jit {
- 
- enum CalleeTokenTag
- {
-     CalleeToken_Function = 0x0, // untagged
-     CalleeToken_FunctionConstructing = 0x1,
-     CalleeToken_Script = 0x2
- };
- 
-+struct SafepointSlotEntry;
-+
- static const uintptr_t CalleeTokenMask = ~uintptr_t(0x3);
- 
- static inline CalleeTokenTag
- GetCalleeTokenTag(CalleeToken token)
- {
-     CalleeTokenTag tag = CalleeTokenTag(uintptr_t(token) & 0x3);
-     MOZ_ASSERT(tag <= CalleeToken_Script);
-     return tag;
-diff --git a/js/src/jit/OptimizationTracking.h b/js/src/jit/OptimizationTracking.h
---- a/js/src/jit/OptimizationTracking.h
-+++ b/js/src/jit/OptimizationTracking.h
-@@ -8,16 +8,17 @@
- #define jit_OptimizationTracking_h
- 
- #include "mozilla/Maybe.h"
- 
- #include "jit/CompactBuffer.h"
- #include "jit/CompileInfo.h"
- #include "jit/JitAllocPolicy.h"
- #include "jit/JitSpewer.h"
-+#include "jit/shared/Assembler-shared.h"
- #include "js/TrackedOptimizationInfo.h"
- #include "vm/TypeInference.h"
- 
- namespace js {
- 
- namespace jit {
- 
- struct NativeToTrackedOptimizations

frg/work-js/mozilla-release/patches/mozilla-central-push_426942.patch

@@ -1,98 +0,0 @@
-# HG changeset patch
-# User Jon Coppeard <jcoppeard@mozilla.com>
-# Date 1531829314 -3600
-#      Tue Jul 17 13:08:34 2018 +0100
-# Node ID f47a00d46ef21f4da2760ea9634aa8ef5f44b442
-# Parent  c67b560d92a6920b8254adb5fee6fe25a43e8c4b
-Bug 1476012 - Remove dependency of Realm.h on GlobalObject.h r=jandem
-
-diff --git a/js/src/vm/EnvironmentObject.h b/js/src/vm/EnvironmentObject.h
---- a/js/src/vm/EnvironmentObject.h
-+++ b/js/src/vm/EnvironmentObject.h
-@@ -8,16 +8,17 @@
- #define vm_EnvironmentObject_h
- 
- #include "builtin/ModuleObject.h"
- #include "frontend/NameAnalysisTypes.h"
- #include "gc/Barrier.h"
- #include "gc/WeakMap.h"
- #include "js/GCHashTable.h"
- #include "vm/ArgumentsObject.h"
-+#include "vm/GlobalObject.h"
- #include "vm/JSContext.h"
- #include "vm/JSObject.h"
- #include "vm/ProxyObject.h"
- #include "vm/Scope.h"
- 
- namespace js {
- 
- class ModuleObject;
-diff --git a/js/src/vm/ErrorReporting.cpp b/js/src/vm/ErrorReporting.cpp
---- a/js/src/vm/ErrorReporting.cpp
-+++ b/js/src/vm/ErrorReporting.cpp
-@@ -8,16 +8,17 @@
- 
- #include "mozilla/Move.h"
- 
- #include <stdarg.h>
- 
- #include "jsexn.h"
- #include "jsfriendapi.h"
- 
-+#include "vm/GlobalObject.h"
- #include "vm/JSContext.h"
- 
- #include "vm/JSContext-inl.h"
- 
- using JS::HandleObject;
- using JS::HandleValue;
- using JS::UniqueTwoByteChars;
- 
-diff --git a/js/src/vm/Realm-inl.h b/js/src/vm/Realm-inl.h
---- a/js/src/vm/Realm-inl.h
-+++ b/js/src/vm/Realm-inl.h
-@@ -6,16 +6,17 @@
- 
- #ifndef vm_Realm_inl_h
- #define vm_Realm_inl_h
- 
- #include "vm/Realm.h"
- 
- #include "gc/Barrier.h"
- #include "gc/Marking.h"
-+#include "vm/GlobalObject.h"
- #include "vm/Iteration.h"
- 
- #include "vm/JSContext-inl.h"
- 
- inline void
- JS::Realm::initGlobal(js::GlobalObject& global)
- {
-     MOZ_ASSERT(global.realm() == this);
-diff --git a/js/src/vm/Realm.h b/js/src/vm/Realm.h
---- a/js/src/vm/Realm.h
-+++ b/js/src/vm/Realm.h
-@@ -13,22 +13,22 @@
- #include "mozilla/MemoryReporting.h"
- #include "mozilla/TimeStamp.h"
- #include "mozilla/Tuple.h"
- #include "mozilla/Variant.h"
- #include "mozilla/XorShift128PlusRNG.h"
- 
- #include <stddef.h>
- 
-+#include "builtin/Array.h"
- #include "gc/Barrier.h"
- #include "gc/Zone.h"
- #include "js/UniquePtr.h"
- #include "vm/ArrayBufferObject.h"
- #include "vm/Compartment.h"
--#include "vm/GlobalObject.h"
- #include "vm/ReceiverGuard.h"
- #include "vm/RegExpShared.h"
- #include "vm/SavedStacks.h"
- #include "vm/Time.h"
- #include "wasm/WasmRealm.h"
- 
- namespace js {
- 

frg/work-js/mozilla-release/patches/mozilla-central-push_426943.patch

@@ -1,180 +0,0 @@
-# HG changeset patch
-# User Jon Coppeard <jcoppeard@mozilla.com>
-# Date 1531829335 -3600
-#      Tue Jul 17 13:08:55 2018 +0100
-# Node ID 9c19e1788337dc016e76071f10c8a493e38c89a7
-# Parent  f47a00d46ef21f4da2760ea9634aa8ef5f44b442
-Bug 1476012 - Remove dependency of Principals.h on StructuredClone.h r=sfink
-
-diff --git a/js/public/Principals.h b/js/public/Principals.h
---- a/js/public/Principals.h
-+++ b/js/public/Principals.h
-@@ -10,17 +10,18 @@
- #define js_Principals_h
- 
- #include "mozilla/Atomics.h"
- 
- #include <stdint.h>
- 
- #include "jspubtd.h"
- 
--#include "js/StructuredClone.h"
-+struct JSStructuredCloneReader;
-+struct JSStructuredCloneWriter;
- 
- namespace js {
-     struct JS_PUBLIC_API(PerformanceGroup);
- } // namespace js
- 
- struct JSPrincipals {
-     /* Don't call "destroy"; use reference counting macros below. */
-     mozilla::Atomic<int32_t> refcount;
-diff --git a/js/rust/src/jsglue.cpp b/js/rust/src/jsglue.cpp
---- a/js/rust/src/jsglue.cpp
-+++ b/js/rust/src/jsglue.cpp
-@@ -13,16 +13,17 @@
- #endif
- 
- #include "jsapi.h"
- #include "jsfriendapi.h"
- #include "js/Proxy.h"
- #include "js/Class.h"
- #include "js/MemoryMetrics.h"
- #include "js/Principals.h"
-+#include "js/StructuredClone.h"
- #include "js/Wrapper.h"
- #include "assert.h"
- 
- struct ProxyTraps {
-     bool (*enter)(JSContext *cx, JS::HandleObject proxy, JS::HandleId id,
-                   js::BaseProxyHandler::Action action, bool *bp);
- 
-     bool (*getOwnPropertyDescriptor)(JSContext *cx, JS::HandleObject proxy,
-diff --git a/js/src/builtin/AtomicsObject.h b/js/src/builtin/AtomicsObject.h
---- a/js/src/builtin/AtomicsObject.h
-+++ b/js/src/builtin/AtomicsObject.h
-@@ -13,16 +13,17 @@
- #include "threading/ConditionVariable.h"
- #include "vm/JSObject.h"
- #include "vm/MutexIDs.h"
- #include "vm/NativeObject.h"
- 
- namespace js {
- 
- class GlobalObject;
-+class SharedArrayRawBuffer;
- 
- class AtomicsObject : public NativeObject
- {
-   public:
-     static const Class class_;
-     static JSObject* initClass(JSContext* cx, Handle<GlobalObject*> global);
-     static MOZ_MUST_USE bool toString(JSContext* cx, unsigned int argc, Value* vp);
- };
-diff --git a/js/src/fuzz-tests/testStructuredCloneReader.cpp b/js/src/fuzz-tests/testStructuredCloneReader.cpp
---- a/js/src/fuzz-tests/testStructuredCloneReader.cpp
-+++ b/js/src/fuzz-tests/testStructuredCloneReader.cpp
-@@ -6,16 +6,17 @@
-  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
- 
- 
- #include "mozilla/ScopeExit.h"
- 
- #include "jsapi.h"
- 
- #include "fuzz-tests/tests.h"
-+#include "js/StructuredClone.h"
- #include "vm/Interpreter.h"
- 
- #include "vm/JSContext-inl.h"
- 
- using namespace js;
- 
- // These are defined and pre-initialized by the harness (in tests.cpp).
- extern JS::PersistentRootedObject gGlobal;
-diff --git a/js/src/jit/CacheIRCompiler.cpp b/js/src/jit/CacheIRCompiler.cpp
---- a/js/src/jit/CacheIRCompiler.cpp
-+++ b/js/src/jit/CacheIRCompiler.cpp
-@@ -1,16 +1,18 @@
- /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
-  * vim: set ts=8 sts=4 et sw=4 tw=99:
-  * This Source Code Form is subject to the terms of the Mozilla Public
-  * License, v. 2.0. If a copy of the MPL was not distributed with this
-  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
- 
- #include "jit/CacheIRCompiler.h"
- 
-+#include "mozilla/ScopeExit.h"
-+
- #include <utility>
- 
- #include "jit/IonIC.h"
- #include "jit/SharedICHelpers.h"
- 
- #include "builtin/Boolean-inl.h"
- 
- #include "jit/MacroAssembler-inl.h"
-diff --git a/js/src/vm/Scope.cpp b/js/src/vm/Scope.cpp
---- a/js/src/vm/Scope.cpp
-+++ b/js/src/vm/Scope.cpp
-@@ -1,16 +1,18 @@
- /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
-  * vim: set ts=8 sts=4 et sw=4 tw=99:
-  * This Source Code Form is subject to the terms of the Mozilla Public
-  * License, v. 2.0. If a copy of the MPL was not distributed with this
-  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
- 
- #include "vm/Scope.h"
- 
-+#include "mozilla/ScopeExit.h"
-+
- #include <memory>
- #include <new>
- 
- #include "builtin/ModuleObject.h"
- #include "gc/Allocator.h"
- #include "gc/FreeOp.h"
- #include "util/StringBuffer.h"
- #include "vm/EnvironmentObject.h"
-diff --git a/js/src/wasm/WasmJS.h b/js/src/wasm/WasmJS.h
---- a/js/src/wasm/WasmJS.h
-+++ b/js/src/wasm/WasmJS.h
-@@ -24,16 +24,17 @@
- #include "wasm/WasmTypes.h"
- 
- namespace js {
- 
- class GlobalObject;
- class TypedArrayObject;
- class WasmFunctionScope;
- class WasmInstanceScope;
-+class SharedArrayRawBuffer;
- 
- namespace wasm {
- 
- // Return whether WebAssembly can be compiled on this platform.
- // This must be checked and must be true to call any of the top-level wasm
- // eval/compile methods.
- 
- bool
-diff --git a/js/src/wasm/WasmProcess.cpp b/js/src/wasm/WasmProcess.cpp
---- a/js/src/wasm/WasmProcess.cpp
-+++ b/js/src/wasm/WasmProcess.cpp
-@@ -14,16 +14,17 @@
-  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-  * See the License for the specific language governing permissions and
-  * limitations under the License.
-  */
- 
- #include "wasm/WasmProcess.h"
- 
- #include "mozilla/BinarySearch.h"
-+#include "mozilla/ScopeExit.h"
- 
- #include "vm/MutexIDs.h"
- #include "wasm/WasmBuiltins.h"
- #include "wasm/WasmCode.h"
- #include "wasm/WasmInstance.h"
- 
- using namespace js;
- using namespace wasm;

frg/work-js/mozilla-release/patches/mozilla-central-push_426944.patch

@@ -1,34 +0,0 @@
-# HG changeset patch
-# User Jon Coppeard <jcoppeard@mozilla.com>
-# Date 1531829356 -3600
-#      Tue Jul 17 13:09:16 2018 +0100
-# Node ID 372e6a24e99b2230431f9a53b6851fa13658e035
-# Parent  9c19e1788337dc016e76071f10c8a493e38c89a7
-Bug 1476012 - Remove the dependency of DeletePolicy.h on BigIntType.h r=sfink
-
-diff --git a/js/src/gc/DeletePolicy.h b/js/src/gc/DeletePolicy.h
---- a/js/src/gc/DeletePolicy.h
-+++ b/js/src/gc/DeletePolicy.h
-@@ -3,18 +3,21 @@
-  * This Source Code Form is subject to the terms of the Mozilla Public
-  * License, v. 2.0. If a copy of the MPL was not distributed with this
-  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
- 
- #ifndef gc_DeletePolicy_h
- #define gc_DeletePolicy_h
- 
- #include "js/TracingAPI.h"
-+
- #ifdef ENABLE_BIGINT
--#include "vm/BigIntType.h"
-+namespace JS {
-+class BigInt;
-+} // namespace JS
- #endif
- 
- namespace js {
- namespace gc {
- 
- struct ClearEdgesTracer : public JS::CallbackTracer
- {
-     ClearEdgesTracer();

frg/work-js/mozilla-release/patches/mozilla-central-push_426946.patch

@@ -1,27 +0,0 @@
-# HG changeset patch
-# User Jon Coppeard <jcoppeard@mozilla.com>
-# Date 1531831960 -3600
-#      Tue Jul 17 13:52:40 2018 +0100
-# Node ID 9a7bf0017c6cdc258f3bec3383b86ec6b4795af0
-# Parent  66ee3a9fe9caee878fc3d1163458e9fb6de61f88
-Bug 1476012 - Fix rust bustage r=me
-
-diff --git a/js/rust/etc/wrapper.hpp b/js/rust/etc/wrapper.hpp
---- a/js/rust/etc/wrapper.hpp
-+++ b/js/rust/etc/wrapper.hpp
-@@ -10,14 +10,15 @@
- #endif
- 
- typedef uint32_t HashNumber;
- 
- #include "jsfriendapi.h"
- #include "js/Conversions.h"
- #include "js/Initialization.h"
- #include "js/MemoryMetrics.h"
-+#include "js/StructuredClone.h"
- 
- // Replacements for types that are too difficult for rust-bindgen.
- 
- /// <div rustbindgen replaces="JS::detail::MaybeWrapped" />
- template <typename T>
- using replaces_MaybeWrapped = T;

frg/work-js/mozilla-release/patches/mozilla-central-push_427027.patch

@@ -1,98 +0,0 @@
-# HG changeset patch
-# User Jason Orendorff <jorendorff@mozilla.com>
-# Date 1530118855 18000
-#      Wed Jun 27 12:00:55 2018 -0500
-# Node ID 59e443ff0e2f7837b60be02f1e12a9666bd95f19
-# Parent  9bdec96cf9385318ba79f0d2825616ea7bbaf456
-Bug 1440481 - Part 1: Make Debugger stepping work the same in baseline as in the interpreter. r=nbp
-
-diff --git a/js/src/jit-test/tests/debug/Frame-onStep-20.js b/js/src/jit-test/tests/debug/Frame-onStep-20.js
-new file mode 100644
---- /dev/null
-+++ b/js/src/jit-test/tests/debug/Frame-onStep-20.js
-@@ -0,0 +1,41 @@
-+// Stepping should always pause in a frame between two function calls.
-+
-+let g = newGlobal();
-+g.evaluate(`
-+    class X {
-+        constructor() { this._p = 0; }
-+        m() { return this; }
-+        get p() { return this._p; }
-+        set p(value) { this._p = value; }
-+    }
-+    let x = new X;
-+
-+    function f() { return 1; }
-+    function inc(x) { return x + 1; }
-+`);
-+
-+let dbg = Debugger(g);
-+
-+// `code` is a snippet of JS that performs two JS calls.
-+function test(code) {
-+    let hits = 0;
-+    let log = "";
-+    dbg.onEnterFrame = frame => {
-+        if (hits++ === 0)
-+            frame.onStep = () => { log += "s"; };
-+        else
-+            log += "E";
-+    };
-+
-+    g.eval(code);
-+    assertEq(log.includes("EE"), false, "should have received onStep between onEnterFrame events");
-+    assertEq(log.match(/^s+Es+Es*$/) !== null, true,
-+             "should get two calls, with steps before, between, and possibly after");
-+}
-+
-+test("f(); f();");
-+test("f() + f()");
-+test("inc(f())");
-+test("x.m().m()");
-+test("new X().m()");
-+test("x.p = x.p");  // getter, then setter
-diff --git a/js/src/jit/BaselineJIT.cpp b/js/src/jit/BaselineJIT.cpp
---- a/js/src/jit/BaselineJIT.cpp
-+++ b/js/src/jit/BaselineJIT.cpp
-@@ -919,39 +919,34 @@ void
- BaselineScript::toggleDebugTraps(JSScript* script, jsbytecode* pc)
- {
-     MOZ_ASSERT(script->baselineScript() == this);
- 
-     // Only scripts compiled for debug mode have toggled calls.
-     if (!hasDebugInstrumentation())
-         return;
- 
--    SrcNoteLineScanner scanner(script->notes(), script->lineno());
--
-     AutoWritableJitCode awjc(method());
- 
-     for (uint32_t i = 0; i < numPCMappingIndexEntries(); i++) {
-         PCMappingIndexEntry& entry = pcMappingIndexEntry(i);
- 
-         CompactBufferReader reader(pcMappingReader(i));
-         jsbytecode* curPC = script->offsetToPC(entry.pcOffset);
-         uint32_t nativeOffset = entry.nativeOffset;
- 
-         MOZ_ASSERT(script->containsPC(curPC));
- 
-         while (reader.more()) {
-             uint8_t b = reader.readByte();
-             if (b & 0x80)
-                 nativeOffset += reader.readUnsigned();
- 
--            scanner.advanceTo(script->pcToOffset(curPC));
--
-             if (!pc || pc == curPC) {
--                bool enabled = (script->stepModeEnabled() && scanner.isLineHeader()) ||
--                    script->hasBreakpointsAt(curPC);
-+                bool enabled = script->stepModeEnabled() || script->hasBreakpointsAt(curPC);
- 
-                 // Patch the trap.
-                 CodeLocationLabel label(method(), CodeOffset(nativeOffset));
-                 Assembler::ToggleCall(label, enabled);
-             }
- 
-             curPC += GetBytecodeLength(curPC);
-         }

frg/work-js/mozilla-release/patches/mozilla-central-push_427028.patch

@@ -1,395 +0,0 @@
-# HG changeset patch
-# User Jason Orendorff <jorendorff@mozilla.com>
-# Date 1530120195 18000
-#      Wed Jun 27 12:23:15 2018 -0500
-# Node ID 71a6537e84fe2314ed64eddb8a91ccd97b480c98
-# Parent  59e443ff0e2f7837b60be02f1e12a9666bd95f19
-Bug 1440481 - Part 2: Delete SrcNoteLineScanner. Use BytecodeRangeWithPosition instead. r=nbp
-
-diff --git a/js/src/vm/BytecodeUtil-inl.h b/js/src/vm/BytecodeUtil-inl.h
---- a/js/src/vm/BytecodeUtil-inl.h
-+++ b/js/src/vm/BytecodeUtil-inl.h
-@@ -4,16 +4,17 @@
-  * License, v. 2.0. If a copy of the MPL was not distributed with this
-  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
- 
- #ifndef vm_BytecodeUtil_inl_h
- #define vm_BytecodeUtil_inl_h
- 
- #include "vm/BytecodeUtil.h"
- 
-+#include "frontend/SourceNotes.h"
- #include "vm/JSScript.h"
- 
- namespace js {
- 
- static inline unsigned
- GetDefCount(jsbytecode* pc)
- {
-     /*
-@@ -106,11 +107,105 @@ class BytecodeRange {
-     void popFront() { pc += GetBytecodeLength(pc); }
- 
-   private:
-     RootedScript script;
-     jsbytecode* pc;
-     jsbytecode* end;
- };
- 
-+class BytecodeRangeWithPosition : private BytecodeRange
-+{
-+  public:
-+    using BytecodeRange::empty;
-+    using BytecodeRange::frontPC;
-+    using BytecodeRange::frontOpcode;
-+    using BytecodeRange::frontOffset;
-+
-+    BytecodeRangeWithPosition(JSContext* cx, JSScript* script)
-+      : BytecodeRange(cx, script), lineno(script->lineno()), column(0),
-+        sn(script->notes()), snpc(script->code()), isEntryPoint(false),
-+        wasArtifactEntryPoint(false)
-+    {
-+        if (!SN_IS_TERMINATOR(sn))
-+            snpc += SN_DELTA(sn);
-+        updatePosition();
-+        while (frontPC() != script->main())
-+            popFront();
-+
-+        if (frontOpcode() != JSOP_JUMPTARGET)
-+            isEntryPoint = true;
-+        else
-+            wasArtifactEntryPoint =  true;
-+    }
-+
-+    void popFront() {
-+        BytecodeRange::popFront();
-+        if (empty())
-+            isEntryPoint = false;
-+        else
-+            updatePosition();
-+
-+        // The following conditions are handling artifacts introduced by the
-+        // bytecode emitter, such that we do not add breakpoints on empty
-+        // statements of the source code of the user.
-+        if (wasArtifactEntryPoint) {
-+            wasArtifactEntryPoint = false;
-+            isEntryPoint = true;
-+        }
-+
-+        if (isEntryPoint && frontOpcode() == JSOP_JUMPTARGET) {
-+            wasArtifactEntryPoint = isEntryPoint;
-+            isEntryPoint = false;
-+        }
-+    }
-+
-+    size_t frontLineNumber() const { return lineno; }
-+    size_t frontColumnNumber() const { return column; }
-+
-+    // Entry points are restricted to bytecode offsets that have an
-+    // explicit mention in the line table.  This restriction avoids a
-+    // number of failing cases caused by some instructions not having
-+    // sensible (to the user) line numbers, and it is one way to
-+    // implement the idea that the bytecode emitter should tell the
-+    // debugger exactly which offsets represent "interesting" (to the
-+    // user) places to stop.
-+    bool frontIsEntryPoint() const { return isEntryPoint; }
-+
-+  private:
-+    void updatePosition() {
-+        // Determine the current line number by reading all source notes up to
-+        // and including the current offset.
-+        jsbytecode *lastLinePC = nullptr;
-+        while (!SN_IS_TERMINATOR(sn) && snpc <= frontPC()) {
-+            SrcNoteType type = SN_TYPE(sn);
-+            if (type == SRC_COLSPAN) {
-+                ptrdiff_t colspan = SN_OFFSET_TO_COLSPAN(GetSrcNoteOffset(sn, 0));
-+                MOZ_ASSERT(ptrdiff_t(column) + colspan >= 0);
-+                column += colspan;
-+                lastLinePC = snpc;
-+            } else if (type == SRC_SETLINE) {
-+                lineno = size_t(GetSrcNoteOffset(sn, 0));
-+                column = 0;
-+                lastLinePC = snpc;
-+            } else if (type == SRC_NEWLINE) {
-+                lineno++;
-+                column = 0;
-+                lastLinePC = snpc;
-+            }
-+
-+            sn = SN_NEXT(sn);
-+            snpc += SN_DELTA(sn);
-+        }
-+        isEntryPoint = lastLinePC == frontPC();
-+    }
-+
-+    size_t lineno;
-+    size_t column;
-+    jssrcnote* sn;
-+    jsbytecode* snpc;
-+    bool isEntryPoint;
-+    bool wasArtifactEntryPoint;
-+};
-+
- } // namespace js
- 
- #endif /* vm_BytecodeUtil_inl_h */
-diff --git a/js/src/vm/BytecodeUtil.cpp b/js/src/vm/BytecodeUtil.cpp
---- a/js/src/vm/BytecodeUtil.cpp
-+++ b/js/src/vm/BytecodeUtil.cpp
-@@ -2690,21 +2690,20 @@ GetPCCountJSON(JSContext* cx, const Scri
-         return false;
- 
-     if (!AppendJSONProperty(buf, "opcodes"))
-         return false;
-     if (!buf.append('['))
-         return false;
-     bool comma = false;
- 
--    SrcNoteLineScanner scanner(script->notes(), script->lineno());
-     uint64_t hits = 0;
- 
--    jsbytecode* end = script->codeEnd();
--    for (jsbytecode* pc = script->code(); pc < end; pc = GetNextPc(pc)) {
-+    for (BytecodeRangeWithPosition range(cx, script); !range.empty(); range.popFront()) {
-+        jsbytecode *pc = range.frontPC();
-         size_t offset = script->pcToOffset(pc);
-         JSOp op = JSOp(*pc);
- 
-         // If the current instruction is a jump target,
-         // then update the number of hits.
-         const PCCounts* counts = sac.maybeGetPCCounts(pc);
-         if (counts)
-             hits = counts->numExec();
-@@ -2716,21 +2715,19 @@ GetPCCountJSON(JSContext* cx, const Scri
-         if (!buf.append('{'))
-             return false;
- 
-         if (!AppendJSONProperty(buf, "id", NO_COMMA))
-             return false;
-         if (!NumberValueToStringBuffer(cx, Int32Value(offset), buf))
-             return false;
- 
--        scanner.advanceTo(offset);
--
-         if (!AppendJSONProperty(buf, "line"))
-             return false;
--        if (!NumberValueToStringBuffer(cx, Int32Value(scanner.getLine()), buf))
-+        if (!NumberValueToStringBuffer(cx, Int32Value(range.frontLineNumber()), buf))
-             return false;
- 
-         {
-             const char* name = CodeName[op];
-             if (!AppendJSONProperty(buf, "name"))
-                 return false;
-             if (!buf.append('\"'))
-                 return false;
-diff --git a/js/src/vm/BytecodeUtil.h b/js/src/vm/BytecodeUtil.h
---- a/js/src/vm/BytecodeUtil.h
-+++ b/js/src/vm/BytecodeUtil.h
-@@ -448,92 +448,16 @@ BytecodeIsJumpTarget(JSOp op)
-       case JSOP_ENDITER:
-       case JSOP_TRY:
-         return true;
-       default:
-         return false;
-     }
- }
- 
--class SrcNoteLineScanner
--{
--    /* offset of the current JSOp in the bytecode */
--    ptrdiff_t offset;
--
--    /* next src note to process */
--    jssrcnote* sn;
--
--    /* line number of the current JSOp */
--    uint32_t lineno;
--
--    /*
--     * Is the current op the first one after a line change directive? Note that
--     * multiple ops may be "first" if a line directive is used to return to a
--     * previous line (eg, with a for loop increment expression.)
--     */
--    bool lineHeader;
--
--  public:
--    SrcNoteLineScanner(jssrcnote* sn, uint32_t lineno)
--        : offset(0), sn(sn), lineno(lineno), lineHeader(false)
--    {
--    }
--
--    /*
--     * This is called repeatedly with always-advancing relpc values. The src
--     * notes are tuples of <PC offset from prev src note, type, args>. Scan
--     * through, updating the lineno, until the next src note is for a later
--     * bytecode.
--     *
--     * When looking at the desired PC offset ('relpc'), the op is first in that
--     * line iff there is a SRC_SETLINE or SRC_NEWLINE src note for that exact
--     * bytecode.
--     *
--     * Note that a single bytecode may have multiple line-modifying notes (even
--     * though only one should ever be needed.)
--     */
--    void advanceTo(ptrdiff_t relpc) {
--        // Must always advance! If the same or an earlier PC is erroneously
--        // passed in, we will already be past the relevant src notes
--        MOZ_ASSERT_IF(offset > 0, relpc > offset);
--
--        // Next src note should be for after the current offset
--        MOZ_ASSERT_IF(offset > 0, SN_IS_TERMINATOR(sn) || SN_DELTA(sn) > 0);
--
--        // The first PC requested is always considered to be a line header
--        lineHeader = (offset == 0);
--
--        if (SN_IS_TERMINATOR(sn))
--            return;
--
--        ptrdiff_t nextOffset;
--        while ((nextOffset = offset + SN_DELTA(sn)) <= relpc && !SN_IS_TERMINATOR(sn)) {
--            offset = nextOffset;
--            SrcNoteType type = SN_TYPE(sn);
--            if (type == SRC_SETLINE || type == SRC_NEWLINE) {
--                if (type == SRC_SETLINE)
--                    lineno = GetSrcNoteOffset(sn, 0);
--                else
--                    lineno++;
--
--                if (offset == relpc)
--                    lineHeader = true;
--            }
--
--            sn = SN_NEXT(sn);
--        }
--    }
--
--    bool isLineHeader() const {
--        return lineHeader;
--    }
--
--    uint32_t getLine() const { return lineno; }
--};
--
- MOZ_ALWAYS_INLINE unsigned
- StackUses(jsbytecode* pc)
- {
-     JSOp op = JSOp(*pc);
-     int nuses = CodeSpec[op].nuses;
-     if (nuses >= 0)
-         return nuses;
- 
-diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
---- a/js/src/vm/Debugger.cpp
-+++ b/js/src/vm/Debugger.cpp
-@@ -5580,110 +5580,16 @@ EnsureScriptOffsetIsValid(JSContext* cx,
-     if (IsValidBytecodeOffset(cx, script, offset))
-         return true;
-     JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_DEBUG_BAD_OFFSET);
-     return false;
- }
- 
- namespace {
- 
--class BytecodeRangeWithPosition : private BytecodeRange
--{
--  public:
--    using BytecodeRange::empty;
--    using BytecodeRange::frontPC;
--    using BytecodeRange::frontOpcode;
--    using BytecodeRange::frontOffset;
--
--    BytecodeRangeWithPosition(JSContext* cx, JSScript* script)
--      : BytecodeRange(cx, script), lineno(script->lineno()), column(0),
--        sn(script->notes()), snpc(script->code()), isEntryPoint(false),
--        wasArtifactEntryPoint(false)
--    {
--        if (!SN_IS_TERMINATOR(sn))
--            snpc += SN_DELTA(sn);
--        updatePosition();
--        while (frontPC() != script->main())
--            popFront();
--
--        if (frontOpcode() != JSOP_JUMPTARGET)
--            isEntryPoint = true;
--        else
--            wasArtifactEntryPoint =  true;
--    }
--
--    void popFront() {
--        BytecodeRange::popFront();
--        if (empty())
--            isEntryPoint = false;
--        else
--            updatePosition();
--
--        // The following conditions are handling artifacts introduced by the
--        // bytecode emitter, such that we do not add breakpoints on empty
--        // statements of the source code of the user.
--        if (wasArtifactEntryPoint) {
--            wasArtifactEntryPoint = false;
--            isEntryPoint = true;
--        }
--
--        if (isEntryPoint && frontOpcode() == JSOP_JUMPTARGET) {
--            wasArtifactEntryPoint = isEntryPoint;
--            isEntryPoint = false;
--        }
--    }
--
--    size_t frontLineNumber() const { return lineno; }
--    size_t frontColumnNumber() const { return column; }
--
--    // Entry points are restricted to bytecode offsets that have an
--    // explicit mention in the line table.  This restriction avoids a
--    // number of failing cases caused by some instructions not having
--    // sensible (to the user) line numbers, and it is one way to
--    // implement the idea that the bytecode emitter should tell the
--    // debugger exactly which offsets represent "interesting" (to the
--    // user) places to stop.
--    bool frontIsEntryPoint() const { return isEntryPoint; }
--
--  private:
--    void updatePosition() {
--        // Determine the current line number by reading all source notes up to
--        // and including the current offset.
--        jsbytecode *lastLinePC = nullptr;
--        while (!SN_IS_TERMINATOR(sn) && snpc <= frontPC()) {
--            SrcNoteType type = SN_TYPE(sn);
--            if (type == SRC_COLSPAN) {
--                ptrdiff_t colspan = SN_OFFSET_TO_COLSPAN(GetSrcNoteOffset(sn, 0));
--                MOZ_ASSERT(ptrdiff_t(column) + colspan >= 0);
--                column += colspan;
--                lastLinePC = snpc;
--            } else if (type == SRC_SETLINE) {
--                lineno = size_t(GetSrcNoteOffset(sn, 0));
--                column = 0;
--                lastLinePC = snpc;
--            } else if (type == SRC_NEWLINE) {
--                lineno++;
--                column = 0;
--                lastLinePC = snpc;
--            }
--
--            sn = SN_NEXT(sn);
--            snpc += SN_DELTA(sn);
--        }
--        isEntryPoint = lastLinePC == frontPC();
--    }
--
--    size_t lineno;
--    size_t column;
--    jssrcnote* sn;
--    jsbytecode* snpc;
--    bool isEntryPoint;
--    bool wasArtifactEntryPoint;
--};
--
- /*
-  * FlowGraphSummary::populate(cx, script) computes a summary of script's
-  * control flow graph used by DebuggerScript_{getAllOffsets,getLineOffsets}.
-  *
-  * An instruction on a given line is an entry point for that line if it can be
-  * reached from (an instruction on) a different line. We distinguish between the
-  * following cases:
-  *   - hasNoEdges:

