backportw

frg/work-js/mozilla-release/patches/1040316-63a1.patch

@@ -2,7 +2,7 @@
 # User Jeff Walden <jwalden@mit.edu>
 # Date 1534776284 25200
 # Node ID 6d10eda7f12de64044246e544d581537f30f8998
-# Parent  2487164942a9bf4856a73a596d368630930a5e33
+# Parent  7181270081f1575266dfd9d22dd0edf47ab505d2
 Bug 1040316 - Move AutoStableStringChars out of friendapi into public API.  r=jandem
 
 diff --git a/dom/base/nsJSUtils.h b/dom/base/nsJSUtils.h

frg/work-js/mozilla-release/patches/1346211-6-63a1.patch

@@ -2,7 +2,7 @@
 # User Andre Bargull <andre.bargull@gmail.com>
 # Date 1534500279 25200
 # Node ID 7b1a3a49547dc9564aaa6ecf90b919b66b7ada8d
-# Parent  dc10e4300c0519229d03cd66cb4abd10c357f896
+# Parent  5c24163be1b25b2ccd33341e35f504211c6e0e37
 Bug 1346211 - Part 6: Use ICU for all time zone computations when available. r=Waldo
 
 diff --git a/browser/components/resistfingerprinting/test/browser/browser_timezone.js b/browser/components/resistfingerprinting/test/browser/browser_timezone.js
@@ -191,27 +191,27 @@ diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctio
  
      uint32_t max_cnt;
      if (!ToUint32(cx, args.get(0), &max_cnt))
-@@ -5921,16 +6002,20 @@ gc::ZealModeHelpText),
-     JS_FN_HELP("objectGlobal", ObjectGlobal, 1, 0,
- "objectGlobal(obj)",
- "  Returns the object's global object or null if the object is a wrapper.\n"),
+@@ -5909,16 +5990,20 @@ gc::ZealModeHelpText),
+     JS_FN_HELP("isLegacyIterator", IsLegacyIterator, 1, 0,
+ "isLegacyIterator(value)",
+ "  Returns whether the value is considered is a legacy iterator.\n"),
  
-     JS_FN_HELP("assertCorrectRealm", AssertCorrectRealm, 0, 0,
- "assertCorrectRealm()",
- "  Asserts cx->realm matches callee->raelm.\n"),
+     JS_FN_HELP("getTimeZone", GetTimeZone, 0, 0,
+ "getTimeZone()",
+ "  Get the current time zone.\n"),
  
 +    JS_FN_HELP("getDefaultLocale", GetDefaultLocale, 0, 0,
 +"getDefaultLocale()",
 +"  Get the current default locale.\n"),
 +
-     JS_FN_HELP("baselineCompile", BaselineCompile, 2, 0,
- "baselineCompile([fun/code], forceDebugInstrumentation=false)",
- "  Baseline-compiles the given JS function or script.\n"
- "  Without arguments, baseline-compiles the caller's script; but note\n"
- "  that extra boilerplate is needed afterwards to cause the VM to start\n"
- "  running the jitcode rather than staying in the interpreter:\n"
- "    baselineCompile();  for (var i=0; i<1; i++) {} ...\n"
- "  The interpreter will enter the new jitcode at the loop header.\n"),
+     JS_FN_HELP("scriptedCallerGlobal", ScriptedCallerGlobal, 0, 0,
+ "scriptedCallerGlobal()",
+ "  Get the caller's global (or null). See JS::GetScriptedCallerGlobal.\n"),
+ 
+     JS_FN_HELP("objectGlobal", ObjectGlobal, 1, 0,
+ "objectGlobal(obj)",
+ "  Returns the object's global object or null if the object is a wrapper.\n"),
+ 
 @@ -5954,16 +6039,22 @@ static const JSFunctionSpecWithHelp Fuzz
  "  Returns an array of error notes."),
  
@@ -238,8 +238,7 @@ diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctio
 diff --git a/js/src/jsdate.cpp b/js/src/jsdate.cpp
 --- a/js/src/jsdate.cpp
 +++ b/js/src/jsdate.cpp
-@@ -31,16 +31,17 @@
- #include "jsnum.h"
+@@ -32,16 +32,17 @@
  #include "jstypes.h"
  #include "jsutil.h"
  
@@ -247,8 +246,8 @@ diff --git a/js/src/jsdate.cpp b/js/src/jsdate.cpp
  #include "js/Conversions.h"
  #include "js/Date.h"
  #include "js/Wrapper.h"
-+#include "util/Text.h"
  #include "util/StringBuffer.h"
++#include "util/Text.h"
  #include "vm/DateTime.h"
  #include "vm/GlobalObject.h"
  #include "vm/Interpreter.h"
@@ -256,6 +255,7 @@ diff --git a/js/src/jsdate.cpp b/js/src/jsdate.cpp
  #include "vm/JSObject.h"
  #include "vm/StringType.h"
  #include "vm/Time.h"
+ 
 @@ -416,16 +417,55 @@ JS::DayWithinYear(double time, double ye
  }
  

frg/work-js/mozilla-release/patches/1469019-fix-tests-63a1.patch

@@ -0,0 +1,48 @@
+# HG changeset patch
+# User Jason Orendorff <jorendorff@mozilla.com>
+# Date 1534271130 18000
+#      Tue Aug 14 13:25:30 2018 -0500
+# Node ID ed3c662bb21dd708601519540c99e939abb12cff
+# Parent  a1a469b6e2464a79b11aa223ce9d13c5ec015636
+Bug 1469019 - Object.fromEntries. r=evilpie, r=peterv
+
+diff --git a/js/src/tests/jstests.list b/js/src/tests/jstests.list
+--- a/js/src/tests/jstests.list
++++ b/js/src/tests/jstests.list
+@@ -450,36 +450,16 @@ skip script test262/built-ins/Function/p
+ skip script test262/built-ins/Function/prototype/toString/well-known-intrinsic-object-functions.js
+ 
+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1462745
+ skip script test262/annexB/language/function-code/block-decl-nested-blocks-with-fun-decl.js
+ 
+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1406171
+ skip script test262/built-ins/Reflect/ownKeys/return-on-corresponding-order-large-index.js
+ 
+-# https://bugzilla.mozilla.org/show_bug.cgi?id=1469019
+-skip script test262/built-ins/Object/fromEntries/to-property-key.js
+-skip script test262/built-ins/Object/fromEntries/iterator-closed-for-string-entry.js.js
+-skip script test262/built-ins/Object/fromEntries/supports-symbols.js
+-skip script test262/built-ins/Object/fromEntries/evaluation-order.js
+-skip script test262/built-ins/Object/fromEntries/length.js
+-skip script test262/built-ins/Object/fromEntries/uses-keys-not-iterator.js
+-skip script test262/built-ins/Object/fromEntries/iterator-not-closed-for-throwing-next.js
+-skip script test262/built-ins/Object/fromEntries/uses-define-semantics.js
+-skip script test262/built-ins/Object/fromEntries/key-order.js
+-skip script test262/built-ins/Object/fromEntries/iterator-closed-for-null-entry.js.js
+-skip script test262/built-ins/Object/fromEntries/simple-properties.js
+-skip script test262/built-ins/Object/fromEntries/empty-iterable.js
+-skip script test262/built-ins/Object/fromEntries/iterator-closed-for-throwing-entry-accessor.js
+-skip script test262/built-ins/Object/fromEntries/string-entry-object-succeeds.js
+-skip script test262/built-ins/Object/fromEntries/iterator-not-closed-for-throwing-done-accessor.js
+-skip script test262/built-ins/Object/fromEntries/prototype.js
+-skip script test262/built-ins/Object/fromEntries/iterator-closed-for-throwing-entry-key-tostring.js
+-skip script test262/built-ins/Object/fromEntries/name.js
+-
+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1291407
+ skip script test262/intl402/ListFormat/prototype/toStringTag/toString.js
+ skip script test262/intl402/ListFormat/prototype/toStringTag/toStringTag.js
+ 
+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1473228
+ skip script test262/intl402/RelativeTimeFormat/prototype/toStringTag/toString.js
+ skip script test262/intl402/RelativeTimeFormat/prototype/toStringTag/toStringTag.js
+ 

frg/work-js/mozilla-release/patches/1470921-63a1.patch

@@ -2,13 +2,13 @@
 # User Steve Fink <sfink@mozilla.com>
 # Date 1534463365 25200
 # Node ID a546df23e27d5247cdad10198fac095aadb7a1dd
-# Parent  c002a39ad10f6d5333f13d19e352a3ec54641852
+# Parent  e68495f68b70b9ced1a5030ebfb6a9668d2a69e7
 Bug 1470921 - Re-check whether nursery strings are enabled after collecting during allocation, r=jonco
 
 diff --git a/js/src/gc/Allocator.cpp b/js/src/gc/Allocator.cpp
 --- a/js/src/gc/Allocator.cpp
 +++ b/js/src/gc/Allocator.cpp
-@@ -144,18 +144,19 @@ GCRuntime::tryNewNurseryString(JSContext
+@@ -146,18 +146,19 @@ GCRuntime::tryNewNurseryString(JSContext
  
      Cell* cell = cx->nursery().allocateString(cx->zone(), thingSize, kind);
      if (cell)
@@ -33,7 +33,7 @@ diff --git a/js/src/gc/Allocator.cpp b/js/src/gc/Allocator.cpp
 diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
 --- a/js/src/jit/CodeGenerator.cpp
 +++ b/js/src/jit/CodeGenerator.cpp
-@@ -8441,17 +8441,18 @@ JitCompartment::generateStringConcatStub
+@@ -8688,17 +8688,18 @@ JitRealm::generateStringConcatStub(JSCon
      }
      masm.bind(&notInline);
  

frg/work-js/mozilla-release/patches/1473228-63a1.patch

@@ -2,13 +2,13 @@
 # User Ashley Hauck <khyperia@mozilla.com>
 # Date 1534871640 14400
 # Node ID c1e8bad5cea6ae5d0beccb7a242aff318c3a2eb3
-# Parent  827159ff7d580e165f32f4950acc2cd2da25decf
+# Parent  19a9250d71c3003cae82de794e64982a8f4eed31
 Bug 1473228 - Add @@toStringTag in Intl.RelativeTimeFormat. r=jorendorff
 
 diff --git a/js/src/builtin/intl/RelativeTimeFormat.cpp b/js/src/builtin/intl/RelativeTimeFormat.cpp
 --- a/js/src/builtin/intl/RelativeTimeFormat.cpp
 +++ b/js/src/builtin/intl/RelativeTimeFormat.cpp
-@@ -62,16 +62,21 @@ static const JSFunctionSpec relativeTime
+@@ -63,16 +63,21 @@ static const JSFunctionSpec relativeTime
  
  static const JSFunctionSpec relativeTimeFormat_methods[] = {
      JS_SELF_HOSTED_FN("resolvedOptions", "Intl_RelativeTimeFormat_resolvedOptions", 0, 0),
@@ -30,7 +30,7 @@ diff --git a/js/src/builtin/intl/RelativeTimeFormat.cpp b/js/src/builtin/intl/Re
  RelativeTimeFormat(JSContext* cx, unsigned argc, Value* vp)
  {
      CallArgs args = CallArgsFromVp(argc, vp);
-@@ -142,16 +147,19 @@ js::CreateRelativeTimeFormatPrototype(JS
+@@ -143,16 +148,19 @@ js::CreateRelativeTimeFormatPrototype(JS
          return nullptr;
  
      if (!JS_DefineFunctions(cx, ctor, relativeTimeFormat_static_methods))
@@ -50,31 +50,27 @@ diff --git a/js/src/builtin/intl/RelativeTimeFormat.cpp b/js/src/builtin/intl/Re
  }
  
  /* static */ bool
-diff --git a/js/src/tests/jstests.list.1473228.later b/js/src/tests/jstests.list.1473228.later
-new file mode 100644
---- /dev/null
-+++ b/js/src/tests/jstests.list.1473228.later
-@@ -0,0 +1,23 @@
-+--- jstests.list
-++++ jstests.list
-+@@ -447,20 +447,16 @@ skip script test262/annexB/language/func
-+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1406171
-+ skip script test262/built-ins/Reflect/ownKeys/return-on-corresponding-order-large-index.js
-+ 
-+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1291407
-+ skip script test262/intl402/ListFormat/prototype/toStringTag/toString.js
-+ skip script test262/intl402/ListFormat/prototype/toStringTag/toStringTag.js
-+ 
-+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1473228
-+-skip script test262/intl402/RelativeTimeFormat/prototype/toStringTag/toString.js
-+-skip script test262/intl402/RelativeTimeFormat/prototype/toStringTag/toStringTag.js
-+-
-+-# https://bugzilla.mozilla.org/show_bug.cgi?id=1473228
-+ skip script test262/intl402/Segmenter/prototype/toStringTag/toString.js
-+ skip script test262/intl402/Segmenter/prototype/toStringTag/toStringTag.js
-+ 
-+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1473229
-+ skip include test262/intl402/RelativeTimeFormat/prototype/formatToParts/jstests.list
-+ 
-+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1483545
-+ skip script test262/intl402/RelativeTimeFormat/prototype/format/en-us-numeric-always.js
+diff --git a/js/src/tests/jstests.list b/js/src/tests/jstests.list
+--- a/js/src/tests/jstests.list
++++ b/js/src/tests/jstests.list
+@@ -455,20 +455,16 @@ skip script test262/annexB/language/func
+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1406171
+ skip script test262/built-ins/Reflect/ownKeys/return-on-corresponding-order-large-index.js
+ 
+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1291407
+ skip script test262/intl402/ListFormat/prototype/toStringTag/toString.js
+ skip script test262/intl402/ListFormat/prototype/toStringTag/toStringTag.js
+ 
+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1473228
+-skip script test262/intl402/RelativeTimeFormat/prototype/toStringTag/toString.js
+-skip script test262/intl402/RelativeTimeFormat/prototype/toStringTag/toStringTag.js
+-
+-# https://bugzilla.mozilla.org/show_bug.cgi?id=1473228
+ skip script test262/intl402/Segmenter/prototype/toStringTag/toString.js
+ skip script test262/intl402/Segmenter/prototype/toStringTag/toStringTag.js
+ 
+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1473229
+ skip include test262/intl402/RelativeTimeFormat/prototype/formatToParts/jstests.list
+ 
+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1483545
+ skip script test262/intl402/RelativeTimeFormat/prototype/format/en-us-numeric-always.js

frg/work-js/mozilla-release/patches/mozilla-central-push_433069.patch → frg/work-js/mozilla-release/patches/1479962-63a1.patch

@@ -3,7 +3,7 @@
 # Date 1532476363 25200
 #      Tue Jul 24 16:52:43 2018 -0700
 # Node ID 5b595406855ef0ab1d65e43a408a252b4a476748
-# Parent  aedd937e5d6a64b48b1458e408e2124376c15409
+# Parent  7cefd85eeca77c1b0d45cc094e6f9ba221411955
 Bug 1479962 - Add JS_HAZ_ROOTED_BASE for AutoGCRooter, which assumes all descendants are rooted, r=jonco
 
 diff --git a/js/public/GCAnnotations.h b/js/public/GCAnnotations.h
@@ -32,8 +32,8 @@ diff --git a/js/public/GCAnnotations.h b/js/public/GCAnnotations.h
  // pointer when it holds an exception (and it does its own rooting,
  // conditionally.)
  # define JS_HAZ_NON_GC_POINTER __attribute__((tag("Suppressed GC Pointer")))
-@@ -47,16 +53,17 @@
- # define JS_HAZ_CAN_RUN_SCRIPT __attribute__((tag("Can run script")))
+@@ -43,15 +49,16 @@
+ # define JS_HAZ_GC_SUPPRESSED __attribute__((tag("Suppress GC")))
  
  #else
  
@@ -45,7 +45,6 @@ diff --git a/js/public/GCAnnotations.h b/js/public/GCAnnotations.h
  # define JS_HAZ_NON_GC_POINTER
  # define JS_HAZ_GC_CALL
  # define JS_HAZ_GC_SUPPRESSED
- # define JS_HAZ_CAN_RUN_SCRIPT
  
  #endif
  
@@ -53,7 +52,7 @@ diff --git a/js/public/GCAnnotations.h b/js/public/GCAnnotations.h
 diff --git a/js/public/RootingAPI.h b/js/public/RootingAPI.h
 --- a/js/public/RootingAPI.h
 +++ b/js/public/RootingAPI.h
-@@ -940,17 +940,17 @@ class JS_PUBLIC_API(AutoGCRooter)
+@@ -937,17 +937,17 @@ class JS_PUBLIC_API(AutoGCRooter)
       * Discriminates actual subclass of this being used. The meaning is
       * indicated by the corresponding value in the Tag enum.
       */

frg/work-js/mozilla-release/patches/mozilla-central-push_431587.patch → frg/work-js/mozilla-release/patches/1480524-1-63a1.patch

@@ -3,7 +3,7 @@
 # Date 1533138583 14400
 #      Wed Aug 01 11:49:43 2018 -0400
 # Node ID 2a09332be9ac7cc7c2b3bd224ad4be8bb408af96
-# Parent  34f564520a234b4318cce5be5c86adcd2be8187b
+# Parent  febcf6091b3ef7172b1cab603a8c594888ca7e8b
 Bug 1480524 - [Part 1] Use CacheIR version of NewObject for Baseline r=jandem
 
 diff --git a/js/src/jit/BaselineCacheIRCompiler.cpp b/js/src/jit/BaselineCacheIRCompiler.cpp
@@ -30,7 +30,7 @@ diff --git a/js/src/jit/BaselineCacheIRCompiler.cpp b/js/src/jit/BaselineCacheIR
 diff --git a/js/src/jit/CacheIR.cpp b/js/src/jit/CacheIR.cpp
 --- a/js/src/jit/CacheIR.cpp
 +++ b/js/src/jit/CacheIR.cpp
-@@ -5593,8 +5593,60 @@ BinaryArithIRGenerator::tryAttachBoolean
+@@ -5590,8 +5590,60 @@ BinaryArithIRGenerator::tryAttachBoolean
          break;
        default:
          MOZ_CRASH("Unhandled op in tryAttachInt32");
@@ -386,7 +386,7 @@ diff --git a/js/src/jit/CacheIRCompiler.h b/js/src/jit/CacheIRCompiler.h
 diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
 --- a/js/src/jit/CodeGenerator.cpp
 +++ b/js/src/jit/CodeGenerator.cpp
-@@ -423,16 +423,17 @@ CodeGenerator::visitOutOfLineICFallback(
+@@ -422,16 +422,17 @@ CodeGenerator::visitOutOfLineICFallback(
  
          masm.jump(ool->rejoin());
          return;
@@ -449,9 +449,9 @@ diff --git a/js/src/jit/IonIC.cpp b/js/src/jit/IonIC.cpp
 diff --git a/js/src/jit/JitRealm.h b/js/src/jit/JitRealm.h
 --- a/js/src/jit/JitRealm.h
 +++ b/js/src/jit/JitRealm.h
-@@ -158,16 +158,19 @@ class JitRuntime
-                             mozilla::recordreplay::Behavior::DontPreserve> NumFinishedBuildersType;
-     NumFinishedBuildersType numFinishedBuilders_;
+@@ -156,16 +156,19 @@ class JitRuntime
+     // thread state lock, but may be read from at other times.
+     mozilla::Atomic<size_t> numFinishedBuilders_;
  