frg/work-js/mozilla-release/patches/mozilla-central-push_427052.patch

@@ -1,124 +0,0 @@
-# HG changeset patch
-# User Jeff Walden <jwalden@mit.edu>
-# Date 1531886428 25200
-#      Tue Jul 17 21:00:28 2018 -0700
-# Node ID 0e23f233f5cfc81731417f562456016a59a3d865
-# Parent  430be372318cdc8623ddb24c669ae042fd42f4fa
-Bug 1476409 - Fix a case where during tokenization we could overread source text by one code unit -- but safely, due to conservatively-written subsequent code.  r=arai
-
-diff --git a/js/src/frontend/TokenStream.cpp b/js/src/frontend/TokenStream.cpp
---- a/js/src/frontend/TokenStream.cpp
-+++ b/js/src/frontend/TokenStream.cpp
-@@ -2337,17 +2337,18 @@ TokenStreamSpecific<CharT, AnyCharsAcces
-               case 'b': unit = '\b'; break;
-               case 'f': unit = '\f'; break;
-               case 'n': unit = '\n'; break;
-               case 'r': unit = '\r'; break;
-               case 't': unit = '\t'; break;
-               case 'v': unit = '\v'; break;
- 
-               case '\r':
--                this->sourceUnits.matchCodeUnit('\n');
-+                if (MOZ_LIKELY(!this->sourceUnits.atEnd()))
-+                    this->sourceUnits.matchCodeUnit('\n');
-                 MOZ_FALLTHROUGH;
-               case '\n': {
-                 // LineContinuation represents no code points.  We're manually
-                 // consuming a LineTerminatorSequence, so we must manually
-                 // update line/column info.
-                 if (!updateLineInfoForEOL())
-                     return false;
- 
-diff --git a/js/src/tests/non262/syntax/linefeed-at-eof-in-unterminated-string-or-template.js b/js/src/tests/non262/syntax/linefeed-at-eof-in-unterminated-string-or-template.js
-new file mode 100644
---- /dev/null
-+++ b/js/src/tests/non262/syntax/linefeed-at-eof-in-unterminated-string-or-template.js
-@@ -0,0 +1,88 @@
-+/*
-+ * Any copyright is dedicated to the Public Domain.
-+ * http://creativecommons.org/licenses/publicdomain/
-+ */
-+
-+//-----------------------------------------------------------------------------
-+var BUGNUMBER = 1476409;
-+var summary =
-+  "Properly handle the case of U+005C REVERSE SOLIDUS U+000D CARRIAGE RETURN " +
-+  "at the end of source text being tokenized, in the middle of a string or " +
-+  "template literal, where the next code point in memory (outside the bounds " +
-+  "of the source text) is U+000A LINE FEED";
-+
-+print(BUGNUMBER + ": " + summary);
-+
-+/**************
-+ * BEGIN TEST *
-+ **************/
-+
-+function expectSyntaxError(code)
-+{
-+  try
-+  {
-+    eval(code);
-+    throw new Error("didn't throw");
-+  }
-+  catch (e)
-+  {
-+    assertEq(e instanceof SyntaxError, true,
-+             "got " + e.name + ", expected SyntaxError");
-+  }
-+}
-+
-+// The fundamental requirements of this test:
-+//
-+// 1. The computed string that is eval'd must be a Script that ends in a string
-+//    literal ending with the code points U+005C REVERSE SOLIDUS U+000D CARRIAGE
-+//    RETURN.
-+// 2. The *memory* that is actually tokenized/parsed by eval must be
-+//    immediately followed by U+000A LINE FEED.
-+//
-+// There's only one way to guarantee a U+000A LINE FEED after the source text:
-+// compute the source text as a dependent string,  of a larger (linear) string.
-+//  A simple substr will do the trick -- just as long as the substring can't fit
-+// in inline storage.  53 in the tests below comfortably exceeds all inline
-+// storage limits.
-+//
-+// One final wrinkle: because we only tokenize/parse two-byte source text right
-+// now, ensuring we directly tokenize/parse the dependent string's character
-+// data means the dependent string must have two-byte character data, hence the
-+// '\u1234' in the strings below.
-+
-+function singleQuote()
-+{
-+  var containsBadSingleQuoteLiteral =
-+    "\u1234x'01234567890123456789012345678901234567890123456789\\\r\n0123456789";
-+  //        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-+
-+  expectSyntaxError(containsBadSingleQuoteLiteral.substr(2, 53));
-+}
-+singleQuote();
-+
-+function doubleQuote()
-+{
-+  var containsBadDoubleQuoteLiteral =
-+    "\u1234x\"01234567890123456789012345678901234567890123456789\\\r\n0123456789";
-+  //        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-+
-+  expectSyntaxError(containsBadDoubleQuoteLiteral.substr(2, 53));
-+}
-+doubleQuote();
-+
-+function template()
-+{
-+  var containsBadTemplateLiteral =
-+    "\u1234x`01234567890123456789012345678901234567890123456789\\\r\n0123456789";
-+  //        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-+
-+  expectSyntaxError(containsBadTemplateLiteral.substr(2, 53));
-+}
-+template();
-+
-+/******************************************************************************/
-+
-+if (typeof reportCompare === "function")
-+  reportCompare(true, true);
-+
-+print("Tests complete");

frg/work-js/mozilla-release/patches/mozilla-central-push_427126.patch

@@ -1,432 +0,0 @@
-# HG changeset patch
-# User Tooru Fujisawa <arai_a@mac.com>
-# Date 1531916132 -32400
-#      Wed Jul 18 21:15:32 2018 +0900
-# Node ID eb4fac6db424a39e865b646c26397ca427753b70
-# Parent  1467f56b0eeeacb76dc038382dbc62c45a23bef9
-Bug 1463979 - Part 0: Prohibit failing compilation after linking function and non-lazy script while delazification. r=jorendorff
-
-diff --git a/js/src/frontend/BytecodeCompiler.cpp b/js/src/frontend/BytecodeCompiler.cpp
---- a/js/src/frontend/BytecodeCompiler.cpp
-+++ b/js/src/frontend/BytecodeCompiler.cpp
-@@ -11,17 +11,16 @@
- 
- #include "builtin/ModuleObject.h"
- #if defined(JS_BUILD_BINAST)
- # include "frontend/BinSource.h"
- #endif // JS_BUILD_BINAST
- #include "frontend/BytecodeEmitter.h"
- #include "frontend/ErrorReporter.h"
- #include "frontend/FoldConstants.h"
--#include "frontend/NameFunctions.h"
- #include "frontend/Parser.h"
- #include "vm/GlobalObject.h"
- #include "vm/JSContext.h"
- #include "vm/JSScript.h"
- #include "vm/TraceLogging.h"
- #include "wasm/AsmJS.h"
- 
- #include "vm/EnvironmentObject-inl.h"
-@@ -342,19 +341,16 @@ BytecodeCompiler::compileScript(HandleOb
-                 // of arguments objects for the caller script and any other scripts it is
-                 // transitively nested inside. The debugger can access any variable on the
-                 // scope chain.
-                 if (!deoptimizeArgumentsInEnclosingScripts(cx, environment))
-                     return nullptr;
-             }
-             if (!emitter->emitScript(pn))
-                 return nullptr;
--            if (!NameFunctions(cx, pn))
--                return nullptr;
--
-             break;
-         }
- 
-         // Maybe we aborted a syntax parse. See if we can try again.
-         if (!handleParseFailure(directives, startPosition))
-             return nullptr;
- 
-         // Reset UsedNameTracker state before trying again.
-@@ -414,19 +410,16 @@ BytecodeCompiler::compileModule()
-         return nullptr;
- 
-     Maybe<BytecodeEmitter> emitter;
-     if (!emplaceEmitter(emitter, &modulesc))
-         return nullptr;
-     if (!emitter->emitScript(pn->pn_body))
-         return nullptr;
- 
--    if (!NameFunctions(cx, pn))
--        return nullptr;
--
-     if (!builder.initModule())
-         return nullptr;
- 
-     RootedModuleEnvironmentObject env(cx, ModuleEnvironmentObject::create(cx, module));
-     if (!env)
-         return nullptr;
- 
-     module->setInitialEnvironment(env);
-@@ -474,26 +467,23 @@ BytecodeCompiler::compileStandaloneFunct
-         MOZ_ASSERT(fun == fn->pn_funbox->function());
- 
-         if (!createScript(fn->pn_funbox->toStringStart, fn->pn_funbox->toStringEnd))
-             return false;
- 
-         Maybe<BytecodeEmitter> emitter;
-         if (!emplaceEmitter(emitter, fn->pn_funbox))
-             return false;
--        if (!emitter->emitFunctionScript(fn->pn_body))
-+        if (!emitter->emitFunctionScript(fn, BytecodeEmitter::TopLevelFunction::Yes))
-             return false;
-     } else {
-         fun.set(fn->pn_funbox->function());
-         MOZ_ASSERT(IsAsmJSModule(fun));
-     }
- 
--    if (!NameFunctions(cx, fn))
--        return false;
--
-     // Enqueue an off-thread source compression task after finishing parsing.
-     if (!scriptSource->tryCompressOffThread(cx))
-         return false;
- 
-     return true;
- }
- 
- ScriptSourceObject*
-@@ -656,19 +646,16 @@ frontend::CompileGlobalBinASTScript(JSCo
- 
-     if (!bce.init())
-         return nullptr;
- 
-     ParseNode *pn = parsed.unwrap();
-     if (!bce.emitScript(pn))
-         return nullptr;
- 
--    if (!NameFunctions(cx, pn))
--        return nullptr;
--
-     if (sourceObjectOut)
-         *sourceObjectOut = sourceObj;
- 
-     assertException.reset();
-     return script;
- }
- 
- #endif // JS_BUILD_BINAST
-@@ -735,24 +722,68 @@ frontend::CompileModule(JSContext* cx, c
-     // module is compiled off thread.
-     if (!ModuleObject::Freeze(cx, module))
-         return nullptr;
- 
-     assertException.reset();
-     return module;
- }
- 
-+// When leaving this scope, the given function should either:
-+//   * be linked to a fully compiled script
-+//   * remain linking to a lazy script
-+class MOZ_STACK_CLASS AutoAssertFunctionDelazificationCompletion
-+{
-+#ifdef DEBUG
-+    RootedFunction fun_;
-+#endif
-+
-+  public:
-+    AutoAssertFunctionDelazificationCompletion(JSContext* cx, HandleFunction fun)
-+#ifdef DEBUG
-+      : fun_(cx, fun)
-+#endif
-+    {
-+        MOZ_ASSERT(fun_->isInterpretedLazy());
-+        MOZ_ASSERT(!fun_->lazyScript()->hasScript());
-+    }
-+
-+    ~AutoAssertFunctionDelazificationCompletion() {
-+#ifdef DEBUG
-+        if (!fun_)
-+            return;
-+#endif
-+
-+        // If fun_ is not nullptr, it means delazification doesn't complete.
-+        // Assert that the function keeps linking to lazy script
-+        MOZ_ASSERT(fun_->isInterpretedLazy());
-+        MOZ_ASSERT(!fun_->lazyScript()->hasScript());
-+    }
-+
-+    void complete() {
-+        // Assert the completion of delazification and forget the function.
-+        MOZ_ASSERT(fun_->hasScript());
-+        MOZ_ASSERT(!fun_->hasUncompletedScript());
-+
-+#ifdef DEBUG
-+        fun_ = nullptr;
-+#endif
-+    }
-+};
-+
- bool
- frontend::CompileLazyFunction(JSContext* cx, Handle<LazyScript*> lazy, const char16_t* chars, size_t length)
- {
-     MOZ_ASSERT(cx->compartment() == lazy->functionNonDelazifying()->compartment());
-     // We can't be running this script unless we've run its parent.
-     MOZ_ASSERT(!lazy->isEnclosingScriptLazy());
- 
-     AutoAssertReportedException assertException(cx);
-+    Rooted<JSFunction*> fun(cx, lazy->functionNonDelazifying());
-+    AutoAssertFunctionDelazificationCompletion delazificationCompletion(cx, fun);
- 
-     CompileOptions options(cx);
-     options.setMutedErrors(lazy->mutedErrors())
-            .setFileAndLine(lazy->filename(), lazy->lineno())
-            .setColumn(lazy->column())
-            .setScriptSourceOffset(lazy->sourceStart())
-            .setNoScriptRval(false)
-            .setSelfHostingMode(false);
-@@ -781,17 +812,16 @@ frontend::CompileLazyFunction(JSContext*
- 
-     RootedScriptSourceObject sourceObject(cx, &lazy->sourceObject());
-     Parser<FullParseHandler, char16_t> parser(cx, cx->tempLifoAlloc(), options, chars, length,
-                                               /* foldConstants = */ true, usedNames, nullptr,
-                                               lazy, sourceObject, lazy->parseGoal());
-     if (!parser.checkOptions())
-         return false;
- 
--    Rooted<JSFunction*> fun(cx, lazy->functionNonDelazifying());
-     ParseNode* pn = parser.standaloneLazyFunction(fun, lazy->toStringStart(),
-                                                   lazy->strict(), lazy->generatorKind(),
-                                                   lazy->asyncKind());
-     if (!pn)
-         return false;
- 
-     Rooted<JSScript*> script(cx, JSScript::Create(cx, options, sourceObject,
-                                                   lazy->sourceStart(), lazy->sourceEnd(),
-@@ -804,22 +834,20 @@ frontend::CompileLazyFunction(JSContext*
-     if (lazy->hasBeenCloned())
-         script->setHasBeenCloned();
- 
-     BytecodeEmitter bce(/* parent = */ nullptr, &parser, pn->pn_funbox, script, lazy,
-                         pn->pn_pos, BytecodeEmitter::LazyFunction);
-     if (!bce.init())
-         return false;
- 
--    if (!bce.emitFunctionScript(pn->pn_body))
-+    if (!bce.emitFunctionScript(pn, BytecodeEmitter::TopLevelFunction::Yes))
-         return false;
- 
--    if (!NameFunctions(cx, pn))
--        return false;
--
-+    delazificationCompletion.complete();
-     assertException.reset();
-     return true;
- }
- 
- bool
- frontend::CompileStandaloneFunction(JSContext* cx, MutableHandleFunction fun,
-                                     const ReadOnlyCompileOptions& options,
-                                     JS::SourceBufferHolder& srcBuf,
-diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
---- a/js/src/frontend/BytecodeEmitter.cpp
-+++ b/js/src/frontend/BytecodeEmitter.cpp
-@@ -2804,27 +2804,33 @@ BytecodeEmitter::emitScript(ParseNode* b
-         return false;
- 
-     if (!emit1(JSOP_RETRVAL))
-         return false;
- 
-     if (!emitterScope.leave(this))
-         return false;
- 
-+    if (!NameFunctions(cx, body))
-+        return false;
-+
-     if (!JSScript::fullyInitFromEmitter(cx, script, this))
-         return false;
- 
-     tellDebuggerAboutCompiledScript(cx);
- 
-     return true;
- }
- 
- bool
--BytecodeEmitter::emitFunctionScript(ParseNode* body)
--{
-+BytecodeEmitter::emitFunctionScript(ParseNode* fn, TopLevelFunction isTopLevel)
-+{
-+    MOZ_ASSERT(fn->isKind(ParseNodeKind::Function));
-+    ParseNode* body = fn->pn_body;
-+    MOZ_ASSERT(body->isKind(ParseNodeKind::ParamsBody));
-     FunctionBox* funbox = sc->asFunctionBox();
-     AutoFrontendTraceLog traceLog(cx, TraceLogger_BytecodeEmission, parser->errorReporter(), funbox);
- 
-     setScriptStartOffsetIfUnset(body->pn_pos);
- 
-     // The ordering of these EmitterScopes is important. The named lambda
-     // scope needs to enclose the function scope needs to enclose the extra
-     // var scope.
-@@ -2868,16 +2874,21 @@ BytecodeEmitter::emitFunctionScript(Pars
-         return false;
- 
-     if (namedLambdaEmitterScope) {
-         if (!namedLambdaEmitterScope->leave(this))
-             return false;
-         namedLambdaEmitterScope.reset();
-     }
- 
-+    if (isTopLevel == TopLevelFunction::Yes) {
-+        if (!NameFunctions(cx, fn))
-+            return false;
-+    }
-+
-     if (!JSScript::fullyInitFromEmitter(cx, script, this))
-         return false;
- 
-     tellDebuggerAboutCompiledScript(cx);
- 
-     return true;
- }
- 
-@@ -5666,17 +5677,17 @@ BytecodeEmitter::emitFunction(ParseNode*
-                 return false;
- 
-             BytecodeEmitter bce2(this, parser, funbox, script, /* lazyScript = */ nullptr,
-                                  pn->pn_pos, emitterMode);
-             if (!bce2.init())
-                 return false;
- 
-             /* We measured the max scope depth when we parsed the function. */
--            if (!bce2.emitFunctionScript(pn->pn_body))
-+            if (!bce2.emitFunctionScript(pn, TopLevelFunction::No))
-                 return false;
- 
-             if (funbox->isLikelyConstructorWrapper())
-                 script->setLikelyConstructorWrapper();
-         }
- 
-         if (outersc->isFunctionBox())
-             outersc->asFunctionBox()->setHasInnerFunctions();
-diff --git a/js/src/frontend/BytecodeEmitter.h b/js/src/frontend/BytecodeEmitter.h
---- a/js/src/frontend/BytecodeEmitter.h
-+++ b/js/src/frontend/BytecodeEmitter.h
-@@ -10,16 +10,17 @@
- #define frontend_BytecodeEmitter_h
- 
- #include "mozilla/Attributes.h"
- 
- #include "ds/InlineTable.h"
- #include "frontend/BCEParserHandle.h"
- #include "frontend/EitherParser.h"
- #include "frontend/JumpList.h"
-+#include "frontend/NameFunctions.h"
- #include "frontend/SharedContext.h"
- #include "frontend/SourceNotes.h"
- #include "vm/BytecodeUtil.h"
- #include "vm/Interpreter.h"
- #include "vm/Iteration.h"
- #include "vm/JSContext.h"
- #include "vm/JSScript.h"
- 
-@@ -468,17 +469,21 @@ struct MOZ_STACK_CLASS BytecodeEmitter
-     MOZ_MUST_USE bool emitTreeInBranch(ParseNode* pn,
-                                        ValueUsage valueUsage = ValueUsage::WantValue);
- 
-     // Emit global, eval, or module code for tree rooted at body. Always
-     // encompasses the entire source.
-     MOZ_MUST_USE bool emitScript(ParseNode* body);
- 
-     // Emit function code for the tree rooted at body.
--    MOZ_MUST_USE bool emitFunctionScript(ParseNode* body);
-+    enum class TopLevelFunction {
-+        No,
-+        Yes
-+    };
-+    MOZ_MUST_USE bool emitFunctionScript(ParseNode* fn, TopLevelFunction isTopLevel);
- 
-     // If op is JOF_TYPESET (see the type barriers comment in TypeInference.h),
-     // reserve a type set to store its result.
-     void checkTypeSet(JSOp op);
- 
-     void updateDepth(ptrdiff_t target);
-     MOZ_MUST_USE bool updateLineNumberNotes(uint32_t offset);
-     MOZ_MUST_USE bool updateSourceCoordNotes(uint32_t offset);
-diff --git a/js/src/vm/JSFunction.cpp b/js/src/vm/JSFunction.cpp
---- a/js/src/vm/JSFunction.cpp
-+++ b/js/src/vm/JSFunction.cpp
-@@ -1616,22 +1616,21 @@ JSFunction::createScriptForLazilyInterpr
-         size_t lazyLength = lazy->sourceEnd() - lazy->sourceStart();
-         UncompressedSourceCache::AutoHoldEntry holder;
-         ScriptSource::PinnedChars chars(cx, lazy->scriptSource(), holder,
-                                         lazy->sourceStart(), lazyLength);
-         if (!chars.get())
-             return false;
- 
-         if (!frontend::CompileLazyFunction(cx, lazy, chars.get(), lazyLength)) {
--            // The frontend may have linked the function and the non-lazy
--            // script together during bytecode compilation. Reset it now on
--            // error.
--            fun->initLazyScript(lazy);
--            if (lazy->hasScript())
--                lazy->resetScript();
-+            // The frontend shouldn't fail after linking the function and the
-+            // non-lazy script together.
-+            MOZ_ASSERT(fun->isInterpretedLazy());
-+            MOZ_ASSERT(fun->lazyScript() == lazy);
-+            MOZ_ASSERT(!lazy->hasScript());
-             return false;
-         }
- 
-         script = fun->nonLazyScript();
- 
-         // Remember the compiled script on the lazy script itself, in case
-         // there are clones of the function still pointing to the lazy script.
-         if (!lazy->maybeScript())
-diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
---- a/js/src/vm/JSScript.cpp
-+++ b/js/src/vm/JSScript.cpp
-@@ -4223,23 +4223,16 @@ void
- LazyScript::initScript(JSScript* script)
- {
-     MOZ_ASSERT(script);
-     MOZ_ASSERT(!script_.unbarrieredGet());
-     script_.set(script);
- }
- 
- void
--LazyScript::resetScript()
--{
--    MOZ_ASSERT(script_.unbarrieredGet());
--    script_.set(nullptr);
--}
--
--void
- LazyScript::setEnclosingScope(Scope* enclosingScope)
- {
-     // This method may be called to update the enclosing scope. See comment
-     // above the callsite in BytecodeEmitter::emitFunction.
-     enclosingScope_ = enclosingScope;
- }
- 
- ScriptSourceObject&
-diff --git a/js/src/vm/JSScript.h b/js/src/vm/JSScript.h
---- a/js/src/vm/JSScript.h
-+++ b/js/src/vm/JSScript.h
-@@ -2254,17 +2254,16 @@ class LazyScript : public gc::TenuredCel
-     void initRuntimeFields(uint64_t packedFields);
- 
-     static inline JSFunction* functionDelazifying(JSContext* cx, Handle<LazyScript*>);
-     JSFunction* functionNonDelazifying() const {
-         return function_;
-     }
- 
-     void initScript(JSScript* script);
--    void resetScript();
- 
-     JSScript* maybeScript() {
-         return script_;
-     }
-     const JSScript* maybeScriptUnbarriered() const {
-         return script_.unbarrieredGet();
-     }
-     bool hasScript() const {

frg/work-js/mozilla-release/patches/mozilla-central-push_427127.patch

@@ -1,950 +0,0 @@
-# HG changeset patch
-# User Tooru Fujisawa <arai_a@mac.com>
-# Date 1531916132 -32400
-#      Wed Jul 18 21:15:32 2018 +0900
-# Node ID 6edce1e74d5aeb53247e9c22d4e3b5fce3810d8b
-# Parent  eb4fac6db424a39e865b646c26397ca427753b70
-Bug 1463979 - Part 1: Store a pointer to enclosing LazyScript into LazyScript. r=jimb,sfink
-
-diff --git a/js/src/frontend/BytecodeCompiler.cpp b/js/src/frontend/BytecodeCompiler.cpp
---- a/js/src/frontend/BytecodeCompiler.cpp
-+++ b/js/src/frontend/BytecodeCompiler.cpp
-@@ -768,18 +768,20 @@ class MOZ_STACK_CLASS AutoAssertFunction
- #endif
-     }
- };
- 
- bool
- frontend::CompileLazyFunction(JSContext* cx, Handle<LazyScript*> lazy, const char16_t* chars, size_t length)
- {
-     MOZ_ASSERT(cx->compartment() == lazy->functionNonDelazifying()->compartment());
--    // We can't be running this script unless we've run its parent.
--    MOZ_ASSERT(!lazy->isEnclosingScriptLazy());
-+    // We can only compile functions whose parents have previously been
-+    // compiled, because compilation requires full information about the
-+    // function's immediately enclosing scope.
-+    MOZ_ASSERT(lazy->enclosingScriptHasEverBeenCompiled());
- 
-     AutoAssertReportedException assertException(cx);
-     Rooted<JSFunction*> fun(cx, lazy->functionNonDelazifying());
-     AutoAssertFunctionDelazificationCompletion delazificationCompletion(cx, fun);
- 
-     CompileOptions options(cx);
-     options.setMutedErrors(lazy->mutedErrors())
-            .setFileAndLine(lazy->filename(), lazy->lineno())
-diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
---- a/js/src/frontend/BytecodeEmitter.cpp
-+++ b/js/src/frontend/BytecodeEmitter.cpp
-@@ -5643,24 +5643,17 @@ BytecodeEmitter::emitFunction(ParseNode*
-     // make a deep clone of its contents.
-     if (fun->isInterpreted()) {
-         bool singleton = checkRunOnceContext();
-         if (!JSFunction::setTypeForScriptedFunction(cx, fun, singleton))
-             return false;
- 
-         SharedContext* outersc = sc;
-         if (fun->isInterpretedLazy()) {
--            // We need to update the static scope chain regardless of whether
--            // the LazyScript has already been initialized, due to the case
--            // where we previously successfully compiled an inner function's
--            // lazy script but failed to compile the outer script after the
--            // fact. If we attempt to compile the outer script again, the
--            // static scope chain will be newly allocated and will mismatch
--            // the previously compiled LazyScript's.
--            fun->lazyScript()->setEnclosingScope(innermostScope());
-+            funbox->setEnclosingScopeForInnerLazyFunction(innermostScope());
-             if (emittingRunOnceLambda)
-                 fun->lazyScript()->setTreatAsRunOnce();
-         } else {
-             MOZ_ASSERT_IF(outersc->strict(), funbox->strictScript);
- 
-             // Inherit most things (principals, version, etc) from the
-             // parent.  Use default values for the rest.
-             Rooted<JSScript*> parent(cx, script);
-@@ -9124,16 +9117,18 @@ CGObjectList::finish(ObjectArray* array)
-     MOZ_ASSERT(length == array->length);
- 
-     js::GCPtrObject* cursor = array->vector + array->length;
-     ObjectBox* objbox = lastbox;
-     do {
-         --cursor;
-         MOZ_ASSERT(!*cursor);
-         MOZ_ASSERT(objbox->object->isTenured());
-+        if (objbox->isFunctionBox())
-+            objbox->asFunctionBox()->finish();
-         *cursor = objbox->object;
-     } while ((objbox = objbox->emitLink) != nullptr);
-     MOZ_ASSERT(cursor == array->vector);
- }
- 
- void
- CGScopeList::finish(ScopeArray* array)
- {
-diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp
---- a/js/src/frontend/Parser.cpp
-+++ b/js/src/frontend/Parser.cpp
-@@ -507,17 +507,20 @@ FunctionBox::FunctionBox(JSContext* cx, 
- void
- FunctionBox::initFromLazyFunction()
- {
-     JSFunction* fun = function();
-     if (fun->lazyScript()->isDerivedClassConstructor())
-         setDerivedClassConstructor();
-     if (fun->lazyScript()->needsHomeObject())
-         setNeedsHomeObject();
--    enclosingScope_ = fun->lazyScript()->enclosingScope();
-+    if (fun->lazyScript()->hasEnclosingScope())
-+        enclosingScope_ = fun->lazyScript()->enclosingScope();
-+    else
-+        enclosingScope_ = nullptr;
-     initWithEnclosingScope(enclosingScope_);
- }
- 
- void
- FunctionBox::initStandaloneFunction(Scope* enclosingScope)
- {
-     // Standalone functions are Function or Generator constructors and are
-     // always scoped to the global.
-@@ -589,16 +592,37 @@ FunctionBox::initWithEnclosingScope(Scop
-     } else {
-         computeAllowSyntax(enclosingScope);
-         computeThisBinding(enclosingScope);
-     }
- 
-     computeInWith(enclosingScope);
- }
- 
-+void
-+FunctionBox::setEnclosingScopeForInnerLazyFunction(Scope* enclosingScope)
-+{
-+    MOZ_ASSERT(isLazyFunctionWithoutEnclosingScope());
-+
-+    // For lazy functions inside a function which is being compiled, we cache
-+    // the incomplete scope object while compiling, and store it to the
-+    // LazyScript once the enclosing script successfully finishes compilation
-+    // in FunctionBox::finish.
-+    enclosingScope_ = enclosingScope;
-+}
-+
-+void
-+FunctionBox::finish()
-+{
-+    if (!isLazyFunctionWithoutEnclosingScope())
-+        return;
-+    MOZ_ASSERT(enclosingScope_);
-+    function()->lazyScript()->setEnclosingScope(enclosingScope_);
-+}
-+
- template <class ParseHandler, typename CharT>
- inline typename GeneralParser<ParseHandler, CharT>::FinalParser*
- GeneralParser<ParseHandler, CharT>::asFinalParser()
- {
-     static_assert(mozilla::IsBaseOf<GeneralParser<ParseHandler, CharT>, FinalParser>::value,
-                   "inheritance relationship required by the static_cast<> below");
- 
-     return static_cast<FinalParser*>(this);
-diff --git a/js/src/frontend/SharedContext.h b/js/src/frontend/SharedContext.h
---- a/js/src/frontend/SharedContext.h
-+++ b/js/src/frontend/SharedContext.h
-@@ -292,16 +292,26 @@ SharedContext::asEvalContext()
-     return static_cast<EvalSharedContext*>(this);
- }
- 
- class FunctionBox : public ObjectBox, public SharedContext
- {
-     // The parser handles tracing the fields below via the ObjectBox linked
-     // list.
- 
-+    // This field is used for two purposes:
-+    //   * If this FunctionBox refers to the function being compiled, this field
-+    //     holds its enclosing scope, used for compilation.
-+    //   * If this FunctionBox refers to a lazy child of the function being
-+    //     compiled, this field holds the child's immediately enclosing scope.
-+    //     Once compilation succeeds, we will store it in the child's
-+    //     LazyScript.  (Debugger may become confused if LazyScripts refer to
-+    //     partially initialized enclosing scopes, so we must avoid storing the
-+    //     scope in the LazyScript until compilation has completed
-+    //     successfully.)
-     Scope* enclosingScope_;
- 
-     // Names from the named lambda scope, if a named lambda.
-     LexicalScope::Data* namedLambdaBindings_;
- 
-     // Names from the function scope.
-     FunctionScope::Data* functionScopeBindings_;
- 
-@@ -413,24 +423,44 @@ class FunctionBox : public ObjectBox, pu
-         MOZ_ASSERT(context->zone()->hasKeptAtoms());
-         return MutableHandle<VarScope::Data*>::fromMarkedLocation(&extraVarScopeBindings_);
-     }
- 
-     void initFromLazyFunction();
-     void initStandaloneFunction(Scope* enclosingScope);
-     void initWithEnclosingParseContext(ParseContext* enclosing, FunctionSyntaxKind kind);
- 
-+    inline bool isLazyFunctionWithoutEnclosingScope() const {
-+        return function()->isInterpretedLazy() &&
-+               !function()->lazyScript()->hasEnclosingScope();
-+    }
-+    void setEnclosingScopeForInnerLazyFunction(Scope* enclosingScope);
-+    void finish();
-+
-     JSFunction* function() const { return &object->as<JSFunction>(); }
- 
-     Scope* compilationEnclosingScope() const override {
-         // This method is used to distinguish the outermost SharedContext. If
-         // a FunctionBox is the outermost SharedContext, it must be a lazy
-         // function.
--        MOZ_ASSERT_IF(function()->isInterpretedLazy(),
-+
-+        // If the function is lazy and it has enclosing scope, the function is
-+        // being delazified.  In that case the enclosingScope_ field is copied
-+        // from the lazy function at the beginning of delazification and should
-+        // keep pointing the same scope.
-+        MOZ_ASSERT_IF(function()->isInterpretedLazy() &&
-+                      function()->lazyScript()->hasEnclosingScope(),
-                       enclosingScope_ == function()->lazyScript()->enclosingScope());
-+
-+        // If this FunctionBox is a lazy child of the function we're actually
-+        // compiling, then it is not the outermost SharedContext, so this
-+        // method should return nullptr."
-+        if (isLazyFunctionWithoutEnclosingScope())
-+            return nullptr;
-+
-         return enclosingScope_;
-     }
- 
-     bool needsCallObjectRegardlessOfBindings() const {
-         return hasExtensibleScope() ||
-                needsHomeObject() ||
-                isDerivedClassConstructor() ||
-                isGenerator() ||
-diff --git a/js/src/gc/Marking.cpp b/js/src/gc/Marking.cpp
---- a/js/src/gc/Marking.cpp
-+++ b/js/src/gc/Marking.cpp
-@@ -934,18 +934,20 @@ LazyScript::traceChildren(JSTracer* trc)
-         TraceWeakEdge(trc, &script_, "script");
- 
-     if (function_)
-         TraceEdge(trc, &function_, "function");
- 
-     if (sourceObject_)
-         TraceEdge(trc, &sourceObject_, "sourceObject");
- 
--    if (enclosingScope_)
--        TraceEdge(trc, &enclosingScope_, "enclosingScope");
-+    if (enclosingLazyScriptOrScope_) {
-+        TraceGenericPointerRoot(trc, reinterpret_cast<Cell**>(enclosingLazyScriptOrScope_.unsafeUnbarrieredForTracing()),
-+                                "enclosingScope or enclosingLazyScript");
-+    }
- 
-     // We rely on the fact that atoms are always tenured.
-     JSAtom** closedOverBindings = this->closedOverBindings();
-     for (auto i : IntegerRange(numClosedOverBindings())) {
-         if (closedOverBindings[i])
-             TraceManuallyBarrieredEdge(trc, &closedOverBindings[i], "closedOverBinding");
-     }
- 
-@@ -960,18 +962,20 @@ js::GCMarker::eagerlyMarkChildren(LazySc
-         noteWeakEdge(thing->script_.unsafeUnbarrieredForTracing());
- 
-     if (thing->function_)
-         traverseEdge(thing, static_cast<JSObject*>(thing->function_));
- 
-     if (thing->sourceObject_)
-         traverseEdge(thing, static_cast<JSObject*>(thing->sourceObject_));
- 
--    if (thing->enclosingScope_)
--        traverseEdge(thing, static_cast<Scope*>(thing->enclosingScope_));
-+    if (thing->enclosingLazyScriptOrScope_) {
-+        TraceManuallyBarrieredGenericPointerEdge(this, reinterpret_cast<Cell**>(thing->enclosingLazyScriptOrScope_.unsafeUnbarrieredForTracing()),
-+                                                 "enclosingScope or enclosingLazyScript");
-+    }
- 
-     // We rely on the fact that atoms are always tenured.
-     JSAtom** closedOverBindings = thing->closedOverBindings();
-     for (auto i : IntegerRange(thing->numClosedOverBindings())) {
-         if (closedOverBindings[i])
-             traverseEdge(thing, static_cast<JSString*>(closedOverBindings[i]));
-     }
- 
-diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
---- a/js/src/vm/Debugger.cpp
-+++ b/js/src/vm/Debugger.cpp
-@@ -4568,20 +4568,21 @@ class MOZ_STACK_CLASS Debugger::ScriptQu
-     }
- 
-     /*
-      * If |script| matches this query, append it to |vector| or place it in
-      * |innermostForRealm|, as appropriate. Set |oom| if an out of memory
-      * condition occurred.
-      */
-     void consider(JSScript* script, const JS::AutoRequireNoGC& nogc) {
--        // We check for presence of script->code() because it is possible that
--        // the script was created and thus exposed to GC, but *not* fully
--        // initialized from fullyInit{FromEmitter,Trivial} due to errors.
--        if (oom || script->selfHosted() || !script->code())
-+        // We check for presence of script->isUncompleted() because it is
-+        // possible that the script was created and thus exposed to GC, but
-+        // *not* fully initialized from fullyInit{FromEmitter,Trivial} due to
-+        // errors.
-+        if (oom || script->selfHosted() || script->isUncompleted())
-             return;
-         Realm* realm = script->realm();
-         if (!realms.has(realm))
-             return;
-         if (urlCString.ptr()) {
-             bool gotFilename = false;
-             if (script->filename() && strcmp(script->filename(), urlCString.ptr()) == 0)
-                 gotFilename = true;
-diff --git a/js/src/vm/JSFunction.cpp b/js/src/vm/JSFunction.cpp
---- a/js/src/vm/JSFunction.cpp
-+++ b/js/src/vm/JSFunction.cpp
-@@ -1586,35 +1586,43 @@ JSFunction::createScriptForLazilyInterpr
-         // chain of their inner functions, or in the case of eval, possibly
-         // eval'd inner functions. This prohibits re-lazification as
-         // StaticScopeIter queries needsCallObject of those functions, which
-         // requires a non-lazy script.  Note that if this ever changes,
-         // XDRRelazificationInfo will have to be fixed.
-         bool canRelazify = !lazy->numInnerFunctions() && !lazy->hasDirectEval();
- 
-         if (script) {
-+            // This function is non-canonical function, and the canonical
-+            // function is already delazified.
-             fun->setUnlazifiedScript(script);
-             // Remember the lazy script on the compiled script, so it can be
-             // stored on the function again in case of re-lazification.
-             if (canRelazify)
-                 script->setLazyScript(lazy);
-             return true;
-         }
- 
-         if (fun != lazy->functionNonDelazifying()) {
-+            // This function is non-canonical function, and the canonical
-+            // function is lazy.
-+            // Delazify the canonical function, which will result in calling
-+            // this function again with the canonical function.
-             if (!LazyScript::functionDelazifying(cx, lazy))
-                 return false;
-             script = lazy->functionNonDelazifying()->nonLazyScript();
-             if (!script)
-                 return false;
- 
-             fun->setUnlazifiedScript(script);
-             return true;
-         }
- 
-+        // This is lazy canonical-function.
-+
-         MOZ_ASSERT(lazy->scriptSource()->hasSourceData());
- 
-         // Parse and compile the script from source.
-         size_t lazyLength = lazy->sourceEnd() - lazy->sourceStart();
-         UncompressedSourceCache::AutoHoldEntry holder;
-         ScriptSource::PinnedChars chars(cx, lazy->scriptSource(), holder,
-                                         lazy->sourceStart(), lazyLength);
-         if (!chars.get())
-@@ -2123,17 +2131,17 @@ js::CanReuseScriptForClone(JS::Realm* re
-     // example.
-     if (IsSyntacticEnvironment(newParent))
-         return true;
- 
-     // We need to clone the script if we're not already marked as having a
-     // non-syntactic scope.
-     return fun->hasScript()
-         ? fun->nonLazyScript()->hasNonSyntacticScope()
--        : fun->lazyScript()->enclosingScope()->hasOnChain(ScopeKind::NonSyntactic);
-+        : fun->lazyScript()->hasNonSyntacticScope();
- }
- 
- static inline JSFunction*
- NewFunctionClone(JSContext* cx, HandleFunction fun, NewObjectKind newKind,
-                  gc::AllocKind allocKind, HandleObject proto)
- {
-     RootedObject cloneProto(cx, proto);
-     if (!proto && (fun->isGenerator() || fun->isAsync())) {
-diff --git a/js/src/vm/JSFunction.h b/js/src/vm/JSFunction.h
---- a/js/src/vm/JSFunction.h
-+++ b/js/src/vm/JSFunction.h
-@@ -559,16 +559,19 @@ class JSFunction : public js::NativeObje
-             initScript(script);
-         }
-         return nonLazyScript();
-     }
- 
-     // The state of a JSFunction whose script errored out during bytecode
-     // compilation. Such JSFunctions are only reachable via GC iteration and
-     // not from script.
-+    // If u.scripted.s.script_ is non-null, the pointed JSScript is guaranteed
-+    // to be complete (see the comment above JSScript::initFromFunctionBox
-+    // callsite in JSScript::fullyInitFromEmitter).
-     bool hasUncompletedScript() const {
-         MOZ_ASSERT(hasScript());
-         return !u.scripted.s.script_;
-     }
- 
-     JSScript* nonLazyScript() const {
-         MOZ_ASSERT(!hasUncompletedScript());
-         return u.scripted.s.script_;
-diff --git a/js/src/vm/JSScript.cpp b/js/src/vm/JSScript.cpp
---- a/js/src/vm/JSScript.cpp
-+++ b/js/src/vm/JSScript.cpp
-@@ -268,19 +268,19 @@ XDRRelazificationInfo(XDRState<mode>* xd
-             // JSFunction::createScriptForLazilyInterpretedFunction.
-             MOZ_ASSERT(lazy->numInnerFunctions() == 0);
-         }
- 
-         MOZ_TRY(xdr->codeUint64(&packedFields));
- 
-         if (mode == XDR_DECODE) {
-             RootedScriptSourceObject sourceObject(cx, &script->scriptSourceUnwrap());
--            lazy.set(LazyScript::Create(cx, fun, script, enclosingScope, sourceObject,
--                                        packedFields, sourceStart, sourceEnd, toStringStart,
--                                        lineno, column));
-+            lazy.set(LazyScript::CreateForXDR(cx, fun, script, enclosingScope, sourceObject,
-+                                              packedFields, sourceStart, sourceEnd, toStringStart,
-+                                              lineno, column));
-             if (!lazy)
-                 return xdr->fail(JS::TranscodeResult_Throw);
- 
-             lazy->setToStringEnd(toStringEnd);
- 
-             // As opposed to XDRLazyScript, we need to restore the runtime bits
-             // of the script, as we are trying to match the fact this function
-             // has already been parsed and that it would need to be re-lazified.
-@@ -946,19 +946,19 @@ js::XDRLazyScript(XDRState<mode>* xdr, H
-         MOZ_TRY(xdr->codeUint32(&sourceEnd));
-         MOZ_TRY(xdr->codeUint32(&toStringStart));
-         MOZ_TRY(xdr->codeUint32(&toStringEnd));
-         MOZ_TRY(xdr->codeUint32(&lineno));
-         MOZ_TRY(xdr->codeUint32(&column));
-         MOZ_TRY(xdr->codeUint64(&packedFields));
- 
-         if (mode == XDR_DECODE) {
--            lazy.set(LazyScript::Create(cx, fun, nullptr, enclosingScope, sourceObject,
--                                        packedFields, sourceStart, sourceEnd, toStringStart,
--                                        lineno, column));
-+            lazy.set(LazyScript::CreateForXDR(cx, fun, nullptr, enclosingScope, sourceObject,
-+                                              packedFields, sourceStart, sourceEnd, toStringStart,
-+                                              lineno, column));
-             if (!lazy)
-                 return xdr->fail(JS::TranscodeResult_Throw);
-             lazy->setToStringEnd(toStringEnd);
-             fun->initLazyScript(lazy);
-         }
-     }
- 
-     // Code closed-over bindings.
-@@ -970,18 +970,21 @@ js::XDRLazyScript(XDRState<mode>* xdr, H
-         GCPtrFunction* innerFunctions = lazy->innerFunctions();
-         size_t numInnerFunctions = lazy->numInnerFunctions();
-         for (size_t i = 0; i < numInnerFunctions; i++) {
-             if (mode == XDR_ENCODE)
-                 func = innerFunctions[i];
- 
-             MOZ_TRY(XDRInterpretedFunction(xdr, nullptr, sourceObject, &func));
- 
--            if (mode == XDR_DECODE)
-+            if (mode == XDR_DECODE) {
-                 innerFunctions[i] = func;
-+                if (innerFunctions[i]->isInterpretedLazy())
-+                    innerFunctions[i]->lazyScript()->setEnclosingLazyScript(lazy);
-+            }
-         }
-     }
- 
-     return Ok();
- }
- 
- template XDRResult
- js::XDRLazyScript(XDRState<XDR_ENCODE>*, HandleScope, HandleScriptSourceObject,
-@@ -2947,16 +2950,22 @@ JSScript::initFromModuleContext(HandleSc
- 
- /* static */ bool
- JSScript::fullyInitFromEmitter(JSContext* cx, HandleScript script, BytecodeEmitter* bce)
- {
-     /* The counts of indexed things must be checked during code generation. */
-     MOZ_ASSERT(bce->atomIndices->count() <= INDEX_LIMIT);
-     MOZ_ASSERT(bce->objectList.length <= INDEX_LIMIT);
- 
-+    uint64_t nslots = bce->maxFixedSlots + static_cast<uint64_t>(bce->maxStackDepth);
-+    if (nslots > UINT32_MAX) {
-+        bce->reportError(nullptr, JSMSG_NEED_DIET, js_script_str);
-+        return false;
-+    }
-+
-     uint32_t mainLength = bce->offset();
-     uint32_t prologueLength = bce->prologueOffset();
-     uint32_t nsrcnotes;
-     if (!bce->finishTakingSrcNotes(&nsrcnotes))
-         return false;
-     uint32_t natoms = bce->atomIndices->count();
-     if (!partiallyInit(cx, script,
-                        bce->scopeList.length(), bce->constList.length(), bce->objectList.length,
-@@ -2969,16 +2978,21 @@ JSScript::fullyInitFromEmitter(JSContext
-     MOZ_ASSERT(script->mainOffset() == 0);
-     script->mainOffset_ = prologueLength;
- 
-     script->lineno_ = bce->firstLine;
- 
-     if (!script->createScriptData(cx, prologueLength + mainLength, nsrcnotes, natoms))
-         return false;
- 
-+    // Any fallible operation after JSScript::createScriptData should reset
-+    // JSScript.scriptData_, in order to treat this script as uncompleted,
-+    // in JSScript::isUncompleted.
-+    // JSScript::shareScriptData resets it before returning false.
-+
-     jsbytecode* code = script->code();
-     PodCopy<jsbytecode>(code, bce->prologue.code.begin(), prologueLength);
-     PodCopy<jsbytecode>(code + prologueLength, bce->main.code.begin(), mainLength);
-     bce->copySrcNotes((jssrcnote*)(code + script->length()), nsrcnotes);
-     InitAtomMap(*bce->atomIndices, script->atoms());
- 
-     if (!script->shareScriptData(cx))
-         return false;
-@@ -2993,28 +3007,25 @@ JSScript::fullyInitFromEmitter(JSContext
-         bce->tryNoteList.finish(script->trynotes());
-     if (bce->scopeNoteList.length() != 0)
-         bce->scopeNoteList.finish(script->scopeNotes(), prologueLength);
-     script->bitFields_.strict_ = bce->sc->strict();
-     script->bitFields_.explicitUseStrict_ = bce->sc->hasExplicitUseStrict();
-     script->bitFields_.bindingsAccessedDynamically_ = bce->sc->bindingsAccessedDynamically();
-     script->bitFields_.hasSingletons_ = bce->hasSingletons;
- 
--    uint64_t nslots = bce->maxFixedSlots + static_cast<uint64_t>(bce->maxStackDepth);
--    if (nslots > UINT32_MAX) {
--        bce->reportError(nullptr, JSMSG_NEED_DIET, js_script_str);
--        return false;
--    }
--
-     script->nfixed_ = bce->maxFixedSlots;
-     script->nslots_ = nslots;
-     script->bodyScopeIndex_ = bce->bodyScopeIndex;
-     script->bitFields_.hasNonSyntacticScope_ =
-         bce->outermostScope()->hasOnChain(ScopeKind::NonSyntactic);
- 
-+    // There shouldn't be any fallible operation after initFromFunctionBox,
-+    // JSFunction::hasUncompletedScript relies on the fact that the existence
-+    // of the pointer to JSScript means the pointed JSScript is complete.
-     if (bce->sc->isFunctionBox())
-         initFromFunctionBox(script, bce->sc->asFunctionBox());
-     else if (bce->sc->isModuleContext())
-         initFromModuleContext(script);
- 
-     // Copy yield offsets last, as the generator kind is set in
-     // initFromFunctionBox.
-     if (bce->yieldAndAwaitOffsetList.length() != 0)
-@@ -4196,17 +4207,16 @@ JSScript::formalLivesInArgumentsObject(u
- }
- 
- LazyScript::LazyScript(JSFunction* fun, ScriptSourceObject& sourceObject,
-                        void* table, uint64_t packedFields,
-                        uint32_t sourceStart, uint32_t sourceEnd,
-                        uint32_t toStringStart, uint32_t lineno, uint32_t column)
-   : script_(nullptr),
-     function_(fun),
--    enclosingScope_(nullptr),
-     sourceObject_(&sourceObject),
-     table_(table),
-     packedFields_(packedFields),
-     sourceStart_(sourceStart),
-     sourceEnd_(sourceEnd),
-     toStringStart_(toStringStart),
-     toStringEnd_(sourceEnd),
-     lineno_(lineno),
-@@ -4223,21 +4233,36 @@ void
- LazyScript::initScript(JSScript* script)
- {
-     MOZ_ASSERT(script);
-     MOZ_ASSERT(!script_.unbarrieredGet());
-     script_.set(script);
- }
- 
- void
-+LazyScript::setEnclosingLazyScript(LazyScript* enclosingLazyScript)
-+{
-+    MOZ_ASSERT(enclosingLazyScript);
-+
-+    // We never change an existing LazyScript.
-+    MOZ_ASSERT(!hasEnclosingLazyScript());
-+
-+    // Enclosing scopes never transition back to enclosing lazy scripts.
-+    MOZ_ASSERT(!hasEnclosingScope());
-+
-+    enclosingLazyScriptOrScope_ = enclosingLazyScript;
-+}
-+
-+void
- LazyScript::setEnclosingScope(Scope* enclosingScope)
- {
--    // This method may be called to update the enclosing scope. See comment
--    // above the callsite in BytecodeEmitter::emitFunction.
--    enclosingScope_ = enclosingScope;
-+    MOZ_ASSERT(enclosingScope);
-+    MOZ_ASSERT(!hasEnclosingScope());
-+
-+    enclosingLazyScriptOrScope_ = enclosingScope;
- }
- 
- ScriptSourceObject&
- LazyScript::sourceObject() const
- {
-     return sourceObject_->as<ScriptSourceObject>();
- }
- 
-@@ -4324,28 +4349,31 @@ LazyScript::Create(JSContext* cx, Handle
-     if (!res)
-         return nullptr;
- 
-     JSAtom** resClosedOverBindings = res->closedOverBindings();
-     for (size_t i = 0; i < res->numClosedOverBindings(); i++)
-         resClosedOverBindings[i] = closedOverBindings[i];
- 
-     GCPtrFunction* resInnerFunctions = res->innerFunctions();
--    for (size_t i = 0; i < res->numInnerFunctions(); i++)
-+    for (size_t i = 0; i < res->numInnerFunctions(); i++) {
-         resInnerFunctions[i].init(innerFunctions[i]);
-+        if (resInnerFunctions[i]->isInterpretedLazy())
-+            resInnerFunctions[i]->lazyScript()->setEnclosingLazyScript(res);
-+    }
- 
-     return res;
- }
- 
- /* static */ LazyScript*
--LazyScript::Create(JSContext* cx, HandleFunction fun,
--                   HandleScript script, HandleScope enclosingScope,
--                   HandleScriptSourceObject sourceObject,
--                   uint64_t packedFields, uint32_t sourceStart, uint32_t sourceEnd,
--                   uint32_t toStringStart, uint32_t lineno, uint32_t column)
-+LazyScript::CreateForXDR(JSContext* cx, HandleFunction fun,
-+                         HandleScript script, HandleScope enclosingScope,
-+                         HandleScriptSourceObject sourceObject,
-+                         uint64_t packedFields, uint32_t sourceStart, uint32_t sourceEnd,
-+                         uint32_t toStringStart, uint32_t lineno, uint32_t column)
- {
-     // Dummy atom which is not a valid property name.
-     RootedAtom dummyAtom(cx, cx->names().comma);
- 
-     // Dummy function which is not a valid function as this is the one which is
-     // holding this lazy script.
-     HandleFunction dummyFun = fun;
- 
-@@ -4362,20 +4390,21 @@ LazyScript::Create(JSContext* cx, Handle
-     for (i = 0, num = res->numClosedOverBindings(); i < num; i++)
-         closedOverBindings[i] = dummyAtom;
- 
-     GCPtrFunction* functions = res->innerFunctions();
-     for (i = 0, num = res->numInnerFunctions(); i < num; i++)
-         functions[i].init(dummyFun);
- 
-     // Set the enclosing scope of the lazy function. This value should only be
--    // non-null if we have a non-lazy enclosing script.
--    // LazyScript::isEnclosingScriptLazy relies on the enclosing scope being
--    // null if we're nested inside another lazy function.
--    MOZ_ASSERT(!res->enclosingScope());
-+    // set if we have a non-lazy enclosing script at this point.
-+    // LazyScript::enclosingScriptHasEverBeenCompiled relies on the enclosing
-+    // scope being non-null if we have ever been nested inside non-lazy
-+    // function.
-+    MOZ_ASSERT(!res->hasEnclosingScope());
-     if (enclosingScope)
-         res->setEnclosingScope(enclosingScope);
- 
-     MOZ_ASSERT(!res->hasScript());
-     if (script)
-         res->initScript(script);
- 
-     return res;
-@@ -4389,34 +4418,16 @@ LazyScript::initRuntimeFields(uint64_t p
-         uint64_t packed;
-     };
- 
-     packed = packedFields;
-     p_.hasBeenCloned = p.hasBeenCloned;
-     p_.treatAsRunOnce = p.treatAsRunOnce;
- }
- 
--bool
--LazyScript::hasUncompletedEnclosingScript() const
--{
--    // It can happen that we created lazy scripts while compiling an enclosing
--    // script, but we errored out while compiling that script. When we iterate
--    // over lazy script in a compartment, we might see lazy scripts that never
--    // escaped to script and should be ignored.
--    //
--    // If the enclosing scope is a function with a null script or has a script
--    // without code, it was not successfully compiled.
--
--    if (!enclosingScope() || !enclosingScope()->is<FunctionScope>())
--        return false;
--
--    JSFunction* fun = enclosingScope()->as<FunctionScope>().canonicalFunction();
--    return !fun->hasScript() || fun->hasUncompletedScript() || !fun->nonLazyScript()->code();
--}
--
- void
- JSScript::updateJitCodeRaw(JSRuntime* rt)
- {
-     MOZ_ASSERT(rt);
-     if (hasBaselineScript() && baseline->hasPendingIonBuilder()) {
-         MOZ_ASSERT(!isIonCompilingOffThread());
-         jitCodeRaw_ = rt->jitRuntime()->lazyLinkStub().value;
-         jitCodeSkipArgCheck_ = jitCodeRaw_;
-diff --git a/js/src/vm/JSScript.h b/js/src/vm/JSScript.h
---- a/js/src/vm/JSScript.h
-+++ b/js/src/vm/JSScript.h
-@@ -1259,16 +1259,22 @@ class JSScript : public js::gc::TenuredC
-     }
- 
-     // Script bytecode is immutable after creation.
-     jsbytecode* code() const {
-         if (!scriptData_)
-             return nullptr;
-         return scriptData_->code();
-     }
-+    bool isUncompleted() const {
-+        // code() becomes non-null only if this script is complete.
-+        // See the comment in JSScript::fullyInitFromEmitter.
-+        return !code();
-+    }
-+
-     size_t length() const {
-         MOZ_ASSERT(scriptData_);
-         return scriptData_->codeLength();
-     }
- 
-     jsbytecode* codeEnd() const { return code() + length(); }
- 
-     jsbytecode* lastPC() const {
-@@ -2138,18 +2144,92 @@ class LazyScript : public gc::TenuredCel
-     // If non-nullptr, the script has been compiled and this is a forwarding
-     // pointer to the result. This is a weak pointer: after relazification, we
-     // can collect the script if there are no other pointers to it.
-     WeakRef<JSScript*> script_;
- 
-     // Original function with which the lazy script is associated.
-     GCPtrFunction function_;
- 
--    // Scope in which the script is nested.
--    GCPtrScope enclosingScope_;
-+    // This field holds one of:
-+    //   * LazyScript in which the script is nested.  This case happens if the
-+    //     enclosing script is lazily parsed and have never been compiled.
-+    //
-+    //     This is used by the debugger to delazify the enclosing scripts
-+    //     recursively.  The all ancestor LazyScripts in this linked-list are
-+    //     kept alive as long as this LazyScript is alive, which doesn't result
-+    //     in keeping them unnecessarily alive outside of the debugger for the
-+    //     following reasons:
-+    //
-+    //       * Outside of the debugger, a LazyScript is visible to user (which
-+    //         means the LazyScript can be pointed from somewhere else than the
-+    //         enclosing script) only if the enclosing script is compiled and
-+    //         executed.  While compiling the enclosing script, this field is
-+    //         changed to point the enclosing scope.  So the enclosing
-+    //         LazyScript is no more in the list.
-+    //       * Before the enclosing script gets compiled, this LazyScript is
-+    //         kept alive only if the outermost LazyScript in the list is kept
-+    //         alive.
-+    //       * Once this field is changed to point the enclosing scope, this
-+    //         field will never point the enclosing LazyScript again, since
-+    //         relazification is not performed on non-leaf scripts.
-+    //
-+    //   * Scope in which the script is nested.  This case happens if the
-+    //     enclosing script has ever been compiled.
-+    //
-+    //   * nullptr for incomplete (initial or failure) state
-+    //
-+    // This field should be accessed via accessors:
-+    //   * enclosingScope
-+    //   * setEnclosingScope (cannot be called twice)
-+    //   * enclosingLazyScript
-+    //   * setEnclosingLazyScript (cannot be called twice)
-+    // after checking:
-+    //   * hasEnclosingLazyScript
-+    //   * hasEnclosingScope
-+    //
-+    // The transition of fields are following:
-+    //
-+    //  o                               o
-+    //  | when function is lazily       | when decoded from XDR,
-+    //  | parsed inside a function      | and enclosing script is lazy
-+    //  | which is lazily parsed        | (CreateForXDR without enclosingScope)
-+    //  | (Create)                      |
-+    //  v                               v
-+    // +---------+                     +---------+
-+    // | nullptr |                     | nullptr |
-+    // +---------+                     +---------+
-+    //  |                               |
-+    //  | when enclosing function is    | when enclosing script is decoded
-+    //  | lazily parsed and this        | and this script's function is put
-+    //  | script's function is put      | into innerFunctions()
-+    //  | into innerFunctions()         | (setEnclosingLazyScript)
-+    //  | (setEnclosingLazyScript)      |
-+    //  |                               |
-+    //  |                               |     o
-+    //  |                               |     | when function is lazily
-+    //  |                               |     | parsed inside a function
-+    //  |                               |     | which is eagerly parsed
-+    //  |                               |     | (Create)
-+    //  v                               |     v
-+    // +----------------------+         |    +---------+
-+    // | enclosing LazyScript |<--------+    | nullptr |
-+    // +----------------------+              +---------+
-+    //  |                                     |
-+    //  v                                     |
-+    //  +<------------------------------------+
-+    //  |
-+    //  | when the enclosing script     o
-+    //  | is successfully compiled      | when decoded from XDR,
-+    //  | (setEnclosingScope)           | and enclosing script is not lazy
-+    //  v                               | (CreateForXDR with enclosingScope)
-+    // +-----------------+              |
-+    // | enclosing Scope |<-------------+
-+    // +-----------------+
-+    GCPtr<TenuredCell*> enclosingLazyScriptOrScope_;
- 
-     // ScriptSourceObject. We leave this set to nullptr until we generate
-     // bytecode for our immediate parent. This is never a CCW; we don't clone
-     // LazyScripts into other compartments.
-     GCPtrObject sourceObject_;
- 
-     // Heap allocated table with any free variables or inner functions.
-     void* table_;
-@@ -2240,21 +2320,21 @@ class LazyScript : public gc::TenuredCel
-     // innerFunctions with dummy values to be replaced in a later initialization
-     // phase.
-     //
-     // The "script" argument to this function can be null.  If it's non-null,
-     // then this LazyScript should be associated with the given JSScript.
-     //
-     // The sourceObject and enclosingScope arguments may be null if the
-     // enclosing function is also lazy.
--    static LazyScript* Create(JSContext* cx, HandleFunction fun,
--                              HandleScript script, HandleScope enclosingScope,
--                              HandleScriptSourceObject sourceObject,
--                              uint64_t packedData, uint32_t begin, uint32_t end,
--                              uint32_t toStringStart, uint32_t lineno, uint32_t column);
-+    static LazyScript* CreateForXDR(JSContext* cx, HandleFunction fun,
-+                                    HandleScript script, HandleScope enclosingScope,
-+                                    HandleScriptSourceObject sourceObject,
-+                                    uint64_t packedData, uint32_t begin, uint32_t end,
-+                                    uint32_t toStringStart, uint32_t lineno, uint32_t column);
- 
-     void initRuntimeFields(uint64_t packedFields);
- 
-     static inline JSFunction* functionDelazifying(JSContext* cx, Handle<LazyScript*>);
-     JSFunction* functionNonDelazifying() const {
-         return function_;
-     }
- 
-@@ -2265,31 +2345,50 @@ class LazyScript : public gc::TenuredCel
-     }
-     const JSScript* maybeScriptUnbarriered() const {
-         return script_.unbarrieredGet();
-     }
-     bool hasScript() const {
-         return bool(script_);
-     }
- 
-+    bool hasEnclosingScope() const {
-+        return enclosingLazyScriptOrScope_ &&
-+               enclosingLazyScriptOrScope_->is<Scope>();
-+    }
-+    bool hasEnclosingLazyScript() const {
-+        return enclosingLazyScriptOrScope_ &&
-+               enclosingLazyScriptOrScope_->is<LazyScript>();
-+    }
-+
-+    LazyScript* enclosingLazyScript() const {
-+        MOZ_ASSERT(hasEnclosingLazyScript());
-+        return enclosingLazyScriptOrScope_->as<LazyScript>();
-+    }
-+    void setEnclosingLazyScript(LazyScript* enclosingLazyScript);
-+
-     Scope* enclosingScope() const {
--        return enclosingScope_;
-+        MOZ_ASSERT(hasEnclosingScope());
-+        return enclosingLazyScriptOrScope_->as<Scope>();
-+    }
-+    void setEnclosingScope(Scope* enclosingScope);
-+
-+    bool hasNonSyntacticScope() const {
-+        return enclosingScope()->hasOnChain(ScopeKind::NonSyntactic);
-     }
- 
-     ScriptSourceObject& sourceObject() const;
-     ScriptSource* scriptSource() const {
-         return sourceObject().source();
-     }
-     ScriptSource* maybeForwardedScriptSource() const;
-     bool mutedErrors() const {
-         return scriptSource()->mutedErrors();
-     }
- 
--    void setEnclosingScope(Scope* enclosingScope);
--
-     uint32_t numClosedOverBindings() const {
-         return p_.numClosedOverBindings;
-     }
-     JSAtom** closedOverBindings() {
-         return (JSAtom**)table_;
-     }
- 
-     uint32_t numInnerFunctions() const {
-@@ -2434,23 +2533,24 @@ class LazyScript : public gc::TenuredCel
-     }
- 
-     void setToStringEnd(uint32_t toStringEnd) {
-         MOZ_ASSERT(toStringStart_ <= toStringEnd);
-         MOZ_ASSERT(toStringEnd_ >= sourceEnd_);
-         toStringEnd_ = toStringEnd;
-     }
- 
--    // Returns true if the enclosing script failed to compile.
--    // See the comment in the definition for more details.
--    bool hasUncompletedEnclosingScript() const;
--
--    // Returns true if the enclosing script is also lazy.
--    bool isEnclosingScriptLazy() const {
--        return !enclosingScope_;
-+    // Returns true if the enclosing script has ever been compiled.
-+    // Once the enclosing script is compiled, the scope chain is created.
-+    // This LazyScript is delazify-able as long as it has the enclosing scope,
-+    // even if the enclosing JSScript is GCed.
-+    // The enclosing JSScript can be GCed later if the enclosing scope is not
-+    // FunctionScope or ModuleScope.
-+    bool enclosingScriptHasEverBeenCompiled() const {
-+        return hasEnclosingScope();
-     }
- 
-     friend class GCMarker;
-     void traceChildren(JSTracer* trc);
-     void finalize(js::FreeOp* fop);
- 
-     static const JS::TraceKind TraceKind = JS::TraceKind::LazyScript;
- 
-diff --git a/js/src/vm/Realm.cpp b/js/src/vm/Realm.cpp
---- a/js/src/vm/Realm.cpp
-+++ b/js/src/vm/Realm.cpp
-@@ -702,17 +702,17 @@ AddLazyFunctionsForRealm(JSContext* cx, 
-         if (gc::IsAboutToBeFinalizedUnbarriered(&fun) ||
-             fun->realm() != cx->realm())
-         {
-             continue;
-         }
- 
-         if (fun->isInterpretedLazy()) {
-             LazyScript* lazy = fun->lazyScriptOrNull();
--            if (lazy && !lazy->isEnclosingScriptLazy() && !lazy->hasUncompletedEnclosingScript()) {
-+            if (lazy && lazy->enclosingScriptHasEverBeenCompiled()) {
-                 if (!lazyFunctions.append(fun))
-                     return false;
-             }
-         }
-     }
- 
-     return true;
- }

frg/work-js/mozilla-release/patches/mozilla-central-push_427431.patch

@@ -1,52 +0,0 @@
-# HG changeset patch
-# User Jeff Walden <jwalden@mit.edu>
-# Date 1531887173 25200
-#      Tue Jul 17 21:12:53 2018 -0700
-# Node ID 729210e6e8b614b8c51f16acf642f6f508679d98
-# Parent  f065635c180e5ff91666320c55a8b5acc690e016
-Remove some excess qualification in various tokenizing-related template class instantiations.  No bug, r=me as trivial ("if it compiles, it's good")
-
-diff --git a/js/src/frontend/TokenStream.cpp b/js/src/frontend/TokenStream.cpp
---- a/js/src/frontend/TokenStream.cpp
-+++ b/js/src/frontend/TokenStream.cpp
-@@ -2610,31 +2610,31 @@ TokenKindToString(TokenKind tt)
- #undef EMIT_CASE
-       case TokenKind::Limit: break;
-     }
- 
-     return "<bad TokenKind>";
- }
- #endif
- 
--template class frontend::TokenStreamCharsBase<Utf8Unit>;
--template class frontend::TokenStreamCharsBase<char16_t>;
--
--template class frontend::TokenStreamChars<char16_t, frontend::TokenStreamAnyCharsAccess>;
--template class frontend::TokenStreamSpecific<char16_t, frontend::TokenStreamAnyCharsAccess>;
-+template class TokenStreamCharsBase<Utf8Unit>;
-+template class TokenStreamCharsBase<char16_t>;
-+
-+template class TokenStreamChars<char16_t, TokenStreamAnyCharsAccess>;
-+template class TokenStreamSpecific<char16_t, TokenStreamAnyCharsAccess>;
- 
- template class
--frontend::TokenStreamChars<char16_t, frontend::ParserAnyCharsAccess<frontend::GeneralParser<frontend::FullParseHandler, char16_t>>>;
-+TokenStreamChars<char16_t, ParserAnyCharsAccess<GeneralParser<FullParseHandler, char16_t>>>;
- template class
--frontend::TokenStreamChars<char16_t, frontend::ParserAnyCharsAccess<frontend::GeneralParser<frontend::SyntaxParseHandler, char16_t>>>;
-+TokenStreamChars<char16_t, ParserAnyCharsAccess<GeneralParser<SyntaxParseHandler, char16_t>>>;
- 
- template class
--frontend::TokenStreamSpecific<char16_t, frontend::ParserAnyCharsAccess<frontend::GeneralParser<frontend::FullParseHandler, char16_t>>>;
-+TokenStreamSpecific<char16_t, ParserAnyCharsAccess<GeneralParser<FullParseHandler, char16_t>>>;
- template class
--frontend::TokenStreamSpecific<char16_t, frontend::ParserAnyCharsAccess<frontend::GeneralParser<frontend::SyntaxParseHandler, char16_t>>>;
-+TokenStreamSpecific<char16_t, ParserAnyCharsAccess<GeneralParser<SyntaxParseHandler, char16_t>>>;
- 
- } // namespace frontend
- 
- } // namespace js
- 
- 
- JS_FRIEND_API(int)
- js_fgets(char* buf, int size, FILE* file)

frg/work-js/mozilla-release/patches/mozilla-central-push_427432.patch

@@ -1,44 +0,0 @@
-# HG changeset patch
-# User Jeff Walden <jwalden@mit.edu>
-# Date 1531886455 25200
-#      Tue Jul 17 21:00:55 2018 -0700
-# Node ID 1b604df36960311748f612b3dd01597938977d77
-# Parent  729210e6e8b614b8c51f16acf642f6f508679d98
-Bug 1476866 - Fix the TokenStreamChars::getNonAsciiCodePoint doc comment to be clearer about |lead| being non-ASCII but still potentially (for UTF-16) a full code point.  r=arai
-
-diff --git a/js/src/frontend/TokenStream.h b/js/src/frontend/TokenStream.h
---- a/js/src/frontend/TokenStream.h
-+++ b/js/src/frontend/TokenStream.h
-@@ -1498,26 +1498,27 @@ class TokenStreamChars<char16_t, AnyChar
-             *codePoint = EOF; // sentinel value to hopefully cause errors
- #endif
-             MOZ_MAKE_MEM_UNDEFINED(codePoint, sizeof(*codePoint));
-         }
-         return ok;
-     }
- 
-     /**
--     * Given a just-consumed non-ASCII code unit (and maybe point) |lead|,
--     * consume a full code point or LineTerminatorSequence (normalizing it to
--     * '\n') and store it in |*codePoint|.  Return true on success, otherwise
--     * return false and leave |*codePoint| undefined on failure.
-+     * Given a just-consumed non-ASCII code unit |lead| (which may also be a
-+     * full code point, for UTF-16), consume a full code point or
-+     * LineTerminatorSequence (normalizing it to '\n') and store it in
-+     * |*codePoint|.  Return true on success, otherwise return false and leave
-+     * |*codePoint| undefined on failure.
-      *
-      * If a LineTerminatorSequence was consumed, also update line/column info.
-      *
-      * This may change the current |sourceUnits| offset.
-      */
--    MOZ_MUST_USE bool getNonAsciiCodePoint(int32_t lead, int32_t* cp);
-+    MOZ_MUST_USE bool getNonAsciiCodePoint(int32_t lead, int32_t* codePoint);
- 
-     /**
-      * Unget a full code point (ASCII or not) without altering line/column
-      * state.  If line/column state must be updated, this must happen manually.
-      * This method ungets a single code point, not a LineTerminatorSequence
-      * that is multiple code points.  (Generally you shouldn't be in a state
-      * where you've just consumed "\r\n" and want to unget that full sequence.)
-      *