      // List of Ion compilation waiting to get linked.
      using IonBuilderList = mozilla::LinkedList<js::jit::IonBuilder>;
@@ -469,7 +469,7 @@ diff --git a/js/src/jit/JitRealm.h b/js/src/jit/JitRealm.h
      void generateBailoutTailStub(MacroAssembler& masm, Label* bailoutTail);
      void generateEnterJIT(JSContext* cx, MacroAssembler& masm);
      void generateArgumentsRectifier(MacroAssembler& masm);
-@@ -324,16 +327,20 @@ class JitRuntime
+@@ -322,16 +325,20 @@ class JitRuntime
      IonBuilderList& ionLazyLinkList(JSRuntime* rt);
  
      size_t ionLazyLinkListSize() const {
@@ -493,7 +493,7 @@ diff --git a/js/src/jit/JitRealm.h b/js/src/jit/JitRealm.h
 diff --git a/js/src/jit/MacroAssembler.cpp b/js/src/jit/MacroAssembler.cpp
 --- a/js/src/jit/MacroAssembler.cpp
 +++ b/js/src/jit/MacroAssembler.cpp
-@@ -3320,20 +3320,27 @@ MacroAssembler::branchIfObjGroupHasNoAdd
+@@ -3386,20 +3386,27 @@ MacroAssembler::branchIfObjGroupHasNoAdd
                ImmWord(0),
                label);
  }

frg/work-js/mozilla-release/patches/mozilla-central-push_432455.patch → frg/work-js/mozilla-release/patches/1483183-1-63a1.patch

@@ -3,7 +3,7 @@
 # Date 1534379588 25200
 #      Wed Aug 15 17:33:08 2018 -0700
 # Node ID 79082cb95664b59e9507d7099854bae30caa4921
-# Parent  2e949e5a9a62d0db0d33833e1e875f12f2969ac4
+# Parent  58dd5390d1809d9f95d6cb80db8f05c6b0f338e3
 Bug 1483183 - Discard pending exception during CCW GetProp IC failure r=tcampbell
 
 diff --git a/js/src/jit-test/tests/cacheir/bug1483183.js b/js/src/jit-test/tests/cacheir/bug1483183.js
@@ -22,7 +22,7 @@ new file mode 100644
 diff --git a/js/src/jit/CacheIR.cpp b/js/src/jit/CacheIR.cpp
 --- a/js/src/jit/CacheIR.cpp
 +++ b/js/src/jit/CacheIR.cpp
-@@ -1136,18 +1136,20 @@ GetPropIRGenerator::tryAttachCrossCompar
+@@ -1134,18 +1134,20 @@ GetPropIRGenerator::tryAttachCrossCompar
      // If we allowed different zones we would have to wrap strings.
      if (unwrapped->compartment()->zone() != cx_->compartment()->zone())
          return false;
@@ -30,7 +30,7 @@ diff --git a/js/src/jit/CacheIR.cpp b/js/src/jit/CacheIR.cpp
      // Take the unwrapped object's global, and wrap in a
      // this-compartment wrapper. This is what will be stored in the IC
      // keep the compartment alive.
-     RootedObject wrappedTargetGlobal(cx_, &unwrapped->nonCCWGlobal());
+     RootedObject wrappedTargetGlobal(cx_, &unwrapped->deprecatedGlobal());
 -    if (!cx_->compartment()->wrap(cx_, &wrappedTargetGlobal))
 -        return false;
 +    if (!cx_->compartment()->wrap(cx_, &wrappedTargetGlobal)) {

frg/work-js/mozilla-release/patches/1483374-63a1.patch

@@ -1,8 +1,9 @@
 # HG changeset patch
 # User Jeff Walden <jwalden@mit.edu>
 # Date 1534453062 25200
+#      Thu Aug 16 13:57:42 2018 -0700
 # Node ID e0e6b77fb800d5b81c5b68af3dde3c4beee68d7a
-# Parent  30e8eebe3b8ad87e259dcb99457dde6fbd5c13de
+# Parent  dc7413a25676e83242f0d1e539bf36015bb14550
 Bug 1483374 - Intl.NumberFormat shouldn't deliberately conflate -0 with +0.  r=anba
 
 diff --git a/js/src/builtin/intl/NumberFormat.cpp b/js/src/builtin/intl/NumberFormat.cpp
@@ -109,33 +110,29 @@ diff --git a/js/src/builtin/intl/NumberFormat.cpp b/js/src/builtin/intl/NumberFo
          return false;
  
      // First, vacuum up fields in the overall formatted string.
-diff --git a/js/src/tests/jstests.list.1483374.later b/js/src/tests/jstests.list.1483374.later
-new file mode 100644
---- /dev/null
-+++ b/js/src/tests/jstests.list.1483374.later
-@@ -0,0 +1,22 @@
-+--- jstests.list
-++++ jstests.list
-+@@ -469,19 +469,16 @@ skip script test262/intl402/RelativeTime
-+ 
-+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1473228
-+ skip script test262/intl402/Segmenter/prototype/toStringTag/toString.js
-+ skip script test262/intl402/Segmenter/prototype/toStringTag/toStringTag.js
-+ 
-+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1473229
-+ skip include test262/intl402/RelativeTimeFormat/prototype/formatToParts/jstests.list
-+ 
-+-# https://bugzilla.mozilla.org/show_bug.cgi?id=1483374
-+-skip script test262/intl402/NumberFormat/prototype/format/format-negative-numbers.js
-+-
-+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1483545
-+ skip script test262/intl402/RelativeTimeFormat/prototype/format/en-us-numeric-always.js
-+ skip script test262/intl402/RelativeTimeFormat/prototype/format/en-us-numeric-auto.js
-+ skip script test262/intl402/RelativeTimeFormat/prototype/format/en-us-style-short.js
-+ skip script test262/intl402/RelativeTimeFormat/prototype/format/pl-pl-style-long.js
-+ skip script test262/intl402/RelativeTimeFormat/prototype/format/pl-pl-style-narrow.js
-+ 
-+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1473230
+diff --git a/js/src/tests/jstests.list b/js/src/tests/jstests.list
+--- a/js/src/tests/jstests.list
++++ b/js/src/tests/jstests.list
+@@ -469,19 +469,16 @@ skip script test262/intl402/RelativeTime
+ 
+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1473228
+ skip script test262/intl402/Segmenter/prototype/toStringTag/toString.js
+ skip script test262/intl402/Segmenter/prototype/toStringTag/toStringTag.js
+ 
+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1473229
+ skip include test262/intl402/RelativeTimeFormat/prototype/formatToParts/jstests.list
+ 
+-# https://bugzilla.mozilla.org/show_bug.cgi?id=1483374
+-skip script test262/intl402/NumberFormat/prototype/format/format-negative-numbers.js
+-
+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1483545
+ skip script test262/intl402/RelativeTimeFormat/prototype/format/en-us-numeric-always.js
+ skip script test262/intl402/RelativeTimeFormat/prototype/format/en-us-numeric-auto.js
+ skip script test262/intl402/RelativeTimeFormat/prototype/format/en-us-style-short.js
+ skip script test262/intl402/RelativeTimeFormat/prototype/format/pl-pl-style-long.js
+ skip script test262/intl402/RelativeTimeFormat/prototype/format/pl-pl-style-narrow.js
+ 
+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1473230
 diff --git a/js/src/tests/non262/Intl/NumberFormat/formatToParts.js b/js/src/tests/non262/Intl/NumberFormat/formatToParts.js
 --- a/js/src/tests/non262/Intl/NumberFormat/formatToParts.js
 +++ b/js/src/tests/non262/Intl/NumberFormat/formatToParts.js

frg/work-js/mozilla-release/patches/1483380-2-63a1.patch

@@ -0,0 +1,80 @@
+# HG changeset patch
+# User Jason Orendorff <jorendorff@mozilla.com>
+# Date 1534545772 18000
+#      Fri Aug 17 17:42:52 2018 -0500
+# Node ID 66a2d0d0f6ed7ea7cc0060e3005016aeb66cc575
+# Parent  559fc5f49a4906503414b138f83c1ffa5d3bac25
+Bug 1483380 - Mark some test262 tests slow. r=sfink
+
+diff --git a/js/src/devtools/automation/cgc-jstests-slow.txt.1483380.later b/js/src/devtools/automation/cgc-jstests-slow.txt.1483380.later
+new file mode 100644
+--- /dev/null
++++ b/js/src/devtools/automation/cgc-jstests-slow.txt.1483380.later
+@@ -0,0 +1,31 @@
++--- cgc-jstests-slow.txt
+++++ cgc-jstests-slow.txt
++@@ -58,20 +58,20 @@ non262/regress/regress-360969-02.js
++ non262/regress/regress-360969-03.js
++ non262/regress/regress-360969-04.js
++ non262/regress/regress-360969-05.js
++ non262/regress/regress-360969-06.js
++ non262/extensions/regress-477187.js
++ non262/regress/regress-452498-052-a.js
++ non262/extensions/clone-complex-object.js
++ non262/extensions/clone-object-deep.js
++-test262/built-ins/RegExp/CharacterClassEscapes/character-class-word-class-escape-flags-u.js
+++test262/built-ins/RegExp/CharacterClassEscapes/character-class-digit-class-escape-flags-u.js
+++test262/built-ins/RegExp/CharacterClassEscapes/character-class-digit-class-escape-plus-quantifier-flags-u.js
+++test262/built-ins/RegExp/CharacterClassEscapes/character-class-non-digit-class-escape-flags-u.js
++ test262/built-ins/RegExp/CharacterClassEscapes/character-class-non-digit-class-escape-plus-quantifier-flags-u.js
++-test262/built-ins/RegExp/CharacterClassEscapes/character-class-non-digit-class-escape-flags-u.js
++-test262/built-ins/RegExp/CharacterClassEscapes/character-class-whitespace-class-escape-flags-u.js
+++test262/built-ins/RegExp/CharacterClassEscapes/character-class-non-whitespace-class-escape-flags-u.js
++ test262/built-ins/RegExp/CharacterClassEscapes/character-class-non-whitespace-class-escape-plus-quantifier-flags-u.js
++-test262/built-ins/RegExp/CharacterClassEscapes/character-class-digit-class-escape-flags-u.js
+++test262/built-ins/RegExp/CharacterClassEscapes/character-class-non-word-class-escape-flags-u.js
++ test262/built-ins/RegExp/CharacterClassEscapes/character-class-non-word-class-escape-plus-quantifier-flags-u.js
++-test262/built-ins/RegExp/CharacterClassEscapes/character-class-digit-class-escape-plus-quantifier-flags-u.js
+++test262/built-ins/RegExp/CharacterClassEscapes/character-class-whitespace-class-escape-flags-u.js
+++test262/built-ins/RegExp/CharacterClassEscapes/character-class-whitespace-class-escape-plus-quantifier-flags-u.js
+++test262/built-ins/RegExp/CharacterClassEscapes/character-class-word-class-escape-flags-u.js
++ test262/built-ins/RegExp/CharacterClassEscapes/character-class-word-class-escape-plus-quantifier-flags-u.js
++-test262/built-ins/RegExp/CharacterClassEscapes/character-class-whitespace-class-escape-plus-quantifier-flags-u.js
++-test262/built-ins/RegExp/CharacterClassEscapes/character-class-non-whitespace-class-escape-flags-u.js
++-test262/built-ins/RegExp/CharacterClassEscapes/character-class-non-word-class-escape-flags-u.js
+diff --git a/js/src/tests/jstests.list b/js/src/tests/jstests.list
+--- a/js/src/tests/jstests.list
++++ b/js/src/tests/jstests.list
+@@ -1,19 +1,31 @@
+ # Manifest entries for imported test suites whose individual test cases
+ # we don't want to change.
+ 
+ # Skip the folder with tests for the scripts
+ skip include test/jstests.list
+ 
+ skip script non262/String/normalize-generateddata-input.js # input data for other test
+ 
+-# Times out on arm and cgc builds.
++# Timeouts on arm and cgc builds.
+ slow script test262/built-ins/decodeURI/S15.1.3.1_A2.5_T1.js
+ slow script test262/built-ins/decodeURIComponent/S15.1.3.2_A2.5_T1.js
++slow script test262/built-ins/RegExp/CharacterClassEscapes/character-class-digit-class-escape-flags-u.js
++slow script test262/built-ins/RegExp/CharacterClassEscapes/character-class-digit-class-escape-plus-quantifier-flags-u.js
++slow script test262/built-ins/RegExp/CharacterClassEscapes/character-class-non-digit-class-escape-flags-u.js
++slow script test262/built-ins/RegExp/CharacterClassEscapes/character-class-non-digit-class-escape-plus-quantifier-flags-u.js
++slow script test262/built-ins/RegExp/CharacterClassEscapes/character-class-non-whitespace-class-escape-flags-u.js
++slow script test262/built-ins/RegExp/CharacterClassEscapes/character-class-non-whitespace-class-escape-plus-quantifier-flags-u.js
++slow script test262/built-ins/RegExp/CharacterClassEscapes/character-class-non-word-class-escape-flags-u.js
++slow script test262/built-ins/RegExp/CharacterClassEscapes/character-class-non-word-class-escape-plus-quantifier-flags-u.js
++slow script test262/built-ins/RegExp/CharacterClassEscapes/character-class-whitespace-class-escape-flags-u.js
++slow script test262/built-ins/RegExp/CharacterClassEscapes/character-class-whitespace-class-escape-plus-quantifier-flags-u.js
++slow script test262/built-ins/RegExp/CharacterClassEscapes/character-class-word-class-escape-flags-u.js
++slow script test262/built-ins/RegExp/CharacterClassEscapes/character-class-word-class-escape-plus-quantifier-flags-u.js
+ 
+ 
+ #################################################################
+ # Tests disabled due to intentional alternative implementations #
+ #################################################################
+ 
+ # Legacy "caller" and "arguments" implemented as accessor properties on Function.prototype.
+ skip script test262/built-ins/Function/prototype/restricted-property-arguments.js

frg/work-js/mozilla-release/patches/1483548-65a1.patch

@@ -2,13 +2,13 @@
 # User Andre Bargull <andre.bargull@gmail.com>
 # Date 1540408508 25200
 # Node ID fd95f65239ed4bfeb679cc35d627883eddf738d2
-# Parent  c681b8a2fadff57ff7a7d67dc3c6845fd813f9b6
+# Parent  695a21b24b519bb12d995dbcc0fa94b584c4e1e0
 Bug 1483548: Throw a RangeError if the input value for Intl.RelativeTimeFormat is not finite. r=jorendorff
 
 diff --git a/js/src/builtin/intl/DateTimeFormat.cpp b/js/src/builtin/intl/DateTimeFormat.cpp
 --- a/js/src/builtin/intl/DateTimeFormat.cpp
 +++ b/js/src/builtin/intl/DateTimeFormat.cpp
-@@ -891,17 +891,18 @@ js::intl_FormatDateTime(JSContext* cx, u
+@@ -906,17 +906,18 @@ js::intl_FormatDateTime(JSContext* cx, u
      MOZ_ASSERT(args[1].isNumber());
      MOZ_ASSERT(args[2].isBoolean());
  
@@ -57,7 +57,7 @@ diff --git a/js/src/builtin/intl/RelativeTimeFormat.js b/js/src/builtin/intl/Rel
 diff --git a/js/src/js.msg b/js/src/js.msg
 --- a/js/src/js.msg
 +++ b/js/src/js.msg
-@@ -483,17 +483,17 @@ MSG_DEF(JSMSG_DEBUG_NO_BINARY_SOURCE,  0
+@@ -494,17 +494,17 @@ MSG_DEF(JSMSG_DEBUG_NO_BINARY_SOURCE,  0
  