frg/work-js/mozilla-release/patches/mozilla-central-push_427433.patch

@@ -1,153 +0,0 @@
-# HG changeset patch
-# User Jeff Walden <jwalden@mit.edu>
-# Date 1530922373 25200
-#      Fri Jul 06 17:12:53 2018 -0700
-# Node ID 9ed1d40847424b11e2bc6b5cbc7e497753c81938
-# Parent  1b604df36960311748f612b3dd01597938977d77
-Bug 1476866 - Add a SpecializedTokenStreamCharsBase class to the hierarchy as a clear collection point for functions entirely specific to UTF-8 or UTF-16 tokenizing only.  r=arai
-
-diff --git a/js/src/frontend/TokenStream.h b/js/src/frontend/TokenStream.h
---- a/js/src/frontend/TokenStream.h
-+++ b/js/src/frontend/TokenStream.h
-@@ -55,33 +55,51 @@
-  * potentially the compiler *can't* unify them because offsets into the
-  * hypothetical TokenStream<CharT>s would differ.)  Second, some of this stuff
-  * needs to be accessible in ParserBase, the aspects of JS language parsing
-  * that have meaning independent of the character type of the source text being
-  * parsed.  So we need a separate data structure that ParserBase can hold on to
-  * for it.  (ParserBase isn't the only instance of this, but it's certainly the
-  * biggest case of it.)  Ergo, TokenStreamAnyChars.
-  *
-- * == TokenStreamCharsBase<CharT> → ∅ ==
-+ * == TokenStreamCharsShared → ∅ ==
-+ *
-+ * Some functionality has meaning independent of character type, yet has no use
-+ * *unless* you know the character type in actual use.  It *could* live in
-+ * TokenStreamAnyChars, but it makes more sense to live in a separate class
-+ * that character-aware token information can simply inherit.
-  *
-- * Certain data structures in tokenizing are character-type-specific:
-+ * This class currently exists only to contain a char16_t buffer, transiently
-+ * used to accumulate strings in tricky cases that can't just be read directly
-+ * from source text.  It's not used outside character-aware tokenizing, so it
-+ * doesn't make sense in TokenStreamAnyChars.
-+ *
-+ * == TokenStreamCharsBase<CharT> → TokenStreamCharsShared ==
-+ *
-+ * Certain data structures in tokenizing are character-type-specific: namely,
-  * the various pointers identifying the source text (including current offset
-- * and end) , and the temporary vector into which characters are read/written
-- * in certain cases (think writing out the actual codepoints identified by an
-- * identifier containing a Unicode escape, to create the atom for the
-- * identifier: |a\u0062c| versus |abc|, for example).
-+ * and end).
-  *
-  * Additionally, some functions operating on this data are defined the same way
-- * no matter what character type you have -- the offset being |offset - start|
-- * no matter whether those two variables are single- or double-byte pointers.
-+ * no matter what character type you have (e.g. current offset in code units
-+ * into the source text) or share a common interface regardless of character
-+ * type (e.g. consume the next code unit if it has a given value).
-  *
-  * All such functionality lives in TokenStreamCharsBase<CharT>.
-  *
-+ * == SpecializedTokenStreamCharsBase<CharT> → TokenStreamCharsBase<CharT> ==
-+ *
-+ * Certain tokenizing functionality is specific to a single character type.
-+ * For example, JS's UTF-16 encoding recognizes no coding errors, because lone
-+ * surrogates are not an error; but a UTF-8 encoding must recognize a variety
-+ * of validation errors.  Such functionality is defined only in the appropriate
-+ * SpecializedTokenStreamCharsBase specialization.
-+ *
-  * == GeneralTokenStreamChars<CharT, AnyCharsAccess> →
-- *    TokenStreamCharsBase<CharT> ==
-+ *    SpecializedTokenStreamCharsBase<CharT> ==
-  *
-  * Some functionality operates differently on different character types, just
-  * as for TokenStreamCharsBase, but additionally requires access to character-
-  * type-agnostic information in TokenStreamAnyChars.  For example, getting the
-  * next character performs different steps for different character types and
-  * must access TokenStreamAnyChars to update line break information.
-  *
-  * Such functionality, if it can be defined using the same algorithm for all
-@@ -1274,16 +1292,39 @@ TokenStreamCharsBase<char16_t>::fillChar
- 
-         if (!this->charBuffer.append(ch))
-             return false;
-     }
- 
-     return true;
- }
- 
-+template<typename CharT>
-+class SpecializedTokenStreamCharsBase;
-+
-+template<>
-+class SpecializedTokenStreamCharsBase<char16_t>
-+  : public TokenStreamCharsBase<char16_t>
-+{
-+    using CharsBase = TokenStreamCharsBase<char16_t>;
-+
-+  protected:
-+    using CharsBase::CharsBase;
-+};
-+
-+template<>
-+class SpecializedTokenStreamCharsBase<mozilla::Utf8Unit>
-+  : public TokenStreamCharsBase<mozilla::Utf8Unit>
-+{
-+    using CharsBase = TokenStreamCharsBase<mozilla::Utf8Unit>;
-+
-+  protected:
-+    using CharsBase::CharsBase;
-+};
-+
- /** A small class encapsulating computation of the start-offset of a Token. */
- class TokenStart
- {
-     uint32_t startOffset_;
- 
-   public:
-     /**
-      * Compute a starting offset that is the current offset of |sourceUnits|,
-@@ -1297,19 +1338,20 @@ class TokenStart
- 
-     TokenStart(const TokenStart&) = default;
- 
-     uint32_t offset() const { return startOffset_; }
- };
- 
- template<typename CharT, class AnyCharsAccess>
- class GeneralTokenStreamChars
--  : public TokenStreamCharsBase<CharT>
-+  : public SpecializedTokenStreamCharsBase<CharT>
- {
-     using CharsBase = TokenStreamCharsBase<CharT>;
-+    using SpecializedCharsBase = SpecializedTokenStreamCharsBase<CharT>;
- 
-     Token* newTokenInternal(TokenKind kind, TokenStart start, TokenKind* out);
- 
-     /**
-      * Allocates a new Token from the given offset to the current offset,
-      * ascribes it the given kind, and sets |*out| to that kind.
-      */
-     Token* newToken(TokenKind kind, TokenStart start, TokenStreamShared::Modifier modifier,
-@@ -1330,17 +1372,17 @@ class GeneralTokenStreamChars
- 
-     uint32_t matchUnicodeEscape(uint32_t* codePoint);
-     uint32_t matchExtendedUnicodeEscape(uint32_t* codePoint);
- 
-   protected:
-     using typename CharsBase::SourceUnits;
- 
-   protected:
--    using CharsBase::CharsBase;
-+    using SpecializedCharsBase::SpecializedCharsBase;
- 
-     TokenStreamAnyChars& anyCharsAccess() {
-         return AnyCharsAccess::anyChars(this);
-     }
- 
-     const TokenStreamAnyChars& anyCharsAccess() const {
-         return AnyCharsAccess::anyChars(this);
-     }

frg/work-js/mozilla-release/patches/mozilla-central-push_427434.patch

@@ -1,393 +0,0 @@
-# HG changeset patch
-# User Jeff Walden <jwalden@mit.edu>
-# Date 1530305169 25200
-#      Fri Jun 29 13:46:09 2018 -0700
-# Node ID 44b64b5a44fcfdaf086bd32b7c8038efac5bf652
-# Parent  9ed1d40847424b11e2bc6b5cbc7e497753c81938
-Bug 1476866 - Move consumeRestOfSingleLineComment into TokenStreamChars (and the infallible UTF-16 implementation into SpecializedTokenStreamCharsBase) so that it can be easily specialized for UTF-8.  r=arai
-
-diff --git a/js/src/frontend/TokenStream.cpp b/js/src/frontend/TokenStream.cpp
---- a/js/src/frontend/TokenStream.cpp
-+++ b/js/src/frontend/TokenStream.cpp
-@@ -1506,26 +1506,26 @@ static const uint8_t firstCharKinds[] = 
- #undef T_RB
- #undef T_LC
- #undef T_RC
- #undef _______
- 
- static_assert(LastCharKind < (1 << (sizeof(firstCharKinds[0]) * 8)),
-               "Elements of firstCharKinds[] are too small");
- 
--template<typename CharT, class AnyCharsAccess>
- void
--GeneralTokenStreamChars<CharT, AnyCharsAccess>::consumeRestOfSingleLineComment()
-+SpecializedTokenStreamCharsBase<char16_t>::infallibleConsumeRestOfSingleLineComment()
- {
--    int32_t c;
--    do {
--        c = getCodeUnit();
--    } while (c != EOF && !SourceUnits::isRawEOLChar(c));
--
--    ungetCodeUnit(c);
-+    while (MOZ_LIKELY(!this->sourceUnits.atEnd())) {
-+        char16_t unit = this->sourceUnits.peekCodeUnit();
-+        if (SourceUnits::isRawEOLChar(unit))
-+            return;
-+
-+        this->sourceUnits.consumeKnownCodeUnit(unit);
-+    }
- }
- 
- template<typename CharT, class AnyCharsAccess>
- MOZ_MUST_USE bool
- TokenStreamSpecific<CharT, AnyCharsAccess>::decimalNumber(int32_t unit, TokenStart start,
-                                                           const CharT* numStart,
-                                                           Modifier modifier, TokenKind* out)
- {
-@@ -2092,17 +2092,19 @@ TokenStreamSpecific<CharT, AnyCharsAcces
-             break;
- 
-           case '<':
-             if (anyCharsAccess().options().allowHTMLComments) {
-                 // Treat HTML begin-comment as comment-till-end-of-line.
-                 if (matchCodeUnit('!')) {
-                     if (matchCodeUnit('-')) {
-                         if (matchCodeUnit('-')) {
--                            consumeRestOfSingleLineComment();
-+                            if (!consumeRestOfSingleLineComment())
-+                                return false;
-+
-                             continue;
-                         }
-                         ungetCodeUnit('-');
-                     }
-                     ungetCodeUnit('!');
-                 }
-             }
-             if (matchCodeUnit('<'))
-@@ -2137,17 +2139,19 @@ TokenStreamSpecific<CharT, AnyCharsAcces
-                     bool shouldWarn = unit == '@';
-                     if (!getDirectives(false, shouldWarn))
-                         return false;
-                 } else {
-                     // NOTE: |unit| may be EOF here.
-                     ungetCodeUnit(unit);
-                 }
- 
--                consumeRestOfSingleLineComment();
-+                if (!consumeRestOfSingleLineComment())
-+                    return false;
-+
-                 continue;
-             }
- 
-             // Look for a multi-line comment.
-             if (matchCodeUnit('*')) {
-                 TokenStreamAnyChars& anyChars = anyCharsAccess();
-                 unsigned linenoBefore = anyChars.lineno;
- 
-@@ -2194,17 +2198,19 @@ TokenStreamSpecific<CharT, AnyCharsAcces
-             break;
- 
-           case '-':
-             if (matchCodeUnit('-')) {
-                 if (anyCharsAccess().options().allowHTMLComments &&
-                     !anyCharsAccess().flags.isDirtyLine)
-                 {
-                     if (matchCodeUnit('>')) {
--                        consumeRestOfSingleLineComment();
-+                        if (!consumeRestOfSingleLineComment())
-+                            return false;
-+
-                         continue;
-                     }
-                 }
- 
-                 simpleKind = TokenKind::Dec;
-             } else {
-                 simpleKind = matchCodeUnit('=') ? TokenKind::SubAssign : TokenKind::Sub;
-             }
-diff --git a/js/src/frontend/TokenStream.h b/js/src/frontend/TokenStream.h
---- a/js/src/frontend/TokenStream.h
-+++ b/js/src/frontend/TokenStream.h
-@@ -1071,16 +1071,22 @@ class SourceUnits
-     bool matchCodeUnit(CharT c) {
-         if (*ptr == c) {    // this will nullptr-crash if poisoned
-             ptr++;
-             return true;
-         }
-         return false;
-     }
- 
-+    void consumeKnownCodeUnit(CharT c) {
-+        MOZ_ASSERT(ptr, "shouldn't use poisoned SourceUnits");
-+        MOZ_ASSERT(*ptr == c, "consuming the wrong code unit");
-+        ptr++;
-+    }
-+
-     /**
-      * Unget the '\n' (CR) that precedes a '\n' (LF), when ungetting a line
-      * terminator that's a full "\r\n" sequence.  If the prior code unit isn't
-      * '\r', do nothing.
-      */
-     void ungetOptionalCRBeforeLF() {
-         MOZ_ASSERT(ptr, "shouldn't unget a '\\r' from poisoned SourceUnits");
-         MOZ_ASSERT(*ptr == CharT('\n'),
-@@ -1213,26 +1219,24 @@ class TokenStreamCharsBase
-     /** Match a non-EOL, non-EOF code unit; return true iff it was matched. */
-     inline bool matchCodeUnit(int32_t expect);
- 
-   protected:
-     int32_t peekCodeUnit() {
-         return MOZ_LIKELY(!sourceUnits.atEnd()) ? CodeUnitValue(sourceUnits.peekCodeUnit()) : EOF;
-     }
- 
--    void consumeKnownCodeUnit(int32_t unit) {
--        MOZ_ASSERT(unit != EOF, "shouldn't be matching EOF");
--        MOZ_ASSERT(!sourceUnits.atEnd(), "must have units to consume");
--#ifdef DEBUG
--        CharT next =
--#endif
--            sourceUnits.getCodeUnit();
--        MOZ_ASSERT(CodeUnitValue(next) == unit,
--                   "must be consuming the correct unit");
--    }
-+    /** Consume a known, non-EOF code unit. */
-+    inline void consumeKnownCodeUnit(int32_t unit);
-+
-+    // Forbid accidental calls to consumeKnownCodeUnit *not* with the single
-+    // unit-or-EOF type.  CharT should use SourceUnits::consumeKnownCodeUnit;
-+    // CodeUnitValue() results should go through toCharT(), or better yet just
-+    // use the original CharT.
-+    template<typename T> inline void consumeKnownCodeUnit(T) = delete;
- 
-     MOZ_MUST_USE inline bool
-     fillCharBufferWithTemplateStringContents(const CharT* cur, const CharT* end);
- 
-   protected:
-     /** Code units in the source code being tokenized. */
-     SourceUnits sourceUnits;
- };
-@@ -1248,16 +1252,23 @@ TokenStreamCharsBase<char16_t>::toCharT(
- template<>
- inline mozilla::Utf8Unit
- TokenStreamCharsBase<mozilla::Utf8Unit>::toCharT(int32_t value)
- {
-     MOZ_ASSERT(value != EOF, "EOF is not a CharT");
-     return mozilla::Utf8Unit(static_cast<unsigned char>(value));
- }
- 
-+template<typename CharT>
-+inline void
-+TokenStreamCharsBase<CharT>::consumeKnownCodeUnit(int32_t unit)
-+{
-+    sourceUnits.consumeKnownCodeUnit(toCharT(unit));
-+}
-+
- template<>
- /* static */ MOZ_ALWAYS_INLINE JSAtom*
- TokenStreamCharsBase<char16_t>::atomizeSourceChars(JSContext* cx, const char16_t* chars,
-                                                    size_t length)
- {
-     return AtomizeChars(cx, chars, length);
- }
- 
-@@ -1302,26 +1313,53 @@ class SpecializedTokenStreamCharsBase;
- 
- template<>
- class SpecializedTokenStreamCharsBase<char16_t>
-   : public TokenStreamCharsBase<char16_t>
- {
-     using CharsBase = TokenStreamCharsBase<char16_t>;
- 
-   protected:
-+    // Deliberately don't |using| |sourceUnits| because of bug 1472569.  :-(
-+
-+    using typename CharsBase::SourceUnits;
-+
-+  protected:
-+    // These APIs are only usable by UTF-16-specific code.
-+
-+    /**
-+     * Consume the rest of a single-line comment (but not the EOL/EOF that
-+     * terminates it) -- infallibly because no 16-bit code unit sequence in a
-+     * comment is an error.
-+     */
-+    void infallibleConsumeRestOfSingleLineComment();
-+
-+  protected:
-+    // These APIs are in both SpecializedTokenStreamCharsBase specializations
-+    // and so are usable in subclasses no matter what CharT is.
-+
-     using CharsBase::CharsBase;
- };
- 
- template<>
- class SpecializedTokenStreamCharsBase<mozilla::Utf8Unit>
-   : public TokenStreamCharsBase<mozilla::Utf8Unit>
- {
-     using CharsBase = TokenStreamCharsBase<mozilla::Utf8Unit>;
- 
-   protected:
-+    // Deliberately don't |using| |sourceUnits| because of bug 1472569.  :-(
-+
-+  protected:
-+    // These APIs are only usable by UTF-8-specific code.
-+
-+  protected:
-+    // These APIs are in both SpecializedTokenStreamCharsBase specializations
-+    // and so are usable in subclasses no matter what CharT is.
-+
-     using CharsBase::CharsBase;
- };
- 
- /** A small class encapsulating computation of the start-offset of a Token. */
- class TokenStart
- {
-     uint32_t startOffset_;
- 
-@@ -1454,48 +1492,44 @@ class GeneralTokenStreamChars
-     }
- 
-     void ungetCodeUnit(int32_t c) {
-         MOZ_ASSERT_IF(c == EOF, anyCharsAccess().flags.isEOF);
- 
-         CharsBase::ungetCodeUnit(c);
-     }
- 
--    /**
--     * Consume code units til EOL/EOF following the start of a single-line
--     * comment, without consuming the EOL/EOF.
--     */
--    void consumeRestOfSingleLineComment();
--
-     MOZ_MUST_USE MOZ_ALWAYS_INLINE bool updateLineInfoForEOL() {
-         return anyCharsAccess().internalUpdateLineInfoForEOL(this->sourceUnits.offset());
-     }
- 
-     uint32_t matchUnicodeEscapeIdStart(uint32_t* codePoint);
-     bool matchUnicodeEscapeIdent(uint32_t* codePoint);
- };
- 
- template<typename CharT, class AnyCharsAccess> class TokenStreamChars;
- 
- template<class AnyCharsAccess>
- class TokenStreamChars<char16_t, AnyCharsAccess>
-   : public GeneralTokenStreamChars<char16_t, AnyCharsAccess>
- {
-   private:
-     using CharsBase = TokenStreamCharsBase<char16_t>;
-+    using SpecializedCharsBase = SpecializedTokenStreamCharsBase<char16_t>;
-     using GeneralCharsBase = GeneralTokenStreamChars<char16_t, AnyCharsAccess>;
-     using Self = TokenStreamChars<char16_t, AnyCharsAccess>;
- 
-     using GeneralCharsBase::asSpecific;
- 
-     using typename GeneralCharsBase::TokenStreamSpecific;
- 
-   protected:
-     using GeneralCharsBase::anyCharsAccess;
-     using GeneralCharsBase::getCodeUnit;
-+    using SpecializedCharsBase::infallibleConsumeRestOfSingleLineComment;
-     using TokenStreamCharsShared::isAsciiCodePoint;
-     // Deliberately don't |using| |sourceUnits| because of bug 1472569.  :-(
-     using GeneralCharsBase::ungetCodeUnit;
-     using GeneralCharsBase::updateLineInfoForEOL;
- 
-     using typename GeneralCharsBase::SourceUnits;
- 
-   protected:
-@@ -1588,16 +1622,27 @@ class TokenStreamChars<char16_t, AnyChar
-     }
- 
-     /**
-      * Unget a just-gotten LineTerminator sequence: '\r', '\n', '\r\n', or
-      * a Unicode line/paragraph separator, also undoing line/column information
-      * changes reflecting that LineTerminator.
-      */
-     void ungetLineTerminator();
-+
-+    /**
-+     * Consume code points til EOL/EOF following the start of a single-line
-+     * comment, without consuming the EOL/EOF.
-+     */
-+    MOZ_MUST_USE bool consumeRestOfSingleLineComment() {
-+        // This operation is infallible for UTF-16 -- and this implementation
-+        // approach lets the compiler boil away call-side fallibility handling.
-+        infallibleConsumeRestOfSingleLineComment();
-+        return true;
-+    }
- };
- 
- // TokenStream is the lexical scanner for JavaScript source text.
- //
- // It takes a buffer of CharT code units (currently only char16_t encoding
- // UTF-16, but we're adding either UTF-8 or Latin-1 single-byte text soon) and
- // linearly scans it into |Token|s.
- //
-@@ -1639,18 +1684,19 @@ class TokenStreamChars<char16_t, AnyChar
- template<typename CharT, class AnyCharsAccess>
- class MOZ_STACK_CLASS TokenStreamSpecific
-   : public TokenStreamChars<CharT, AnyCharsAccess>,
-     public TokenStreamShared,
-     public ErrorReporter
- {
-   public:
-     using CharsBase = TokenStreamCharsBase<CharT>;
-+    using SpecializedCharsBase = SpecializedTokenStreamCharsBase<CharT>;
-     using GeneralCharsBase = GeneralTokenStreamChars<CharT, AnyCharsAccess>;
--    using SpecializedCharsBase = TokenStreamChars<CharT, AnyCharsAccess>;
-+    using SpecializedChars = TokenStreamChars<CharT, AnyCharsAccess>;
- 
-     using Position = TokenStreamPosition<CharT>;
- 
-     // Anything inherited through a base class whose type depends upon this
-     // class's template parameters can only be accessed through a dependent
-     // name: prefixed with |this|, by explicit qualification, and so on.  (This
-     // is so that references to inherited fields are statically distinguishable
-     // from references to names outside of the class.)  This is tedious and
-@@ -1667,38 +1713,38 @@ class MOZ_STACK_CLASS TokenStreamSpecifi
-     using typename CharsBase::SourceUnits;
- 
-   private:
-     using TokenStreamCharsShared::appendCodePointToCharBuffer;
-     using CharsBase::atomizeSourceChars;
-     using GeneralCharsBase::badToken;
-     // Deliberately don't |using| |charBuffer| because of bug 1472569.  :-(
-     using CharsBase::consumeKnownCodeUnit;
--    using GeneralCharsBase::consumeRestOfSingleLineComment;
-+    using SpecializedChars::consumeRestOfSingleLineComment;
-     using TokenStreamCharsShared::copyCharBufferTo;
-     using TokenStreamCharsShared::drainCharBufferIntoAtom;
-     using CharsBase::fillCharBufferWithTemplateStringContents;
--    using SpecializedCharsBase::getCodePoint;
-+    using SpecializedChars::getCodePoint;
-     using GeneralCharsBase::getCodeUnit;
--    using SpecializedCharsBase::getFullAsciiCodePoint;
--    using SpecializedCharsBase::getNonAsciiCodePoint;
-+    using SpecializedChars::getFullAsciiCodePoint;
-+    using SpecializedChars::getNonAsciiCodePoint;
-     using TokenStreamCharsShared::isAsciiCodePoint;
-     using CharsBase::matchCodeUnit;
-     using GeneralCharsBase::matchUnicodeEscapeIdent;
-     using GeneralCharsBase::matchUnicodeEscapeIdStart;
-     using GeneralCharsBase::newAtomToken;
-     using GeneralCharsBase::newNameToken;
-     using GeneralCharsBase::newNumberToken;
-     using GeneralCharsBase::newRegExpToken;
-     using GeneralCharsBase::newSimpleToken;
-     using CharsBase::peekCodeUnit;
-     // Deliberately don't |using| |sourceUnits| because of bug 1472569.  :-(
--    using SpecializedCharsBase::ungetCodePointIgnoreEOL;
-+    using SpecializedChars::ungetCodePointIgnoreEOL;
-     using GeneralCharsBase::ungetCodeUnit;
--    using SpecializedCharsBase::ungetNonAsciiNormalizedCodePoint;
-+    using SpecializedChars::ungetNonAsciiNormalizedCodePoint;
-     using GeneralCharsBase::updateLineInfoForEOL;
- 
-     template<typename CharU> friend class TokenStreamPosition;
- 
-   public:
-     TokenStreamSpecific(JSContext* cx, const ReadOnlyCompileOptions& options,
-                         const CharT* base, size_t length);
- 

frg/work-js/mozilla-release/patches/mozilla-central-push_427435.patch

@@ -1,163 +0,0 @@
-# HG changeset patch
-# User Jeff Walden <jwalden@mit.edu>
-# Date 1531172296 25200
-#      Mon Jul 09 14:38:16 2018 -0700
-# Node ID 3a4e6ae59b597084afaed1d84d1674ee556406d5
-# Parent  44b64b5a44fcfdaf086bd32b7c8038efac5bf652
-Bug 1476866 - Add a getNonAsciiCodePointDontNormalize for use in situations that demand such.  r=arai
-
-diff --git a/js/src/frontend/TokenStream.cpp b/js/src/frontend/TokenStream.cpp
---- a/js/src/frontend/TokenStream.cpp
-+++ b/js/src/frontend/TokenStream.cpp
-@@ -1324,30 +1324,25 @@ TokenStreamSpecific<CharT, AnyCharsAcces
-                     return false;
- 
-                 continue;
-             }
- 
-             if (unit != '\\' || !matchUnicodeEscapeIdent(&codePoint))
-                 break;
-         } else {
--            int32_t cp;
--            if (!getNonAsciiCodePoint(unit, &cp))
-+            // |restoreNextRawCharAddress| undoes all gets, and this function
-+            // doesn't update line/column info.
-+            char32_t cp;
-+            if (!getNonAsciiCodePointDontNormalize(unit, &cp))
-                 return false;
- 
--            codePoint = AssertedCast<uint32_t>(cp);
--
--            if (!unicode::IsIdentifierPart(codePoint)) {
--                if (MOZ_UNLIKELY(codePoint == '\n')) {
--                    // |restoreNextRawCharAddress| will undo all gets, but we
--                    // have to revert a line/column update manually.
--                    anyCharsAccess().undoInternalUpdateLineInfoForEOL();
--                }
-+            codePoint = cp;
-+            if (!unicode::IsIdentifierPart(codePoint))
-                 break;
--            }
-         }
- 
-         if (!appendCodePointToCharBuffer(codePoint))
-             return false;
-     } while (true);
- 
-     return true;
- }
-diff --git a/js/src/frontend/TokenStream.h b/js/src/frontend/TokenStream.h
---- a/js/src/frontend/TokenStream.h
-+++ b/js/src/frontend/TokenStream.h
-@@ -1313,30 +1313,53 @@ class SpecializedTokenStreamCharsBase;
- 
- template<>
- class SpecializedTokenStreamCharsBase<char16_t>
-   : public TokenStreamCharsBase<char16_t>
- {
-     using CharsBase = TokenStreamCharsBase<char16_t>;
- 
-   protected:
-+    using TokenStreamCharsShared::isAsciiCodePoint;
-     // Deliberately don't |using| |sourceUnits| because of bug 1472569.  :-(
- 
-     using typename CharsBase::SourceUnits;
- 
-   protected:
-     // These APIs are only usable by UTF-16-specific code.
- 
-     /**
-      * Consume the rest of a single-line comment (but not the EOL/EOF that
-      * terminates it) -- infallibly because no 16-bit code unit sequence in a
-      * comment is an error.
-      */
-     void infallibleConsumeRestOfSingleLineComment();
- 
-+    /**
-+     * Given |lead| already consumed, consume and return the code point encoded
-+     * starting from it.  Infallible because lone surrogates in JS encode a
-+     * "code point" of the same value.
-+     */
-+    char32_t infallibleGetNonAsciiCodePointDontNormalize(char16_t lead) {
-+        MOZ_ASSERT(!isAsciiCodePoint(lead));
-+        MOZ_ASSERT(this->sourceUnits.previousCodeUnit() == lead);
-+
-+        // Handle single-unit code points and lone trailing surrogates.
-+        if (MOZ_LIKELY(!unicode::IsLeadSurrogate(lead)) ||
-+            // Or handle lead surrogates not paired with trailing surrogates.
-+            MOZ_UNLIKELY(this->sourceUnits.atEnd() ||
-+                         !unicode::IsTrailSurrogate(this->sourceUnits.peekCodeUnit())))
-+        {
-+            return lead;
-+        }
-+
-+        // Otherwise it's a multi-unit code point.
-+        return unicode::UTF16Decode(lead, this->sourceUnits.getCodeUnit());
-+    }
-+
-   protected:
-     // These APIs are in both SpecializedTokenStreamCharsBase specializations
-     // and so are usable in subclasses no matter what CharT is.
- 
-     using CharsBase::CharsBase;
- };
- 
- template<>
-@@ -1520,26 +1543,39 @@ class TokenStreamChars<char16_t, AnyChar
-     using GeneralCharsBase::asSpecific;
- 
-     using typename GeneralCharsBase::TokenStreamSpecific;
- 
-   protected:
-     using GeneralCharsBase::anyCharsAccess;
-     using GeneralCharsBase::getCodeUnit;
-     using SpecializedCharsBase::infallibleConsumeRestOfSingleLineComment;
-+    using SpecializedCharsBase::infallibleGetNonAsciiCodePointDontNormalize;
-     using TokenStreamCharsShared::isAsciiCodePoint;
-     // Deliberately don't |using| |sourceUnits| because of bug 1472569.  :-(
-     using GeneralCharsBase::ungetCodeUnit;
-     using GeneralCharsBase::updateLineInfoForEOL;
- 
-     using typename GeneralCharsBase::SourceUnits;
- 
-   protected:
-     using GeneralCharsBase::GeneralCharsBase;
- 
-+    /**
-+     * Given the non-ASCII |lead| code unit just consumed, consume and return a
-+     * complete non-ASCII code point.  Line/column updates are not performed,
-+     * and line breaks are returned as-is without normalization.
-+     */
-+    MOZ_MUST_USE bool getNonAsciiCodePointDontNormalize(char16_t lead, char32_t* codePoint) {
-+        // There are no encoding errors in 16-bit JS, so implement this so that
-+        // the compiler knows it, too.
-+        *codePoint = infallibleGetNonAsciiCodePointDontNormalize(lead);
-+        return true;
-+    }
-+
-     // Try to get the next code point, normalizing '\r', '\r\n', '\n', and the
-     // Unicode line/paragraph separators into '\n'.  Also updates internal
-     // line-counter state.  Return true on success and store the code point in
-     // |*c|.  Return false and leave |*c| undefined on failure.
-     MOZ_MUST_USE bool getCodePoint(int32_t* cp);
- 
-     /**
-      * Given a just-consumed ASCII code unit/point |lead|, consume a full code
-@@ -1721,16 +1757,17 @@ class MOZ_STACK_CLASS TokenStreamSpecifi
-     using SpecializedChars::consumeRestOfSingleLineComment;
-     using TokenStreamCharsShared::copyCharBufferTo;
-     using TokenStreamCharsShared::drainCharBufferIntoAtom;
-     using CharsBase::fillCharBufferWithTemplateStringContents;
-     using SpecializedChars::getCodePoint;
-     using GeneralCharsBase::getCodeUnit;
-     using SpecializedChars::getFullAsciiCodePoint;
-     using SpecializedChars::getNonAsciiCodePoint;
-+    using SpecializedChars::getNonAsciiCodePointDontNormalize;
-     using TokenStreamCharsShared::isAsciiCodePoint;
-     using CharsBase::matchCodeUnit;
-     using GeneralCharsBase::matchUnicodeEscapeIdent;
-     using GeneralCharsBase::matchUnicodeEscapeIdStart;
-     using GeneralCharsBase::newAtomToken;
-     using GeneralCharsBase::newNameToken;
-     using GeneralCharsBase::newNumberToken;
-     using GeneralCharsBase::newRegExpToken;

frg/work-js/mozilla-release/patches/mozilla-central-push_427436.patch

@@ -1,166 +0,0 @@
-# HG changeset patch
-# User Jeff Walden <jwalden@mit.edu>
-# Date 1531178570 25200
-#      Mon Jul 09 16:22:50 2018 -0700
-# Node ID 80b3a14e84c23a7215243376d1a3143a985aee8a
-# Parent  3a4e6ae59b597084afaed1d84d1674ee556406d5
-Bug 1476866 - Remove ungetLineTerminator, used only to unget Unicode separators, and replace it with a SourceUnits::ungetLineOrParagraphSeparator.  r=arai
-
-diff --git a/js/src/frontend/TokenStream.cpp b/js/src/frontend/TokenStream.cpp
---- a/js/src/frontend/TokenStream.cpp
-+++ b/js/src/frontend/TokenStream.cpp
-@@ -596,31 +596,16 @@ TokenStreamChars<char16_t, AnyCharsAcces
-     unicode::UTF16Encode(codePoint, units, &numUnits);
- 
-     MOZ_ASSERT(numUnits == 1 || numUnits == 2);
- 
-     while (numUnits-- > 0)
-         ungetCodeUnit(units[numUnits]);
- }
- 
--template<class AnyCharsAccess>
--void
--TokenStreamChars<char16_t, AnyCharsAccess>::ungetLineTerminator()
--{
--    this->sourceUnits.ungetCodeUnit();
--
--    char16_t last = this->sourceUnits.peekCodeUnit();
--    MOZ_ASSERT(SourceUnits::isRawEOLChar(last));
--
--    if (last == '\n')
--        this->sourceUnits.ungetOptionalCRBeforeLF();
--
--    anyCharsAccess().undoInternalUpdateLineInfoForEOL();
--}
--
- template<typename CharT>
- size_t
- SourceUnits<CharT>::findEOLMax(size_t start, size_t max)
- {
-     const CharT* p = codeUnitPtrAt(start);
- 
-     size_t n = 0;
-     while (true) {
-@@ -1618,23 +1603,26 @@ template<typename CharT, class AnyCharsA
- MOZ_MUST_USE bool
- TokenStreamSpecific<CharT, AnyCharsAccess>::regexpLiteral(TokenStart start, TokenKind* out)
- {
-     MOZ_ASSERT(this->sourceUnits.previousCodeUnit() == '/');
-     this->charBuffer.clear();
- 
-     auto ProcessNonAsciiCodePoint = [this](int32_t lead) {
-         MOZ_ASSERT(lead != EOF);
--
--        int32_t codePoint;
--        if (!this->getNonAsciiCodePoint(lead, &codePoint))
-+        MOZ_ASSERT(!this->isAsciiCodePoint(lead));
-+
-+        char32_t codePoint;
-+        if (!this->getNonAsciiCodePointDontNormalize(lead, &codePoint))
-             return false;
- 
--        if (codePoint == '\n') {
--            this->ungetLineTerminator();
-+        if (MOZ_UNLIKELY(codePoint == unicode::LINE_SEPARATOR ||
-+                         codePoint == unicode::PARA_SEPARATOR))
-+        {
-+            this->sourceUnits.ungetLineOrParagraphSeparator();
-             this->reportError(JSMSG_UNTERMINATED_REGEXP);
-             return false;
-         }
- 
-         return this->appendCodePointToCharBuffer(codePoint);
-     };
- 
-     auto ReportUnterminatedRegExp = [this](CharT unit) {
-diff --git a/js/src/frontend/TokenStream.h b/js/src/frontend/TokenStream.h
---- a/js/src/frontend/TokenStream.h
-+++ b/js/src/frontend/TokenStream.h
-@@ -1092,16 +1092,19 @@ class SourceUnits
-         MOZ_ASSERT(*ptr == CharT('\n'),
-                    "function should only be called when a '\\n' was just "
-                    "ungotten, and any '\\r' preceding it must also be "
-                    "ungotten");
-         if (*(ptr - 1) == CharT('\r'))
-             ptr--;
-     }
- 
-+    /** Unget U+2028 LINE SEPARATOR or U+2029 PARAGRAPH SEPARATOR. */
-+    inline void ungetLineOrParagraphSeparator();
-+
-     void ungetCodeUnit() {
-         MOZ_ASSERT(!atStart(), "can't unget if currently at start");
-         MOZ_ASSERT(ptr);     // make sure it hasn't been poisoned
-         ptr--;
-     }
- 
-     const CharT* addressOfNextCodeUnit(bool allowPoisoned = false) const {
-         MOZ_ASSERT_IF(!allowPoisoned, ptr);     // make sure it hasn't been poisoned
-@@ -1141,16 +1144,43 @@ class SourceUnits
- 
-     /** Limit for quick bounds check. */
-     const CharT* limit_;
- 
-     /** Next char to get. */
-     const CharT* ptr;
- };
- 
-+template<>
-+inline void
-+SourceUnits<char16_t>::ungetLineOrParagraphSeparator()
-+{
-+#ifdef DEBUG
-+    char16_t prev = previousCodeUnit();
-+#endif
-+    MOZ_ASSERT(prev == unicode::LINE_SEPARATOR || prev == unicode::PARA_SEPARATOR);
-+
-+    ungetCodeUnit();
-+}
-+
-+template<>
-+inline void
-+SourceUnits<mozilla::Utf8Unit>::ungetLineOrParagraphSeparator()
-+{
-+    unskipCodeUnits(3);
-+
-+    MOZ_ASSERT(ptr[0].toUint8() == 0xE2);
-+    MOZ_ASSERT(ptr[1].toUint8() == 0x80);
-+
-+#ifdef DEBUG
-+    uint8_t last = ptr[2].toUint8();
-+#endif
-+    MOZ_ASSERT(last == 0xA8 || last == 0xA9);
-+}
-+
- class TokenStreamCharsShared
- {
-     // Using char16_t (not CharT) is a simplifying decision that hopefully
-     // eliminates the need for a UTF-8 regular expression parser and makes
-     // |copyCharBufferTo| markedly simpler.
-     using CharBuffer = Vector<char16_t, 32>;
- 
-   protected:
-@@ -1653,23 +1683,16 @@ class TokenStreamChars<char16_t, AnyChar
-                    "should not be ungetting un-normalized code points");
- 
-         ungetCodePointIgnoreEOL(codePoint);
-         if (codePoint == '\n')
-             anyCharsAccess().undoInternalUpdateLineInfoForEOL();
-     }
- 
-     /**
--     * Unget a just-gotten LineTerminator sequence: '\r', '\n', '\r\n', or
--     * a Unicode line/paragraph separator, also undoing line/column information
--     * changes reflecting that LineTerminator.
--     */
--    void ungetLineTerminator();
--
--    /**
-      * Consume code points til EOL/EOF following the start of a single-line
-      * comment, without consuming the EOL/EOF.
-      */
-     MOZ_MUST_USE bool consumeRestOfSingleLineComment() {
-         // This operation is infallible for UTF-16 -- and this implementation
-         // approach lets the compiler boil away call-side fallibility handling.
-         infallibleConsumeRestOfSingleLineComment();
-         return true;

frg/work-js/mozilla-release/patches/mozilla-central-push_427437.patch

@@ -1,109 +0,0 @@
-# HG changeset patch
-# User Jeff Walden <jwalden@mit.edu>
-# Date 1531886456 25200
-#      Tue Jul 17 21:00:56 2018 -0700
-# Node ID 0ed3f8f103c013b9c360360c6337956175b59ef5
-# Parent  80b3a14e84c23a7215243376d1a3143a985aee8a
-Bug 1476866 - Reduce code indentation in the loop to accumulate regular expression source text by handling the non-ASCII case in an early block-with-continue.  r=arai
-
-diff --git a/js/src/frontend/TokenStream.cpp b/js/src/frontend/TokenStream.cpp
---- a/js/src/frontend/TokenStream.cpp
-+++ b/js/src/frontend/TokenStream.cpp
-@@ -1633,55 +1633,63 @@ TokenStreamSpecific<CharT, AnyCharsAcces
-     bool inCharClass = false;
-     do {
-         int32_t unit = getCodeUnit();
-         if (unit == EOF) {
-             ReportUnterminatedRegExp(unit);
-             return badToken();
-         }
- 
--        if (MOZ_LIKELY(isAsciiCodePoint(unit))) {
--            if (unit == '\\')  {
--                if (!this->charBuffer.append(unit))
--                    return badToken();
--
--                unit = getCodeUnit();
--                if (unit == EOF) {
--                    ReportUnterminatedRegExp(unit);
--                    return badToken();
--                }
--
--                // Fallthrough only handles ASCII code points, so
--                // deal with non-ASCII and skip everything else.
--                if (MOZ_UNLIKELY(!isAsciiCodePoint(unit))) {
--                    if (!ProcessNonAsciiCodePoint(unit))
--                        return badToken();
--
--                    continue;
--                }
--            } else if (unit == '[') {
--                inCharClass = true;
--            } else if (unit == ']') {
--                inCharClass = false;
--            } else if (unit == '/' && !inCharClass) {
--                // For IE compat, allow unescaped / in char classes.
--                break;
--            }
--
--            if (unit == '\r' || unit == '\n') {
-+        if (MOZ_UNLIKELY(!isAsciiCodePoint(unit))) {
-+            if (!ProcessNonAsciiCodePoint(unit))
-+                return badToken();
-+
-+            continue;
-+        }
-+
-+        if (unit == '\\')  {
-+            if (!this->charBuffer.append(unit))
-+                return badToken();
-+
-+            unit = getCodeUnit();
-+            if (unit == EOF) {
-                 ReportUnterminatedRegExp(unit);
-                 return badToken();
-             }
- 
--            if (!this->charBuffer.append(unit))
--                return badToken();
--        } else {
--            if (!ProcessNonAsciiCodePoint(unit))
--                return badToken();
-+            // Fallthrough only handles ASCII code points, so
-+            // deal with non-ASCII and skip everything else.
-+            if (MOZ_UNLIKELY(!isAsciiCodePoint(unit))) {
-+                if (!ProcessNonAsciiCodePoint(unit))
-+                    return badToken();
-+
-+                continue;
-+            }
-+        } else if (unit == '[') {
-+            inCharClass = true;
-+        } else if (unit == ']') {
-+            inCharClass = false;
-+        } else if (unit == '/' && !inCharClass) {
-+            // For IE compat, allow unescaped / in char classes.
-+            break;
-         }
-+
-+        if (unit == '\r' || unit == '\n') {
-+            ReportUnterminatedRegExp(unit);
-+            return badToken();
-+        }
-+
-+        // We're accumulating regular expression *source* text here: source
-+        // text matching a line break will appear as U+005C REVERSE SOLIDUS
-+        // U+006E LATIN SMALL LETTER N, and |unit| here would be the latter
-+        // code point.
-+        MOZ_ASSERT(!SourceUnits::isRawEOLChar(unit));
-+
-+        if (!this->charBuffer.append(unit))
-+            return badToken();
-     } while (true);
- 
-     int32_t unit;
-     RegExpFlag reflags = NoFlags;
-     while (true) {
-         RegExpFlag flag;
-         unit = getCodeUnit();
-         if (unit == 'g')

frg/work-js/mozilla-release/patches/mozilla-central-push_427438.patch

@@ -1,349 +0,0 @@
-# HG changeset patch
-# User Jeff Walden <jwalden@mit.edu>
-# Date 1531886457 25200
-#      Tue Jul 17 21:00:57 2018 -0700
-# Node ID 4bd4c0e74bc6ce7ef610ef902085a3609b9517f8
-# Parent  0ed3f8f103c013b9c360360c6337956175b59ef5
-Bug 1476866 - Make matchCodeUnit only accept ASCII, and split matchLineTerminator (for '\r' and '\n') out of it.  r=arai
-
-diff --git a/js/src/frontend/TokenStream.cpp b/js/src/frontend/TokenStream.cpp
---- a/js/src/frontend/TokenStream.cpp
-+++ b/js/src/frontend/TokenStream.cpp
-@@ -482,19 +482,16 @@ void
- TokenStreamAnyChars::undoInternalUpdateLineInfoForEOL()
- {
-     MOZ_ASSERT(prevLinebase != size_t(-1)); // we should never get more than one EOL
-     linebase = prevLinebase;
-     prevLinebase = size_t(-1);
-     lineno--;
- }
- 
--// This gets a full code point, starting from an already-consumed leading code
--// unit, normalizing EOL sequences to '\n', also updating line/column info as
--// needed.
- template<class AnyCharsAccess>
- bool
- TokenStreamChars<char16_t, AnyCharsAccess>::getCodePoint(int32_t* cp)
- {
-     TokenStreamAnyChars& anyChars = anyCharsAccess();
- 
-     if (MOZ_UNLIKELY(this->sourceUnits.atEnd())) {
-         anyChars.flags.isEOF = true;
-@@ -505,20 +502,17 @@ TokenStreamChars<char16_t, AnyCharsAcces
-     int32_t c = this->sourceUnits.getCodeUnit();
- 
-     do {
-         // Normalize the char16_t if it was a newline.
-         if (MOZ_UNLIKELY(c == '\n'))
-             break;
- 
-         if (MOZ_UNLIKELY(c == '\r')) {
--            // If it's a \r\n sequence: treat as a single EOL, skip over the \n.
--            if (MOZ_LIKELY(!this->sourceUnits.atEnd()))
--                this->sourceUnits.matchCodeUnit('\n');
--
-+            matchLineTerminator('\n');
-             break;
-         }
- 
-         if (MOZ_UNLIKELY(c == unicode::LINE_SEPARATOR || c == unicode::PARA_SEPARATOR))
-             break;
- 
-         *cp = c;
-         return true;
-@@ -1841,19 +1835,18 @@ TokenStreamSpecific<CharT, AnyCharsAcces
-         // Look for a string or a template string.
-         //
-         if (c1kind == String)
-             return getStringOrTemplateToken(static_cast<char>(unit), modifier, ttp);
- 
-         // Skip over EOL chars, updating line state along the way.
-         //
-         if (c1kind == EOL) {
--            // If it's a \r\n sequence, consume it as a single EOL.
--            if (unit == '\r' && !this->sourceUnits.atEnd())
--                this->sourceUnits.matchCodeUnit('\n');
-+            if (unit == '\r')
-+                matchLineTerminator('\n');
- 
-             if (!updateLineInfoForEOL())
-                 return badToken();
- 
-             anyCharsAccess().updateFlagsForEOL();
-             continue;
-         }
- 
-@@ -2334,18 +2327,17 @@ TokenStreamSpecific<CharT, AnyCharsAcces
-               case 'b': unit = '\b'; break;
-               case 'f': unit = '\f'; break;
-               case 'n': unit = '\n'; break;
-               case 'r': unit = '\r'; break;
-               case 't': unit = '\t'; break;
-               case 'v': unit = '\v'; break;
- 
-               case '\r':
--                if (MOZ_LIKELY(!this->sourceUnits.atEnd()))
--                    this->sourceUnits.matchCodeUnit('\n');
-+                matchLineTerminator('\n');
-                 MOZ_FALLTHROUGH;
-               case '\n': {
-                 // LineContinuation represents no code points.  We're manually
-                 // consuming a LineTerminatorSequence, so we must manually
-                 // update line/column info.
-                 if (!updateLineInfoForEOL())
-                     return false;
- 
-@@ -2541,20 +2533,17 @@ TokenStreamSpecific<CharT, AnyCharsAcces
-                 // String literals don't allow ASCII line breaks.
-                 ungetCodeUnit(unit);
-                 ReportPrematureEndOfLiteral(JSMSG_EOL_BEFORE_END_OF_STRING);
-                 return false;
-             }
- 
-             if (unit == '\r') {
-                 unit = '\n';
--
--                // If it's a \r\n sequence: treat as a single EOL, skip over the \n.
--                if (!this->sourceUnits.atEnd())
--                    this->sourceUnits.matchCodeUnit('\n');
-+                matchLineTerminator('\n');
-             }
- 
-             if (!updateLineInfoForEOL())
-                 return false;
- 
-             anyCharsAccess().updateFlagsForEOL();
-         } else if (parsingTemplate && unit == '$' && matchCodeUnit('{')) {
-             templateHead = true;
-diff --git a/js/src/frontend/TokenStream.h b/js/src/frontend/TokenStream.h
---- a/js/src/frontend/TokenStream.h
-+++ b/js/src/frontend/TokenStream.h
-@@ -941,16 +941,19 @@ CodeUnitValue(char16_t unit)
- }
- 
- constexpr uint8_t
- CodeUnitValue(mozilla::Utf8Unit unit)
- {
-     return unit.toUint8();
- }
- 
-+template<typename CharT>
-+class TokenStreamCharsBase;
-+
- // This is the low-level interface to the JS source code buffer.  It just gets
- // raw Unicode code units -- 16-bit char16_t units of source text that are not
- // (always) full code points, and 8-bit units of UTF-8 source text soon.
- // TokenStreams functions are layered on top and do some extra stuff like
- // converting all EOL sequences to '\n', tracking the line number, and setting
- // |flags.isEOF|.  (The "raw" in "raw Unicode code units" refers to the lack of
- // EOL sequence normalization.)
- //
-@@ -1063,24 +1066,29 @@ class SourceUnits
- 
-     void unskipCodeUnits(uint32_t n) {
-         MOZ_ASSERT(ptr, "shouldn't use poisoned SourceUnits");
-         MOZ_ASSERT(n <= mozilla::PointerRangeSize(base_, ptr),
-                    "shouldn't unskip beyond start of SourceUnits");
-         ptr -= n;
-     }
- 
--    bool matchCodeUnit(CharT c) {
--        if (*ptr == c) {    // this will nullptr-crash if poisoned
-+  private:
-+    friend class TokenStreamCharsBase<CharT>;
-+
-+    bool internalMatchCodeUnit(CharT c) {
-+        MOZ_ASSERT(ptr, "shouldn't use poisoned SourceUnits");
-+        if (MOZ_LIKELY(!atEnd()) && *ptr == c) {
-             ptr++;
-             return true;
-         }
-         return false;
-     }
- 
-+  public:
-     void consumeKnownCodeUnit(CharT c) {
-         MOZ_ASSERT(ptr, "shouldn't use poisoned SourceUnits");
-         MOZ_ASSERT(*ptr == c, "consuming the wrong code unit");
-         ptr++;
-     }
- 
-     /**
-      * Unget the '\n' (CR) that precedes a '\n' (LF), when ungetting a line
-@@ -1220,41 +1228,59 @@ class TokenStreamCharsShared
-     CharBuffer& getCharBuffer() { return charBuffer; }
- };
- 
- template<typename CharT>
- class TokenStreamCharsBase
-   : public TokenStreamCharsShared
- {
-   protected:
-+    TokenStreamCharsBase(JSContext* cx, const CharT* chars, size_t length, size_t startOffset);
-+
-     /**
-      * Convert a non-EOF code unit returned by |getCodeUnit()| or
-      * |peekCodeUnit()| to a CharT code unit.
-      */
-     inline CharT toCharT(int32_t codeUnitValue);
- 
-     void ungetCodeUnit(int32_t c) {
-         if (c == EOF)
-             return;
- 
-         sourceUnits.ungetCodeUnit();
-     }
- 
--  public:
--    TokenStreamCharsBase(JSContext* cx, const CharT* chars, size_t length, size_t startOffset);
--
-     static MOZ_ALWAYS_INLINE JSAtom*
-     atomizeSourceChars(JSContext* cx, const CharT* chars, size_t length);
- 
-     using SourceUnits = frontend::SourceUnits<CharT>;
- 
--    /** Match a non-EOL, non-EOF code unit; return true iff it was matched. */
--    inline bool matchCodeUnit(int32_t expect);
-+    /**
-+     * Try to match a non-LineTerminator ASCII code point.  Return true iff it
-+     * was matched.
-+     */
-+    bool matchCodeUnit(char expect) {
-+        MOZ_ASSERT(mozilla::IsAscii(expect));
-+        MOZ_ASSERT(expect != '\r');
-+        MOZ_ASSERT(expect != '\n');
-+        return this->sourceUnits.internalMatchCodeUnit(CharT(expect));
-+    }
- 
--  protected:
-+    /**
-+     * Try to match an ASCII LineTerminator code point.  Return true iff it was
-+     * matched.
-+     */
-+    bool matchLineTerminator(char expect) {
-+        MOZ_ASSERT(expect == '\r' || expect == '\n');
-+        return this->sourceUnits.internalMatchCodeUnit(CharT(expect));
-+    }
-+
-+    template<typename T> bool matchCodeUnit(T) = delete;
-+    template<typename T> bool matchLineTerminator(T) = delete;
-+
-     int32_t peekCodeUnit() {
-         return MOZ_LIKELY(!sourceUnits.atEnd()) ? CodeUnitValue(sourceUnits.peekCodeUnit()) : EOF;
-     }
- 
-     /** Consume a known, non-EOF code unit. */
-     inline void consumeKnownCodeUnit(int32_t unit);
- 
-     // Forbid accidental calls to consumeKnownCodeUnit *not* with the single
-@@ -1297,26 +1323,16 @@ TokenStreamCharsBase<CharT>::consumeKnow
- template<>
- /* static */ MOZ_ALWAYS_INLINE JSAtom*
- TokenStreamCharsBase<char16_t>::atomizeSourceChars(JSContext* cx, const char16_t* chars,
-                                                    size_t length)
- {
-     return AtomizeChars(cx, chars, length);
- }
- 
--template<typename CharT>
--inline bool
--TokenStreamCharsBase<CharT>::matchCodeUnit(int32_t expect)
--{
--    MOZ_ASSERT(expect != EOF, "shouldn't be matching EOFs");
--    MOZ_ASSERT(!SourceUnits::isRawEOLChar(expect));
--    return MOZ_LIKELY(!this->sourceUnits.atEnd()) &&
--           this->sourceUnits.matchCodeUnit(toCharT(expect));
--}
--
- template<>
- MOZ_MUST_USE inline bool
- TokenStreamCharsBase<char16_t>::fillCharBufferWithTemplateStringContents(const char16_t* cur,
-                                                                          const char16_t* end)
- {
-     MOZ_ASSERT(this->charBuffer.length() == 0);
- 
-     while (cur < end) {
-@@ -1575,16 +1591,17 @@ class TokenStreamChars<char16_t, AnyChar
-     using typename GeneralCharsBase::TokenStreamSpecific;
- 
-   protected:
-     using GeneralCharsBase::anyCharsAccess;
-     using GeneralCharsBase::getCodeUnit;
-     using SpecializedCharsBase::infallibleConsumeRestOfSingleLineComment;
-     using SpecializedCharsBase::infallibleGetNonAsciiCodePointDontNormalize;
-     using TokenStreamCharsShared::isAsciiCodePoint;
-+    using CharsBase::matchLineTerminator;
-     // Deliberately don't |using| |sourceUnits| because of bug 1472569.  :-(
-     using GeneralCharsBase::ungetCodeUnit;
-     using GeneralCharsBase::updateLineInfoForEOL;
- 
-     using typename GeneralCharsBase::SourceUnits;
- 
-   protected:
-     using GeneralCharsBase::GeneralCharsBase;
-@@ -1596,20 +1613,22 @@ class TokenStreamChars<char16_t, AnyChar
-      */
-     MOZ_MUST_USE bool getNonAsciiCodePointDontNormalize(char16_t lead, char32_t* codePoint) {
-         // There are no encoding errors in 16-bit JS, so implement this so that
-         // the compiler knows it, too.
-         *codePoint = infallibleGetNonAsciiCodePointDontNormalize(lead);
-         return true;
-     }
- 
--    // Try to get the next code point, normalizing '\r', '\r\n', '\n', and the
--    // Unicode line/paragraph separators into '\n'.  Also updates internal
--    // line-counter state.  Return true on success and store the code point in
--    // |*c|.  Return false and leave |*c| undefined on failure.
-+    /**
-+     * Get the next code point, converting LineTerminatorSequences to '\n' and
-+     * updating internal line-counter state if needed.  Return true on success
-+     * and store the code point in |*c|.  Return false and leave |*c| undefined
-+     * on failure.
-+     */
-     MOZ_MUST_USE bool getCodePoint(int32_t* cp);
- 
-     /**
-      * Given a just-consumed ASCII code unit/point |lead|, consume a full code
-      * point or LineTerminatorSequence (normalizing it to '\n') and store it in
-      * |*codePoint|.  Return true on success, otherwise return false and leave
-      * |*codePoint| undefined on failure.
-      *
-@@ -1620,19 +1639,17 @@ class TokenStreamChars<char16_t, AnyChar
-     MOZ_MUST_USE bool getFullAsciiCodePoint(int32_t lead, int32_t* codePoint) {
-         MOZ_ASSERT(isAsciiCodePoint(lead),
-                    "non-ASCII code units must be handled separately");
-         // NOTE: |this->|-qualify to avoid a gcc bug: see bug 1472569.
-         MOZ_ASSERT(lead == this->sourceUnits.previousCodeUnit(),
-                    "getFullAsciiCodePoint called incorrectly");
- 
-         if (MOZ_UNLIKELY(lead == '\r')) {
--            // NOTE: |this->|-qualify to avoid a gcc bug: see bug 1472569.
--            if (MOZ_LIKELY(!this->sourceUnits.atEnd()))
--                this->sourceUnits.matchCodeUnit('\n');
-+            matchLineTerminator('\n');
-         } else if (MOZ_LIKELY(lead != '\n')) {
-             *codePoint = lead;
-             return true;
-         }
- 
-         *codePoint = '\n';
-         bool ok = updateLineInfoForEOL();
-         if (!ok) {
-@@ -1783,16 +1800,17 @@ class MOZ_STACK_CLASS TokenStreamSpecifi
-     using CharsBase::fillCharBufferWithTemplateStringContents;
-     using SpecializedChars::getCodePoint;
-     using GeneralCharsBase::getCodeUnit;
-     using SpecializedChars::getFullAsciiCodePoint;
-     using SpecializedChars::getNonAsciiCodePoint;
-     using SpecializedChars::getNonAsciiCodePointDontNormalize;
-     using TokenStreamCharsShared::isAsciiCodePoint;
-     using CharsBase::matchCodeUnit;
-+    using CharsBase::matchLineTerminator;
-     using GeneralCharsBase::matchUnicodeEscapeIdent;
-     using GeneralCharsBase::matchUnicodeEscapeIdStart;
-     using GeneralCharsBase::newAtomToken;
-     using GeneralCharsBase::newNameToken;
-     using GeneralCharsBase::newNumberToken;
-     using GeneralCharsBase::newRegExpToken;
-     using GeneralCharsBase::newSimpleToken;
-     using CharsBase::peekCodeUnit;

frg/work-js/mozilla-release/patches/mozilla-central-push_427439.patch

@@ -1,223 +0,0 @@
-# HG changeset patch
-# User Jeff Walden <jwalden@mit.edu>
-# Date 1530305169 25200
-#      Fri Jun 29 13:46:09 2018 -0700
-# Node ID 7d07cfa666bf8bb2ec9aef3c7f88654f66e9a433
-# Parent  4bd4c0e74bc6ce7ef610ef902085a3609b9517f8
-Bug 1476866 - Move fillCharBufferWithTemplateStringContents into TokenStreamCharsBase so that a UTF-8 specialization can eventually be defined for it.  r=arai
-
-diff --git a/js/src/frontend/TokenStream.cpp b/js/src/frontend/TokenStream.cpp
---- a/js/src/frontend/TokenStream.cpp
-+++ b/js/src/frontend/TokenStream.cpp
-@@ -435,16 +435,42 @@ TokenStreamAnyChars::TokenStreamAnyChars
- 
- template<typename CharT>
- TokenStreamCharsBase<CharT>::TokenStreamCharsBase(JSContext* cx, const CharT* chars, size_t length,
-                                                   size_t startOffset)
-   : TokenStreamCharsShared(cx),
-     sourceUnits(chars, length, startOffset)
- {}
- 
-+template<>
-+MOZ_MUST_USE bool
-+TokenStreamCharsBase<char16_t>::fillCharBufferWithTemplateStringContents(const char16_t* cur,
-+                                                                         const char16_t* end)
-+{
-+    MOZ_ASSERT(this->charBuffer.length() == 0);
-+
-+    while (cur < end) {
-+        // Template literals normalize only '\r' and "\r\n" to '\n'.  The
-+        // Unicode separators need no special handling here.
-+        // https://tc39.github.io/ecma262/#sec-static-semantics-tv-and-trv
-+        char16_t ch = *cur++;
-+        if (ch == '\r') {
-+            ch = '\n';
-+            if (cur < end && *cur == '\n')
-+                cur++;
-+        }
-+
-+        if (!this->charBuffer.append(ch))
-+            return false;
-+    }
-+
-+    MOZ_ASSERT(cur == end);
-+    return true;
-+}
-+
- template<typename CharT, class AnyCharsAccess>
- TokenStreamSpecific<CharT, AnyCharsAccess>::TokenStreamSpecific(JSContext* cx,
-                                                                 const ReadOnlyCompileOptions& options,
-                                                                 const CharT* base, size_t length)
-   : TokenStreamChars<CharT, AnyCharsAccess>(cx, base, length, options.scriptSourceOffset)
- {}
- 
- bool
-diff --git a/js/src/frontend/TokenStream.h b/js/src/frontend/TokenStream.h
---- a/js/src/frontend/TokenStream.h
-+++ b/js/src/frontend/TokenStream.h
-@@ -1284,18 +1284,23 @@ class TokenStreamCharsBase
-     inline void consumeKnownCodeUnit(int32_t unit);
- 
-     // Forbid accidental calls to consumeKnownCodeUnit *not* with the single
-     // unit-or-EOF type.  CharT should use SourceUnits::consumeKnownCodeUnit;
-     // CodeUnitValue() results should go through toCharT(), or better yet just
-     // use the original CharT.
-     template<typename T> inline void consumeKnownCodeUnit(T) = delete;
- 
--    MOZ_MUST_USE inline bool
--    fillCharBufferWithTemplateStringContents(const CharT* cur, const CharT* end);
-+    /**
-+     * Accumulate the provided range of already-validated (i.e. valid UTF-8, or
-+     * anything if CharT is char16_t because JS permits lone and mispaired
-+     * surrogates) raw template literal text (i.e. containing no escapes or
-+     * substitutions) into |charBuffer|.
-+     */
-+    MOZ_MUST_USE bool fillCharBufferWithTemplateStringContents(const CharT* cur, const CharT* end);
- 
-   protected:
-     /** Code units in the source code being tokenized. */
-     SourceUnits sourceUnits;
- };
- 
- template<>
- inline char16_t
-@@ -1323,42 +1328,16 @@ TokenStreamCharsBase<CharT>::consumeKnow
- template<>
- /* static */ MOZ_ALWAYS_INLINE JSAtom*
- TokenStreamCharsBase<char16_t>::atomizeSourceChars(JSContext* cx, const char16_t* chars,
-                                                    size_t length)
- {
-     return AtomizeChars(cx, chars, length);
- }
- 
--template<>
--MOZ_MUST_USE inline bool
--TokenStreamCharsBase<char16_t>::fillCharBufferWithTemplateStringContents(const char16_t* cur,
--                                                                         const char16_t* end)
--{
--    MOZ_ASSERT(this->charBuffer.length() == 0);
--
--    while (cur < end) {
--        // U+2028 LINE SEPARATOR and U+2029 PARAGRAPH SEPARATOR are
--        // interpreted literally inside template literal contents; only
--        // literal CRLF sequences are normalized to '\n'.  See
--        // <https://tc39.github.io/ecma262/#sec-static-semantics-tv-and-trv>.
--        char16_t ch = *cur++;
--        if (ch == '\r') {
--            ch = '\n';
--            if (cur < end && *cur == '\n')
--                cur++;
--        }
--
--        if (!this->charBuffer.append(ch))
--            return false;
--    }
--
--    return true;
--}
--
- template<typename CharT>
- class SpecializedTokenStreamCharsBase;
- 
- template<>
- class SpecializedTokenStreamCharsBase<char16_t>
-   : public TokenStreamCharsBase<char16_t>
- {
-     using CharsBase = TokenStreamCharsBase<char16_t>;
-@@ -1476,16 +1455,19 @@ class GeneralTokenStreamChars
- 
-         return token;
-     }
- 
-     uint32_t matchUnicodeEscape(uint32_t* codePoint);
-     uint32_t matchExtendedUnicodeEscape(uint32_t* codePoint);
- 
-   protected:
-+    using TokenStreamCharsShared::drainCharBufferIntoAtom;
-+    using CharsBase::fillCharBufferWithTemplateStringContents;
-+
-     using typename CharsBase::SourceUnits;
- 
-   protected:
-     using SpecializedCharsBase::SpecializedCharsBase;
- 
-     TokenStreamAnyChars& anyCharsAccess() {
-         return AnyCharsAccess::anyChars(this);
-     }
-@@ -1567,16 +1549,38 @@ class GeneralTokenStreamChars
-     }
- 
-     MOZ_MUST_USE MOZ_ALWAYS_INLINE bool updateLineInfoForEOL() {
-         return anyCharsAccess().internalUpdateLineInfoForEOL(this->sourceUnits.offset());
-     }
- 
-     uint32_t matchUnicodeEscapeIdStart(uint32_t* codePoint);
-     bool matchUnicodeEscapeIdent(uint32_t* codePoint);
-+
-+  public:
-+    JSAtom* getRawTemplateStringAtom() {
-+        TokenStreamAnyChars& anyChars = anyCharsAccess();
-+
-+        MOZ_ASSERT(anyChars.currentToken().type == TokenKind::TemplateHead ||
-+                   anyChars.currentToken().type == TokenKind::NoSubsTemplate);
-+        const CharT* cur = this->sourceUnits.codeUnitPtrAt(anyChars.currentToken().pos.begin + 1);
-+        const CharT* end;
-+        if (anyChars.currentToken().type == TokenKind::TemplateHead) {
-+            // Of the form    |`...${|   or   |}...${|
-+            end = this->sourceUnits.codeUnitPtrAt(anyChars.currentToken().pos.end - 2);
-+        } else {
-+            // NO_SUBS_TEMPLATE is of the form   |`...`|   or   |}...`|
-+            end = this->sourceUnits.codeUnitPtrAt(anyChars.currentToken().pos.end - 1);
-+        }
-+
-+        if (!fillCharBufferWithTemplateStringContents(cur, end))
-+            return nullptr;
-+
-+        return drainCharBufferIntoAtom(anyChars.cx);
-+    }
- };
- 
- template<typename CharT, class AnyCharsAccess> class TokenStreamChars;
- 
- template<class AnyCharsAccess>
- class TokenStreamChars<char16_t, AnyCharsAccess>
-   : public GeneralTokenStreamChars<char16_t, AnyCharsAccess>
- {
-@@ -1900,37 +1904,16 @@ class MOZ_STACK_CLASS TokenStreamSpecifi
-     // These functions take a |va_list*| parameter, not a |va_list| parameter,
-     // to hack around bug 1363116.  (Longer-term, the right fix is of course to
-     // not use ellipsis functions or |va_list| at all in error reporting.)
-     bool reportStrictModeErrorNumberVA(UniquePtr<JSErrorNotes> notes, uint32_t offset,
-                                        bool strictMode, unsigned errorNumber, va_list* args);
-     bool reportExtraWarningErrorNumberVA(UniquePtr<JSErrorNotes> notes, uint32_t offset,
-                                          unsigned errorNumber, va_list* args);
- 
--    JSAtom* getRawTemplateStringAtom() {
--        TokenStreamAnyChars& anyChars = anyCharsAccess();
--
--        MOZ_ASSERT(anyChars.currentToken().type == TokenKind::TemplateHead ||
--                   anyChars.currentToken().type == TokenKind::NoSubsTemplate);
--        const CharT* cur = this->sourceUnits.codeUnitPtrAt(anyChars.currentToken().pos.begin + 1);
--        const CharT* end;
--        if (anyChars.currentToken().type == TokenKind::TemplateHead) {
--            // Of the form    |`...${|   or   |}...${|
--            end = this->sourceUnits.codeUnitPtrAt(anyChars.currentToken().pos.end - 2);
--        } else {
--            // NO_SUBS_TEMPLATE is of the form   |`...`|   or   |}...`|
--            end = this->sourceUnits.codeUnitPtrAt(anyChars.currentToken().pos.end - 1);
--        }
--
--        if (!fillCharBufferWithTemplateStringContents(cur, end))
--            return nullptr;
--
--        return drainCharBufferIntoAtom(anyChars.cx);
--    }
--
-   private:
-     // This is private because it should only be called by the tokenizer while
-     // tokenizing not by, for example, BytecodeEmitter.
-     bool reportStrictModeError(unsigned errorNumber, ...);
- 
-     void reportInvalidEscapeError(uint32_t offset, InvalidEscapeType type) {
-         switch (type) {
-             case InvalidEscapeType::None:

frg/work-js/mozilla-release/patches/mozilla-central-push_427445.patch

@@ -1,99 +0,0 @@
-# HG changeset patch
-# User Tooru Fujisawa <arai_a@mac.com>
-# Date 1532070836 -32400
-#      Fri Jul 20 16:13:56 2018 +0900
-# Node ID 74b3d9d91b3e2432fd30a1c36a140ad730076ba6
-# Parent  96cad016ab42ec1283a8c51935e3bb4610d9b0f0
-Bug 1456006 - Part 0: Add reportError and reportExtraWarning variants to receive offset instead of ParseNode. r=jwalden
-
-diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
---- a/js/src/frontend/BytecodeEmitter.cpp
-+++ b/js/src/frontend/BytecodeEmitter.cpp
-@@ -1479,32 +1479,62 @@ BytecodeEmitter::reportError(ParseNode* 
-     va_list args;
-     va_start(args, errorNumber);
- 
-     parser->errorReporter().errorAtVA(offset, errorNumber, &args);
- 
-     va_end(args);
- }
- 
-+void
-+BytecodeEmitter::reportError(const Maybe<uint32_t>& maybeOffset, unsigned errorNumber, ...)
-+{
-+    MOZ_ASSERT_IF(!maybeOffset, this->scriptStartOffsetSet);
-+    uint32_t offset = maybeOffset ? *maybeOffset : this->scriptStartOffset;
-+
-+    va_list args;
-+    va_start(args, errorNumber);
-+
-+    parser->errorReporter().errorAtVA(offset, errorNumber, &args);
-+
-+    va_end(args);
-+}
-+
- bool
- BytecodeEmitter::reportExtraWarning(ParseNode* pn, unsigned errorNumber, ...)
- {
-     MOZ_ASSERT_IF(!pn, this->scriptStartOffsetSet);
-     uint32_t offset = pn ? pn->pn_pos.begin : this->scriptStartOffset;
- 
-     va_list args;
-     va_start(args, errorNumber);
- 
-     bool result = parser->errorReporter().reportExtraWarningErrorNumberVA(nullptr, offset, errorNumber, &args);
- 
-     va_end(args);
-     return result;
- }
- 
- bool
-+BytecodeEmitter::reportExtraWarning(const Maybe<uint32_t>& maybeOffset,
-+                                    unsigned errorNumber, ...)
-+{
-+    MOZ_ASSERT_IF(!maybeOffset, this->scriptStartOffsetSet);
-+    uint32_t offset = maybeOffset ? *maybeOffset : this->scriptStartOffset;
-+
-+    va_list args;
-+    va_start(args, errorNumber);
-+
-+    bool result = parser->errorReporter().reportExtraWarningErrorNumberVA(nullptr, offset, errorNumber, &args);
-+
-+    va_end(args);
-+    return result;
-+}
-+
-+bool
- BytecodeEmitter::emitNewInit(JSProtoKey key)
- {
-     const size_t len = 1 + UINT32_INDEX_LEN;
-     ptrdiff_t offset;
-     if (!emitCheck(len, &offset))
-         return false;
- 
-     jsbytecode* code = this->code(offset);
-diff --git a/js/src/frontend/BytecodeEmitter.h b/js/src/frontend/BytecodeEmitter.h
---- a/js/src/frontend/BytecodeEmitter.h
-+++ b/js/src/frontend/BytecodeEmitter.h
-@@ -414,17 +414,21 @@ struct MOZ_STACK_CLASS BytecodeEmitter
-     void setScriptStartOffsetIfUnset(TokenPos pos) {
-         if (!scriptStartOffsetSet) {
-             scriptStartOffset = pos.begin;
-             scriptStartOffsetSet = true;
-         }
-     }
- 
-     void reportError(ParseNode* pn, unsigned errorNumber, ...);
-+    void reportError(const mozilla::Maybe<uint32_t>& maybeOffset,
-+                     unsigned errorNumber, ...);
-     bool reportExtraWarning(ParseNode* pn, unsigned errorNumber, ...);
-+    bool reportExtraWarning(const mozilla::Maybe<uint32_t>& maybeOffset,
-+                            unsigned errorNumber, ...);
- 
-     // If pn contains a useful expression, return true with *answer set to true.
-     // If pn contains a useless expression, return true with *answer set to
-     // false. Return false on error.
-     //
-     // The caller should initialize *answer to false and invoke this function on
-     // an expression statement or similar subtree to decide whether the tree
-     // could produce code that has any side effects.  For an expression

frg/work-js/mozilla-release/patches/mozilla-central-push_427446.patch

@@ -1,1450 +0,0 @@
-# HG changeset patch
-# User Tooru Fujisawa <arai_a@mac.com>
-# Date 1532070836 -32400
-#      Fri Jul 20 16:13:56 2018 +0900
-# Node ID d2cfbb2fcc82ea270d177a3200c6d69b97bc0053
-# Parent  74b3d9d91b3e2432fd30a1c36a140ad730076ba6
-Bug 1456006 - Part 1: Add SwitchEmitter. r=jwalden
-
-diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
---- a/js/src/frontend/BytecodeEmitter.cpp
-+++ b/js/src/frontend/BytecodeEmitter.cpp
-@@ -24,16 +24,17 @@
- #include "jsutil.h"
- 
- #include "ds/Nestable.h"
- #include "frontend/BytecodeControlStructures.h"
- #include "frontend/EmitterScope.h"
- #include "frontend/ForOfLoopControl.h"
- #include "frontend/IfEmitter.h"
- #include "frontend/Parser.h"
-+#include "frontend/SwitchEmitter.h"
- #include "frontend/TDZCheckCache.h"
- #include "frontend/TryEmitter.h"
- #include "vm/BytecodeUtil.h"
- #include "vm/Debugger.h"
- #include "vm/GeneratorObject.h"
- #include "vm/JSAtom.h"
- #include "vm/JSContext.h"
- #include "vm/JSFunction.h"
-@@ -2336,354 +2337,142 @@ BytecodeEmitter::emitNumberOp(double dva
- /*
-  * Using MOZ_NEVER_INLINE in here is a workaround for llvm.org/pr14047.
-  * LLVM is deciding to inline this function which uses a lot of stack space
-  * into emitTree which is recursive and uses relatively little stack space.
-  */
- MOZ_NEVER_INLINE bool
- BytecodeEmitter::emitSwitch(ParseNode* pn)
- {
--    ParseNode* cases = pn->pn_right;
--    MOZ_ASSERT(cases->isKind(ParseNodeKind::LexicalScope) ||
--               cases->isKind(ParseNodeKind::StatementList));
--
--    // Ensure that the column of the switch statement is set properly.
--    if (!updateSourceCoordNotes(pn->pn_pos.begin))
--        return false;
--
--    // Emit code for the discriminant.
-+    ParseNode* lexical = pn->pn_right;
-+    MOZ_ASSERT(lexical->isKind(ParseNodeKind::LexicalScope));
-+    ParseNode* cases = lexical->scopeBody();
-+    MOZ_ASSERT(cases->isKind(ParseNodeKind::StatementList));
-+
-+    SwitchEmitter se(this);
-+    if (!se.emitDiscriminant(Some(pn->pn_pos.begin)))
-+        return false;
-     if (!emitTree(pn->pn_left))
-         return false;
- 
-     // Enter the scope before pushing the switch BreakableControl since all
-     // breaks are under this scope.
--    Maybe<TDZCheckCache> tdzCache;
--    Maybe<EmitterScope> emitterScope;
--    if (cases->isKind(ParseNodeKind::LexicalScope)) {
--        if (!cases->isEmptyScope()) {
--            tdzCache.emplace(this);
--            emitterScope.emplace(this);
--            if (!emitterScope->enterLexical(this, ScopeKind::Lexical, cases->scopeBindings()))
--                return false;
--        }
--
--        // Advance |cases| to refer to the switch case list.
--        cases = cases->scopeBody();
-+    if (!lexical->isEmptyScope()) {
-+        if (!se.emitLexical(lexical->scopeBindings()))
-+            return false;
- 
-         // A switch statement may contain hoisted functions inside its
-         // cases. The PNX_FUNCDEFS flag is propagated from the STATEMENTLIST
-         // bodies of the cases to the case list.
-         if (cases->pn_xflags & PNX_FUNCDEFS) {
--            MOZ_ASSERT(emitterScope);
-             for (ParseNode* caseNode = cases->pn_head; caseNode; caseNode = caseNode->pn_next) {
-                 if (caseNode->pn_right->pn_xflags & PNX_FUNCDEFS) {
-                     if (!emitHoistedFunctionsInList(caseNode->pn_right))
-                         return false;
-                 }
-             }
-         }
--    }
--
--    // After entering the scope, push the switch control.
--    BreakableControl controlInfo(this, StatementKind::Switch);
--
--    ptrdiff_t top = offset();
--
--    // Switch bytecodes run from here till end of final case.
-+    } else {
-+        MOZ_ASSERT(!(cases->pn_xflags & PNX_FUNCDEFS));
-+    }
-+
-+    SwitchEmitter::TableGenerator tableGen(this);
-     uint32_t caseCount = cases->pn_count;
--    if (caseCount > JS_BIT(16)) {
--        reportError(pn, JSMSG_TOO_MANY_CASES);
--        return false;
--    }
--
--    // Try for most optimal, fall back if not dense ints.
--    JSOp switchOp = JSOP_TABLESWITCH;
--    uint32_t tableLength = 0;
--    int32_t low, high;
--    bool hasDefault = false;
-     CaseClause* firstCase = cases->pn_head ? &cases->pn_head->as<CaseClause>() : nullptr;
--    if (caseCount == 0 ||
--        (caseCount == 1 && (hasDefault = firstCase->isDefault())))
--    {
--        low = 0;
--        high = -1;
-+    if (caseCount == 0) {
-+        tableGen.finish(0);
-+    } else if (caseCount == 1 && firstCase->isDefault()) {
-+        caseCount = 0;
-+        tableGen.finish(0);
-     } else {
--        Vector<size_t, 128, SystemAllocPolicy> intmap;
--        int32_t intmapBitLength = 0;
--
--        low  = JSVAL_INT_MAX;
--        high = JSVAL_INT_MIN;
--
-         for (CaseClause* caseNode = firstCase; caseNode; caseNode = caseNode->next()) {
-             if (caseNode->isDefault()) {
--                hasDefault = true;
-                 caseCount--;  // one of the "cases" was the default
-                 continue;
-             }
- 
--            if (switchOp == JSOP_CONDSWITCH)
-+            if (tableGen.isInvalid())
-                 continue;
- 
--            MOZ_ASSERT(switchOp == JSOP_TABLESWITCH);
--
-             ParseNode* caseValue = caseNode->caseExpression();
- 
-             if (caseValue->getKind() != ParseNodeKind::Number) {
--                switchOp = JSOP_CONDSWITCH;
-+                tableGen.setInvalid();
-                 continue;
-             }
- 
-             int32_t i;
-             if (!NumberEqualsInt32(caseValue->pn_dval, &i)) {
--                switchOp = JSOP_CONDSWITCH;
--                continue;
--            }
--
--            if (unsigned(i + int(JS_BIT(15))) >= unsigned(JS_BIT(16))) {
--                switchOp = JSOP_CONDSWITCH;
--                continue;
--            }
--            if (i < low)
--                low = i;
--            if (i > high)
--                high = i;
--
--            // Check for duplicates, which require a JSOP_CONDSWITCH.
--            // We bias i by 65536 if it's negative, and hope that's a rare
--            // case (because it requires a malloc'd bitmap).
--            if (i < 0)
--                i += JS_BIT(16);
--            if (i >= intmapBitLength) {
--                size_t newLength = NumWordsForBitArrayOfLength(i + 1);
--                if (!intmap.resize(newLength)) {
--                    ReportOutOfMemory(cx);
--                    return false;
--                }
--                intmapBitLength = newLength * BitArrayElementBits;
--            }
--            if (IsBitArrayElementSet(intmap.begin(), intmap.length(), i)) {
--                switchOp = JSOP_CONDSWITCH;
-+                tableGen.setInvalid();
-                 continue;
-             }
--            SetBitArrayElement(intmap.begin(), intmap.length(), i);
--        }
--
--        // Compute table length and select condswitch instead if overlarge or
--        // more than half-sparse.
--        if (switchOp == JSOP_TABLESWITCH) {
--            tableLength = uint32_t(high - low + 1);
--            if (tableLength >= JS_BIT(16) || tableLength > 2 * caseCount)
--                switchOp = JSOP_CONDSWITCH;
--        }
--    }
--
--    // The note has one or two offsets: first tells total switch code length;
--    // second (if condswitch) tells offset to first JSOP_CASE.
--    unsigned noteIndex;
--    size_t switchSize;
--    if (switchOp == JSOP_CONDSWITCH) {
--        // 0 bytes of immediate for unoptimized switch.
--        switchSize = 0;
--        if (!newSrcNote3(SRC_CONDSWITCH, 0, 0, &noteIndex))
-+
-+            if (!tableGen.addNumber(i))
-+                return false;
-+        }
-+
-+        tableGen.finish(caseCount);
-+    }
-+
-+    if (!se.validateCaseCount(caseCount))
-+        return false;
-+
-+    bool isTableSwitch = tableGen.isValid();
-+    if (isTableSwitch) {
-+        if (!se.emitTable(tableGen))
-             return false;
-     } else {
--        MOZ_ASSERT(switchOp == JSOP_TABLESWITCH);
--
--        // 3 offsets (len, low, high) before the table, 1 per entry.
--        switchSize = size_t(JUMP_OFFSET_LEN * (3 + tableLength));
--        if (!newSrcNote2(SRC_TABLESWITCH, 0, &noteIndex))
--            return false;
--    }
--
--    // Emit switchOp followed by switchSize bytes of jump or lookup table.
--    MOZ_ASSERT(top == offset());
--    if (!emitN(switchOp, switchSize))
--        return false;
--
--    Vector<CaseClause*, 32, SystemAllocPolicy> table;
--
--    JumpList condSwitchDefaultOff;
--    if (switchOp == JSOP_CONDSWITCH) {
--        unsigned caseNoteIndex;
--        bool beforeCases = true;
--        ptrdiff_t lastCaseOffset = -1;
--
--        // The case conditions need their own TDZ cache since they might not
--        // all execute.
--        TDZCheckCache tdzCache(this);
-+        if (!se.emitCond())
-+            return false;
- 
-         // Emit code for evaluating cases and jumping to case statements.
-         for (CaseClause* caseNode = firstCase; caseNode; caseNode = caseNode->next()) {
-+            if (caseNode->isDefault())
-+                continue;
-+
-             ParseNode* caseValue = caseNode->caseExpression();
--
-             // If the expression is a literal, suppress line number emission so
-             // that debugging works more naturally.
--            if (caseValue) {
--                if (!emitTree(caseValue, ValueUsage::WantValue,
--                              caseValue->isLiteral() ? SUPPRESS_LINENOTE : EMIT_LINENOTE))
--                {
--                    return false;
--                }
--            }
--
--            if (!beforeCases) {
--                // prevCase is the previous JSOP_CASE's bytecode offset.
--                if (!setSrcNoteOffset(caseNoteIndex, 0, offset() - lastCaseOffset))
--                    return false;
--            }
--            if (!caseValue) {
--                // This is the default clause.
--                continue;
--            }
--
--            if (!newSrcNote2(SRC_NEXTCASE, 0, &caseNoteIndex))
--                return false;
--
--            // The case clauses are produced before any of the case body. The
--            // JumpList is saved on the parsed tree, then later restored and
--            // patched when generating the cases body.
--            JumpList caseJump;
--            if (!emitJump(JSOP_CASE, &caseJump))
--                return false;
--            caseNode->setOffset(caseJump.offset);
--            lastCaseOffset = caseJump.offset;
--
--            if (beforeCases) {
--                // Switch note's second offset is to first JSOP_CASE.
--                unsigned noteCount = notes().length();
--                if (!setSrcNoteOffset(noteIndex, 1, lastCaseOffset - top))
--                    return false;
--                unsigned noteCountDelta = notes().length() - noteCount;
--                if (noteCountDelta != 0)
--                    caseNoteIndex += noteCountDelta;
--                beforeCases = false;
--            }
--        }
--
--        // If we didn't have an explicit default (which could fall in between
--        // cases, preventing us from fusing this setSrcNoteOffset with the call
--        // in the loop above), link the last case to the implicit default for
--        // the benefit of IonBuilder.
--        if (!hasDefault &&
--            !beforeCases &&
--            !setSrcNoteOffset(caseNoteIndex, 0, offset() - lastCaseOffset))
--        {
--            return false;
--        }
--
--        // Emit default even if no explicit default statement.
--        if (!emitJump(JSOP_DEFAULT, &condSwitchDefaultOff))
--            return false;
--    } else {
--        MOZ_ASSERT(switchOp == JSOP_TABLESWITCH);
--
--        // skip default offset.
--        jsbytecode* pc = code(top + JUMP_OFFSET_LEN);
--
--        // Fill in switch bounds, which we know fit in 16-bit offsets.
--        SET_JUMP_OFFSET(pc, low);
--        pc += JUMP_OFFSET_LEN;
--        SET_JUMP_OFFSET(pc, high);
--        pc += JUMP_OFFSET_LEN;
--
--        if (tableLength != 0) {
--            if (!table.growBy(tableLength)) {
--                ReportOutOfMemory(cx);
-+            if (!emitTree(caseValue, ValueUsage::WantValue,
-+                          caseValue->isLiteral() ? SUPPRESS_LINENOTE : EMIT_LINENOTE))
-+            {
-                 return false;
-             }
- 
--            for (CaseClause* caseNode = firstCase; caseNode; caseNode = caseNode->next()) {
--                if (ParseNode* caseValue = caseNode->caseExpression()) {
--                    MOZ_ASSERT(caseValue->isKind(ParseNodeKind::Number));
--
--                    int32_t i = int32_t(caseValue->pn_dval);
--                    MOZ_ASSERT(double(i) == caseValue->pn_dval);
--
--                    i -= low;
--                    MOZ_ASSERT(uint32_t(i) < tableLength);
--                    MOZ_ASSERT(!table[i]);
--                    table[i] = caseNode;
--                }
--            }
--        }
--    }
--
--    JumpTarget defaultOffset{ -1 };
-+            if (!se.emitCaseJump())
-+                return false;
-+        }
-+    }
- 
-     // Emit code for each case's statements.
-     for (CaseClause* caseNode = firstCase; caseNode; caseNode = caseNode->next()) {
--        if (switchOp == JSOP_CONDSWITCH && !caseNode->isDefault()) {
--            // The case offset got saved in the caseNode structure after
--            // emitting the JSOP_CASE jump instruction above.
--            JumpList caseCond;
--            caseCond.offset = caseNode->offset();
--            if (!emitJumpTargetAndPatch(caseCond))
--                return false;
--        }
--
--        JumpTarget here;
--        if (!emitJumpTarget(&here))
--            return false;
--        if (caseNode->isDefault())
--            defaultOffset = here;
--
--        // If this is emitted as a TABLESWITCH, we'll need to know this case's
--        // offset later when emitting the table. Store it in the node's
--        // pn_offset (giving the field a different meaning vs. how we used it
--        // on the immediately preceding line of code).
--        caseNode->setOffset(here.offset);
--
--        TDZCheckCache tdzCache(this);
-+        if (caseNode->isDefault()) {
-+            if (!se.emitDefaultBody())
-+                return false;
-+        } else {
-+            if (isTableSwitch) {
-+                ParseNode* caseValue = caseNode->caseExpression();
-+                MOZ_ASSERT(caseValue->isKind(ParseNodeKind::Number));
-+
-+                int32_t i = int32_t(caseValue->pn_dval);
-+                MOZ_ASSERT(double(i) == caseValue->pn_dval);
-+
-+                if (!se.emitCaseBody(i, tableGen))
-+                    return false;
-+            } else {
-+                if (!se.emitCaseBody())
-+                    return false;
-+            }
-+        }
- 
-         if (!emitTree(caseNode->statementList()))
-             return false;
-     }
- 
--    if (!hasDefault) {
--        // If no default case, offset for default is to end of switch.
--        if (!emitJumpTarget(&defaultOffset))
--            return false;
--    }
--    MOZ_ASSERT(defaultOffset.offset != -1);
--
--    // Set the default offset (to end of switch if no default).
--    jsbytecode* pc;
--    if (switchOp == JSOP_CONDSWITCH) {
--        pc = nullptr;
--        patchJumpsToTarget(condSwitchDefaultOff, defaultOffset);
--    } else {
--        MOZ_ASSERT(switchOp == JSOP_TABLESWITCH);
--        pc = code(top);
--        SET_JUMP_OFFSET(pc, defaultOffset.offset - top);
--        pc += JUMP_OFFSET_LEN;
--    }
--
--    // Set the SRC_SWITCH note's offset operand to tell end of switch.
--    if (!setSrcNoteOffset(noteIndex, 0, lastNonJumpTargetOffset() - top))
--        return false;
--
--    if (switchOp == JSOP_TABLESWITCH) {
--        // Skip over the already-initialized switch bounds.
--        pc += 2 * JUMP_OFFSET_LEN;
--
--        // Fill in the jump table, if there is one.
--        for (uint32_t i = 0; i < tableLength; i++) {
--            CaseClause* caseNode = table[i];
--            ptrdiff_t off = caseNode ? caseNode->offset() - top : 0;
--            SET_JUMP_OFFSET(pc, off);
--            pc += JUMP_OFFSET_LEN;
--        }
--    }
--
--    // Patch breaks before leaving the scope, as all breaks are under the
--    // lexical scope if it exists.
--    if (!controlInfo.patchBreaks(this))
--        return false;
--
--    if (emitterScope && !emitterScope->leave(this))
-+    if (!se.emitEnd())
-         return false;
- 
-     return true;
- }
- 
- bool
- BytecodeEmitter::isRunOnceLambda()
- {
-diff --git a/js/src/frontend/ParseNode.h b/js/src/frontend/ParseNode.h
---- a/js/src/frontend/ParseNode.h
-+++ b/js/src/frontend/ParseNode.h
-@@ -250,26 +250,23 @@ IsTypeofKind(ParseNodeKind kind)
-  *                          pn_count: 1 + number of formal parameters
-  *                          pn_tree: ParamsBody or StatementList node
-  * Spread   unary       pn_kid: expression being spread
-  *
-  * <Statements>
-  * StatementList list   pn_head: list of pn_count statements
-  * If       ternary     pn_kid1: cond, pn_kid2: then, pn_kid3: else or null.
-  * Switch   binary      pn_left: discriminant
-- *                          pn_right: list of Case nodes, with at most one
-- *                            default node, or if there are let bindings
-- *                            in the top level of the switch body's cases, a
-- *                            LexicalScope node that contains the list of
-- *                            Case nodes.
-+ *                      pn_right: LexicalScope node that contains the list
-+ *                        of Case nodes, with at most one
-+ *                        default node.
-  * Case     binary      pn_left: case-expression if CaseClause, or
-  *                            null if DefaultClause
-  *                          pn_right: StatementList node for this case's
-  *                            statements
-- *                          pn_u.binary.offset: scratch space for the emitter
-  * While    binary      pn_left: cond, pn_right: body
-  * DoWhile  binary      pn_left: body, pn_right: cond
-  * For      binary      pn_left: either ForIn (for-in statement),
-  *                            ForOf (for-of) or ForHead (for(;;))
-  *                          pn_right: body
-  * ForIn    ternary     pn_kid1: declaration or expression to left of 'in'
-  *                          pn_kid2: null
-  *                          pn_kid3: object expr to right of 'in'
-@@ -553,17 +550,16 @@ class ParseNode
-             ParseNode*  kid3;           /* else-part, default case, etc. */
-         } ternary;
-         struct {                        /* two kids if binary */
-             ParseNode*  left;
-             ParseNode*  right;
-             union {
-                 unsigned iflags;        /* JSITER_* flags for ParseNodeKind::For node */
-                 bool isStatic;          /* only for ParseNodeKind::ClassMethod */
--                uint32_t offset;        /* for the emitter's use on ParseNodeKind::Case nodes */
-             };
-         } binary;
-         struct {                        /* one kid if unary */
-             ParseNode*  kid;
-             bool        prologue;       /* directive prologue member (as
-                                            pn_prologue) */
-         } unary;
-         struct {                        /* name, labeled statement, etc. */
-@@ -1017,20 +1013,16 @@ class CaseClause : public BinaryNode
- 
-     ParseNode* caseExpression() const { return pn_left; }
-     bool isDefault() const { return !caseExpression(); }
-     ParseNode* statementList() const { return pn_right; }
- 
-     // The next CaseClause in the same switch statement.
-     CaseClause* next() const { return pn_next ? &pn_next->as<CaseClause>() : nullptr; }
- 
--    // Scratch space used by the emitter.
--    uint32_t offset() const { return pn_u.binary.offset; }
--    void setOffset(uint32_t u) { pn_u.binary.offset = u; }
--
-     static bool test(const ParseNode& node) {
-         bool match = node.isKind(ParseNodeKind::Case);
-         MOZ_ASSERT_IF(match, node.isArity(PN_BINARY));
-         MOZ_ASSERT_IF(match, node.isOp(JSOP_NOP));
-         return match;
-     }
- };
- 
-diff --git a/js/src/frontend/SwitchEmitter.cpp b/js/src/frontend/SwitchEmitter.cpp
-new file mode 100644
---- /dev/null
-+++ b/js/src/frontend/SwitchEmitter.cpp
-@@ -0,0 +1,425 @@
-+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
-+ * vim: set ts=8 sts=4 et sw=4 tw=99:
-+ * This Source Code Form is subject to the terms of the Mozilla Public
-+ * License, v. 2.0. If a copy of the MPL was not distributed with this
-+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-+
-+#include "frontend/SwitchEmitter.h"
-+
-+#include "jsutil.h"
-+
-+#include "frontend/BytecodeEmitter.h"
-+#include "frontend/SharedContext.h"
-+#include "frontend/SourceNotes.h"
-+#include "vm/BytecodeUtil.h"
-+#include "vm/Opcodes.h"
-+#include "vm/Runtime.h"
-+
-+using namespace js;
-+using namespace js::frontend;
-+
-+using mozilla::Maybe;
-+
-+bool
-+SwitchEmitter::TableGenerator::addNumber(int32_t caseValue)
-+{
-+    if (isInvalid())
-+        return true;
-+
-+    if (unsigned(caseValue + int(JS_BIT(15))) >= unsigned(JS_BIT(16))) {
-+        setInvalid();
-+        return true;
-+    }
-+
-+    if (intmap_.isNothing())
-+        intmap_.emplace();
-+
-+    low_ = std::min(low_, caseValue);
-+    high_ = std::max(high_, caseValue);
-+
-+    // Check for duplicates, which require a JSOP_CONDSWITCH.
-+    // We bias caseValue by 65536 if it's negative, and hope that's a rare case
-+    // (because it requires a malloc'd bitmap).
-+    if (caseValue < 0)
-+        caseValue += JS_BIT(16);
-+    if (caseValue >= intmapBitLength_) {
-+        size_t newLength = NumWordsForBitArrayOfLength(caseValue + 1);
-+        if (!intmap_->resize(newLength)) {
-+            ReportOutOfMemory(bce_->cx);
-+            return false;
-+        }
-+        intmapBitLength_ = newLength * BitArrayElementBits;
-+    }
-+    if (IsBitArrayElementSet(intmap_->begin(), intmap_->length(), caseValue)) {
-+        // Duplicate entry is not supported in table switch.
-+        setInvalid();
-+        return true;
-+    }
-+    SetBitArrayElement(intmap_->begin(), intmap_->length(), caseValue);
-+    return true;
-+}
-+
-+void
-+SwitchEmitter::TableGenerator::finish(uint32_t caseCount)
-+{
-+    intmap_.reset();
-+
-+#ifdef DEBUG
-+    finished_ = true;
-+#endif
-+
-+    if (isInvalid())
-+        return;
-+
-+    if (caseCount == 0) {
-+        low_ = 0;
-+        high_ = -1;
-+        return;
-+    }
-+
-+    // Compute table length and select condswitch instead if overlarge
-+    // or more than half-sparse.
-+    tableLength_ = uint32_t(high_ - low_ + 1);
-+    if (tableLength_ >= JS_BIT(16) || tableLength_ > 2 * caseCount)
-+        setInvalid();
-+}
-+
-+uint32_t
-+SwitchEmitter::TableGenerator::toCaseIndex(int32_t caseValue) const
-+{
-+    MOZ_ASSERT(finished_);
-+    MOZ_ASSERT(isValid());
-+    uint32_t caseIndex = uint32_t(caseValue - low_);
-+    MOZ_ASSERT(caseIndex < tableLength_);
-+    return caseIndex;
-+}
-+
-+uint32_t
-+SwitchEmitter::TableGenerator::tableLength() const
-+{
-+    MOZ_ASSERT(finished_);
-+    MOZ_ASSERT(isValid());
-+    return tableLength_;
-+}
-+
-+SwitchEmitter::SwitchEmitter(BytecodeEmitter* bce)
-+  : bce_(bce)
-+{}
-+
-+bool
-+SwitchEmitter::emitDiscriminant(const Maybe<uint32_t>& switchPos)
-+{
-+    MOZ_ASSERT(state_ == State::Start);
-+    switchPos_ = switchPos;
-+
-+    if (switchPos_) {
-+        // Ensure that the column of the switch statement is set properly.
-+        if (!bce_->updateSourceCoordNotes(*switchPos_))
-+            return false;
-+    }
-+
-+    state_ = State::Discriminant;
-+    return true;
-+}
-+
-+bool
-+SwitchEmitter::emitLexical(Handle<LexicalScope::Data*> bindings)
-+{
-+    MOZ_ASSERT(state_ == State::Discriminant);
-+    MOZ_ASSERT(bindings);
-+
-+    tdzCacheLexical_.emplace(bce_);
-+    emitterScope_.emplace(bce_);
-+    if (!emitterScope_->enterLexical(bce_, ScopeKind::Lexical, bindings))
-+        return false;
-+
-+    state_ = State::Lexical;
-+    return true;
-+}
-+
-+bool
-+SwitchEmitter::validateCaseCount(uint32_t caseCount)
-+{
-+    MOZ_ASSERT(state_ == State::Discriminant || state_ == State::Lexical);
-+    if (caseCount > JS_BIT(16)) {
-+        bce_->reportError(switchPos_, JSMSG_TOO_MANY_CASES);
-+        return false;
-+    }
-+    caseCount_ = caseCount;
-+
-+    state_ = State::CaseCount;
-+    return true;
-+}
-+
-+bool
-+SwitchEmitter::emitCond()
-+{
-+    MOZ_ASSERT(state_ == State::CaseCount);
-+
-+    kind_ = Kind::Cond;
-+
-+    // After entering the scope if necessary, push the switch control.
-+    controlInfo_.emplace(bce_, StatementKind::Switch);
-+    top_ = bce_->offset();
-+
-+    if (!caseOffsets_.resize(caseCount_)) {
-+        ReportOutOfMemory(bce_->cx);
-+        return false;
-+    }
-+
-+    // The note has two offsets: first tells total switch code length;
-+    // second tells offset to first JSOP_CASE.
-+    if (!bce_->newSrcNote3(SRC_CONDSWITCH, 0, 0, &noteIndex_))
-+        return false;
-+
-+    MOZ_ASSERT(top_ == bce_->offset());
-+    if (!bce_->emitN(JSOP_CONDSWITCH, 0))
-+        return false;
-+
-+    tdzCacheCaseAndBody_.emplace(bce_);
-+
-+    state_ = State::Cond;
-+    return true;
-+}
-+
-+bool
-+SwitchEmitter::emitTable(const TableGenerator& tableGen)
-+{
-+    MOZ_ASSERT(state_ == State::CaseCount);
-+    kind_ = Kind::Table;
-+
-+    // After entering the scope if necessary, push the switch control.
-+    controlInfo_.emplace(bce_, StatementKind::Switch);
-+    top_ = bce_->offset();
-+
-+    // The note has one offset that tells total switch code length.
-+
-+    // 3 offsets (len, low, high) before the table, 1 per entry.
-+    size_t switchSize = size_t(JUMP_OFFSET_LEN * (3 + tableGen.tableLength()));
-+    if (!bce_->newSrcNote2(SRC_TABLESWITCH, 0, &noteIndex_))
-+        return false;
-+
-+    if (!caseOffsets_.resize(tableGen.tableLength())) {
-+        ReportOutOfMemory(bce_->cx);
-+        return false;
-+    }
-+
-+    MOZ_ASSERT(top_ == bce_->offset());
-+    if (!bce_->emitN(JSOP_TABLESWITCH, switchSize))
-+        return false;
-+
-+    // Skip default offset.
-+    jsbytecode* pc = bce_->code(top_ + JUMP_OFFSET_LEN);
-+
-+    // Fill in switch bounds, which we know fit in 16-bit offsets.
-+    SET_JUMP_OFFSET(pc, tableGen.low());
-+    SET_JUMP_OFFSET(pc + JUMP_OFFSET_LEN, tableGen.high());
-+
-+    state_ = State::Table;
-+    return true;
-+}
-+
-+bool
-+SwitchEmitter::emitCaseOrDefaultJump(uint32_t caseIndex, bool isDefault)
-+{
-+    MOZ_ASSERT(kind_ == Kind::Cond);
-+
-+    if (state_ == State::Case) {
-+        // Link the last JSOP_CASE's SRC_NEXTCASE to current JSOP_CASE or
-+        // JSOP_DEFAULT for the benefit of IonBuilder.
-+        if (!bce_->setSrcNoteOffset(caseNoteIndex_, 0, bce_->offset() - lastCaseOffset_))
-+            return false;
-+    }
-+
-+    if (isDefault) {
-+        if (!bce_->emitJump(JSOP_DEFAULT, &condSwitchDefaultOffset_))
-+            return false;
-+        return true;
-+    }
-+
-+    if (!bce_->newSrcNote2(SRC_NEXTCASE, 0, &caseNoteIndex_))
-+        return false;
-+
-+    JumpList caseJump;
-+    if (!bce_->emitJump(JSOP_CASE, &caseJump))
-+        return false;
-+    caseOffsets_[caseIndex] = caseJump.offset;
-+    lastCaseOffset_ = caseJump.offset;
-+
-+    if (state_ == State::Cond) {
-+        // Switch note's second offset is to first JSOP_CASE.
-+        unsigned noteCount = bce_->notes().length();
-+        if (!bce_->setSrcNoteOffset(noteIndex_, 1, lastCaseOffset_ - top_))
-+            return false;
-+        unsigned noteCountDelta = bce_->notes().length() - noteCount;
-+        if (noteCountDelta != 0)
-+            caseNoteIndex_ += noteCountDelta;
-+    }
-+
-+    return true;
-+}
-+
-+bool
-+SwitchEmitter::emitCaseJump()
-+{
-+    MOZ_ASSERT(kind_ == Kind::Cond);
-+    MOZ_ASSERT(state_ == State::Cond || state_ == State::Case);
-+    if (!emitCaseOrDefaultJump(caseIndex_, false))
-+        return false;
-+    caseIndex_++;
-+
-+    state_ = State::Case;
-+    return true;
-+}
-+
-+bool
-+SwitchEmitter::emitImplicitDefault()
-+{
-+    MOZ_ASSERT(kind_ == Kind::Cond);
-+    MOZ_ASSERT(state_ == State::Cond || state_ == State::Case);
-+    if (!emitCaseOrDefaultJump(0, true))
-+        return false;
-+
-+    caseIndex_ = 0;
-+
-+    // No internal state after emitting default jump.
-+    return true;
-+}
-+
-+bool
-+SwitchEmitter::emitCaseBody()
-+{
-+    MOZ_ASSERT(kind_ == Kind::Cond);
-+    MOZ_ASSERT(state_ == State::Cond || state_ == State::Case ||
-+               state_ == State::CaseBody || state_ == State::DefaultBody);
-+
-+    tdzCacheCaseAndBody_.reset();
-+
-+    if (state_ == State::Cond || state_ == State::Case) {
-+        // For cond switch, JSOP_DEFAULT is always emitted.
-+        if (!emitImplicitDefault())
-+            return false;
-+    }
-+
-+    JumpList caseJump;
-+    caseJump.offset = caseOffsets_[caseIndex_];
-+    if (!bce_->emitJumpTargetAndPatch(caseJump))
-+        return false;
-+
-+    JumpTarget here;
-+    if (!bce_->emitJumpTarget(&here))
-+        return false;
-+    caseIndex_++;
-+
-+    tdzCacheCaseAndBody_.emplace(bce_);
-+
-+    state_ = State::CaseBody;
-+    return true;
-+}
-+
-+bool
-+SwitchEmitter::emitCaseBody(int32_t caseValue, const TableGenerator& tableGen)
-+{
-+    MOZ_ASSERT(kind_ == Kind::Table);
-+    MOZ_ASSERT(state_ == State::Table ||
-+               state_ == State::CaseBody || state_ == State::DefaultBody);
-+
-+    tdzCacheCaseAndBody_.reset();
-+
-+    JumpTarget here;
-+    if (!bce_->emitJumpTarget(&here))
-+        return false;
-+    caseOffsets_[tableGen.toCaseIndex(caseValue)] = here.offset;
-+
-+    tdzCacheCaseAndBody_.emplace(bce_);
-+
-+    state_ = State::CaseBody;
-+    return true;
-+}
-+
-+bool
-+SwitchEmitter::emitDefaultBody()
-+{
-+    MOZ_ASSERT(state_ == State::Cond || state_ == State::Table ||
-+               state_ == State::Case ||
-+               state_ == State::CaseBody);
-+    MOZ_ASSERT(!hasDefault_);
-+
-+    tdzCacheCaseAndBody_.reset();
-+
-+    if (state_ == State::Cond || state_ == State::Case) {
-+        // For cond switch, JSOP_DEFAULT is always emitted.
-+        if (!emitImplicitDefault())
-+            return false;
-+    }
-+    JumpTarget here;
-+    if (!bce_->emitJumpTarget(&here))
-+        return false;
-+    defaultJumpTargetOffset_ = here;
-+
-+    tdzCacheCaseAndBody_.emplace(bce_);
-+
-+    hasDefault_ = true;
-+    state_ = State::DefaultBody;
-+    return true;
-+}
-+
-+bool
-+SwitchEmitter::emitEnd()
-+{
-+    MOZ_ASSERT(state_ == State::Cond || state_ == State::Table ||
-+               state_ == State::CaseBody || state_ == State::DefaultBody);
-+
-+    tdzCacheCaseAndBody_.reset();
-+
-+    if (!hasDefault_) {
-+        // If no default case, offset for default is to end of switch.
-+        if (!bce_->emitJumpTarget(&defaultJumpTargetOffset_))
-+            return false;
-+    }
-+    MOZ_ASSERT(defaultJumpTargetOffset_.offset != -1);
-+
-+    // Set the default offset (to end of switch if no default).
-+    jsbytecode* pc;
-+    if (kind_ == Kind::Cond) {
-+        pc = nullptr;
-+        bce_->patchJumpsToTarget(condSwitchDefaultOffset_, defaultJumpTargetOffset_);
-+    } else {
-+        // Fill in the default jump target.
-+        pc = bce_->code(top_);
-+        SET_JUMP_OFFSET(pc, defaultJumpTargetOffset_.offset - top_);
-+        pc += JUMP_OFFSET_LEN;
-+    }
-+
-+    // Set the SRC_SWITCH note's offset operand to tell end of switch.
-+    if (!bce_->setSrcNoteOffset(noteIndex_, 0, bce_->lastNonJumpTargetOffset() - top_))
-+        return false;
-+
-+    if (kind_ == Kind::Table) {
-+        // Skip over the already-initialized switch bounds.
-+        pc += 2 * JUMP_OFFSET_LEN;
-+
-+        // Fill in the jump table, if there is one.
-+        for (uint32_t i = 0, length = caseOffsets_.length(); i < length; i++) {
-+            ptrdiff_t off = caseOffsets_[i];
-+            SET_JUMP_OFFSET(pc, off == 0 ? 0 : off - top_);
-+            pc += JUMP_OFFSET_LEN;
-+        }
-+    }
-+
-+    // Patch breaks before leaving the scope, as all breaks are under the
-+    // lexical scope if it exists.
-+    if (!controlInfo_->patchBreaks(bce_))
-+        return false;
-+
-+    if (emitterScope_ && !emitterScope_->leave(bce_))
-+        return false;
-+
-+    emitterScope_.reset();
-+    tdzCacheLexical_.reset();
-+
-+    controlInfo_.reset();
-+
-+    state_ = State::End;
-+    return true;
-+}
-diff --git a/js/src/frontend/SwitchEmitter.h b/js/src/frontend/SwitchEmitter.h
-new file mode 100644
---- /dev/null
-+++ b/js/src/frontend/SwitchEmitter.h
-@@ -0,0 +1,469 @@
-+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
-+ * vim: set ts=8 sts=4 et sw=4 tw=99:
-+ * This Source Code Form is subject to the terms of the Mozilla Public
-+ * License, v. 2.0. If a copy of the MPL was not distributed with this
-+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-+
-+#ifndef frontend_SwitchEmitter_h
-+#define frontend_SwitchEmitter_h
-+
-+#include "mozilla/Attributes.h"
-+#include "mozilla/Maybe.h"
-+
-+#include <stddef.h>
-+#include <stdint.h>
-+
-+#include "frontend/BytecodeControlStructures.h"
-+#include "frontend/EmitterScope.h"
-+#include "frontend/JumpList.h"
-+#include "frontend/TDZCheckCache.h"
-+#include "gc/Rooting.h"
-+#include "js/AllocPolicy.h"
-+#include "js/Value.h"
-+#include "js/Vector.h"
-+#include "vm/Scope.h"
-+
-+namespace js {
-+namespace frontend {
-+
-+struct BytecodeEmitter;
-+
-+// Class for emitting bytecode for switch-case-default block.
-+//
-+// Usage: (check for the return value is omitted for simplicity)
-+//
-+//   `switch (discriminant) { case c1_expr: c1_body; }`
-+//     SwitchEmitter se(this);
-+//     se.emitDiscriminant(Some(offset_of_switch));
-+//     emit(discriminant);
-+//
-+//     se.validateCaseCount(1);
-+//     se.emitCond();
-+//
-+//     emit(c1_expr);
-+//     se.emitCaseJump();
-+//
-+//     se.emitCaseBody();
-+//     emit(c1_body);
-+//
-+//     se.emitEnd();
-+//
-+//   `switch (discriminant) { case c1_expr: c1_body; case c2_expr: c2_body;
-+//                            default: def_body; }`
-+//     SwitchEmitter se(this);
-+//     se.emitDiscriminant(Some(offset_of_switch));
-+//     emit(discriminant);
-+//
-+//     se.validateCaseCount(2);
-+//     se.emitCond();
-+//
-+//     emit(c1_expr);
-+//     se.emitCaseJump();
-+//
-+//     emit(c2_expr);
-+//     se.emitCaseJump();
-+//
-+//     se.emitCaseBody();
-+//     emit(c1_body);
-+//
-+//     se.emitCaseBody();
-+//     emit(c2_body);
-+//
-+//     se.emitDefaultBody();
-+//     emit(def_body);
-+//
-+//     se.emitEnd();
-+//
-+//   `switch (discriminant) { case c1_expr: c1_body; case c2_expr: c2_body; }`
-+//   with Table Switch
-+//     SwitchEmitter::TableGenerator tableGen(this);
-+//     tableGen.addNumber(c1_expr_value);
-+//     tableGen.addNumber(c2_expr_value);
-+//     tableGen.finish(2);
-+//
-+//     // If `!tableGen.isValid()` here, `emitCond` should be used instead.
-+//
-+//     SwitchEmitter se(this);
-+//     se.emitDiscriminant(Some(offset_of_switch));
-+//     emit(discriminant);
-+//     se.validateCaseCount(2);
-+//     se.emitTable(tableGen);
-+//
-+//     se.emitCaseBody(c1_expr_value, tableGen);
-+//     emit(c1_body);
-+//
-+//     se.emitCaseBody(c2_expr_value, tableGen);
-+//     emit(c2_body);
-+//
-+//     se.emitEnd();
-+//
-+//   `switch (discriminant) { case c1_expr: c1_body; case c2_expr: c2_body;
-+//                            default: def_body; }`
-+//   with Table Switch
-+//     SwitchEmitter::TableGenerator tableGen(bce);
-+//     tableGen.addNumber(c1_expr_value);
-+//     tableGen.addNumber(c2_expr_value);
-+//     tableGen.finish(2);
-+//
-+//     // If `!tableGen.isValid()` here, `emitCond` should be used instead.
-+//
-+//     SwitchEmitter se(this);
-+//     se.emitDiscriminant(Some(offset_of_switch));
-+//     emit(discriminant);
-+//     se.validateCaseCount(2);
-+//     se.emitTable(tableGen);
-+//
-+//     se.emitCaseBody(c1_expr_value, tableGen);
-+//     emit(c1_body);
-+//
-+//     se.emitCaseBody(c2_expr_value, tableGen);
-+//     emit(c2_body);
-+//
-+//     se.emitDefaultBody();
-+//     emit(def_body);
-+//
-+//     se.emitEnd();
-+//
-+//   `switch (discriminant) { case c1_expr: c1_body; }`
-+//   in case c1_body contains lexical bindings
-+//     SwitchEmitter se(this);
-+//     se.emitDiscriminant(Some(offset_of_switch));
-+//     emit(discriminant);
-+//
-+//     se.validateCaseCount(1);
-+//
-+//     se.emitLexical(bindings);
-+//
-+//     se.emitCond();
-+//
-+//     emit(c1_expr);
-+//     se.emitCaseJump();
-+//
-+//     se.emitCaseBody();
-+//     emit(c1_body);
-+//
-+//     se.emitEnd();
-+//
-+//   `switch (discriminant) { case c1_expr: c1_body; }`
-+//   in case c1_body contains hosted functions
-+//     SwitchEmitter se(this);
-+//     se.emitDiscriminant(Some(offset_of_switch));
-+//     emit(discriminant);
-+//
-+//     se.validateCaseCount(1);
-+//
-+//     se.emitLexical(bindings);
-+//     emit(hosted functions);
-+//
-+//     se.emitCond();
-+//
-+//     emit(c1_expr);
-+//     se.emitCaseJump();
-+//
-+//     se.emitCaseBody();
-+//     emit(c1_body);
-+//
-+//     se.emitEnd();
-+//
-+class MOZ_STACK_CLASS SwitchEmitter
-+{
-+    // Bytecode for each case.
-+    //
-+    // Cond Switch
-+    //     {discriminant}
-+    //     JSOP_CONDSWITCH
-+    //
-+    //     {c1_expr}
-+    //     JSOP_CASE c1
-+    //
-+    //     JSOP_JUMPTARGET
-+    //     {c2_expr}
-+    //     JSOP_CASE c2
-+    //
-+    //     ...
-+    //
-+    //     JSOP_JUMPTARGET
-+    //     JSOP_DEFAULT default
-+    //
-+    //   c1:
-+    //     JSOP_JUMPTARGET
-+    //     {c1_body}
-+    //     JSOP_GOTO end
-+    //
-+    //   c2:
-+    //     JSOP_JUMPTARGET
-+    //     {c2_body}
-+    //     JSOP_GOTO end
-+    //
-+    //   default:
-+    //   end:
-+    //     JSOP_JUMPTARGET
-+    //
-+    // Table Switch
-+    //     {discriminant}
-+    //     JSOP_TABLESWITCH c1, c2, ...
-+    //
-+    //   c1:
-+    //     JSOP_JUMPTARGET
-+    //     {c1_body}
-+    //     JSOP_GOTO end
-+    //
-+    //   c2:
-+    //     JSOP_JUMPTARGET
-+    //     {c2_body}
-+    //     JSOP_GOTO end
-+    //
-+    //   ...
-+    //
-+    //   end:
-+    //     JSOP_JUMPTARGET
-+
-+  public:
-+    enum class Kind {
-+        Table,
-+        Cond
-+    };
-+
-+    // Class for generating optimized table switch data.
-+    class MOZ_STACK_CLASS TableGenerator
-+    {
-+        BytecodeEmitter* bce_;
-+
-+        // Bit array for given numbers.
-+        mozilla::Maybe<js::Vector<size_t, 128, SystemAllocPolicy>> intmap_;
-+
-+        // The length of the intmap_.
-+        int32_t intmapBitLength_ = 0;
-+
-+        // The length of the table.
-+        uint32_t tableLength_ = 0;
-+
-+        // The lower and higher bounds of the table.
-+        int32_t low_ = JSVAL_INT_MAX, high_ = JSVAL_INT_MIN;
-+
-+        // Whether the table is still valid.
-+        bool valid_= true;
-+
-+#ifdef DEBUG
-+        bool finished_ = false;
-+#endif
-+
-+      public:
-+        explicit TableGenerator(BytecodeEmitter* bce)
-+          : bce_(bce)
-+        {}
-+
-+        void setInvalid() {
-+            valid_ = false;
-+        }
-+        MOZ_MUST_USE bool isValid() const {
-+            return valid_;
-+        }
-+        MOZ_MUST_USE bool isInvalid() const {
-+            return !valid_;
-+        }
-+
-+        // Add the given number to the table.  The number is the value of
-+        // `expr` for `case expr:` syntax.
-+        MOZ_MUST_USE bool addNumber(int32_t caseValue);
-+
-+        // Finish generating the table.
-+        // `caseCount` should be the number of cases in the switch statement,
-+        // excluding the default case.
-+        void finish(uint32_t caseCount);
-+
-+      private:
-+        friend SwitchEmitter;
-+
-+        // The following methods can be used only after calling `finish`.
-+
-+        // Returns the lower bound of the added numbers.
-+        int32_t low() const {
-+            MOZ_ASSERT(finished_);
-+            return low_;
-+        }
-+
-+        // Returns the higher bound of the numbers.
-+        int32_t high() const {
-+            MOZ_ASSERT(finished_);
-+            return high_;
-+        }
-+
-+        // Returns the index in SwitchEmitter.caseOffsets_ for table switch.
-+        uint32_t toCaseIndex(int32_t caseValue) const;
-+
-+        // Returns the length of the table.
-+        // This method can be called only if `isValid()` is true.
-+        uint32_t tableLength() const;
-+    };
-+
-+  private:
-+    BytecodeEmitter* bce_;
-+
-+    // `kind_` should be set to the correct value in emitCond/emitTable.
-+    Kind kind_ = Kind::Cond;
-+
-+    // True if there's explicit default case.
-+    bool hasDefault_ = false;
-+
-+    // The source note index for SRC_CONDSWITCH.
-+    unsigned noteIndex_ = 0;
-+
-+    // Source note index of the previous SRC_NEXTCASE.
-+    unsigned caseNoteIndex_ = 0;
-+
-+    // The number of cases in the switch statement, excluding the default case.
-+    uint32_t caseCount_ = 0;
-+
-+    // Internal index for case jump and case body, used by cond switch.
-+    uint32_t caseIndex_ = 0;
-+
-+    // Bytecode offset after emitting `discriminant`.
-+    ptrdiff_t top_ = 0;
-+
-+    // Bytecode offset of the previous JSOP_CASE.
-+    ptrdiff_t lastCaseOffset_ = 0;
-+
-+    // Bytecode offset of the JSOP_JUMPTARGET for default body.
-+    JumpTarget defaultJumpTargetOffset_ = { -1 };
-+
-+    // Bytecode offset of the JSOP_DEFAULT.
-+    JumpList condSwitchDefaultOffset_;
-+
-+    // Instantiated when there's lexical scope for entire switch.
-+    mozilla::Maybe<TDZCheckCache> tdzCacheLexical_;
-+    mozilla::Maybe<EmitterScope> emitterScope_;
-+
-+    // Instantiated while emitting case expression and case/default body.
-+    mozilla::Maybe<TDZCheckCache> tdzCacheCaseAndBody_;
-+
-+    // Control for switch.
-+    mozilla::Maybe<BreakableControl> controlInfo_;
-+
-+    mozilla::Maybe<uint32_t> switchPos_;
-+
-+    // Cond Switch:
-+    //   Offset of each JSOP_CASE.
-+    // Table Switch:
-+    //   Offset of each JSOP_JUMPTARGET for case.
-+    js::Vector<ptrdiff_t, 32, SystemAllocPolicy> caseOffsets_;
-+
-+    // The state of this emitter.
-+    //
-+    // +-------+ emitDiscriminant +--------------+
-+    // | Start |----------------->| Discriminant |-+
-+    // +-------+                  +--------------+ |
-+    //                                             |
-+    // +-------------------------------------------+
-+    // |
-+    // |                              validateCaseCount +-----------+
-+    // +->+------------------------>+------------------>| CaseCount |-+
-+    //    |                         ^                   +-----------+ |
-+    //    | emitLexical +---------+ |                                 |
-+    //    +------------>| Lexical |-+                                 |
-+    //                  +---------+                                   |
-+    //                                                                |
-+    // +--------------------------------------------------------------+
-+    // |
-+    // | emitTable +-------+
-+    // +---------->| Table |---------------------------->+-+
-+    // |           +-------+                             ^ |
-+    // |                                                 | |
-+    // | emitCond  +------+                              | |
-+    // +---------->| Cond |-+------------------------>+->+ |
-+    //             +------+ |                         ^    |
-+    //                      |                         |    |
-+    //                      |    emitCase +------+    |    |
-+    //                      +->+--------->| Case |->+-+    |
-+    //                         ^          +------+  |      |
-+    //                         |                    |      |
-+    //                         +--------------------+      |
-+    //                                                     |
-+    // +---------------------------------------------------+
-+    // |
-+    // |                                              emitEnd +-----+
-+    // +-+----------------------------------------->+-------->| End |
-+    //   |                                          ^         +-----+
-+    //   |      emitCaseBody    +----------+        |
-+    //   +->+-+---------------->| CaseBody |--->+-+-+
-+    //      ^ |                 +----------+    ^ |
-+    //      | |                                 | |
-+    //      | | emitDefaultBody +-------------+ | |
-+    //      | +---------------->| DefaultBody |-+ |
-+    //      |                   +-------------+   |
-+    //      |                                     |
-+    //      +-------------------------------------+
-+    //
-+    enum class State {
-+        // The initial state.
-+        Start,
-+
-+        // After calling emitDiscriminant.
-+        Discriminant,
-+
-+        // After calling validateCaseCount.
-+        CaseCount,
-+
-+        // After calling emitLexical.
-+        Lexical,
-+
-+        // After calling emitCond.
-+        Cond,
-+
-+        // After calling emitTable.
-+        Table,
-+
-+        // After calling emitCase.
-+        Case,
-+
-+        // After calling emitCaseBody.
-+        CaseBody,
-+
-+        // After calling emitDefaultBody.
-+        DefaultBody,
-+
-+        // After calling emitEnd.
-+        End
-+    };
-+    State state_ = State::Start;
-+
-+  public:
-+    explicit SwitchEmitter(BytecodeEmitter* bce);
-+
-+    // `switchPos` is the offset in the source code for the character below:
-+    //
-+    //   switch ( cond ) { ... }
-+    //   ^
-+    //   |
-+    //   switchPos
-+    //
-+    // Can be Nothing() if not available.
-+    MOZ_MUST_USE bool emitDiscriminant(const mozilla::Maybe<uint32_t>& switchPos);
-+
-+    // `caseCount` should be the number of cases in the switch statement,
-+    // excluding the default case.
-+    MOZ_MUST_USE bool validateCaseCount(uint32_t caseCount);
-+
-+    // `bindings` is a lexical scope for the entire switch, in case there's
-+    // let/const effectively directly under case or default blocks.
-+    MOZ_MUST_USE bool emitLexical(Handle<LexicalScope::Data*> bindings);
-+
-+    MOZ_MUST_USE bool emitCond();
-+    MOZ_MUST_USE bool emitTable(const TableGenerator& tableGen);
-+
-+    MOZ_MUST_USE bool emitCaseJump();
-+
-+    MOZ_MUST_USE bool emitCaseBody();
-+    MOZ_MUST_USE bool emitCaseBody(int32_t caseValue, const TableGenerator& tableGen);
-+    MOZ_MUST_USE bool emitDefaultBody();
-+    MOZ_MUST_USE bool emitEnd();
-+
-+  private:
-+    MOZ_MUST_USE bool emitCaseOrDefaultJump(uint32_t caseIndex, bool isDefault);
-+    MOZ_MUST_USE bool emitImplicitDefault();
-+};
-+
-+} /* namespace frontend */
-+} /* namespace js */
-+
-+#endif /* frontend_SwitchEmitter_h */
-diff --git a/js/src/moz.build b/js/src/moz.build
---- a/js/src/moz.build
-+++ b/js/src/moz.build
-@@ -214,16 +214,17 @@ UNIFIED_SOURCES += [
-     'frontend/BytecodeEmitter.cpp',
-     'frontend/EmitterScope.cpp',
-     'frontend/FoldConstants.cpp',
-     'frontend/ForOfLoopControl.cpp',
-     'frontend/IfEmitter.cpp',
-     'frontend/JumpList.cpp',
-     'frontend/NameFunctions.cpp',
-     'frontend/ParseNode.cpp',
-+    'frontend/SwitchEmitter.cpp',
-     'frontend/TDZCheckCache.cpp',
-     'frontend/TokenStream.cpp',
-     'frontend/TryEmitter.cpp',
-     'gc/Allocator.cpp',
-     'gc/AtomMarking.cpp',
-     'gc/Barrier.cpp',
-     'gc/GC.cpp',
-     'gc/GCTrace.cpp',