  // Testing functions
  MSG_DEF(JSMSG_TESTING_SCRIPTS_ONLY, 0, JSEXN_TYPEERR, "only works on scripts")
@@ -79,7 +79,7 @@ diff --git a/js/src/js.msg b/js/src/js.msg
 diff --git a/js/src/tests/jstests.list b/js/src/tests/jstests.list
 --- a/js/src/tests/jstests.list
 +++ b/js/src/tests/jstests.list
-@@ -414,18 +414,18 @@ skip-if(!xulRuntime.shell) script test26
+@@ -388,18 +388,18 @@ skip-if(!xulRuntime.shell) script test26
  skip-if(!xulRuntime.shell) script test262/built-ins/Atomics/wake/wake-negative.js
  skip-if(!xulRuntime.shell) script test262/built-ins/Atomics/wake/wake-nan.js
  skip-if(!xulRuntime.shell) script test262/built-ins/Atomics/wake/wake-two.js
@@ -100,56 +100,51 @@ diff --git a/js/src/tests/jstests.list b/js/src/tests/jstests.list
  # https://bugzilla.mozilla.org/show_bug.cgi?id=1407587
  skip script test262/language/expressions/assignment/destructuring/keyed-destructuring-property-reference-target-evaluation-order.js
  skip script test262/language/expressions/assignment/destructuring/iterator-destructuring-property-reference-target-evaluation-order.js
-diff --git a/js/src/tests/jstests.list.1483548.later b/js/src/tests/jstests.list.1483548.later
-new file mode 100644
---- /dev/null
-+++ b/js/src/tests/jstests.list.1483548.later
-@@ -0,0 +1,45 @@
-+--- jstests.list
-++++ jstests.list
-+@@ -426,41 +424,30 @@ skip script test262/built-ins/DataView/l
-+ skip script test262/built-ins/Function/prototype/toString/well-known-intrinsic-object-functions.js
-+ 
-+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1462745
-+ skip script test262/annexB/language/function-code/block-decl-nested-blocks-with-fun-decl.js
-+ 
-+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1406171
-+ skip script test262/built-ins/Reflect/ownKeys/return-on-corresponding-order-large-index.js
-+ 
-+-# https://bugzilla.mozilla.org/show_bug.cgi?id=1291407
-+-skip script test262/intl402/ListFormat/prototype/toStringTag/toString.js
-+-skip script test262/intl402/ListFormat/prototype/toStringTag/toStringTag.js
-+-
-+-# https://bugzilla.mozilla.org/show_bug.cgi?id=1473228
-+-skip script test262/intl402/Segmenter/prototype/toStringTag/toString.js
-+-skip script test262/intl402/Segmenter/prototype/toStringTag/toStringTag.js
-+-
-+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1473229
-+ skip include test262/intl402/RelativeTimeFormat/prototype/formatToParts/jstests.list
-+ 
-+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1483545
-+ skip script test262/intl402/RelativeTimeFormat/prototype/format/en-us-numeric-always.js
-+ skip script test262/intl402/RelativeTimeFormat/prototype/format/en-us-numeric-auto.js
-+ skip script test262/intl402/RelativeTimeFormat/prototype/format/en-us-style-short.js
-+ skip script test262/intl402/RelativeTimeFormat/prototype/format/pl-pl-style-long.js
-+ skip script test262/intl402/RelativeTimeFormat/prototype/format/pl-pl-style-narrow.js
-+ skip script test262/intl402/RelativeTimeFormat/prototype/format/pl-pl-style-short.js
-+ 
-+-# https://bugzilla.mozilla.org/show_bug.cgi?id=1473230
-++# https://bugzilla.mozilla.org/show_bug.cgi?id=1473588
-+ skip script test262/intl402/RelativeTimeFormat/prototype/format/unit-plural.js
-+ 
-+-# https://bugzilla.mozilla.org/show_bug.cgi?id=1483548
-+-skip script test262/intl402/RelativeTimeFormat/prototype/format/value-non-finite.js
-+-
-+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1499933
-+ skip script test262/intl402/DateTimeFormat/prototype/resolvedOptions/order.js
-+ skip script test262/intl402/PluralRules/prototype/resolvedOptions/order.js
-+ skip script test262/intl402/NumberFormat/prototype/resolvedOptions/order.js
-+ 
-+ 
-+ ###########################################################
-+ # Tests disabled due to issues in test262 importer script #
+@@ -427,43 +427,32 @@ skip script test262/built-ins/Function/p
+ skip script test262/built-ins/Function/prototype/toString/well-known-intrinsic-object-functions.js
+ 
+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1462745
+ skip script test262/annexB/language/function-code/block-decl-nested-blocks-with-fun-decl.js
+ 
+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1406171
+ skip script test262/built-ins/Reflect/ownKeys/return-on-corresponding-order-large-index.js
+ 
+-# https://bugzilla.mozilla.org/show_bug.cgi?id=1291407
+-skip script test262/intl402/ListFormat/prototype/toStringTag/toString.js
+-skip script test262/intl402/ListFormat/prototype/toStringTag/toStringTag.js
+-
+-# https://bugzilla.mozilla.org/show_bug.cgi?id=1473228
+-skip script test262/intl402/Segmenter/prototype/toStringTag/toString.js
+-skip script test262/intl402/Segmenter/prototype/toStringTag/toStringTag.js
+-
+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1473229
+ skip include test262/intl402/RelativeTimeFormat/prototype/formatToParts/jstests.list
+ 
+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1483545
+ skip script test262/intl402/RelativeTimeFormat/prototype/format/en-us-numeric-always.js
+ skip script test262/intl402/RelativeTimeFormat/prototype/format/en-us-numeric-auto.js
+ skip script test262/intl402/RelativeTimeFormat/prototype/format/en-us-style-short.js
+ skip script test262/intl402/RelativeTimeFormat/prototype/format/pl-pl-style-long.js
+ skip script test262/intl402/RelativeTimeFormat/prototype/format/pl-pl-style-narrow.js
+ 
+-# https://bugzilla.mozilla.org/show_bug.cgi?id=1473230
++# https://bugzilla.mozilla.org/show_bug.cgi?id=1473588
+ skip script test262/intl402/RelativeTimeFormat/prototype/format/unit-plural.js
+ 
+ # https://bugzilla.mozilla.org/show_bug.cgi?id=1483547
+ skip script test262/intl402/RelativeTimeFormat/prototype/format/pl-pl-style-short.js
+ 
+-# https://bugzilla.mozilla.org/show_bug.cgi?id=1483548
+-skip script test262/intl402/RelativeTimeFormat/prototype/format/value-non-finite.js
+-
+ 
+ ###########################################################
+ # Tests disabled due to issues in test262 importer script #
+ ###########################################################
+ 
+ # test262 importer merges all includes in a per directory shell.js file, breaking this harness test case.
+ skip script test262/harness/detachArrayBuffer.js
+ 
 diff --git a/js/src/tests/non262/Intl/RelativeTimeFormat/format.js b/js/src/tests/non262/Intl/RelativeTimeFormat/format.js
 --- a/js/src/tests/non262/Intl/RelativeTimeFormat/format.js
 +++ b/js/src/tests/non262/Intl/RelativeTimeFormat/format.js

frg/work-js/mozilla-release/patches/mozilla-central-push_432275.patch → frg/work-js/mozilla-release/patches/1483999-1-63a1.patch

@@ -3,13 +3,13 @@
 # Date 1534448985 -7200
 #      Thu Aug 16 21:49:45 2018 +0200
 # Node ID 27cabd417f7828fdc75f5a19b03376733a2eeb26
-# Parent  936a20fefe031d3d3d4a4ce0857a23bedd352114
+# Parent  3cd55d191fead471561d94325b35d078f4ff6610
 Bug 1483999 - Move rooting outside of loop. r=sfink
 
 diff --git a/js/src/vm/StructuredClone.cpp b/js/src/vm/StructuredClone.cpp
 --- a/js/src/vm/StructuredClone.cpp
 +++ b/js/src/vm/StructuredClone.cpp
-@@ -1850,55 +1850,58 @@ JSStructuredCloneWriter::transferOwnersh
+@@ -1836,55 +1836,58 @@ JSStructuredCloneWriter::transferOwnersh
  }
  
  bool
@@ -26,7 +26,7 @@ diff --git a/js/src/vm/StructuredClone.cpp b/js/src/vm/StructuredClone.cpp
      while (!counts.empty()) {
 -        RootedObject obj(context(), &objs.back().toObject());
 +        obj = &objs.back().toObject();
-         assertSameCompartment(context(), obj);
+         AutoRealm ar(context(), obj);
          if (counts.back()) {
              counts.back()--;
 -            RootedValue key(context(), entries.back());

frg/work-js/mozilla-release/patches/mozilla-central-push_432655.patch → frg/work-js/mozilla-release/patches/1484382-63a1.patch

@@ -3,7 +3,7 @@
 # Date 1534841971 0
 #      Tue Aug 21 08:59:31 2018 +0000
 # Node ID ed07516ab49e79cdfaf85785bc8f572aee1de55a
-# Parent  20a3b24e500abc7bf403466c8beb8c38abbaeb6a
+# Parent  22f93572ef7478b0bb05bf80e9b384db445964f8
 Bug 1484382 - Use mozilla::ScopeExit in js/src r=jandem
 
 Bug 1484382 - Use mozilla::ScopeExit in jit/JitFrames.cpp
@@ -168,13 +168,13 @@ diff --git a/js/src/jit/JitFrames.cpp b/js/src/jit/JitFrames.cpp
 diff --git a/js/src/jit/JitcodeMap.cpp b/js/src/jit/JitcodeMap.cpp
 --- a/js/src/jit/JitcodeMap.cpp
 +++ b/js/src/jit/JitcodeMap.cpp
-@@ -4,16 +4,17 @@
+@@ -3,16 +3,17 @@
+  * This Source Code Form is subject to the terms of the Mozilla Public
   * License, v. 2.0. If a copy of the MPL was not distributed with this
   * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
  
  #include "jit/JitcodeMap.h"
  
- #include "mozilla/ArrayUtils.h"
  #include "mozilla/MathAlgorithms.h"
  #include "mozilla/Maybe.h"
 +#include "mozilla/ScopeExit.h"
@@ -186,7 +186,7 @@ diff --git a/js/src/jit/JitcodeMap.cpp b/js/src/jit/JitcodeMap.cpp
  #include "jit/JitRealm.h"
  #include "jit/JitSpewer.h"
  #include "js/Vector.h"
-@@ -1420,68 +1421,53 @@ JitcodeRegionEntry::findPcOffset(uint32_
+@@ -1417,68 +1418,53 @@ JitcodeRegionEntry::findPcOffset(uint32_
          if (queryNativeOffset <= curNativeOffset + nativeDelta)
              break;
          curNativeOffset += nativeDelta;
@@ -428,7 +428,7 @@ diff --git a/js/src/vm/TypeInference.cpp b/js/src/vm/TypeInference.cpp
  #include "builtin/String.h"
  
  #include "gc/HashUtil.h"
-@@ -3813,35 +3814,16 @@ ChangeObjectFixedSlotCount(JSContext* cx
+@@ -3809,35 +3810,16 @@ ChangeObjectFixedSlotCount(JSContext* cx
      Shape* newShape = ReshapeForAllocKind(cx, obj->lastProperty(), obj->taggedProto(), allocKind);
      if (!newShape)
          return false;
@@ -464,7 +464,7 @@ diff --git a/js/src/vm/TypeInference.cpp b/js/src/vm/TypeInference.cpp
  
      // Make sure there aren't dead references in preliminaryObjects. This can
      // clear out the new script information on OOM.
-@@ -3863,17 +3845,20 @@ TypeNewScript::maybeAnalyze(JSContext* c
+@@ -3859,17 +3841,20 @@ TypeNewScript::maybeAnalyze(JSContext* c
      // Don't perform the analyses until sufficient preliminary objects have
      // been allocated.
      if (!force && !preliminaryObjects->full())
@@ -486,7 +486,7 @@ diff --git a/js/src/vm/TypeInference.cpp b/js/src/vm/TypeInference.cpp
      for (size_t i = 0; i < PreliminaryObjectArray::COUNT; i++) {
          JSObject* objBase = preliminaryObjects->get(i);
          if (!objBase)
-@@ -3998,17 +3983,17 @@ TypeNewScript::maybeAnalyze(JSContext* c
+@@ -3994,17 +3979,17 @@ TypeNewScript::maybeAnalyze(JSContext* c
  
      js_delete(preliminaryObjects);
      preliminaryObjects = nullptr;
@@ -505,7 +505,7 @@ diff --git a/js/src/vm/TypeInference.cpp b/js/src/vm/TypeInference.cpp
          AutoEnterOOMUnsafeRegion oomUnsafe;
          ObjectGroup* plainGroup = ObjectGroup::defaultNewGroup(cx, &PlainObject::class_,
                                                                 group->proto());
-@@ -4021,17 +4006,17 @@ TypeNewScript::maybeAnalyze(JSContext* c
+@@ -4017,17 +4002,17 @@ TypeNewScript::maybeAnalyze(JSContext* c
      }
  
      if (prefixShape->slotSpan() == templateObject()->slotSpan()) {
@@ -524,7 +524,7 @@ diff --git a/js/src/vm/TypeInference.cpp b/js/src/vm/TypeInference.cpp
      // existing group to represent fully initialized objects with all
      // definite properties in the prefix shape, and make a new group to
      // represent partially initialized objects.
-@@ -4060,17 +4045,17 @@ TypeNewScript::maybeAnalyze(JSContext* c
+@@ -4056,17 +4041,17 @@ TypeNewScript::maybeAnalyze(JSContext* c
  
      // prefixShape was read via a weak pointer, so we need a read barrier before
      // we store it into the heap.

frg/work-js/mozilla-release/patches/1484420-63a1.patch

@@ -2,7 +2,7 @@
 # User Jeff Walden <jwalden@mit.edu>
 # Date 1534803092 18000
 # Node ID 9f92f288b60876c75fddfddb2eba8ff685ed2b78
-# Parent  a17935790ee6444d3e9123182c5c06937779d3cc
+# Parent  705fd5088ecbc5cbdb85ad3e139c5dbd6895052e
 Bug 1484420 - Move locale-related functions into js/public/LocaleSensitive.h that isn't #include'd in jsapi.h.  r=anba
 
 diff --git a/dom/workers/RuntimeService.cpp b/dom/workers/RuntimeService.cpp
@@ -259,7 +259,7 @@ diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
 diff --git a/js/src/jsapi.h b/js/src/jsapi.h
 --- a/js/src/jsapi.h
 +++ b/js/src/jsapi.h
-@@ -217,29 +217,16 @@ enum class PromiseRejectionHandlingState
+@@ -218,29 +218,16 @@ enum class PromiseRejectionHandlingState
  
  } /* namespace JS */
  
@@ -289,7 +289,7 @@ diff --git a/js/src/jsapi.h b/js/src/jsapi.h
   * re-used if possible. |existing| is guaranteed to be a cross-compartment
   * wrapper with a lazily-defined prototype and the correct global. It is
   * guaranteed not to wrap a function.
-@@ -4656,65 +4643,16 @@ PropertySpecNameEqualsId(const char* nam
+@@ -4661,65 +4648,16 @@ PropertySpecNameEqualsId(const char* nam
   */
  JS_PUBLIC_API(bool)
  PropertySpecNameToPermanentId(JSContext* cx, const char* name, jsid* idp);
@@ -402,7 +402,7 @@ diff --git a/js/src/jspubtd.h b/js/src/jspubtd.h
 diff --git a/js/src/moz.build b/js/src/moz.build
 --- a/js/src/moz.build
 +++ b/js/src/moz.build
-@@ -138,16 +138,17 @@ EXPORTS.js += [
+@@ -139,16 +139,17 @@ EXPORTS.js += [
      '../public/GCPolicyAPI.h',
      '../public/GCVariant.h',
      '../public/GCVector.h',
@@ -412,6 +412,7 @@ diff --git a/js/src/moz.build b/js/src/moz.build
      '../public/Initialization.h',
      '../public/JSON.h',
 +    '../public/LocaleSensitive.h',
+     '../public/MemoryFunctions.h',
      '../public/MemoryMetrics.h',
      '../public/Principals.h',
      '../public/Printf.h',
@@ -419,11 +420,10 @@ diff --git a/js/src/moz.build b/js/src/moz.build
      '../public/ProfilingStack.h',
      '../public/ProtoKey.h',
      '../public/Proxy.h',
-     '../public/Realm.h',
 diff --git a/js/src/vm/Runtime.h b/js/src/vm/Runtime.h
 --- a/js/src/vm/Runtime.h
 +++ b/js/src/vm/Runtime.h
-@@ -62,16 +62,17 @@ class TraceLoggerThread;
+@@ -63,16 +63,17 @@ class TraceLoggerThread;
  
  namespace gc {
  class AutoHeapSession;

frg/work-js/mozilla-release/patches/1484421-63a1.patch

@@ -2,7 +2,7 @@
 # User Jeff Walden <jwalden@mit.edu>
 # Date 1534776885 25200
 # Node ID ab5ac052f221b03e0700351ec6534160b38b106c
-# Parent  245097ca7c5752838ac99a48e0fb29d63772337a
+# Parent  efdee31b0779c8ba3fc319ddb1a9ba88528e0e4e
 Bug 1484421 - Move JSON-related functionality into js/public/JSON.h that isn't #include'd in jsapi.h.  r=jandem
 
 diff --git a/dom/base/BodyUtil.cpp b/dom/base/BodyUtil.cpp
@@ -333,7 +333,7 @@ diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
 diff --git a/js/src/jsapi.h b/js/src/jsapi.h
 --- a/js/src/jsapi.h
 +++ b/js/src/jsapi.h
-@@ -4683,71 +4683,16 @@ PropertySpecNameEqualsId(const char* nam
+@@ -4660,71 +4660,16 @@ PropertySpecNameEqualsId(const char* nam
   * during GC marking.
   */
  JS_PUBLIC_API(bool)
@@ -418,6 +418,7 @@ diff --git a/js/src/moz.build b/js/src/moz.build
      '../public/Id.h',
      '../public/Initialization.h',
 +    '../public/JSON.h',
+     '../public/MemoryFunctions.h',
      '../public/MemoryMetrics.h',
      '../public/Principals.h',
      '../public/Printf.h',
@@ -425,7 +426,6 @@ diff --git a/js/src/moz.build b/js/src/moz.build
      '../public/ProfilingStack.h',
      '../public/ProtoKey.h',
      '../public/Proxy.h',
-     '../public/Realm.h',
 diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
 --- a/js/src/shell/js.cpp
 +++ b/js/src/shell/js.cpp

frg/work-js/mozilla-release/patches/mozilla-central-push_432534.patch → frg/work-js/mozilla-release/patches/1484605-63a1.patch

@@ -3,33 +3,11 @@
 # Date 1534816427 -36000
 #      Tue Aug 21 11:53:47 2018 +1000
 # Node ID dc7413a25676e83242f0d1e539bf36015bb14550
-# Parent  3aca6b42ca4efa4d5f1f08d8191e0699d4e0b86a
+# Parent  644b2ac0d3ad2266c3772867b9856ea41616fa66
 Bug 1484605 - Tweak some lookupForAdd() uses. r=luke
 
 These are cases where the existing code is a little dubious or sub-optimal.
 
-diff --git a/dom/plugins/base/nsJSNPRuntime.cpp b/dom/plugins/base/nsJSNPRuntime.cpp
---- a/dom/plugins/base/nsJSNPRuntime.cpp
-+++ b/dom/plugins/base/nsJSNPRuntime.cpp
-@@ -1130,17 +1130,17 @@ nsJSObjWrapper::GetNewOrUsed(NPP npp, JS
- 
-   if (!sJSObjWrappers) {
-     // No hash yet (or any more), initialize it.
-     if (!CreateJSObjWrapperTable())
-       return nullptr;
-   }
-   MOZ_ASSERT(sJSObjWrappersAccessible);
- 
--  JSObjWrapperTable::Ptr p = sJSObjWrappers->lookupForAdd(nsJSObjWrapperKey(obj, npp));
-+  JSObjWrapperTable::Ptr p = sJSObjWrappers->lookup(nsJSObjWrapperKey(obj, npp));
-   if (p) {
-     MOZ_ASSERT(p->value());
-     // Found a live nsJSObjWrapper, return it.
- 
-     return _retainobject(p->value());
-   }
- 
-   // No existing nsJSObjWrapper, create one.
 diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp
 --- a/js/src/frontend/Parser.cpp
 +++ b/js/src/frontend/Parser.cpp

frg/work-js/mozilla-release/patches/mozilla-central-push_432716.patch → frg/work-js/mozilla-release/patches/1484728-1-63a1.patch

@@ -3,33 +3,37 @@
 # Date 1534550065 18000
 #      Fri Aug 17 18:54:25 2018 -0500
 # Node ID e1d3e4328869ff77054ec33c35e2f7a75d7e4b8f
-# Parent  9c34c00e44d0b021fb1d5ac4bf464b9de4955374
+# Parent  0f6f84922f6e519522ddf642e7ecd6ef9037e853
 Bug 1484728 - Update test262 skipped files again. r=anba
 
-diff --git a/js/src/devtools/automation/cgc-jstests-slow.txt b/js/src/devtools/automation/cgc-jstests-slow.txt
---- a/js/src/devtools/automation/cgc-jstests-slow.txt
-+++ b/js/src/devtools/automation/cgc-jstests-slow.txt
-@@ -58,20 +58,8 @@ non262/regress/regress-360969-02.js
- non262/regress/regress-360969-03.js
- non262/regress/regress-360969-04.js
- non262/regress/regress-360969-05.js
- non262/regress/regress-360969-06.js
- non262/extensions/regress-477187.js
- non262/regress/regress-452498-052-a.js
- non262/extensions/clone-complex-object.js
- non262/extensions/clone-object-deep.js
--test262/built-ins/RegExp/CharacterClassEscapes/character-class-digit-class-escape-flags-u.js
--test262/built-ins/RegExp/CharacterClassEscapes/character-class-digit-class-escape-plus-quantifier-flags-u.js
--test262/built-ins/RegExp/CharacterClassEscapes/character-class-non-digit-class-escape-flags-u.js
--test262/built-ins/RegExp/CharacterClassEscapes/character-class-non-digit-class-escape-plus-quantifier-flags-u.js
--test262/built-ins/RegExp/CharacterClassEscapes/character-class-non-whitespace-class-escape-flags-u.js
--test262/built-ins/RegExp/CharacterClassEscapes/character-class-non-whitespace-class-escape-plus-quantifier-flags-u.js
--test262/built-ins/RegExp/CharacterClassEscapes/character-class-non-word-class-escape-flags-u.js
--test262/built-ins/RegExp/CharacterClassEscapes/character-class-non-word-class-escape-plus-quantifier-flags-u.js
--test262/built-ins/RegExp/CharacterClassEscapes/character-class-whitespace-class-escape-flags-u.js
--test262/built-ins/RegExp/CharacterClassEscapes/character-class-whitespace-class-escape-plus-quantifier-flags-u.js
--test262/built-ins/RegExp/CharacterClassEscapes/character-class-word-class-escape-flags-u.js
--test262/built-ins/RegExp/CharacterClassEscapes/character-class-word-class-escape-plus-quantifier-flags-u.js
+diff --git a/js/src/devtools/automation/cgc-jstests-slow.txt.1484728.later b/js/src/devtools/automation/cgc-jstests-slow.txt.1484728.later
+new file mode 100644
+--- /dev/null
++++ b/js/src/devtools/automation/cgc-jstests-slow.txt.1484728.later
+@@ -0,0 +1,23 @@
++--- cgc-jstests-slow.txt
+++++ cgc-jstests-slow.txt
++@@ -58,20 +58,8 @@ non262/regress/regress-360969-02.js
++ non262/regress/regress-360969-03.js
++ non262/regress/regress-360969-04.js
++ non262/regress/regress-360969-05.js
++ non262/regress/regress-360969-06.js
++ non262/extensions/regress-477187.js
++ non262/regress/regress-452498-052-a.js
++ non262/extensions/clone-complex-object.js
++ non262/extensions/clone-object-deep.js
++-test262/built-ins/RegExp/CharacterClassEscapes/character-class-digit-class-escape-flags-u.js
++-test262/built-ins/RegExp/CharacterClassEscapes/character-class-digit-class-escape-plus-quantifier-flags-u.js
++-test262/built-ins/RegExp/CharacterClassEscapes/character-class-non-digit-class-escape-flags-u.js
++-test262/built-ins/RegExp/CharacterClassEscapes/character-class-non-digit-class-escape-plus-quantifier-flags-u.js
++-test262/built-ins/RegExp/CharacterClassEscapes/character-class-non-whitespace-class-escape-flags-u.js
++-test262/built-ins/RegExp/CharacterClassEscapes/character-class-non-whitespace-class-escape-plus-quantifier-flags-u.js
++-test262/built-ins/RegExp/CharacterClassEscapes/character-class-non-word-class-escape-flags-u.js
++-test262/built-ins/RegExp/CharacterClassEscapes/character-class-non-word-class-escape-plus-quantifier-flags-u.js
++-test262/built-ins/RegExp/CharacterClassEscapes/character-class-whitespace-class-escape-flags-u.js
++-test262/built-ins/RegExp/CharacterClassEscapes/character-class-whitespace-class-escape-plus-quantifier-flags-u.js
++-test262/built-ins/RegExp/CharacterClassEscapes/character-class-word-class-escape-flags-u.js
++-test262/built-ins/RegExp/CharacterClassEscapes/character-class-word-class-escape-plus-quantifier-flags-u.js
 diff --git a/js/src/tests/jstests.list b/js/src/tests/jstests.list
 --- a/js/src/tests/jstests.list
 +++ b/js/src/tests/jstests.list

frg/work-js/mozilla-release/patches/1485615-1-63a1.patch

@@ -2,7 +2,7 @@
 # User Jon Coppeard <jcoppeard@mozilla.com>
 # Date 1535039927 -3600
 # Node ID c70943a6b070698c59db4802c912a6c682b49ba4
-# Parent  f7d550d783449a155a5681f0db3939bd9ecad58b
+# Parent  0b03ee6c0c1d17bd346d1b175839136c6731fb4f
 Bug 1485615 - Make RegExpZone a separate allocation to Zone r=sfink
 
 diff --git a/js/src/builtin/RegExp.cpp b/js/src/builtin/RegExp.cpp
@@ -138,7 +138,7 @@ diff --git a/js/src/gc/Zone.cpp b/js/src/gc/Zone.cpp
 diff --git a/js/src/gc/Zone.h b/js/src/gc/Zone.h
 --- a/js/src/gc/Zone.h
 +++ b/js/src/gc/Zone.h
-@@ -9,22 +9,22 @@
+@@ -9,24 +9,24 @@
  
  #include "mozilla/Atomics.h"
  #include "mozilla/HashFunctions.h"
@@ -150,6 +150,8 @@ diff --git a/js/src/gc/Zone.h b/js/src/gc/Zone.h
 -#include "vm/RegExpShared.h"
  #include "vm/Runtime.h"
  
+ struct JSContext;
+ 
  namespace js {
  
  class Debugger;
@@ -162,7 +164,7 @@ diff --git a/js/src/gc/Zone.h b/js/src/gc/Zone.h
  namespace gc {
  
  struct ZoneComponentFinder : public ComponentFinder<JS::Zone, ZoneComponentFinder>
-@@ -454,18 +454,20 @@ class Zone : public JS::shadow::Zone,
+@@ -455,18 +455,20 @@ class Zone : public JS::shadow::Zone,
                                    counter.bytes(), counter.maxBytes()))
          {
              return;
@@ -253,7 +255,7 @@ diff --git a/js/src/vm/RegExpStatics.cpp b/js/src/vm/RegExpStatics.cpp
 diff --git a/js/src/vm/TypeInference.cpp b/js/src/vm/TypeInference.cpp
 --- a/js/src/vm/TypeInference.cpp
 +++ b/js/src/vm/TypeInference.cpp
-@@ -4627,17 +4627,17 @@ Zone::addSizeOfIncludingThis(mozilla::Ma
+@@ -4623,17 +4623,17 @@ Zone::addSizeOfIncludingThis(mozilla::Ma
                               size_t* uniqueIdMap,
                               size_t* shapeTables,
                               size_t* atomsMarkBitmaps,
@@ -272,4 +274,3 @@ diff --git a/js/src/vm/TypeInference.cpp b/js/src/vm/TypeInference.cpp
      *atomsMarkBitmaps += markedAtoms().sizeOfExcludingThis(mallocSizeOf);
  
      for (CompartmentsInZoneIter comp(this); !comp.done(); comp.next()) {
-

frg/work-js/mozilla-release/patches/1486577-1-63a1.patch

@@ -3,7 +3,7 @@
 # Date 1535132455 18000
 #      Fri Aug 24 12:40:55 2018 -0500
 # Node ID 31b77a399fcf7cd458ee255053dfc4e98392d1f0
-# Parent  148a82a8c49367b094194c66588a642900cea419
+# Parent  40ae26f86a5d2fa336bc03dd6e5abd8487e277fd
 Bug 1486577 - Move all compile-options classes to a new public js/CompileOptions.h header.  r=jandem
 
 diff --git a/js/public/CompileOptions.h b/js/public/CompileOptions.h
@@ -589,11 +589,11 @@ diff --git a/js/src/jsapi.h b/js/src/jsapi.h
  #include "js/GCVector.h"
  #include "js/HashTable.h"
  #include "js/Id.h"
+ #include "js/MemoryFunctions.h"
  #include "js/Principals.h"
  #include "js/Realm.h"
  #include "js/RefCounted.h"
- #include "js/RootingAPI.h"
-@@ -3174,396 +3175,16 @@ JS_GetScriptFilename(JSScript* script);
+@@ -3116,396 +3117,16 @@ JS_GetScriptFilename(JSScript* script);
  extern JS_PUBLIC_API(unsigned)
  JS_GetScriptBaseLineNumber(JSContext* cx, JSScript* script);
  
@@ -1021,7 +1021,7 @@ diff --git a/js/src/jspubtd.h b/js/src/jspubtd.h
 diff --git a/js/src/moz.build b/js/src/moz.build
 --- a/js/src/moz.build
 +++ b/js/src/moz.build
-@@ -123,16 +123,17 @@ EXPORTS += [
+@@ -124,16 +124,17 @@ EXPORTS += [
  
  EXPORTS.js += [
      '../public/AllocPolicy.h',

frg/work-js/mozilla-release/patches/1486577-2-63a1.patch

@@ -3,7 +3,7 @@
 # Date 1535137235 18000
 #      Fri Aug 24 14:00:35 2018 -0500
 # Node ID ea8351c63f54a43a568804e81b8a5a237d1f8084
-# Parent  51cb6238ce44e4130f97b217610ef407526d8059
+# Parent  8ab79b36f19dcb7407148c2b44548909ad5b00e1
 Bug 1486577 - Move JS::SourceBufferHolder into a new public js/SourceBufferHolder.h header.  r=jandem
 
 diff --git a/js/public/SourceBufferHolder.h b/js/public/SourceBufferHolder.h
@@ -174,11 +174,11 @@ diff --git a/js/rust/etc/wrapper.hpp b/js/rust/etc/wrapper.hpp
 diff --git a/js/src/jsapi.h b/js/src/jsapi.h
 --- a/js/src/jsapi.h
 +++ b/js/src/jsapi.h
-@@ -32,16 +32,17 @@
- #include "js/ErrorReport.h"
+@@ -33,16 +33,17 @@
  #include "js/GCVector.h"
  #include "js/HashTable.h"
  #include "js/Id.h"
+ #include "js/MemoryFunctions.h"
  #include "js/Principals.h"
  #include "js/Realm.h"
  #include "js/RefCounted.h"
@@ -192,7 +192,7 @@ diff --git a/js/src/jsapi.h b/js/src/jsapi.h
  #include "js/Vector.h"
  
  /************************************************************************/
-@@ -287,124 +288,16 @@ JS_NumberValue(double d)
+@@ -284,124 +285,16 @@ JS_NumberValue(double d)
  
  /************************************************************************/
  
@@ -320,7 +320,7 @@ diff --git a/js/src/jsapi.h b/js/src/jsapi.h
 diff --git a/js/src/moz.build b/js/src/moz.build
 --- a/js/src/moz.build
 +++ b/js/src/moz.build
-@@ -154,16 +154,17 @@ EXPORTS.js += [
+@@ -156,16 +156,17 @@ EXPORTS.js += [
      '../public/Proxy.h',
      '../public/Realm.h',
      '../public/RefCounted.h',

frg/work-js/mozilla-release/patches/1486577-3-63a1.patch

@@ -3,7 +3,7 @@
 # Date 1535139844 18000
 #      Fri Aug 24 14:44:04 2018 -0500
 # Node ID daa263f9eda35ced064b6c12626249c12427311d
-# Parent  638c3a74eb07e3b737c7b41afa7d3ad679658915
+# Parent  f4f9134421a5c8883f1498bf67ad45f61760846b
 Bug 1486577 - Move script/function transcoding API into a new public js/Transcoding.h header.  r=jandem
 
 diff --git a/js/public/Transcoding.h b/js/public/Transcoding.h
@@ -114,8 +114,8 @@ new file mode 100644
 diff --git a/js/src/jsapi.h b/js/src/jsapi.h
 --- a/js/src/jsapi.h
 +++ b/js/src/jsapi.h
-@@ -35,16 +35,17 @@
- #include "js/Id.h"
+@@ -36,16 +36,17 @@
+ #include "js/MemoryFunctions.h"
  #include "js/Principals.h"
  #include "js/Realm.h"
  #include "js/RefCounted.h"
@@ -132,7 +132,7 @@ diff --git a/js/src/jsapi.h b/js/src/jsapi.h
  /************************************************************************/
  
  namespace JS {
-@@ -282,22 +283,16 @@ JS_NumberValue(double d)
+@@ -283,22 +284,16 @@ JS_NumberValue(double d)
      return JS::DoubleValue(d);
  }
  
@@ -155,7 +155,7 @@ diff --git a/js/src/jsapi.h b/js/src/jsapi.h
   *     a uint8_t to store the relevant information. Proceed with caution if
   *     trying to reorder or change the the first byte worth of flags.
   */
-@@ -4770,89 +4765,16 @@ class MOZ_RAII AutoHideScriptedCaller
+@@ -4774,89 +4769,16 @@ class MOZ_RAII AutoHideScriptedCaller
          UnhideScriptedCaller(mContext);
      }
  
@@ -248,7 +248,7 @@ diff --git a/js/src/jsapi.h b/js/src/jsapi.h
 diff --git a/js/src/moz.build b/js/src/moz.build
 --- a/js/src/moz.build
 +++ b/js/src/moz.build
-@@ -163,16 +163,17 @@ EXPORTS.js += [
+@@ -164,16 +164,17 @@ EXPORTS.js += [
      '../public/SourceBufferHolder.h',
      '../public/StableStringChars.h',
      '../public/Stream.h',

frg/work-js/mozilla-release/patches/1486577-4-63a1.patch

@@ -3,7 +3,7 @@
 # Date 1535139850 18000
 #      Fri Aug 24 14:44:10 2018 -0500
 # Node ID 8896f3fdaf990d7d18ba07b08132fa12e18f8284
-# Parent  75a5b74f150497e656338b54c745328e80066909
+# Parent  25e9957b8bffd16fb6f8285a936dee2bb6e78924
 Bug 1486577 - Move of-thread compilation API into a new public js/OffThreadScriptCompilation.h header.  r=jandem
 
 diff --git a/js/public/OffThreadScriptCompilation.h b/js/public/OffThreadScriptCompilation.h
@@ -128,8 +128,7 @@ new file mode 100644
 diff --git a/js/src/jsapi.h b/js/src/jsapi.h
 --- a/js/src/jsapi.h
 +++ b/js/src/jsapi.h
-@@ -28,16 +28,17 @@
- #include "js/CallArgs.h"
+@@ -29,16 +29,17 @@
  #include "js/CharacterEncoding.h"
  #include "js/Class.h"
  #include "js/CompileOptions.h"
@@ -137,6 +136,7 @@ diff --git a/js/src/jsapi.h b/js/src/jsapi.h
  #include "js/GCVector.h"
  #include "js/HashTable.h"
  #include "js/Id.h"
+ #include "js/MemoryFunctions.h"
 +#include "js/OffThreadScriptCompilation.h"
  #include "js/Principals.h"
  #include "js/Realm.h"
@@ -146,7 +146,7 @@ diff --git a/js/src/jsapi.h b/js/src/jsapi.h
  #include "js/Stream.h"
  #include "js/TracingAPI.h"
  #include "js/Transcoding.h"
-@@ -3098,89 +3099,16 @@ CompileForNonSyntacticScope(JSContext* c
+@@ -3040,89 +3041,16 @@ CompileForNonSyntacticScope(JSContext* c
  extern JS_PUBLIC_API(bool)
  CompileForNonSyntacticScope(JSContext* cx, const ReadOnlyCompileOptions& options,
                              FILE* file, JS::MutableHandleScript script);
@@ -263,14 +263,14 @@ diff --git a/js/src/jspubtd.h b/js/src/jspubtd.h
 diff --git a/js/src/moz.build b/js/src/moz.build
 --- a/js/src/moz.build
 +++ b/js/src/moz.build
-@@ -141,16 +141,17 @@ EXPORTS.js += [
-     '../public/GCVector.h',
+@@ -143,16 +143,17 @@ EXPORTS.js += [
      '../public/HashTable.h',
      '../public/HeapAPI.h',
      '../public/Id.h',
      '../public/Initialization.h',
      '../public/JSON.h',
      '../public/LocaleSensitive.h',
+     '../public/MemoryFunctions.h',
      '../public/MemoryMetrics.h',
 +    '../public/OffThreadScriptCompilation.h',
      '../public/Principals.h',

frg/work-js/mozilla-release/patches/1486577-5-63a1.patch

@@ -3,7 +3,7 @@
 # Date 1535140528 18000
 #      Fri Aug 24 14:55:28 2018 -0500
 # Node ID 9fb317294f45476f0a2d2aa6dde4ec4848bac91d
-# Parent  827726bd97058450a02e29589ec360350565f1e4
+# Parent  9116ce3c54d8db56c959ff57800018f925aa1b8e
 Bug 1486577 - Move compilation and evaluation APIs into a new public js/CompilationAndEvaluation.h header.  r=jandem
 
 diff --git a/js/public/CompilationAndEvaluation.h b/js/public/CompilationAndEvaluation.h
@@ -273,10 +273,10 @@ diff --git a/js/src/jsapi.h b/js/src/jsapi.h
  #include "js/GCVector.h"
  #include "js/HashTable.h"
  #include "js/Id.h"
+ #include "js/MemoryFunctions.h"
  #include "js/OffThreadScriptCompilation.h"
  #include "js/Principals.h"
- #include "js/Realm.h"
-@@ -3023,230 +3024,37 @@ CloneFunctionObject(JSContext* cx, Handl
+@@ -2965,230 +2966,37 @@ CloneFunctionObject(JSContext* cx, Handl
   * the global object on it; that's implicit.  It needs to contain the other
   * objects that should end up on the clone's scope chain.
   */
@@ -510,7 +510,7 @@ diff --git a/js/src/jsapi.h b/js/src/jsapi.h
 diff --git a/js/src/moz.build b/js/src/moz.build
 --- a/js/src/moz.build
 +++ b/js/src/moz.build
-@@ -123,16 +123,17 @@ EXPORTS += [
+@@ -124,16 +124,17 @@ EXPORTS += [
  