frg/work-js/mozilla-release/patches/mozilla-central_469093.patch

@@ -1,409 +0,0 @@
-# HG changeset patch
-# User Andre Bargull <andre.bargull@gmail.com>
-# Date 1555016777 0
-#      Thu Apr 11 21:06:17 2019 +0000
-# Node ID af57f8ff4600757ecef6e5491f8e5d6e51df67ed
-# Parent  ca9b52a04b085152ad38b468d3d87e4f56df86f3
-Bug 1539694 - Part 1: Modify shared Promise.all/race helper to allow passing in a different reject function. r=jorendorff
-
-And a shared helper function for Promise.all, Promise.race, and soon
-Promise.allSettled to avoid code repetition.
-
-Differential Revision: https://phabricator.services.mozilla.com/D25208
-
-diff --git a/js/src/builtin/Promise.cpp b/js/src/builtin/Promise.cpp
---- a/js/src/builtin/Promise.cpp
-+++ b/js/src/builtin/Promise.cpp
-@@ -2267,27 +2267,45 @@ class MOZ_STACK_CLASS PromiseForOfIterat
-     return index != NOT_ARRAY && IsPackedArray(iterator);
-   }
- };
- 
- static MOZ_MUST_USE bool PerformPromiseAll(
-     JSContext* cx, PromiseForOfIterator& iterator, HandleObject C,
-     Handle<PromiseCapability> resultCapability, bool* done);
- 
--// ES2016, 25.4.4.1.
--static bool Promise_static_all(JSContext* cx, unsigned argc, Value* vp) {
--  CallArgs args = CallArgsFromVp(argc, vp);
-+static MOZ_MUST_USE bool PerformPromiseRace(
-+    JSContext* cx, PromiseForOfIterator& iterator, HandleObject C,
-+    Handle<PromiseCapability> resultCapability, bool* done);
-+
-+enum class IterationMode { All, Race };
-+
-+// ES2020 draft rev a09fc232c137800dbf51b6204f37fdede4ba1646
-+//
-+// Unified implementation of
-+// 25.6.4.1 Promise.all ( iterable )
-+// 25.6.4.3 Promise.race ( iterable )
-+static MOZ_MUST_USE bool CommonStaticAllRace(JSContext* cx, CallArgs& args,
-+                                             IterationMode mode) {
-   HandleValue iterable = args.get(0);
- 
-   // Step 2 (reordered).
-   HandleValue CVal = args.thisv();
-   if (!CVal.isObject()) {
-+    const char* message;
-+    switch (mode) {
-+      case IterationMode::All:
-+        message = "Receiver of Promise.all call";
-+        break;
-+      case IterationMode::Race:
-+        message = "Receiver of Promise.race call";
-+        break;
-+    }
-     JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
--                              JSMSG_NOT_NONNULL_OBJECT,
--                              "Receiver of Promise.all call");
-+                              JSMSG_NOT_NONNULL_OBJECT, message);
-     return false;
-   }
- 
-   // Step 1.
-   RootedObject C(cx, &CVal.toObject());
- 
-   // Step 3.
-   Rooted<PromiseCapability> promiseCapability(cx);
-@@ -2297,26 +2315,42 @@ static bool Promise_static_all(JSContext
- 
-   // Steps 4-5.
-   PromiseForOfIterator iter(cx);
-   if (!iter.init(iterable, JS::ForOfIterator::AllowNonIterable)) {
-     return AbruptRejectPromise(cx, args, promiseCapability);
-   }
- 
-   if (!iter.valueIsIterable()) {
-+    const char* message;
-+    switch (mode) {
-+      case IterationMode::All:
-+        message = "Argument of Promise.all";
-+        break;
-+      case IterationMode::Race:
-+        message = "Argument of Promise.race";
-+        break;
-+    }
-     JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_NOT_ITERABLE,
--                              "Argument of Promise.all");
-+                              message);
-     return AbruptRejectPromise(cx, args, promiseCapability);
-   }
- 
-   // Step 6 (implicit).
- 
-   // Step 7.
--  bool done;
--  bool result = PerformPromiseAll(cx, iter, C, promiseCapability, &done);
-+  bool done, result;
-+  switch (mode) {
-+    case IterationMode::All:
-+      result = PerformPromiseAll(cx, iter, C, promiseCapability, &done);
-+      break;
-+    case IterationMode::Race:
-+      result = PerformPromiseRace(cx, iter, C, promiseCapability, &done);
-+      break;
-+  }
- 
-   // Step 8.
-   if (!result) {
-     // Step 8.a.
-     if (!done) {
-       iter.closeThrow();
-     }
- 
-@@ -2324,16 +2358,23 @@ static bool Promise_static_all(JSContext
-     return AbruptRejectPromise(cx, args, promiseCapability);
-   }
- 
-   // Step 9.
-   args.rval().setObject(*promiseCapability.promise());
-   return true;
- }
- 
-+// ES2020 draft rev a09fc232c137800dbf51b6204f37fdede4ba1646
-+// 25.6.4.1 Promise.all ( iterable )
-+static bool Promise_static_all(JSContext* cx, unsigned argc, Value* vp) {
-+  CallArgs args = CallArgsFromVp(argc, vp);
-+  return CommonStaticAllRace(cx, args, IterationMode::All);
-+}
-+
- static MOZ_MUST_USE bool PerformPromiseThen(
-     JSContext* cx, Handle<PromiseObject*> promise, HandleValue onFulfilled_,
-     HandleValue onRejected_, Handle<PromiseCapability> resultCapability);
- 
- static MOZ_MUST_USE bool PerformPromiseThenWithoutSettleHandlers(
-     JSContext* cx, Handle<PromiseObject*> promise,
-     Handle<PromiseObject*> promiseToResolve,
-     Handle<PromiseCapability> resultCapability);
-@@ -2540,18 +2581,18 @@ static MOZ_MUST_USE JSObject* CommonStat
- static bool IsPromiseSpecies(JSContext* cx, JSFunction* species);
- 
- // ES2019 draft rev dd269df67d37409a6f2099a842b8f5c75ee6fc24
- // 25.6.4.1.1 Runtime Semantics: PerformPromiseAll, step 6.
- // 25.6.4.3.1 Runtime Semantics: PerformPromiseRace, step 3.
- template <typename T>
- static MOZ_MUST_USE bool CommonPerformPromiseAllRace(
-     JSContext* cx, PromiseForOfIterator& iterator, HandleObject C,
--    Handle<PromiseCapability> resultCapability, bool* done,
--    bool resolveReturnsUndefined, T getResolveFun) {
-+    HandleObject resultPromise, bool* done, bool resolveReturnsUndefined,
-+    T getResolveAndReject) {
-   RootedObject promiseCtor(
-       cx, GlobalObject::getOrCreatePromiseConstructor(cx, cx->global()));
-   if (!promiseCtor) {
-     return false;
-   }
- 
-   // Optimized dense array iteration ensures no side-effects take place
-   // during the iteration.
-@@ -2561,19 +2602,18 @@ static MOZ_MUST_USE bool CommonPerformPr
-   // with |C == promiseCtor| because we can only perform this optimization
-   // for the builtin Promise constructor.
-   bool isDefaultPromiseState = C == promiseCtor;
-   bool validatePromiseState = true;
- 
-   PromiseLookup& promiseLookup = cx->realm()->promiseLookup;
- 
-   RootedValue CVal(cx, ObjectValue(*C));
--  HandleObject resultPromise = resultCapability.promise();
-   RootedValue resolveFunVal(cx);
--  RootedValue rejectFunVal(cx, ObjectValue(*resultCapability.reject()));
-+  RootedValue rejectFunVal(cx);
- 
-   // We're reusing rooted variables in the loop below, so we don't need to
-   // declare a gazillion different rooted variables here. Rooted variables
-   // which are reused include "Or" in their name.
-   RootedValue nextValueOrNextPromise(cx);
-   RootedObject nextPromiseObj(cx);
-   RootedValue resolveOrThen(cx);
-   RootedObject thenSpeciesOrBlockedPromise(cx);
-@@ -2652,23 +2692,21 @@ static MOZ_MUST_USE bool CommonPerformPr
-         return false;
-       }
- 
-       if (!Call(cx, staticResolve, CVal, nextValue, &nextPromise)) {
-         return false;
-       }
-     }
- 
--    // Get the resolve function for this iteration.
-+    // Get the resolving functions for this iteration.
-     // 25.6.4.1.1, steps 6.j-q.
--    JSObject* resolveFun = getResolveFun();
--    if (!resolveFun) {
-+    if (!getResolveAndReject(&resolveFunVal, &rejectFunVal)) {
-       return false;
-     }
--    resolveFunVal.setObject(*resolveFun);
- 
-     // Call |nextPromise.then| with the provided hooks and add
-     // |resultPromise| to the list of dependent promises.
-     //
-     // If |nextPromise.then| is the original |Promise.prototype.then|
-     // function and the call to |nextPromise.then| would use the original
-     // |Promise| constructor to create the resulting promise, we skip the
-     // call to |nextPromise.then| and thus creating a new promise that
-@@ -2815,17 +2853,18 @@ static MOZ_MUST_USE bool CommonPerformPr
-         if (!AddDummyPromiseReactionForDebugger(cx, promise, blockedPromise)) {
-           return false;
-         }
-       }
-     }
-   }
- }
- 
--// ES2016, 25.4.4.1.1.
-+// ES2020 draft rev a09fc232c137800dbf51b6204f37fdede4ba1646
-+// 25.6.4.1.1 PerformPromiseAll (iteratorRecord, constructor, resultCapability)
- static MOZ_MUST_USE bool PerformPromiseAll(
-     JSContext* cx, PromiseForOfIterator& iterator, HandleObject C,
-     Handle<PromiseCapability> resultCapability, bool* done) {
-   *done = false;
- 
-   // Step 1.
-   MOZ_ASSERT(C->isConstructor());
- 
-@@ -2890,34 +2929,36 @@ static MOZ_MUST_USE bool PerformPromiseA
-                               resultCapability.resolve());
-   if (!dataHolder) {
-     return false;
-   }
- 
-   // Step 5.
-   uint32_t index = 0;
- 
--  auto getResolve = [cx, &valuesArray, &dataHolder, &index]() -> JSObject* {
-+  auto getResolveAndReject = [cx, &resultCapability, &valuesArray, &dataHolder,
-+                              &index](MutableHandleValue resolveFunVal,
-+                                      MutableHandleValue rejectFunVal) {
-     // Step 6.h.
-     {  // Scope for the AutoRealm we need to work with valuesArray.  We
-       // mostly do this for performance; we could go ahead and do the define via
-       // a cross-compartment proxy instead...
-       AutoRealm ar(cx, valuesArray);
- 
-       if (!NewbornArrayPush(cx, valuesArray, UndefinedValue())) {
--        return nullptr;
-+        return false;
-       }
-     }
- 
-     // Steps 6.j-k.
-     JSFunction* resolveFunc =
-         NewNativeFunction(cx, PromiseAllResolveElementFunction, 1, nullptr,
-                           gc::AllocKind::FUNCTION_EXTENDED, GenericObject);
-     if (!resolveFunc) {
--      return nullptr;
-+      return false;
-     }
- 
-     // Steps 6.l, 6.n-p.
-     resolveFunc->setExtendedSlot(PromiseAllResolveElementFunctionSlot_Data,
-                                  ObjectValue(*dataHolder));
- 
-     // Step 6.m.
-     resolveFunc->setExtendedSlot(
-@@ -2925,22 +2966,24 @@ static MOZ_MUST_USE bool PerformPromiseA
- 
-     // Step 6.q.
-     dataHolder->increaseRemainingCount();
- 
-     // Step 6.s.
-     index++;
-     MOZ_ASSERT(index > 0);
- 
--    return resolveFunc;
-+    resolveFunVal.setObject(*resolveFunc);
-+    rejectFunVal.setObject(*resultCapability.reject());
-+    return true;
-   };
- 
-   // Step 6.
--  if (!CommonPerformPromiseAllRace(cx, iterator, C, resultCapability, done,
--                                   true, getResolve)) {
-+  if (!CommonPerformPromiseAllRace(cx, iterator, C, resultCapability.promise(),
-+                                   done, true, getResolveAndReject)) {
-     return false;
-   }
- 
-   // Step 6.d.ii.
-   int32_t remainingCount = dataHolder->decreaseRemainingCount();
- 
-   // Steps 6.d.iii-iv.
-   if (remainingCount == 0) {
-@@ -3030,101 +3073,53 @@ static bool PromiseAllResolveElementFunc
-     }
-   }
- 
-   // Step 11.
-   args.rval().setUndefined();
-   return true;
- }
- 
--static MOZ_MUST_USE bool PerformPromiseRace(
--    JSContext* cx, PromiseForOfIterator& iterator, HandleObject C,
--    Handle<PromiseCapability> resultCapability, bool* done);
--
--// ES2016, 25.4.4.3.
-+// ES2020 draft rev a09fc232c137800dbf51b6204f37fdede4ba1646
-+// 25.6.4.3 Promise.race ( iterable )
- static bool Promise_static_race(JSContext* cx, unsigned argc, Value* vp) {
-   CallArgs args = CallArgsFromVp(argc, vp);
--  HandleValue iterable = args.get(0);
--
--  // Step 2 (reordered).
--  HandleValue CVal = args.thisv();
--  if (!CVal.isObject()) {
--    JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr,
--                              JSMSG_NOT_NONNULL_OBJECT,
--                              "Receiver of Promise.race call");
--    return false;
--  }
--
--  // Step 1.
--  RootedObject C(cx, &CVal.toObject());
--
--  // Step 3.
--  Rooted<PromiseCapability> promiseCapability(cx);
--  if (!NewPromiseCapability(cx, C, &promiseCapability, false)) {
--    return false;
--  }
--
--  // Steps 4-5.
--  PromiseForOfIterator iter(cx);
--  if (!iter.init(iterable, JS::ForOfIterator::AllowNonIterable)) {
--    return AbruptRejectPromise(cx, args, promiseCapability);
--  }
--
--  if (!iter.valueIsIterable()) {
--    JS_ReportErrorNumberASCII(cx, GetErrorMessage, nullptr, JSMSG_NOT_ITERABLE,
--                              "Argument of Promise.race");
--    return AbruptRejectPromise(cx, args, promiseCapability);
--  }
--
--  // Step 6 (implicit).
--
--  // Step 7.
--  bool done;
--  bool result = PerformPromiseRace(cx, iter, C, promiseCapability, &done);
--
--  // Step 8.
--  if (!result) {
--    // Step 8.a.
--    if (!done) {
--      iter.closeThrow();
--    }
--
--    // Step 8.b.
--    return AbruptRejectPromise(cx, args, promiseCapability);
--  }
--
--  // Step 9.
--  args.rval().setObject(*promiseCapability.promise());
--  return true;
-+  return CommonStaticAllRace(cx, args, IterationMode::Race);
- }
- 
--// ES2016, 25.4.4.3.1.
-+// ES2020 draft rev a09fc232c137800dbf51b6204f37fdede4ba1646
-+// 25.6.4.3.1 PerformPromiseRace (iteratorRecord, constructor, resultCapability)
- static MOZ_MUST_USE bool PerformPromiseRace(
-     JSContext* cx, PromiseForOfIterator& iterator, HandleObject C,
-     Handle<PromiseCapability> resultCapability, bool* done) {
-   *done = false;
- 
-   // Step 1.
-   MOZ_ASSERT(C->isConstructor());
- 
-   // Step 2 (omitted).
- 
-   // BlockOnPromise fast path requires the passed onFulfilled function
-   // doesn't return an object value, because otherwise the skipped promise
-   // creation is detectable due to missing property lookups.
-   bool isDefaultResolveFn =
-       IsNativeFunction(resultCapability.resolve(), ResolvePromiseFunction);
- 
--  auto getResolve = [&resultCapability]() -> JSObject* {
--    return resultCapability.resolve();
-+  auto getResolveAndReject = [&resultCapability](
-+                                 MutableHandleValue resolveFunVal,
-+                                 MutableHandleValue rejectFunVal) {
-+    resolveFunVal.setObject(*resultCapability.resolve());
-+    rejectFunVal.setObject(*resultCapability.reject());
-+    return true;
-   };
- 
-   // Step 3.
--  return CommonPerformPromiseAllRace(cx, iterator, C, resultCapability, done,
--                                     isDefaultResolveFn, getResolve);
-+  return CommonPerformPromiseAllRace(cx, iterator, C,
-+                                     resultCapability.promise(), done,
-+                                     isDefaultResolveFn, getResolveAndReject);
- }
- 
- // https://tc39.github.io/ecma262/#sec-promise.reject
- //
- // Unified implementation of
- // 25.6.4.4 Promise.reject ( r )
- // 25.6.4.5 Promise.resolve ( x )
- // 25.6.4.5.1 PromiseResolve ( C, x )