  EXPORTS.js += [
      '../public/AllocPolicy.h',

frg/work-js/mozilla-release/patches/1486577-6-63a1.patch

@@ -3,7 +3,7 @@
 # Date 1535162518 18000
 #      Fri Aug 24 21:01:58 2018 -0500
 # Node ID 2dc7007e3924444f55345606b6785f2d2ba89ce1
-# Parent  7f91a2f2b519a4f12e53b046a7400f00e7fc0c72
+# Parent  32c594387ca52faa95f8f9852f43696fa328724c
 Bug 1486577 - Don't #include js/SourceBufferHolder.h in jsapi.h, and instead require users to do so -- a minor translation-unit size improvement for anyone who never has to use SourceBufferHolder other than by reference.  r=jandem
 
 diff --git a/dom/base/nsFrameMessageManager.cpp b/dom/base/nsFrameMessageManager.cpp
@@ -555,10 +555,10 @@ diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
 diff --git a/js/src/jsapi.h b/js/src/jsapi.h
 --- a/js/src/jsapi.h
 +++ b/js/src/jsapi.h
-@@ -34,29 +34,29 @@
- #include "js/GCVector.h"
+@@ -35,29 +35,29 @@
  #include "js/HashTable.h"
  #include "js/Id.h"
+ #include "js/MemoryFunctions.h"
  #include "js/OffThreadScriptCompilation.h"
  #include "js/Principals.h"
  #include "js/Realm.h"

frg/work-js/mozilla-release/patches/1486577-8-63a1.patch

@@ -3,7 +3,7 @@
 # Date 1535169109 18000
 #      Fri Aug 24 22:51:49 2018 -0500
 # Node ID 48921866b394212e0dddd0ba72c183081bc6805f
-# Parent  ac4a57076ade452e1349b7248e7136ef16a5e5f4
+# Parent  622462d3c06ce5dc685ed7577821599a052415e8
 Bug 1486577 - Don't #include "js/CompilationAndEvaluation.h" in jsapi.h, minimizing the scope of that header and reducing translation-unit size of anything that needs JSAPI but doesn't need to compile/evaluate JavaScript.  r=jandem
 
 diff --git a/dom/base/nsFrameMessageManager.cpp b/dom/base/nsFrameMessageManager.cpp
@@ -702,9 +702,9 @@ diff --git a/js/src/jsapi.h b/js/src/jsapi.h
  #include "js/GCVector.h"
  #include "js/HashTable.h"
  #include "js/Id.h"
+ #include "js/MemoryFunctions.h"
  #include "js/OffThreadScriptCompilation.h"
  #include "js/Principals.h"
- #include "js/Realm.h"
 diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
 --- a/js/src/shell/js.cpp
 +++ b/js/src/shell/js.cpp

frg/work-js/mozilla-release/patches/1489698-5-65a1.patch

@@ -3,14 +3,14 @@
 # Date 1536361555 14400
 #      Fri Sep 07 19:05:55 2018 -0400
 # Node ID a17dfbac6b10ec140dc69ed3053662987eba25ef
-# Parent  663093856d61cf7a5ff376cb3076d8ff74db0f46
+# Parent  248ba4667d0cf76208d262083259052caf115554
 Bug 1489698 - Add moz.build for js/src/jit. r=jandem,froydnj
 
 diff --git a/js/src/jit/moz.build b/js/src/jit/moz.build
 new file mode 100644
 --- /dev/null
 +++ b/js/src/jit/moz.build
-@@ -0,0 +1,253 @@
+@@ -0,0 +1,252 @@
 +# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 +# vim: set filetype=python:
 +# This Source Code Form is subject to the terms of the Mozilla Public
@@ -110,7 +110,6 @@ new file mode 100644
 +    'shared/CodeGenerator-shared.cpp',
 +    'shared/Disassembler-shared.cpp',
 +    'shared/Lowering-shared.cpp',
-+    'SharedIC.cpp',
 +    'Sink.cpp',
 +    'Snapshots.cpp',
 +    'StupidAllocator.cpp',
@@ -297,7 +296,7 @@ diff --git a/js/src/moz.build b/js/src/moz.build
      'js.msg',
      'jsapi.h',
      'jsfriendapi.h',
-@@ -261,89 +248,16 @@ UNIFIED_SOURCES += [
+@@ -262,88 +249,16 @@ UNIFIED_SOURCES += [
      'irregexp/NativeRegExpMacroAssembler.cpp',
      'irregexp/RegExpAST.cpp',
      'irregexp/RegExpCharacters.cpp',
@@ -370,7 +369,6 @@ diff --git a/js/src/moz.build b/js/src/moz.build
 -    'jit/shared/CodeGenerator-shared.cpp',
 -    'jit/shared/Disassembler-shared.cpp',
 -    'jit/shared/Lowering-shared.cpp',
--    'jit/SharedIC.cpp',
 -    'jit/Sink.cpp',
 -    'jit/Snapshots.cpp',
 -    'jit/StupidAllocator.cpp',
@@ -387,7 +385,7 @@ diff --git a/js/src/moz.build b/js/src/moz.build
      'perf/jsperf.cpp',
      'proxy/BaseProxyHandler.cpp',
      'proxy/CrossCompartmentWrapper.cpp',
-@@ -498,160 +412,16 @@ if CONFIG['MOZ_INSTRUMENTS']:
+@@ -498,160 +413,16 @@ if CONFIG['MOZ_INSTRUMENTS']:
  
  if CONFIG['ENABLE_TRACE_LOGGING']:
      SOURCES += [
@@ -548,7 +546,7 @@ diff --git a/js/src/moz.build b/js/src/moz.build
  else:
      UNIFIED_SOURCES += [
          'threading/posix/CpuCount.cpp',
-@@ -693,16 +463,17 @@ GENERATED_FILES += ['frontend/ReservedWo
+@@ -693,16 +464,17 @@ GENERATED_FILES += ['frontend/ReservedWo
  ReservedWordsGenerated = GENERATED_FILES['frontend/ReservedWordsGenerated.h']
  ReservedWordsGenerated.script = 'frontend/GenerateReservedWords.py'
  ReservedWordsGenerated.inputs += [

frg/work-js/mozilla-release/patches/1814899-1029.patch

@@ -2,7 +2,7 @@
 # User Iain Ireland <iireland@mozilla.com>
 # Date 1676313190 0
 # Node ID 207a0ca14a754cccfed04e5ce55c513afb3d25a6
-# Parent  345318e2f8608f8c2624da0f0f19c93cf515c5a1
+# Parent  963b59f4f9b8ca667391f08687b8d04e820c173c
 Bug 1814899: Ensure more OsiSpace r=jandem, a=dmeehan
 
 Differential Revision: https://phabricator.services.mozilla.com/D169274
@@ -10,25 +10,7 @@ Differential Revision: https://phabricator.services.mozilla.com/D169274
 diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
 --- a/js/src/jit/CodeGenerator.cpp
 +++ b/js/src/jit/CodeGenerator.cpp
-@@ -2835,16 +2835,17 @@ CodeGenerator::emitSharedStub(ICStub::Ki
-     IonICEntry entry(script->pcToOffset(pc), ICEntry::Kind_Op, script);
-     EmitCallIC(&patchOffset, masm);
-     entry.setReturnOffset(CodeOffset(masm.currentOffset()));
- 
-     SharedStub sharedStub(kind, entry, patchOffset);
-     masm.propagateOOM(sharedStubs_.append(sharedStub));
- 
-     // Fix up upon return.
-+    ensureOsiSpace();
-     uint32_t callOffset = masm.currentOffset();
- #ifdef JS_USE_LINK_REGISTER
-     masm.freeStack(sizeof(intptr_t) * 2);
- #else
-     masm.freeStack(sizeof(intptr_t));
- #endif
-     markSafepointAt(callOffset, lir);
- }
-@@ -4375,16 +4376,17 @@ CodeGenerator::visitCallNative(LCallNati
+@@ -4367,16 +4367,17 @@ CodeGenerator::visitCallNative(LCallNati
      masm.passABIArg(argUintNReg);
      masm.passABIArg(argVpReg);
      JSNative native = target->native();
@@ -46,7 +28,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
      // Test for failure.
      masm.branchIfFalseBool(ReturnReg, masm.failureLabel());
  
-@@ -4526,16 +4528,17 @@ CodeGenerator::visitCallDOMNative(LCallD
+@@ -4518,16 +4519,17 @@ CodeGenerator::visitCallDOMNative(LCallD
  
      // Construct and execute call.
      masm.setupUnalignedABICall(argJSContext);
@@ -64,7 +46,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
                         JSReturnOperand);
      } else {
          // Test for failure.
-@@ -4666,16 +4669,17 @@ CodeGenerator::visitCallGeneric(LCallGen
+@@ -4658,16 +4660,17 @@ CodeGenerator::visitCallGeneric(LCallGen
      masm.bind(&thunk);
      {
          TrampolinePtr argumentsRectifier = gen->jitRuntime()->getArgumentsRectifier();
@@ -82,7 +64,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
                        "ReturnReg available as scratch after scripted calls");
          masm.switchToRealm(gen->realm->realmPtr(), ReturnReg);
      }
-@@ -4771,16 +4775,17 @@ CodeGenerator::visitCallKnown(LCallKnown
+@@ -4763,16 +4766,17 @@ CodeGenerator::visitCallKnown(LCallKnown
      // Construct the IonFramePrefix.
      uint32_t descriptor = MakeFrameDescriptor(masm.framePushed(), JitFrame_IonJS,
                                                JitFrameLayout::Size());
@@ -100,7 +82,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
                        "ReturnReg available as scratch after scripted calls");
          masm.switchToRealm(gen->realm->realmPtr(), ReturnReg);
      }
-@@ -5114,16 +5119,17 @@ CodeGenerator::emitApplyGeneric(T* apply
+@@ -5106,16 +5110,17 @@ CodeGenerator::emitApplyGeneric(T* apply
              // Hardcode the address of the argumentsRectifier code.
              TrampolinePtr argumentsRectifier = gen->jitRuntime()->getArgumentsRectifier();
              masm.movePtr(argumentsRectifier, objreg);
@@ -118,7 +100,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
                            "ReturnReg available as scratch after scripted calls");
              masm.switchToRealm(gen->realm->realmPtr(), ReturnReg);
          }
-@@ -12258,16 +12264,17 @@ CodeGenerator::visitGetDOMProperty(LGetD
+@@ -12216,16 +12221,17 @@ CodeGenerator::visitGetDOMProperty(LGetD
      markSafepointAt(safepointOffset, ins);
  
      masm.setupUnalignedABICall(JSContextReg);
@@ -136,7 +118,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
                         JSReturnOperand);
      } else {
          masm.branchIfFalseBool(ReturnReg, masm.exceptionLabel());
-@@ -12377,16 +12384,17 @@ CodeGenerator::visitSetDOMProperty(LSetD
+@@ -12335,16 +12341,17 @@ CodeGenerator::visitSetDOMProperty(LSetD
      markSafepointAt(safepointOffset, ins);
  
      masm.setupUnalignedABICall(JSContextReg);
@@ -200,7 +182,7 @@ new file mode 100644
 diff --git a/js/src/jit/shared/CodeGenerator-shared.cpp b/js/src/jit/shared/CodeGenerator-shared.cpp
 --- a/js/src/jit/shared/CodeGenerator-shared.cpp
 +++ b/js/src/jit/shared/CodeGenerator-shared.cpp
-@@ -1112,28 +1112,28 @@ CodeGeneratorShared::ensureOsiSpace()
+@@ -1108,28 +1108,28 @@ CodeGeneratorShared::ensureOsiSpace()
      if (masm.currentOffset() - lastOsiPointOffset_ < Assembler::PatchWrite_NearCallSize()) {
          int32_t paddingSize = Assembler::PatchWrite_NearCallSize();
          paddingSize -= masm.currentOffset() - lastOsiPointOffset_;

frg/work-js/mozilla-release/patches/1888364-openurl-25319.patch

@@ -0,0 +1,34 @@
+# HG changeset patch
+# User Frank-Rainer Grahl <frgrahl@gmx.net>
+# Date 1711640603 -3600
+# Parent  06f7bad14a4a37318fb4d40ba994501557fbadab
+Bug 1888364 - Fix setting new channel attributes for displaying update url. r=IanN a=IanN
+
+diff --git a/toolkit/content/contentAreaUtils.js b/toolkit/content/contentAreaUtils.js
+--- a/toolkit/content/contentAreaUtils.js
++++ b/toolkit/content/contentAreaUtils.js
+@@ -1228,21 +1228,22 @@ function openURL(aURL) {
+         if (iid.equals(Ci.nsILoadGroup))
+           return loadgroup;
+         throw Cr.NS_ERROR_NO_INTERFACE;
+       }
+     };
+ 
+     var channel = NetUtil.newChannel({
+       uri,
+-      loadUsingSystemPrincipal: true
++      loadUsingSystemPrincipal: true,
+     });
+ 
+     if (channel) {
+-      channel.channelIsForDownload = true;
++      channel.QueryInterface(Ci.nsIHttpChannelInternal)
++             .channelIsForDownload = true;
+     }
+ 
+     var uriLoader = Cc["@mozilla.org/uriloader;1"]
+                       .getService(Ci.nsIURILoader);
+     uriLoader.openURI(channel,
+                       Ci.nsIURILoader.IS_CONTENT_PREFERRED,
+                       uriListener);
+   }

frg/work-js/mozilla-release/patches/TOP-NOBUG-REGEXP-04-1539690-68a1-25318.patch

@@ -1,7 +1,7 @@
 # HG changeset patch
 # User Dmitry Butskoy <buc@buc.me>
 # Date 1690629350 -7200
-# Parent  5313c076ea30304ba2d5815314b425996d795760
+# Parent  eb313cf07ce377512ba83c78c0fd20adbce4c235
 No Bug - Import new regexp V8 engine. r=frg a=frg
 
 diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp
@@ -407,7 +407,7 @@ diff --git a/js/src/builtin/RegExp.cpp b/js/src/builtin/RegExp.cpp
      // If we already have a RegExpShared for this pattern/flags, we can
      // avoid the much slower CheckPatternSyntaxSlow call.
  
-     if (RegExpShared* shared = cx->zone()->regExps.maybeGet(pattern, flags)) {
+     if (RegExpShared* shared = cx->zone()->regExps().maybeGet(pattern, flags)) {
  #ifdef DEBUG
          // Assert the pattern is valid.
          if (!CheckPatternSyntaxSlow(cx, pattern, flags)) {
@@ -573,7 +573,7 @@ diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctio
  
  // If disableOOMFunctions is set, disable functionality that causes artificial
  // OOM conditions.
-@@ -4760,17 +4763,17 @@ ParseRegExp(JSContext* cx, unsigned argc
+@@ -4776,17 +4779,17 @@ ParseRegExp(JSContext* cx, unsigned argc
          return false;
      }
  
@@ -592,7 +592,7 @@ diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctio
          RootedString flagStr(cx, args[1].toString());
          if (!ParseRegExpFlags(cx, flagStr, &flags))
              return false;
-@@ -4789,21 +4792,17 @@ ParseRegExp(JSContext* cx, unsigned argc
+@@ -4805,21 +4808,17 @@ ParseRegExp(JSContext* cx, unsigned argc
      if (!pattern)
          return false;
  
@@ -1162,7 +1162,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
  #include "vm/RegExpStatics.h"
  #include "vm/StringType.h"
  #include "vm/TraceLogging.h"
-@@ -1524,17 +1525,17 @@ PrepareAndExecuteRegExp(JSContext* cx, M
+@@ -1525,17 +1526,17 @@ PrepareAndExecuteRegExp(JSContext* cx, M
      masm.branchPtr(Assembler::Equal, temp1, ImmWord(0), failure);
  
      // ES6 21.2.2.2 step 2.
@@ -1360,7 +1360,7 @@ diff --git a/js/src/jsapi-tests/tests.h b/js/src/jsapi-tests/tests.h
 diff --git a/js/src/moz.build b/js/src/moz.build
 --- a/js/src/moz.build
 +++ b/js/src/moz.build
-@@ -142,16 +142,17 @@ EXPORTS.js += [
+@@ -143,16 +143,17 @@ EXPORTS.js += [
      '../public/Printf.h',
      '../public/ProfilingFrameIterator.h',
      '../public/ProfilingStack.h',
@@ -2032,14 +2032,14 @@ diff --git a/js/src/vm/RegExpObject.h b/js/src/vm/RegExpObject.h
 diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
 --- a/js/src/vm/RegExpShared.h
 +++ b/js/src/vm/RegExpShared.h
-@@ -15,16 +15,17 @@
- #include "mozilla/Assertions.h"
+@@ -16,16 +16,17 @@
  #include "mozilla/MemoryReporting.h"
  
  #include "builtin/SelfHostingDefines.h"
  #include "gc/Barrier.h"
  #include "gc/Heap.h"
  #include "gc/Marking.h"
+ #include "gc/Zone.h"
  #include "js/AllocPolicy.h"
 +#include "js/RegExpFlags.h"
  #include "js/UbiNode.h"
@@ -2050,7 +2050,7 @@ diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
  namespace js {
  
  class ArrayObject;
-@@ -32,37 +33,16 @@ class RegExpRealm;
+@@ -33,37 +34,16 @@ class RegExpRealm;
  class RegExpShared;
  class RegExpStatics;
  class VectorMatchPairs;
@@ -2088,7 +2088,7 @@ diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
  };
  
  /*
-@@ -112,17 +92,17 @@ class RegExpShared : public gc::TenuredC
+@@ -113,17 +93,17 @@ class RegExpShared : public gc::TenuredC
          bool compiled(ForceByteCodeEnum force = DontForceByteCode) const {
              return byteCode || (force == DontForceByteCode && jitCode);
          }
@@ -2107,7 +2107,7 @@ diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
      static int CompilationIndex(CompilationMode mode, bool latin1) {
          switch (mode) {
            case Normal:    return latin1 ? 0 : 1;
-@@ -130,17 +110,17 @@ class RegExpShared : public gc::TenuredC
+@@ -131,17 +111,17 @@ class RegExpShared : public gc::TenuredC
          }
          MOZ_CRASH();
      }
@@ -2126,7 +2126,7 @@ diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
  
      static bool compileIfNecessary(JSContext* cx, MutableHandleRegExpShared res,
                                     HandleLinearString input, CompilationMode mode,
-@@ -174,23 +154,24 @@ class RegExpShared : public gc::TenuredC
+@@ -175,23 +155,24 @@ class RegExpShared : public gc::TenuredC
          MOZ_ASSERT(isCompiled());
          return parenCount;
      }
@@ -2158,7 +2158,7 @@ diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
      bool isCompiled() const {
          return isCompiled(Normal, true) || isCompiled(Normal, false)
              || isCompiled(MatchOnly, true) || isCompiled(MatchOnly, false);
-@@ -228,38 +209,34 @@ class RegExpShared : public gc::TenuredC
+@@ -229,38 +210,34 @@ class RegExpShared : public gc::TenuredC
  #ifdef DEBUG
      static bool dumpBytecode(JSContext* cx, MutableHandleRegExpShared res, bool match_only,
                               HandleLinearString input);
@@ -2206,7 +2206,7 @@ diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
       * that was not marked is deleted and removed from the set.
       */
      using Set = JS::WeakCache<JS::GCHashSet<ReadBarriered<RegExpShared*>, Key, ZoneAllocPolicy>>;
-@@ -269,22 +246,22 @@ class RegExpZone
+@@ -270,22 +247,22 @@ class RegExpZone
      explicit RegExpZone(Zone* zone);
  
      ~RegExpZone() {
@@ -2336,26 +2336,26 @@ diff --git a/js/src/vm/StructuredClone.cpp b/js/src/vm/StructuredClone.cpp
  //
  // Note that SCTAG_END_OF_KEYS is written into the serialized form and should have
  // a stable ID, it need not be at the end of the list and should not be used for
-@@ -1596,17 +1600,17 @@ JSStructuredCloneWriter::startWrite(Hand
-         ESClass cls;
-         if (!GetBuiltinClass(context(), obj, &cls))
-             return false;
- 
-         if (cls == ESClass::RegExp) {
+@@ -1680,17 +1684,17 @@ JSStructuredCloneWriter::startWrite(Hand
+             if (!Unbox(context(), obj, &unboxed))
+                 return false;
+             return out.writePair(SCTAG_BOOLEAN_OBJECT, unboxed.toBoolean());
+           }
+           case ESClass::RegExp: {
              RegExpShared* re = RegExpToShared(context(), obj);
              if (!re)
                  return false;
 -            return out.writePair(SCTAG_REGEXP_OBJECT, re->getFlags()) &&
 +            return out.writePair(SCTAG_REGEXP_OBJECT, re->getFlags().value()) &&
                     writeString(SCTAG_STRING, re->getSource());
-         } else if (cls == ESClass::Date) {
-             RootedValue unboxed(context());
-             if (!Unbox(context(), obj, &unboxed))
-                 return false;
-             return out.writePair(SCTAG_DATE_OBJECT, 0) && out.writeDouble(unboxed.toNumber());
-         } else if (JS_IsTypedArrayObject(obj)) {
-             return writeTypedArray(obj);
-@@ -2316,17 +2320,17 @@ JSStructuredCloneReader::startRead(Mutab
+           }
+           case ESClass::ArrayBuffer: {
+             if (JS_IsArrayBufferObject(obj) && JS_ArrayBufferHasData(obj))
+                 return writeArrayBuffer(obj);
+             break;
+           }
+           case ESClass::SharedArrayBuffer:
+@@ -2409,17 +2413,17 @@ JSStructuredCloneReader::startRead(Mutab
          JSObject* obj = NewDateObjectMsec(context(), t);
          if (!obj)
              return false;

frg/work-js/mozilla-release/patches/TOP-NOBUG-REGEXP-12-1628835-77a1-25318.patch

@@ -1,13 +1,13 @@
 # HG changeset patch
 # User Dmitry Butskoy <buc@buc.me>
 # Date 1690629791 -7200
-# Parent  b217d72215225ec3176cc13eaf74c55b443fe382
+# Parent  fc8dac371e89ddc3af3fc0c1e08cf3810e8c7f25
 No Bug - Import new regexp V8 engine. r=frg a=frg
 
 diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
 --- a/js/src/jit/CodeGenerator.cpp
 +++ b/js/src/jit/CodeGenerator.cpp
-@@ -1554,21 +1554,20 @@ static bool PrepareAndExecuteRegExp(JSCo
+@@ -1597,21 +1597,20 @@ static bool PrepareAndExecuteRegExp(JSCo
  
          // Move lastIndex to lead surrogate.
          masm.sub32(Imm32(1), lastIndex);
@@ -376,7 +376,7 @@ diff --git a/js/src/vm/RegExpObject.cpp b/js/src/vm/RegExpObject.cpp
  #include "js/StableStringChars.h"
  #include "util/StringBuffer.h"
  #include "vm/MatchPairs.h"
-@@ -980,17 +981,17 @@ js::StringHasRegExpMetaChars(JSLinearStr
+@@ -981,17 +982,17 @@ js::StringHasRegExpMetaChars(JSLinearStr
      return HasRegExpMetaChars(str->twoByteChars(nogc), str->length());
  }
  
@@ -395,7 +395,7 @@ diff --git a/js/src/vm/RegExpObject.cpp b/js/src/vm/RegExpObject.cpp
      // Discard code to avoid holding onto ExecutablePools.
      if (IsMarkingTrace(trc) && trc->runtime()->gc.isShrinkingGC())
          discardJitCode();
-@@ -1094,24 +1095,77 @@ RegExpShared::execute(JSContext* cx,
+@@ -1095,24 +1096,77 @@ RegExpShared::execute(JSContext* cx,
          ReportOutOfMemory(cx);
          return RegExpRunStatus_Error;
      }
@@ -475,7 +475,7 @@ diff --git a/js/src/vm/RegExpObject.cpp b/js/src/vm/RegExpObject.cpp
                        MutableHandleRegExpShared re,
                        HandleAtom pattern,
                        HandleLinearString input,
-@@ -1131,17 +1185,18 @@ RegExpShared::compile(JSContext* cx,
+@@ -1132,17 +1186,18 @@ RegExpShared::compile(JSContext* cx,
                                  cx->tempLifoAlloc(),
                                  pattern,
                                  /*match_only =*/false,
@@ -498,11 +498,11 @@ diff --git a/js/src/vm/RegExpObject.cpp b/js/src/vm/RegExpObject.cpp
 diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
 --- a/js/src/vm/RegExpShared.h
 +++ b/js/src/vm/RegExpShared.h
-@@ -18,36 +18,39 @@
- #include "builtin/SelfHostingDefines.h"
+@@ -19,36 +19,39 @@
  #include "gc/Barrier.h"
  #include "gc/Heap.h"
  #include "gc/Marking.h"
+ #include "gc/Zone.h"
  #include "js/AllocPolicy.h"
  #include "js/RegExpFlags.h"
  #include "js/UbiNode.h"
@@ -543,7 +543,7 @@ diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
   * have pointers to RegExpShareds on the stack. The RegExpShareds are kept in a
   * table so that they can be reused when compiling the same regex string.
   *
-@@ -72,48 +75,55 @@ class RegExpShared : public gc::TenuredC
+@@ -73,48 +76,55 @@ class RegExpShared : public gc::TenuredC
  
      enum class Kind
      {
@@ -601,7 +601,7 @@ diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
      // Tables referenced by JIT code.
      JitCodeTables tables;
  
-@@ -159,34 +169,46 @@ class RegExpShared : public gc::TenuredC
+@@ -160,34 +170,46 @@ class RegExpShared : public gc::TenuredC
  
      // Register a table with this RegExpShared, and take ownership.
      bool addTable(JitCodeTable table) {
@@ -653,7 +653,7 @@ diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
  #else
      JSAtom* patternAtom() const { return getSource(); }
  #endif
-@@ -213,18 +235,18 @@ class RegExpShared : public gc::TenuredC
+@@ -214,18 +236,18 @@ class RegExpShared : public gc::TenuredC
      static size_t offsetOfSource() {
          return offsetof(RegExpShared, source);
      }

frg/work-js/mozilla-release/patches/TOP-NOBUG-REGEXP-14-1629670-77a1-25318.patch

@@ -1,7 +1,7 @@
 # HG changeset patch
 # User Dmitry Butskoy <buc@buc.me>
 # Date 1690629932 -7200
-# Parent  8de8ebc45704e8ecc3a02915f1930e341e9f1f25
+# Parent  c3f133dc7e5a24322d684f903d4bd62953638183
 No Bug - Import new regexp V8 engine. r=frg a=frg
 
 Iain Ireland <iireland@mozilla.com>
@@ -276,7 +276,7 @@ diff --git a/js/src/new-regexp/RegExpAPI.cpp b/js/src/new-regexp/RegExpAPI.cpp
 diff --git a/js/src/vm/RegExpObject.cpp b/js/src/vm/RegExpObject.cpp
 --- a/js/src/vm/RegExpObject.cpp
 +++ b/js/src/vm/RegExpObject.cpp
-@@ -542,17 +542,17 @@ RegExpObject::toString(JSContext* cx) co
+@@ -546,17 +546,17 @@ RegExpObject::toString(JSContext* cx) co
  
      return sb.finishString();
  }
@@ -295,7 +295,7 @@ diff --git a/js/src/vm/RegExpObject.cpp b/js/src/vm/RegExpObject.cpp
      auto Load32Aligned = [](const uint8_t* pc) -> int32_t {
          MOZ_ASSERT((reinterpret_cast<uintptr_t>(pc) & 3) == 0);
          return *reinterpret_cast<const int32_t*>(pc);
-@@ -1023,48 +1023,55 @@ RegExpShared::finalize(FreeOp* fop)
+@@ -1027,48 +1027,55 @@ RegExpShared::finalize(FreeOp* fop)
  {
      for (auto& comp : compilationArray)
          js_free(comp.byteCode);
@@ -356,7 +356,7 @@ diff --git a/js/src/vm/RegExpObject.cpp b/js/src/vm/RegExpObject.cpp
  }
  
  /* static */
-@@ -1075,17 +1082,17 @@ RegExpShared::execute(JSContext* cx,
+@@ -1079,17 +1086,17 @@ RegExpShared::execute(JSContext* cx,
                        size_t start,
                        VectorMatchPairs* matches)
  {
@@ -375,7 +375,7 @@ diff --git a/js/src/vm/RegExpObject.cpp b/js/src/vm/RegExpObject.cpp
       * No need to initialize it. The RegExp engine fills them in on a match.
       */
      if (!matches->allocOrExpandArray(re->pairCount())) {
-@@ -1153,25 +1160,43 @@ void RegExpShared::useAtomMatch(HandleAt
+@@ -1157,25 +1164,43 @@ void RegExpShared::useAtomMatch(HandleAt
    patternAtom_ = pattern;
    pairCount_ = 1;
  }
@@ -420,7 +420,7 @@ diff --git a/js/src/vm/RegExpObject.cpp b/js/src/vm/RegExpObject.cpp
      frontend::TokenStream dummyTokenStream(cx, options, nullptr, 0, nullptr);
  
      LifoAllocScope scope(&cx->tempLifoAlloc());
-@@ -1185,23 +1210,24 @@ RegExpShared::compile(JSContext* cx,
+@@ -1189,23 +1214,24 @@ RegExpShared::compile(JSContext* cx,
                                  re->getFlags(),
                                  &data)) {
          return false;
@@ -446,7 +446,7 @@ diff --git a/js/src/vm/RegExpObject.cpp b/js/src/vm/RegExpObject.cpp
  
      MOZ_ASSERT(!code.jitCode || !code.byteCode);
  
-@@ -1225,35 +1251,35 @@ RegExpShared::compile(JSContext* cx,
+@@ -1229,35 +1255,35 @@ RegExpShared::compile(JSContext* cx,
  
      return true;
  }
@@ -486,7 +486,7 @@ diff --git a/js/src/vm/RegExpObject.cpp b/js/src/vm/RegExpObject.cpp
       */
      if (!matches->allocOrExpandArray(re->pairCount())) {
          ReportOutOfMemory(cx);
-@@ -1303,17 +1329,17 @@ RegExpShared::execute(JSContext* cx,
+@@ -1307,17 +1333,17 @@ RegExpShared::execute(JSContext* cx,
  
          MOZ_ASSERT(result == RegExpRunStatus_Success);
  
@@ -508,8 +508,7 @@ diff --git a/js/src/vm/RegExpObject.cpp b/js/src/vm/RegExpObject.cpp
 diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
 --- a/js/src/vm/RegExpShared.h
 +++ b/js/src/vm/RegExpShared.h
-@@ -14,16 +14,17 @@
- 
+@@ -15,16 +15,17 @@
  #include "mozilla/Assertions.h"
  #include "mozilla/MemoryReporting.h"
  
@@ -517,6 +516,7 @@ diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
  #include "gc/Barrier.h"
  #include "gc/Heap.h"
  #include "gc/Marking.h"
+ #include "gc/Zone.h"
 +#include "jit/JitOptions.h"
  #include "js/AllocPolicy.h"
  #include "js/RegExpFlags.h"
@@ -526,7 +526,7 @@ diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
  #  include "new-regexp/RegExpTypes.h"
  #endif
  #include "vm/ArrayObject.h"
-@@ -43,16 +44,27 @@ using MutableHandleRegExpShared = JS::Mu
+@@ -44,16 +45,27 @@ using MutableHandleRegExpShared = JS::Mu
  
  enum RegExpRunStatus : int32_t
   {
@@ -554,7 +554,7 @@ diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
   *
   * To save memory, a RegExpShared is not created for a RegExpObject until it is
   * needed for execution. When a RegExpShared needs to be created, it is looked
-@@ -63,28 +75,30 @@ enum RegExpRunStatus : int32_t
+@@ -64,28 +76,30 @@ enum RegExpRunStatus : int32_t
   * than explicitly tracing them, so that the RegExpShared and any jitcode can
   * be reclaimed quicker. However, the RegExpShareds are traced through by
   * objects when we are preserving jitcode in their zone, to avoid the same
@@ -590,7 +590,7 @@ diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
      using JitCodeTable = UniquePtr<uint8_t[], JS::FreePolicy>;
  #endif
      using JitCodeTables = Vector<JitCodeTable, 0, SystemAllocPolicy>;
-@@ -95,30 +109,40 @@ class RegExpShared : public gc::TenuredC
+@@ -96,30 +110,40 @@ class RegExpShared : public gc::TenuredC
  
      struct RegExpCompilation
      {
@@ -633,7 +633,7 @@ diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
  
      RegExpCompilation  compilationArray[2];
  
-@@ -128,27 +152,27 @@ class RegExpShared : public gc::TenuredC
+@@ -129,27 +153,27 @@ class RegExpShared : public gc::TenuredC
      JitCodeTables tables;
  
      /* Internal functions. */
@@ -664,7 +664,7 @@ diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
      RegExpCompilation& compilation(bool latin1) {
          return compilationArray[CompilationIndex(latin1)];
      }
-@@ -187,22 +211,31 @@ class RegExpShared : public gc::TenuredC
+@@ -188,22 +212,31 @@ class RegExpShared : public gc::TenuredC
    RegExpShared::Kind kind() const { return kind_; }
  
    // Use simple string matching for this regexp.
@@ -696,7 +696,7 @@ diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
  #endif
  
      JSAtom* getSource() const           { return source; }
-@@ -217,19 +250,19 @@ class RegExpShared : public gc::TenuredC
+@@ -218,19 +251,19 @@ class RegExpShared : public gc::TenuredC
  
      bool global() const                 { return flags.global(); }
      bool ignoreCase() const             { return flags.ignoreCase(); }

frg/work-js/mozilla-release/patches/TOP-NOBUG-REGEXP-25-1362154-1to4-78a1-25318.patch

@@ -1,13 +1,13 @@
 # HG changeset patch
 # User Dmitry Butskoy <buc@buc.me>
 # Date 1690630700 -7200
-# Parent  26fe3700c22a4e27c6c7cb68df944310184ce435
+# Parent  3edd0e9a739b8d7ed1e6dadb850df94b9ef0c8a1
 No Bug - Import new regexp V8 engine. r=frg a=frg
 
 diff --git a/js/src/builtin/RegExp.cpp b/js/src/builtin/RegExp.cpp
 --- a/js/src/builtin/RegExp.cpp
 +++ b/js/src/builtin/RegExp.cpp
-@@ -196,17 +196,18 @@ CheckPatternSyntaxSlow(JSContext* cx, Ha
+@@ -197,17 +197,18 @@ CheckPatternSyntaxSlow(JSContext* cx, Ha
  }
  
  static RegExpShared*
@@ -16,8 +16,8 @@ diff --git a/js/src/builtin/RegExp.cpp b/js/src/builtin/RegExp.cpp
      // If we already have a RegExpShared for this pattern/flags, we can
      // avoid the much slower CheckPatternSyntaxSlow call.
  