frg/work-js/mozilla-release/patches/series

@@ -4394,6 +4394,7 @@ NOBUG-20180508-hashtable-62a1.patch
 1442481-1-62a1.patch
 1442481-2-62a1.patch
 1442481-3-62a1.patch
+1302449-62a1.patch
 1459568-62a1.patch
 1457703-2-62a1.patch
 1401927-62a1.patch
@@ -4578,7 +4579,7 @@ NOBUG-20180516-gccice-62a1.patch
 1442481-5-62a1.patch
 1442722-1-PARTIAL-62a1.patch
 1441876-62a1.patch
-NOBUG-20231031-formattingfixes-253.patch
+NOBUG-20231031-formattingfixes-25319.patch
 1462341-62a1.patch
 1461938-08-62a1.patch
 1461938-09-62a1.patch
@@ -4721,7 +4722,7 @@ NOBUG-20231031-formattingfixes-253.patch
 1454630-4-62a1.patch
 1435828-1-62a1.patch
 1435828-2-62a1.patch
-1464472-62a1.patch
+1464472-1-62a1.patch
 1464912-62a1.patch
 1047514-62a1.patch
 1464954-1-62a1.patch
@@ -5268,6 +5269,10 @@ NOBUG-20180629-testingfunctions-63a1.patch
 1472638-63a1.patch
 1471949-63a1.patch
 1469323-63a1.patch
+1473297-63a1.patch
+1418246-63a1.patch
+1473218-63a1.patch
+1472639-63a1.patch
 1447856-63a1.patch
 1471091-1-63a1.patch
 1471091-2-63a1.patch
@@ -5284,28 +5289,6 @@ NOBUG-20180629-testingfunctions-63a1.patch
 1474348-1-63a1.patch
 1474348-2-63a1.patch
 1466979-63a1.patch
-1474605-63a1.patch
-1468536-63a1.patch
-1474522-63a1.patch
-1052582-1-63a1.patch
-1052582-2-63a1.patch
-1460489-0-63a1.patch
-1460489-1-63a1.patch
-1460489-2-63a1.patch
-1460489-3-63a1.patch
-1460489-4-63a1.patch
-1460489-5-63a1.patch
-1460489-6-63a1.patch
-1472734-63a1.patch
-taken-out-stuff-comes-here.patch
-1473956-63a1.patch
-1473297-63a1.patch
-1472639-63a1.patch
-1471134-1-63a1.patch
-1471134-2-63a1.patch
-1471134-3-63a1.patch
-1471134-4-63a1.patch
-1471134-5-63a1.patch
 1468547-3only-63a1.patch
 1458109-63a1.patch
 1444171-1-63a1.patch
@@ -5326,25 +5309,55 @@ taken-out-stuff-comes-here.patch
 1413922-2-PARTIAL-63a1.patch
 1443471-2-63a1.patch
 1474786-63a1.patch
-NOBUG-20180712-typetraits-63a1.patch
-1474871-63a1.patch
-1475067-63a1.patch
-1475058-63a1.patch
-1475210-63a1.patch
+1474605-63a1.patch
+1468536-63a1.patch
+1474522-63a1.patch
+1052582-1-63a1.patch
+1052582-2-63a1.patch
+1460489-0-63a1.patch
+1460489-1-63a1.patch
+1460489-2-63a1.patch
+1460489-3-63a1.patch
+1460489-4-63a1.patch
+1460489-5-63a1.patch
+1460489-6-63a1.patch
+1472734-63a1.patch
+1474904-63a1.patch
+1464829-2-63a1.patch
+1471134-1-63a1.patch
+1471134-2-63a1.patch
+1471134-3-63a1.patch
+1471134-4-63a1.patch
+1471134-5-63a1.patch
 1469044-1-63a1.patch
 1469044-2-63a1.patch
 1469044-3-63a1.patch
+NOBUG-20180710-floatregister-25319.patch
+1464472-2-63a1.patch
+1462939-2-63a1.patch
 1472291-1-63a1.patch
 1472291-2-63a1.patch
 1475461-1-63a1.patch
 1475461-2-63a1.patch
+NOBUG-20180712-typetraits-63a1.patch
+1474871-63a1.patch
+1475067-63a1.patch
+1475058-63a1.patch
+1475210-63a1.patch
 1475504-PARTIAL-63a1.patch
 1472716-1-63a1.patch
 1472490-63a1.patch
 1475649-1-63a1.patch
+1475226-63a1.patch
+1469223-63a1.patch
 1475642-63a1.patch
 1448976-63a1.patch
 1475650-63a1.patch
+1473956-63a1.patch
+1473587-63a1.patch
+1475464-63a1.patch
+1452762-63a1.patch
+1475968-63a1.patch
 1448980-0-63a1.patch
 1448980-1-63a1.patch
 1476003-63a1.patch
@@ -5387,16 +5400,30 @@ NOBUG-20180712-typetraits-63a1.patch
 1476012-6-63a1.patch
 1476012-7-63a1.patch
 1476012-8-63a1.patch
+1418971-1-63a1.patch
 1476012-9-63a1.patch
-1470115-63a1.patch
+1469330-63a1.patch
+1469350-63a1.patch
+1440481-1-63a1.patch
+1440481-2-63a1.patch
+1474385-1-63a1.patch
+1474385-2-63a1.patch
+1474385-3-63a1.patch
+1474385-4-63a1.patch
+1471954-63a1.patch
+NOBUG-20180717-gcc-63a1.patch
 1476548-63a1.patch
 1476174-63a1.patch
 1476030-1-63a1.patch
-1463979-0-63a1.patch
-1463979-1-63a1.patch
 1476390-63a1.patch
 1476762-63a1.patch
 1476409-63a1.patch
+1476011-63a1.patch
+1463979-0-63a1.patch
+1463979-1-63a1.patch
+1473289-63a1.patch
+1470026-63a1.patch
+NOBUG-20180719-debugdoc-63a1.patch
 1426909-2-63a1.patch
 1476875-63a1.patch
 1471339-3-63a1.patch
@@ -5405,6 +5432,8 @@ NOBUG-20180712-typetraits-63a1.patch
 1354232-1-63a1.patch
 1354232-2-63a1.patch
 1354232-3-63a1.patch
+1476383-63a1.patch
+NOBUG-20180720-tokenstream-63a1.patch
 1476874-63a1.patch
 1379704-63a1.patch
 1264876-63a1.patch
@@ -5420,7 +5449,27 @@ NOBUG-20180712-typetraits-63a1.patch
 1476866-07-63a1.patch
 1476866-08-63a1.patch
 1467798-63a1.patch
-NOBUG-20180720-tokenstream-63a1.patch
+1476500-1-63a1.patch
+1476500-2-63a1.patch
+1476500-3-63a1.patch
+1456006-1-63a1.patch
+1456006-2-63a1.patch
+1477019-63a1.patch
+1475678-01-63a1.patch
+1475678-02-63a1.patch
+1475678-03-63a1.patch
+1475678-04-63a1.patch
+1475678-05-63a1.patch
+1475678-06-63a1.patch
+1475678-07-63a1.patch
+1475678-08-63a1.patch
+1475678-09-63a1.patch
+1475678-10-63a1.patch
+1475678-11-63a1.patch
+1475678-12-63a1.patch
+1475678-13-63a1.patch
+1475678-14-63a1.patch
+taken-out-stuff-comes-here.patch
 1475559-1-63a1.patch
 #mozilla-central_427635.patch
 #mozilla-central_427636.patch
@@ -5434,8 +5483,7 @@ NOBUG-20180720-tokenstream-63a1.patch
 1476866-13-63a1.patch
 1476866-14-63a1.patch
 1476866-15-63a1.patch
-1456006-1-63a1.patch
-1456006-2-63a1.patch
+1470115-63a1.patch
 1475943-63a1.patch
 1309552-63a1.patch
 1323381-63a1.patch
@@ -5568,8 +5616,6 @@ NOBUG-20180720-tokenstream-63a1.patch
 1481032-63a1.patch
 1480963-63a1.patch
 1480306-63a1.patch
-1440481-1-63a1.patch
-1440481-2-63a1.patch
 1477621-0-63a1.patch
 1477621-1-63a1.patch
 1477621-2-63a1.patch
@@ -6226,6 +6272,7 @@ NOBUG-20180824-buildsetting-63a1.patch
 1501218-65a1.patch
 1500154-65a1.patch
 1503537-65a1.patch
+1510247-65a1.patch
 1510183-65a1.patch
 1501224-1-65a1.patch
 1501224-2-65a1.patch
@@ -6612,11 +6659,15 @@ NOBUG-20190207-crashreporter-67a1.patch
 1538810-1-68a1.patch
 1538810-2-68a1.patch
 1405345-68a1.patch
+1539694-1-68a1.patch
+1539694-2-68a1.patch
+1539694-3-68a1.patch
 1544431-68a1.patch
 1544981-68a1.patch
 1545521-68a1.patch
 1545583-68a1.patch
 1544980-68a1.patch
+1543948-68a1.patch
 1546491-68a1.patch
 1547143-PARTIAL-hyphenation-only-68a1.patch
 1457669-68a1.patch
@@ -7046,8 +7097,10 @@ NOBUG-20190207-crashreporter-67a1.patch
 1494090-71a1.patch
 1562996-71a1.patch
 1433941-71a1.patch
+1549176-1-71a1.patch
 1586358-71a1.patch
 1584452-71a1.patch
+1586592-71a1.patch
 1587206-1-71a1.patch
 1583582-71a1.patch
 1587913-71a1.patch
@@ -8132,8 +8185,14 @@ NOBUG-removemobilethemes-25318.patch
 1861843-1-version-prebeta-mr-25319.patch
 1826791-121a1.patch
 1660223-11507.patch
+1864385-PARTIAL-11508.patch
+1867982-124a1.patch
+1878211-11508.patch
+1881093-11509.patch
 NOBUG-removessdks-25319.patch
 NOBUG-nukemozlinker-25319.patch
+1462261-3-25319.patch
+NOBUG-textrange-25319.patch
 PPPPPPP-check_stdcxx-warn.patch
 PPPPPPP-NOBUG-PLASTER-getrandom.patch
 PPPPPPP-NSSgetentropy.patch
@@ -8190,12 +8249,9 @@ TOP-NOBUG-PLASTER-fix-strip-25319.patch
 TOP-1707096-91a1.patch
 TOP-1846703-binutilsfix-11504.patch
 TOP-1859635-NSS3901-11506.patch
-TOP-NOBUG-killtelemetry-debugger-25319.patch
+TOP-1880562-NSS3902-11509.patch
 TOP-1864587-angle-11507.patch
-TOP-NOBUG-fixcompile-25319.patch
-TOP-NOBUG-backout1440761-25318.patch
 TOP-1472170-PARTIAL-NOTESTS-63a1.patch
-TOP-1539694-allsettled-68a1-25313.patch
 TOP-1466000-1-optchain-64a1-25313.patch
 TOP-1518661-3-67a1-25319.patch
 TOP-1566143-1to2-optchain-74a1-25313.patch
@@ -8205,7 +8261,11 @@ TOP-1611777-12-74a1-25313.patch
 TOP-NOBUG-optchain-baselinejit-25313.patch
 TOP-1629106-1-logicassign-25317.patch
 TOP-1629106-2-logicassign-25317.patch
+TOP-NOBUG-backout1440761-25318.patch
+TOP-NOBUG-killtelemetry-debugger-25319.patch
+TOP-NOBUG-fixcompile-25319.patch
 TOP-NOBUG-PLASTER-25319.patch
+TOP-NOBUG-JSFIXUPS-25319.patch
 TOP-NOBUG-REGEXP-01-Import-25318.patch
 TOP-NOBUG-REGEXP-02-1361856-1-dotall-76a1-25318.patch
 TOP-NOBUG-REGEXP-03-1537978-68a1-25318.patch
@@ -8255,15 +8315,7 @@ TOP-NOBUG-REGEXP-44-irregexp-25318.patch
 TOP-NOBUG-REGEXP-45-final-25318.patch
 TOP-NOBUG-REGEXP-46-fixes-25318.patch
 TOP-NOBUG-REGEXP-47-fixes-25319.patch
-1864385-PARTIAL-11508.patch
-1867982-124a1.patch
-1878211-11508.patch
-1881093-11509.patch
-TOP-1880562-NSS3902-11509.patch
-NOBUG-JSFIXUPS-25319.patch
-1462261-3-25319.patch
-1510247-65a1.patch
-NOBUG-textrange-25319.patch
+
 
 
 
@@ -8280,7 +8332,7 @@ ccccccc.fixit.patch
 1485615-2-63a1.patch
 L-1460489-6-63a1.patch
 
-
+1545354-68a1.patch
 
 
 
@@ -10075,11 +10127,6 @@ mozilla-central-push_557628.patch
 
 
 
-mozilla-central_469093.patch
-mozilla-central_469094.patch
-mozilla-central_469095.patch
-
-
 icu-patches-start
 
 
@@ -10993,96 +11040,28 @@ mozilla-central-push_425394.patch
 mozilla-central-push_426202.patch
 compile-error nsipidomwindow-end
 
-the-taken-out-stuff-start.patch
-I-am-here.patch
-aaaaaaaaaaaaaaaaaaaaaaa
-
 mozilla-central-push_426368.patch
-mozilla-central-push_426371.patch
-mozilla-central-push_426376.patch
 mozilla-central-push_426377.patch
 mozilla-central-push_426378.patch
-mozilla-central-push_426381.patch
-mozilla-central-push_426382.patch
-mozilla-central-push_426383.patch
-mozilla-central-push_426453.patch
-mozilla-central-push_426455.patch
-mozilla-central-push_426456.patch
 mozilla-central-push_426460.patch
-mozilla-central-push_426517.patch
-mozilla-central-push_426531.patch
-mozilla-central-push_426663.patch
 mozilla-central-push_426709.patch
-mozilla-central-push_426724.patch
-mozilla-central-push_426726.patch
-mozilla-central-push_426737.patch
-mozilla-central-push_426855.patch
-mozilla-central-push_426887.patch
 mozilla-central-push_426902.patch
 mozilla-central-push_426910.patch
-mozilla-central-push_426936.patch
-mozilla-central-push_426937.patch
-mozilla-central-push_426938.patch
-mozilla-central-push_426939.patch
-mozilla-central-push_426940.patch
-mozilla-central-push_426941.patch
-mozilla-central-push_426942.patch
-mozilla-central-push_426943.patch
-mozilla-central-push_426944.patch
-mozilla-central-push_426945.patch
-mozilla-central-push_426946.patch
+
+compile-error-webidl-element
+L-1418236-63a1.patch
+
+and-back-on-track
 mozilla-central-push_426967.patch
 mozilla-central-push_427019.patch
 mozilla-central-push_427020.patch
 mozilla-central-push_427021.patch
-mozilla-central-push_427025.patch
-mozilla-central-push_427026.patch
-mozilla-central-push_427027.patch
-mozilla-central-push_427028.patch
-mozilla-central-push_427029.patch
-mozilla-central-push_427030.patch
-mozilla-central-push_427031.patch
-mozilla-central-push_427032.patch
-mozilla-central-push_427033.patch
-mozilla-central-push_427051.patch
-mozilla-central-push_427052.patch
-mozilla-central-push_427113.patch
-mozilla-central-push_427126.patch
-mozilla-central-push_427127.patch
-mozilla-central-push_427170.patch
 mozilla-central-push_427183.patch
-mozilla-central-push_427361.patch
-mozilla-central-push_427363.patch
-mozilla-central-push_427428.patch
-mozilla-central-push_427431.patch
-mozilla-central-push_427432.patch
-mozilla-central-push_427433.patch
-mozilla-central-push_427434.patch
-mozilla-central-push_427435.patch
-mozilla-central-push_427436.patch
-mozilla-central-push_427437.patch
-mozilla-central-push_427438.patch
-mozilla-central-push_427439.patch
-mozilla-central-push_427441.patch
-mozilla-central-push_427442.patch
-mozilla-central-push_427443.patch
-mozilla-central-push_427445.patch
-mozilla-central-push_427446.patch
-mozilla-central-push_427510.patch
-mozilla-central-push_427579.patch
-mozilla-central-push_427580.patch
-mozilla-central-push_427581.patch
-mozilla-central-push_427582.patch
-mozilla-central-push_427583.patch
-mozilla-central-push_427584.patch
-mozilla-central-push_427585.patch
-mozilla-central-push_427586.patch
-mozilla-central-push_427587.patch
-mozilla-central-push_427588.patch
-mozilla-central-push_427589.patch
-mozilla-central-push_427590.patch
-mozilla-central-push_427591.patch
-mozilla-central-push_427594.patch
+
+the-taken-out-stuff-start.patch
+I-am-here.patch
+kkkkkkkkkkkkkkkkkkkkkkkkkkkkkk
+
 mozilla-central-push_427609.patch
 mozilla-central-push_427625.patch
 mozilla-central-push_427634.patch

frg/work-js/mozilla-release/patches/series-test

@@ -4394,6 +4394,7 @@ NOBUG-20180508-hashtable-62a1.patch
 1442481-1-62a1.patch
 1442481-2-62a1.patch
 1442481-3-62a1.patch
+1302449-62a1.patch
 1459568-62a1.patch
 1457703-2-62a1.patch
 1401927-62a1.patch
@@ -4578,7 +4579,7 @@ NOBUG-20180516-gccice-62a1.patch
 1442481-5-62a1.patch
 1442722-1-PARTIAL-62a1.patch
 1441876-62a1.patch
-NOBUG-20231031-formattingfixes-253.patch
+NOBUG-20231031-formattingfixes-25319.patch
 1462341-62a1.patch
 1461938-08-62a1.patch
 1461938-09-62a1.patch
@@ -4721,7 +4722,7 @@ NOBUG-20231031-formattingfixes-253.patch
 1454630-4-62a1.patch
 1435828-1-62a1.patch
 1435828-2-62a1.patch
-1464472-62a1.patch
+1464472-1-62a1.patch
 1464912-62a1.patch
 1047514-62a1.patch
 1464954-1-62a1.patch
@@ -5268,6 +5269,10 @@ NOBUG-20180629-testingfunctions-63a1.patch
 1472638-63a1.patch
 1471949-63a1.patch
 1469323-63a1.patch
+1473297-63a1.patch
+1418246-63a1.patch
+1473218-63a1.patch
+1472639-63a1.patch
 1447856-63a1.patch
 1471091-1-63a1.patch
 1471091-2-63a1.patch
@@ -5284,27 +5289,6 @@ NOBUG-20180629-testingfunctions-63a1.patch
 1474348-1-63a1.patch
 1474348-2-63a1.patch
 1466979-63a1.patch
-1474605-63a1.patch
-1468536-63a1.patch
-1474522-63a1.patch
-1052582-1-63a1.patch
-1052582-2-63a1.patch
-1460489-0-63a1.patch
-1460489-1-63a1.patch
-1460489-2-63a1.patch
-1460489-3-63a1.patch
-1460489-4-63a1.patch
-1460489-5-63a1.patch
-1460489-6-63a1.patch
-1472734-63a1.patch
-1473956-63a1.patch
-1473297-63a1.patch
-1472639-63a1.patch
-1471134-1-63a1.patch
-1471134-2-63a1.patch
-1471134-3-63a1.patch
-1471134-4-63a1.patch
-1471134-5-63a1.patch
 1468547-3only-63a1.patch
 1458109-63a1.patch
 1444171-1-63a1.patch
@@ -5325,25 +5309,55 @@ NOBUG-20180629-testingfunctions-63a1.patch
 1413922-2-PARTIAL-63a1.patch
 1443471-2-63a1.patch
 1474786-63a1.patch
-NOBUG-20180712-typetraits-63a1.patch
-1474871-63a1.patch
-1475067-63a1.patch
-1475058-63a1.patch
-1475210-63a1.patch
+1474605-63a1.patch
+1468536-63a1.patch
+1474522-63a1.patch
+1052582-1-63a1.patch
+1052582-2-63a1.patch
+1460489-0-63a1.patch
+1460489-1-63a1.patch
+1460489-2-63a1.patch
+1460489-3-63a1.patch
+1460489-4-63a1.patch
+1460489-5-63a1.patch
+1460489-6-63a1.patch
+1472734-63a1.patch
+1474904-63a1.patch
+1464829-2-63a1.patch
+1471134-1-63a1.patch
+1471134-2-63a1.patch
+1471134-3-63a1.patch
+1471134-4-63a1.patch
+1471134-5-63a1.patch
 1469044-1-63a1.patch
 1469044-2-63a1.patch
 1469044-3-63a1.patch
+NOBUG-20180710-floatregister-25319.patch
+1464472-2-63a1.patch
+1462939-2-63a1.patch
 1472291-1-63a1.patch
 1472291-2-63a1.patch
 1475461-1-63a1.patch
 1475461-2-63a1.patch
+NOBUG-20180712-typetraits-63a1.patch
+1474871-63a1.patch
+1475067-63a1.patch
+1475058-63a1.patch
+1475210-63a1.patch
 1475504-PARTIAL-63a1.patch
 1472716-1-63a1.patch
 1472490-63a1.patch
 1475649-1-63a1.patch
+1475226-63a1.patch
+1469223-63a1.patch
 1475642-63a1.patch
 1448976-63a1.patch
 1475650-63a1.patch
+1473956-63a1.patch
+1473587-63a1.patch
+1475464-63a1.patch
+1452762-63a1.patch
+1475968-63a1.patch
 1448980-0-63a1.patch
 1448980-1-63a1.patch
 1476003-63a1.patch
@@ -5386,16 +5400,30 @@ NOBUG-20180712-typetraits-63a1.patch
 1476012-6-63a1.patch
 1476012-7-63a1.patch
 1476012-8-63a1.patch
+1418971-1-63a1.patch
 1476012-9-63a1.patch
-1470115-63a1.patch
+1469330-63a1.patch
+1469350-63a1.patch
+1440481-1-63a1.patch
+1440481-2-63a1.patch
+1474385-1-63a1.patch
+1474385-2-63a1.patch
+1474385-3-63a1.patch
+1474385-4-63a1.patch
+1471954-63a1.patch
+NOBUG-20180717-gcc-63a1.patch
 1476548-63a1.patch
 1476174-63a1.patch
 1476030-1-63a1.patch
-1463979-0-63a1.patch
-1463979-1-63a1.patch
 1476390-63a1.patch
 1476762-63a1.patch
 1476409-63a1.patch
+1476011-63a1.patch
+1463979-0-63a1.patch
+1463979-1-63a1.patch
+1473289-63a1.patch
+1470026-63a1.patch
+NOBUG-20180719-debugdoc-63a1.patch
 1426909-2-63a1.patch
 1476875-63a1.patch
 1471339-3-63a1.patch
@@ -5404,6 +5432,8 @@ NOBUG-20180712-typetraits-63a1.patch
 1354232-1-63a1.patch
 1354232-2-63a1.patch
 1354232-3-63a1.patch
+1476383-63a1.patch
+NOBUG-20180720-tokenstream-63a1.patch
 1476874-63a1.patch
 1379704-63a1.patch
 1264876-63a1.patch
@@ -5419,7 +5449,26 @@ NOBUG-20180712-typetraits-63a1.patch
 1476866-07-63a1.patch
 1476866-08-63a1.patch
 1467798-63a1.patch
-NOBUG-20180720-tokenstream-63a1.patch
+1476500-1-63a1.patch
+1476500-2-63a1.patch
+1476500-3-63a1.patch
+1456006-1-63a1.patch
+1456006-2-63a1.patch
+1477019-63a1.patch
+1475678-01-63a1.patch
+1475678-02-63a1.patch
+1475678-03-63a1.patch
+1475678-04-63a1.patch
+1475678-05-63a1.patch
+1475678-06-63a1.patch
+1475678-07-63a1.patch
+1475678-08-63a1.patch
+1475678-09-63a1.patch
+1475678-10-63a1.patch
+1475678-11-63a1.patch
+1475678-12-63a1.patch
+1475678-13-63a1.patch
+1475678-14-63a1.patch
 1475559-1-63a1.patch
 1476866-09-63a1.patch
 1476866-10-63a1.patch
@@ -5428,8 +5477,7 @@ NOBUG-20180720-tokenstream-63a1.patch
 1476866-13-63a1.patch
 1476866-14-63a1.patch
 1476866-15-63a1.patch
-1456006-1-63a1.patch
-1456006-2-63a1.patch
+1470115-63a1.patch
 1475943-63a1.patch
 1309552-63a1.patch
 1323381-63a1.patch
@@ -5562,8 +5610,6 @@ NOBUG-20180720-tokenstream-63a1.patch
 1481032-63a1.patch
 1480963-63a1.patch
 1480306-63a1.patch
-1440481-1-63a1.patch
-1440481-2-63a1.patch
 1477621-0-63a1.patch
 1477621-1-63a1.patch
 1477621-2-63a1.patch
@@ -6159,6 +6205,7 @@ NOBUG-20180824-buildsetting-63a1.patch
 1501218-65a1.patch
 1500154-65a1.patch
 1503537-65a1.patch
+1510247-65a1.patch
 1510183-65a1.patch
 1501224-1-65a1.patch
 1501224-2-65a1.patch
@@ -6515,11 +6562,15 @@ NOBUG-20190207-crashreporter-67a1.patch
 1538810-1-68a1.patch
 1538810-2-68a1.patch
 1405345-68a1.patch
+1539694-1-68a1.patch
+1539694-2-68a1.patch
+1539694-3-68a1.patch
 1544431-68a1.patch
 1544981-68a1.patch
 1545521-68a1.patch
 1545583-68a1.patch
 1544980-68a1.patch
+1543948-68a1.patch
 1546491-68a1.patch
 1547143-PARTIAL-hyphenation-only-68a1.patch
 1457669-68a1.patch
@@ -6949,8 +7000,10 @@ NOBUG-20190207-crashreporter-67a1.patch
 1494090-71a1.patch
 1562996-71a1.patch
 1433941-71a1.patch
+1549176-1-71a1.patch
 1586358-71a1.patch
 1584452-71a1.patch
+1586592-71a1.patch
 1587206-1-71a1.patch
 1583582-71a1.patch
 1587913-71a1.patch
@@ -8035,8 +8088,14 @@ NOBUG-removemobilethemes-25318.patch
 1861843-1-version-prebeta-mr-25319.patch
 1826791-121a1.patch
 1660223-11507.patch
+1864385-PARTIAL-11508.patch
+1867982-124a1.patch
+1878211-11508.patch
+1881093-11509.patch
 NOBUG-removessdks-25319.patch
 NOBUG-nukemozlinker-25319.patch
+1462261-3-25319.patch
+NOBUG-textrange-25319.patch
 PPPPPPP-check_stdcxx-warn.patch
 PPPPPPP-NOBUG-PLASTER-getrandom.patch
 PPPPPPP-NSSgetentropy.patch
@@ -8093,12 +8152,9 @@ TOP-NOBUG-PLASTER-fix-strip-25319.patch
 TOP-1707096-91a1.patch
 TOP-1846703-binutilsfix-11504.patch
 TOP-1859635-NSS3901-11506.patch
-TOP-NOBUG-killtelemetry-debugger-25319.patch
+TOP-1880562-NSS3902-11509.patch
 TOP-1864587-angle-11507.patch
-TOP-NOBUG-fixcompile-25319.patch
-TOP-NOBUG-backout1440761-25318.patch
 TOP-1472170-PARTIAL-NOTESTS-63a1.patch
-TOP-1539694-allsettled-68a1-25313.patch
 TOP-1466000-1-optchain-64a1-25313.patch
 TOP-1518661-3-67a1-25319.patch
 TOP-1566143-1to2-optchain-74a1-25313.patch
@@ -8108,7 +8164,11 @@ TOP-1611777-12-74a1-25313.patch
 TOP-NOBUG-optchain-baselinejit-25313.patch
 TOP-1629106-1-logicassign-25317.patch
 TOP-1629106-2-logicassign-25317.patch
+TOP-NOBUG-backout1440761-25318.patch
+TOP-NOBUG-killtelemetry-debugger-25319.patch
+TOP-NOBUG-fixcompile-25319.patch
 TOP-NOBUG-PLASTER-25319.patch
+TOP-NOBUG-JSFIXUPS-25319.patch
 TOP-NOBUG-REGEXP-01-Import-25318.patch
 TOP-NOBUG-REGEXP-02-1361856-1-dotall-76a1-25318.patch
 TOP-NOBUG-REGEXP-03-1537978-68a1-25318.patch
@@ -8158,12 +8218,3 @@ TOP-NOBUG-REGEXP-44-irregexp-25318.patch
 TOP-NOBUG-REGEXP-45-final-25318.patch
 TOP-NOBUG-REGEXP-46-fixes-25318.patch
 TOP-NOBUG-REGEXP-47-fixes-25319.patch
-1864385-PARTIAL-11508.patch
-1867982-124a1.patch
-1878211-11508.patch
-1881093-11509.patch
-TOP-1880562-NSS3902-11509.patch
-NOBUG-JSFIXUPS-25319.patch
-1462261-3-25319.patch
-1510247-65a1.patch
-NOBUG-textrange-25319.patch