--    if (RegExpShared* shared = cx->zone()->regExps.maybeGet(pattern, flags)) {
-+    RootedRegExpShared shared(cx, cx->zone()->regExps.maybeGet(pattern, flags));
+-    if (RegExpShared* shared = cx->zone()->regExps().maybeGet(pattern, flags)) {
++    RootedRegExpShared shared(cx, cx->zone()->regExps().maybeGet(pattern, flags));
 +    if (shared) {
  #ifdef DEBUG
          // Assert the pattern is valid.
@@ -188,7 +188,7 @@ diff --git a/js/src/new-regexp/regexp-parser.cc b/js/src/new-regexp/regexp-parse
 diff --git a/js/src/vm/RegExpObject.cpp b/js/src/vm/RegExpObject.cpp
 --- a/js/src/vm/RegExpObject.cpp
 +++ b/js/src/vm/RegExpObject.cpp
-@@ -996,16 +996,17 @@ RegExpShared::traceChildren(JSTracer* tr
+@@ -1000,16 +1000,17 @@ RegExpShared::traceChildren(JSTracer* tr
      TraceNullableEdge(trc, &source, "RegExpShared source");
  #ifdef JS_NEW_REGEXP
      if (kind() == RegExpShared::Kind::Atom) {
@@ -206,7 +206,7 @@ diff --git a/js/src/vm/RegExpObject.cpp b/js/src/vm/RegExpObject.cpp
  }
  
  void
-@@ -1013,21 +1014,30 @@ RegExpShared::discardJitCode()
+@@ -1017,21 +1018,30 @@ RegExpShared::discardJitCode()
  {
      for (auto& comp : compilationArray)
          comp.jitCode = nullptr;
@@ -239,7 +239,7 @@ diff --git a/js/src/vm/RegExpObject.cpp b/js/src/vm/RegExpObject.cpp
                        RegExpShared::CodeKind codeKind)
  {
      TraceLoggerThread* logger = TraceLoggerForCurrentThread(cx);
-@@ -1170,16 +1180,78 @@ void RegExpShared::useAtomMatch(HandleAt
+@@ -1174,16 +1184,78 @@ void RegExpShared::useAtomMatch(HandleAt
  
  void RegExpShared::useRegExpMatch(size_t pairCount) {
    MOZ_ASSERT(kind() == RegExpShared::Kind::Unparsed);
@@ -321,7 +321,7 @@ diff --git a/js/src/vm/RegExpObject.cpp b/js/src/vm/RegExpObject.cpp
 diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
 --- a/js/src/vm/RegExpShared.h
 +++ b/js/src/vm/RegExpShared.h
-@@ -137,16 +137,22 @@ class RegExpShared : public gc::TenuredC
+@@ -138,16 +138,22 @@ class RegExpShared : public gc::TenuredC
      RegExpShared::Kind kind_ = Kind::Unparsed;
      GCPtrAtom patternAtom_;
      uint32_t maxRegisters_ = 0;
@@ -344,7 +344,7 @@ diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
  
      // Tables referenced by JIT code.
      JitCodeTables tables;
-@@ -211,16 +217,20 @@ class RegExpShared : public gc::TenuredC
+@@ -212,16 +218,20 @@ class RegExpShared : public gc::TenuredC
    RegExpShared::Kind kind() const { return kind_; }
  
    // Use simple string matching for this regexp.
@@ -365,7 +365,7 @@ diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
    }
    ByteCode* getByteCode(bool latin1) const {
      return compilation(latin1).byteCode;
-@@ -231,16 +241,23 @@ class RegExpShared : public gc::TenuredC
+@@ -232,16 +242,23 @@ class RegExpShared : public gc::TenuredC
    jit::JitCode* getJitCode(bool latin1) const {
      return compilation(latin1).jitCode;
    }

frg/work-js/mozilla-release/patches/TOP-NOBUG-REGEXP-37-1642493-79a1-25318.patch

@@ -1,7 +1,7 @@
 # HG changeset patch
 # User Dmitry Butskoy <buc@buc.me>
 # Date 1690631112 -7200
-# Parent  ef2337a25e6d3689bb30c8fc8ce4bad511872cba
+# Parent  4bb09b13e74eea22ee97468c999c90385a51f5db
 No Bug - Import new regexp V8 engine. r=frg a=frg
 
 diff --git a/.clang-format-ignore b/.clang-format-ignore
@@ -230,7 +230,7 @@ diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctio
  #include "js/AutoByteString.h"
  #include "js/CompilationAndEvaluation.h"
  #include "js/CompileOptions.h"
-@@ -4491,370 +4486,16 @@ GetModuleEnvironmentValue(JSContext* cx,
+@@ -4507,370 +4502,16 @@ GetModuleEnvironmentValue(JSContext* cx,
      if (args.rval().isMagic(JS_UNINITIALIZED_LEXICAL)) {
          ReportRuntimeLexicalError(cx, JSMSG_UNINITIALIZED_LEXICAL, id);
          return false;
@@ -601,7 +601,7 @@ diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctio
  
      if (args.length() != 0) {
          ReportUsageErrorASCII(cx, callee, "Wrong number of arguments");
-@@ -6033,26 +5674,16 @@ gc::ZealModeHelpText),
+@@ -6049,26 +5690,16 @@ gc::ZealModeHelpText),
  "    baselineCompile();  for (var i=0; i<1; i++) {} ...\n"
  "  The interpreter will enter the new jitcode at the loop header unless\n"
  "  baselineCompile returned a string or threw an error.\n"),
@@ -23890,7 +23890,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
  #include "vm/RegExpStatics.h"
  #include "vm/StringType.h"
  #include "vm/TraceLogging.h"
-@@ -1542,18 +1537,16 @@ static void UpdateRegExpStatics(MacroAss
+@@ -1543,18 +1538,16 @@ static void UpdateRegExpStatics(MacroAss
                                     RegExpObject::PRIVATE_SLOT)),
                 temp1);
    masm.loadPtr(Address(temp1, RegExpShared::offsetOfSource()), temp2);
@@ -23909,7 +23909,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
                                      Register regexp, Register input,
                                      Register lastIndex, Register temp1,
                                      Register temp2, Register temp3,
-@@ -1753,216 +1746,16 @@ static bool PrepareAndExecuteRegExp(JSCo
+@@ -1754,216 +1747,16 @@ static bool PrepareAndExecuteRegExp(JSCo
    }
    masm.movePtr(ImmPtr(res), temp1);
    UpdateRegExpStatics(masm, regexp, input, lastIndex, temp1, temp2, temp3,
@@ -24126,7 +24126,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
  {
      CharEncoding encoding_;
      Register string_;
-@@ -2279,27 +2072,25 @@ JitRealm::generateRegExpMatcherStub(JSCo
+@@ -2280,27 +2073,25 @@ JitRealm::generateRegExpMatcherStub(JSCo
      Label notFound, oolEntry;
      if (!PrepareAndExecuteRegExp(cx, masm, regexp, input, lastIndex,
                                   temp1, temp2, temp3, inputOutputDataStartOffset,
@@ -24154,7 +24154,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
      masm.bind(&matchResultJoin);
  
      // Initialize slots of result object.
-@@ -2314,21 +2105,19 @@ JitRealm::generateRegExpMatcherStub(JSCo
+@@ -2315,21 +2106,19 @@ JitRealm::generateRegExpMatcherStub(JSCo
                  
      // Initialize the slots of the result object with the dummy values
      // defined in createMatchResultTemplateObject.
@@ -24179,7 +24179,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
 diff --git a/js/src/jit/JitOptions.cpp b/js/src/jit/JitOptions.cpp
 --- a/js/src/jit/JitOptions.cpp
 +++ b/js/src/jit/JitOptions.cpp
-@@ -153,21 +153,19 @@ DefaultJitOptions::DefaultJitOptions()
+@@ -150,21 +150,19 @@ DefaultJitOptions::DefaultJitOptions()
  
      // Whether to enable extra code to perform dynamic validations.
      SET_DEFAULT(runExtraChecks, false);
@@ -24204,7 +24204,7 @@ diff --git a/js/src/jit/JitOptions.cpp b/js/src/jit/JitOptions.cpp
      // Number of bailouts without invalidation before we set
      // JSScript::hadFrequentBailouts and invalidate.
      SET_DEFAULT(frequentBailoutThreshold, 10);
-@@ -272,19 +270,17 @@ DefaultJitOptions::enableGvn(bool enable
+@@ -269,19 +267,17 @@ DefaultJitOptions::enableGvn(bool enable
      disableGvn = !enable;
  }
  
@@ -24227,7 +24227,7 @@ diff --git a/js/src/jit/JitOptions.cpp b/js/src/jit/JitOptions.cpp
 diff --git a/js/src/jit/JitOptions.h b/js/src/jit/JitOptions.h
 --- a/js/src/jit/JitOptions.h
 +++ b/js/src/jit/JitOptions.h
-@@ -69,19 +69,17 @@ struct DefaultJitOptions
+@@ -68,19 +68,17 @@ struct DefaultJitOptions
      bool eagerCompilation;
      bool forceInlineCaches;
      bool fullDebugChecks;
@@ -41925,7 +41925,7 @@ deleted file mode 100644
 diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
 --- a/js/src/shell/js.cpp
 +++ b/js/src/shell/js.cpp
-@@ -8895,22 +8895,20 @@ SetContextOptions(JSContext* cx, const O
+@@ -8890,22 +8890,20 @@ SetContextOptions(JSContext* cx, const O
      int32_t warmUpThreshold = op.getIntOption("ion-warmup-threshold");
      if (warmUpThreshold >= 0)
          jit::JitOptions.setCompilerWarmUpThreshold(warmUpThreshold);
@@ -41948,7 +41948,7 @@ diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
          jit::JitOptions.forcedRegisterAllocator = jit::LookupRegisterAllocator(str);
          if (!jit::JitOptions.forcedRegisterAllocator.isSome())
              return OptionFailure("ion-regalloc", str);
-@@ -9270,23 +9268,21 @@ main(int argc, char** argv, char** envp)
+@@ -9265,23 +9263,21 @@ main(int argc, char** argv, char** envp)
          || !op.addBoolOption('\0', "test-wasm-await-tier2", "Forcibly activate tiering and block "
                                     "instantiation on completion of tier2")
  #ifdef ENABLE_WASM_GC
@@ -42960,8 +42960,7 @@ diff --git a/js/src/vm/RegExpObject.cpp b/js/src/vm/RegExpObject.cpp
 diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
 --- a/js/src/vm/RegExpShared.h
 +++ b/js/src/vm/RegExpShared.h
-@@ -14,24 +14,22 @@
- 
+@@ -15,24 +15,22 @@
  #include "mozilla/Assertions.h"
  #include "mozilla/MemoryReporting.h"
  
@@ -42969,6 +42968,7 @@ diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
  #include "gc/Barrier.h"
  #include "gc/Heap.h"
  #include "gc/Marking.h"
+ #include "gc/Zone.h"
 +#include "irregexp/RegExpTypes.h"
  #include "jit/JitOptions.h"
  #include "js/AllocPolicy.h"
@@ -42987,7 +42987,7 @@ diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
  class ArrayObject;
  class RegExpRealm;
  class RegExpShared;
-@@ -44,26 +42,23 @@ using MutableHandleRegExpShared = JS::Mu
+@@ -45,26 +43,23 @@ using MutableHandleRegExpShared = JS::Mu
  
  enum RegExpRunStatus : int32_t
   {
@@ -43017,7 +43017,7 @@ diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
   * table so that they can be reused when compiling the same regex string.
   *
   * To save memory, a RegExpShared is not created for a RegExpObject until it is
-@@ -89,23 +84,18 @@ class RegExpShared : public gc::TenuredC
+@@ -90,23 +85,18 @@ class RegExpShared : public gc::TenuredC
  
      enum class CodeKind
      {
@@ -43041,7 +43041,7 @@ diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
  
      struct RegExpCompilation
      {
-@@ -128,30 +118,24 @@ class RegExpShared : public gc::TenuredC
+@@ -129,30 +119,24 @@ class RegExpShared : public gc::TenuredC
          }
      };
  
@@ -43075,7 +43075,7 @@ diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
      static int CompilationIndex(bool latin1) { return latin1 ? 0 : 1; }
  
      // Tables referenced by JIT code.
-@@ -200,73 +184,62 @@ class RegExpShared : public gc::TenuredC
+@@ -201,73 +185,62 @@ class RegExpShared : public gc::TenuredC
      // Register a table with this RegExpShared, and take ownership.
      bool addTable(JitCodeTable table) {
          return tables.append(std::move(table));
@@ -43182,7 +43182,7 @@ diff --git a/js/src/vm/RegExpShared.h b/js/src/vm/RegExpShared.h
      bool multiline() const              { return flags.multiline(); }
      bool dotAll() const                 { return flags.dotAll(); }
      bool unicode() const                { return flags.unicode(); }
-@@ -295,21 +268,20 @@ class RegExpShared : public gc::TenuredC
+@@ -296,21 +269,20 @@ class RegExpShared : public gc::TenuredC
      }
  
      static size_t offsetOfJitCode(bool latin1)

frg/work-js/mozilla-release/patches/mozilla-central-push_431413.patch

@@ -1,371 +0,0 @@
-# HG changeset patch
-# User Thi Huynh <so61pi.re@gmail.com>
-# Date 1534244810 0
-#      Tue Aug 14 11:06:50 2018 +0000
-# Node ID 1283ee4cfb6bea6641102cd08931540688e4d2cc
-# Parent  5312e71473c402f520db9e24f5c7e5eb6795cbcf
-Bug 1478910 - Use JSMSG_AWAIT_IN_DEFAULT error for incomplete await expr in async function/generator parameter. r=arai
-
-Differential Revision: https://phabricator.services.mozilla.com/D3207
-
-diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp
---- a/js/src/frontend/Parser.cpp
-+++ b/js/src/frontend/Parser.cpp
-@@ -843,16 +843,17 @@ ParserBase::ParserBase(JSContext* cx, Li
-     sourceObject(cx, sourceObject),
-     keepAtoms(cx),
-     foldConstants(foldConstants),
- #ifdef DEBUG
-     checkOptionsCalled(false),
- #endif
-     isUnexpectedEOF_(false),
-     awaitHandling_(AwaitIsName),
-+    inParametersOfAsyncFunction_(false),
-     parseGoal_(uint8_t(parseGoal))
- {
-     cx->frontendCollectionPool().addActiveCompilation();
-     tempPoolMark = alloc.mark();
- }
- 
- bool
- ParserBase::checkOptions()
-@@ -927,16 +928,39 @@ Parser<FullParseHandler, CharT>::setAwai
- 
- template <class ParseHandler, typename CharT>
- inline void
- GeneralParser<ParseHandler, CharT>::setAwaitHandling(AwaitHandling awaitHandling)
- {
-     asFinalParser()->setAwaitHandling(awaitHandling);
- }
- 
-+template <typename CharT>
-+void
-+Parser<SyntaxParseHandler, CharT>::setInParametersOfAsyncFunction(bool inParameters)
-+{
-+    this->inParametersOfAsyncFunction_ = inParameters;
-+}
-+
-+template <typename CharT>
-+void
-+Parser<FullParseHandler, CharT>::setInParametersOfAsyncFunction(bool inParameters)
-+{
-+    this->inParametersOfAsyncFunction_ = inParameters;
-+    if (SyntaxParser* syntaxParser = getSyntaxParser())
-+        syntaxParser->setInParametersOfAsyncFunction(inParameters);
-+}
-+
-+template <class ParseHandler, typename CharT>
-+inline void
-+GeneralParser<ParseHandler, CharT>::setInParametersOfAsyncFunction(bool inParameters)
-+{
-+    asFinalParser()->setInParametersOfAsyncFunction(inParameters);
-+}
-+
- ObjectBox*
- ParserBase::newObjectBox(JSObject* obj)
- {
-     MOZ_ASSERT(obj);
- 
-     /*
-      * We use JSContext.tempLifoAlloc to allocate parsed objects and place them
-      * on a list in this Parser to ensure GC safety. Thus the tempLifoAlloc
-@@ -3817,16 +3841,17 @@ GeneralParser<ParseHandler, CharT>::func
-     // See below for an explanation why arrow function parameters and arrow
-     // function bodies are parsed with different yield/await settings.
-     {
-         AwaitHandling awaitHandling =
-             (funbox->isAsync() || (kind == FunctionSyntaxKind::Arrow && awaitIsKeyword()))
-             ? AwaitIsKeyword
-             : AwaitIsName;
-         AutoAwaitIsKeyword<ParseHandler, CharT> awaitIsKeyword(this, awaitHandling);
-+        AutoInParametersOfAsyncFunction<ParseHandler, CharT> inParameters(this, funbox->isAsync());
-         if (!functionArguments(yieldHandling, kind, *pn))
-             return false;
-     }
- 
-     Maybe<ParseContext::VarScope> varScope;
-     if (funbox->hasParameterExprs) {
-         varScope.emplace(this);
-         if (!varScope->init(pc))
-@@ -3878,16 +3903,17 @@ GeneralParser<ParseHandler, CharT>::func
-     // Whereas the |yield| in the function body is always parsed as a name.
-     // The same goes when parsing |await| in arrow functions.
-     YieldHandling bodyYieldHandling = GetYieldHandling(pc->generatorKind());
-     AwaitHandling bodyAwaitHandling = GetAwaitHandling(pc->asyncKind());
-     bool inheritedStrict = pc->sc()->strict();
-     Node body;
-     {
-         AutoAwaitIsKeyword<ParseHandler, CharT> awaitIsKeyword(this, bodyAwaitHandling);
-+        AutoInParametersOfAsyncFunction<ParseHandler, CharT> inParameters(this, false);
-         body = functionBody(inHandling, bodyYieldHandling, kind, bodyType);
-         if (!body)
-             return false;
-     }
- 
-     // Revalidate the function name when we transitioned to strict mode.
-     if ((kind == FunctionSyntaxKind::Statement || kind == FunctionSyntaxKind::Expression) &&
-         fun->explicitName() &&
-@@ -8581,16 +8607,20 @@ GeneralParser<ParseHandler, CharT>::unar
-             pc->sc()->setBindingsAccessedDynamically();
-         }
- 
-         return handler.newDelete(begin, expr);
-       }
- 
-       case TokenKind::Await: {
-         if (pc->isAsync()) {
-+            if (inParametersOfAsyncFunction()) {
-+                error(JSMSG_AWAIT_IN_DEFAULT);
-+                return null();
-+            }
-             Node kid = unaryExpr(yieldHandling, tripledotHandling, possibleError, invoked);
-             if (!kid)
-                 return null();
-             pc->lastAwaitOffset = begin;
-             return handler.newAwaitExpression(begin, kid);
-         }
-       }
- 
-diff --git a/js/src/frontend/Parser.h b/js/src/frontend/Parser.h
---- a/js/src/frontend/Parser.h
-+++ b/js/src/frontend/Parser.h
-@@ -244,16 +244,19 @@ enum class PropertyType {
-     DerivedConstructor
- };
- 
- enum AwaitHandling : uint8_t { AwaitIsName, AwaitIsKeyword, AwaitIsModuleKeyword };
- 
- template <class ParseHandler, typename CharT>
- class AutoAwaitIsKeyword;
- 
-+template <class ParseHandler, typename CharT>
-+class AutoInParametersOfAsyncFunction;
-+
- class MOZ_STACK_CLASS ParserBase
-   : public StrictModeGetter,
-     private JS::AutoGCRooter
- {
-   private:
-     ParserBase* thisForCtor() { return this; }
- 
-     // This is needed to cast a parser to JS::AutoGCRooter.
-@@ -292,28 +295,35 @@ class MOZ_STACK_CLASS ParserBase
-     bool checkOptionsCalled:1;
- #endif
- 
-     /* Unexpected end of input, i.e. Eof not at top-level. */
-     bool isUnexpectedEOF_:1;
- 
-     /* AwaitHandling */ uint8_t awaitHandling_:2;
- 
-+    bool inParametersOfAsyncFunction_:1;
-+
-     /* ParseGoal */ uint8_t parseGoal_:1;
- 
-   public:
-     bool awaitIsKeyword() const {
-       return awaitHandling_ != AwaitIsName;
-     }
- 
-+    bool inParametersOfAsyncFunction() const {
-+        return inParametersOfAsyncFunction_;
-+    }
-+
-     ParseGoal parseGoal() const {
-         return ParseGoal(parseGoal_);
-     }
- 
-     template<class, typename> friend class AutoAwaitIsKeyword;
-+    template<class, typename> friend class AutoInParametersOfAsyncFunction;
- 
-     ParserBase(JSContext* cx, LifoAlloc& alloc, const ReadOnlyCompileOptions& options,
-                bool foldConstants, UsedNameTracker& usedNames,
-                ScriptSourceObject* sourceObject, ParseGoal parseGoal);
-     ~ParserBase();
- 
-     bool checkOptions();
- 
-@@ -685,16 +695,17 @@ class MOZ_STACK_CLASS GeneralParser
-     using Modifier = TokenStreamShared::Modifier;
-     using Position = typename TokenStream::Position;
- 
-     using Base::PredictUninvoked;
-     using Base::PredictInvoked;
- 
-     using Base::alloc;
-     using Base::awaitIsKeyword;
-+    using Base::inParametersOfAsyncFunction;
-     using Base::parseGoal;
- #if DEBUG
-     using Base::checkOptionsCalled;
- #endif
-     using Base::finishFunctionScopes;
-     using Base::finishLexicalScope;
-     using Base::foldConstants;
-     using Base::getFilename;
-@@ -891,16 +902,17 @@ class MOZ_STACK_CLASS GeneralParser
-     GeneralParser(JSContext* cx, LifoAlloc& alloc, const ReadOnlyCompileOptions& options,
-                   const CharT* chars, size_t length, bool foldConstants,
-                   UsedNameTracker& usedNames, SyntaxParser* syntaxParser,
-                   LazyScript* lazyOuterFunction,
-                   ScriptSourceObject* sourceObject,
-                   ParseGoal parseGoal);
- 
-     inline void setAwaitHandling(AwaitHandling awaitHandling);
-+    inline void setInParametersOfAsyncFunction(bool inParameters);
- 
-     /*
-      * Parse a top-level JS script.
-      */
-     Node parse();
- 
-     /* Report the given error at the current offset. */
-     void error(unsigned errorNumber, ...);
-@@ -1350,16 +1362,17 @@ class MOZ_STACK_CLASS Parser<SyntaxParse
- 
-     PropertyName* bindingIdentifier(YieldHandling yieldHandling) {
-         return Base::bindingIdentifier(yieldHandling);
-     }
- 
-     // Functions present in both Parser<ParseHandler, CharT> specializations.
- 
-     inline void setAwaitHandling(AwaitHandling awaitHandling);
-+    inline void setInParametersOfAsyncFunction(bool inParameters);
- 
-     Node newRegExp();
- 
-     // Parse a module.
-     Node moduleBody(ModuleSharedContext* modulesc);
- 
-     inline Node importDeclaration();
-     inline bool checkLocalExportNames(Node node);
-@@ -1468,16 +1481,19 @@ class MOZ_STACK_CLASS Parser<FullParseHa
-         return Base::bindingIdentifier(yieldHandling);
-     }
- 
-     // Functions present in both Parser<ParseHandler, CharT> specializations.
- 
-     friend class AutoAwaitIsKeyword<SyntaxParseHandler, CharT>;
-     inline void setAwaitHandling(AwaitHandling awaitHandling);
- 
-+    friend class AutoInParametersOfAsyncFunction<SyntaxParseHandler, CharT>;
-+    inline void setInParametersOfAsyncFunction(bool inParameters);
-+
-     Node newRegExp();
- 
-     // Parse a module.
-     Node moduleBody(ModuleSharedContext* modulesc);
- 
-     Node importDeclaration();
-     bool checkLocalExportNames(Node node);
-     bool checkExportedName(JSAtom* exportName);
-@@ -1607,16 +1623,37 @@ class MOZ_STACK_CLASS AutoAwaitIsKeyword
-             parser_->setAwaitHandling(awaitHandling);
-     }
- 
-     ~AutoAwaitIsKeyword() {
-         parser_->setAwaitHandling(oldAwaitHandling_);
-     }
- };
- 
-+template <class ParseHandler, typename CharT>
-+class MOZ_STACK_CLASS AutoInParametersOfAsyncFunction
-+{
-+    using GeneralParser = frontend::GeneralParser<ParseHandler, CharT>;
-+
-+  private:
-+    GeneralParser* parser_;
-+    bool oldInParametersOfAsyncFunction_;
-+
-+  public:
-+    AutoInParametersOfAsyncFunction(GeneralParser* parser, bool inParameters) {
-+        parser_ = parser;
-+        oldInParametersOfAsyncFunction_ = parser_->inParametersOfAsyncFunction_;
-+        parser_->setInParametersOfAsyncFunction(inParameters);
-+    }
-+
-+    ~AutoInParametersOfAsyncFunction() {
-+        parser_->setInParametersOfAsyncFunction(oldInParametersOfAsyncFunction_);
-+    }
-+};
-+
- template <typename Scope>
- extern typename Scope::Data*
- NewEmptyBindingData(JSContext* cx, LifoAlloc& alloc, uint32_t numBindings);
- 
- mozilla::Maybe<GlobalScope::Data*>
- NewGlobalScopeData(JSContext* context, ParseContext::Scope& scope, LifoAlloc& alloc, ParseContext* pc);
- mozilla::Maybe<EvalScope::Data*>
- NewEvalScopeData(JSContext* context, ParseContext::Scope& scope, LifoAlloc& alloc, ParseContext* pc);
-diff --git a/js/src/tests/non262/async-functions/await-in-parameters-of-async-func.js b/js/src/tests/non262/async-functions/await-in-parameters-of-async-func.js
-new file mode 100644
---- /dev/null
-+++ b/js/src/tests/non262/async-functions/await-in-parameters-of-async-func.js
-@@ -0,0 +1,67 @@
-+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
-+/*
-+ * Any copyright is dedicated to the Public Domain.
-+ * http://creativecommons.org/licenses/publicdomain/
-+ * Contributor: 
-+ */
-+
-+//-----------------------------------------------------------------------------
-+var BUGNUMBER = 1478910;
-+var summary = 'JSMSG_AWAIT_IN_DEFAULT error for incomplete await expr in async function/generator parameter';
-+
-+
-+//-----------------------------------------------------------------------------
-+test();
-+//-----------------------------------------------------------------------------
-+
-+function test()
-+{
-+  printBugNumber(BUGNUMBER);
-+  printStatus(summary);
-+
-+  let testAwaitInDefaultExprOfAsyncFunc = (code) => {
-+  	assertThrowsInstanceOf(() => eval(code), SyntaxError, "await can't be used in default expression");
-+  };
-+
-+  let testNoException = (code) => {
-+  	assertEq(completesNormally(code), true);
-+  };
-+
-+  // https://www.ecma-international.org/ecma-262/9.0/
-+
-+  // Async Generator Function Definitions : AsyncGeneratorDeclaration & AsyncGeneratorExpression
-+  // async function* f() {}
-+  // f = async function*() {}
-+  testAwaitInDefaultExprOfAsyncFunc("async function* f(a = await) {}");
-+  testAwaitInDefaultExprOfAsyncFunc("let f = async function*(a = await) {}");
-+
-+  testAwaitInDefaultExprOfAsyncFunc("function f(a = async function*(a = await) {}) {}");
-+  testAwaitInDefaultExprOfAsyncFunc("function f() { a = async function*(a = await) {}; }");
-+
-+  testAwaitInDefaultExprOfAsyncFunc("async function* f() { a = async function*(a = await) {}; }");
-+  testNoException("async function* f() { let a = function(a = await) {}; }");
-+
-+  testNoException("async function* f(a = async function*() { await 1; }) {}");
-+
-+  // Async Function Definitions : AsyncFunctionDeclaration & AsyncFunctionExpression
-+  // async function f() {}
-+  // f = async function() {}
-+  testAwaitInDefaultExprOfAsyncFunc("async function f(a = await) {}");
-+  testAwaitInDefaultExprOfAsyncFunc("let f = async function(a = await) {}");
-+
-+  testAwaitInDefaultExprOfAsyncFunc("function f(a = async function(a = await) {}) {}");
-+  testAwaitInDefaultExprOfAsyncFunc("function f() { a = async function(a = await) {}; }");
-+
-+  testAwaitInDefaultExprOfAsyncFunc("async function f() { a = async function(a = await) {}; }");
-+  testNoException("async function f() { let a = function(a = await) {}; }");
-+
-+  testNoException("async function f(a = async function() { await 1; }) {}");
-+
-+  // Async Arrow Function Definitions : AsyncArrowFunction
-+  // async () => {}
-+  testAwaitInDefaultExprOfAsyncFunc("async (a = await) => {}");
-+
-+  testNoException("async (a = async () => { await 1; }) => {}");
-+
-+  reportCompare(true, true, summary);
-+}

frg/work-js/mozilla-release/patches/mozilla-central-push_431427.patch

@@ -1,554 +0,0 @@
-# HG changeset patch
-# User Ted Campbell <tcampbell@mozilla.com>
-# Date 1534169521 14400
-#      Mon Aug 13 10:12:01 2018 -0400
-# Node ID 490b0d605859e612832f6b655d4168e39a30ceb1
-# Parent  0dcc490db922fc504a1b92339be000260448d75b
-Bug 1482931 - Cleanup const-ness of statics in js/src. r=waldo
-
-Mark read-only global data as const. Replacing |const char* x[]| with
-|const char* const x[]|. Replacing |static const char* x = "..."| with
-|static const char x[] = "..."|.
-
-MozReview-Commit-ID: Ftv7ziIAWGh
-
-diff --git a/js/src/gc/GC.cpp b/js/src/gc/GC.cpp
---- a/js/src/gc/GC.cpp
-+++ b/js/src/gc/GC.cpp
-@@ -1033,17 +1033,17 @@ GCRuntime::GCRuntime(JSRuntime* rt) :
- void
- GCRuntime::getZealBits(uint32_t* zealBits, uint32_t* frequency, uint32_t* scheduled)
- {
-     *zealBits = zealModeBits;
-     *frequency = zealFrequency;
-     *scheduled = nextScheduled;
- }
- 
--const char* gc::ZealModeHelpText =
-+const char gc::ZealModeHelpText[] =
-     "  Specifies how zealous the garbage collector should be. Some of these modes can\n"
-     "  be set simultaneously, by passing multiple level options, e.g. \"2;4\" will activate\n"
-     "  both modes 2 and 4. Modes can be specified by name or number.\n"
-     "  \n"
-     "  Values:\n"
-     "    0:  (None) Normal amount of collection (resets all modes)\n"
-     "    1:  (RootsChange) Collect when roots are added or removed\n"
-     "    2:  (Alloc) Collect when every N allocations (default: 100)\n"
-@@ -1239,17 +1239,17 @@ GCRuntime::parseAndSetZeal(const char* s
-     }
- 
-     return true;
- }
- 
- static const char*
- AllocKindName(AllocKind kind)
- {
--    static const char* names[] = {
-+    static const char* const names[] = {
- #define EXPAND_THING_NAME(allocKind, _1, _2, _3, _4, _5, _6) \
-         #allocKind,
- FOR_EACH_ALLOCKIND(EXPAND_THING_NAME)
- #undef EXPAND_THING_NAME
-     };
-     static_assert(ArrayLength(names) == size_t(AllocKind::LIMIT),
-                   "names array should have an entry for every AllocKind");
- 
-diff --git a/js/src/gc/GC.h b/js/src/gc/GC.h
---- a/js/src/gc/GC.h
-+++ b/js/src/gc/GC.h
-@@ -140,17 +140,17 @@ void
- MergeRealms(JS::Realm* source, JS::Realm* target);
- 
- enum VerifierType {
-     PreBarrierVerifier
- };
- 
- #ifdef JS_GC_ZEAL
- 
--extern const char* ZealModeHelpText;
-+extern const char ZealModeHelpText[];
- 
- /* Check that write barriers have been used correctly. See gc/Verifier.cpp. */
- void
- VerifyBarriers(JSRuntime* rt, VerifierType type);
- 
- void
- MaybeVerifyBarriers(JSContext* cx, bool always = false);
- 
-diff --git a/js/src/gc/Nursery.cpp b/js/src/gc/Nursery.cpp
---- a/js/src/gc/Nursery.cpp
-+++ b/js/src/gc/Nursery.cpp
-@@ -621,17 +621,17 @@ js::Nursery::renderProfileJSON(JSONPrint
-     // in non-nightly builds.
-     json.property("cells_allocated_nursery", runtime()->gc.stats().allocsSinceMinorGCNursery());
-     json.property("cells_allocated_tenured", runtime()->gc.stats().allocsSinceMinorGCTenured());
- #endif
- 
-     json.beginObjectProperty("phase_times");
- 
- #define EXTRACT_NAME(name, text) #name,
--    static const char* names[] = {
-+    static const char* const names[] = {
- FOR_EACH_NURSERY_PROFILE_TIME(EXTRACT_NAME)
- #undef EXTRACT_NAME
-     "" };
- 
-     size_t i = 0;
-     for (auto time : profileDurations_)
-         json.property(names[i++], time, json.MICROSECONDS);
- 
-diff --git a/js/src/jit/CacheIR.cpp b/js/src/jit/CacheIR.cpp
---- a/js/src/jit/CacheIR.cpp
-+++ b/js/src/jit/CacheIR.cpp
-@@ -21,17 +21,17 @@
- #include "vm/UnboxedObject-inl.h"
- 
- using namespace js;
- using namespace js::jit;
- 
- using mozilla::DebugOnly;
- using mozilla::Maybe;
- 
--const char* js::jit::CacheKindNames[] = {
-+const char* const js::jit::CacheKindNames[] = {
- #define DEFINE_KIND(kind) #kind,
-     CACHE_IR_KINDS(DEFINE_KIND)
- #undef DEFINE_KIND
- };
- 
- void
- CacheIRWriter::assertSameCompartment(JSObject* obj) {
-     assertSameCompartmentDebugOnly(cx_, obj);
-diff --git a/js/src/jit/CacheIR.h b/js/src/jit/CacheIR.h
---- a/js/src/jit/CacheIR.h
-+++ b/js/src/jit/CacheIR.h
-@@ -171,17 +171,17 @@ class TypedOperandId : public OperandId
- 
- enum class CacheKind : uint8_t
- {
- #define DEFINE_KIND(kind) kind,
-     CACHE_IR_KINDS(DEFINE_KIND)
- #undef DEFINE_KIND
- };
- 
--extern const char* CacheKindNames[];
-+extern const char* const CacheKindNames[];
- 
- #define CACHE_IR_OPS(_)                   \
-     _(GuardIsObject)                      \
-     _(GuardIsObjectOrNull)                \
-     _(GuardIsNullOrUndefined)             \
-     _(GuardIsNotNullOrUndefined)          \
-     _(GuardIsNull)                        \
-     _(GuardIsUndefined)                   \
-diff --git a/js/src/jit/IonOptimizationLevels.cpp b/js/src/jit/IonOptimizationLevels.cpp
---- a/js/src/jit/IonOptimizationLevels.cpp
-+++ b/js/src/jit/IonOptimizationLevels.cpp
-@@ -10,17 +10,17 @@
- #include "vm/JSScript.h"
- 
- using namespace js;
- using namespace js::jit;
- 
- namespace js {
- namespace jit {
- 
--OptimizationLevelInfo IonOptimizations;
-+const OptimizationLevelInfo IonOptimizations;
- 
- const uint32_t OptimizationInfo::CompilerWarmupThreshold = 1000;
- const uint32_t OptimizationInfo::CompilerSmallFunctionWarmupThreshold = CompilerWarmupThreshold;
- 
- void
- OptimizationInfo::initNormalOptimizationInfo()
- {
-     level_ = OptimizationLevel::Normal;
-diff --git a/js/src/jit/IonOptimizationLevels.h b/js/src/jit/IonOptimizationLevels.h
---- a/js/src/jit/IonOptimizationLevels.h
-+++ b/js/src/jit/IonOptimizationLevels.h
-@@ -303,14 +303,14 @@ class OptimizationLevelInfo
-     }
- 
-     OptimizationLevel nextLevel(OptimizationLevel level) const;
-     OptimizationLevel firstLevel() const;
-     bool isLastLevel(OptimizationLevel level) const;
-     OptimizationLevel levelForScript(JSScript* script, jsbytecode* pc = nullptr) const;
- };
- 
--extern OptimizationLevelInfo IonOptimizations;
-+extern const OptimizationLevelInfo IonOptimizations;
- 
- } // namespace jit
- } // namespace js
- 
- #endif /* jit_IonOptimizationLevels_h */
-diff --git a/js/src/jit/JitSpewer.cpp b/js/src/jit/JitSpewer.cpp
---- a/js/src/jit/JitSpewer.cpp
-+++ b/js/src/jit/JitSpewer.cpp
-@@ -98,17 +98,17 @@ static size_t ChannelIndentLevel[] =
- #define JITSPEW_CHANNEL(name) 0,
-     JITSPEW_CHANNEL_LIST(JITSPEW_CHANNEL)
- #undef JITSPEW_CHANNEL
- };
- 
- static bool
- FilterContainsLocation(JSScript* function)
- {
--    static const char* filter = getenv("IONFILTER");
-+    static const char* const filter = getenv("IONFILTER");
- 
-     // If there is no filter we accept all outputs.
-     if (!filter || !filter[0])
-         return true;
- 
-     // Disable wasm output when filter is set.
-     if (!function)
-         return false;
-diff --git a/js/src/jit/ScalarReplacement.cpp b/js/src/jit/ScalarReplacement.cpp
---- a/js/src/jit/ScalarReplacement.cpp
-+++ b/js/src/jit/ScalarReplacement.cpp
-@@ -307,17 +307,17 @@ IsObjectEscaped(MInstruction* ins, JSObj
-     JitSpew(JitSpew_Escape, "Object is not escaped");
-     return false;
- }
- 
- class ObjectMemoryView : public MDefinitionVisitorDefaultNoop
- {
-   public:
-     typedef MObjectState BlockState;
--    static const char* phaseName;
-+    static const char phaseName[];
- 
-   private:
-     TempAllocator& alloc_;
-     MConstant* undefinedVal_;
-     MInstruction* obj_;
-     MBasicBlock* startBlock_;
-     BlockState* state_;
- 
-@@ -365,17 +365,18 @@ class ObjectMemoryView : public MDefinit
-     void visitLoadUnboxedString(MLoadUnboxedString* ins);
- 
-   private:
-     void storeOffset(MInstruction* ins, size_t offset, MDefinition* value);
-     void loadOffset(MInstruction* ins, size_t offset);
-     void visitObjectGuard(MInstruction* ins, MDefinition* operand);
- };
- 
--const char* ObjectMemoryView::phaseName = "Scalar Replacement of Object";
-+/* static */ const char
-+ObjectMemoryView::phaseName[] = "Scalar Replacement of Object";
- 
- ObjectMemoryView::ObjectMemoryView(TempAllocator& alloc, MInstruction* obj)
-   : alloc_(alloc),
-     undefinedVal_(nullptr),
-     obj_(obj),
-     startBlock_(obj->block()),
-     state_(nullptr),
-     lastResumePoint_(nullptr),
-diff --git a/js/src/jsnum.cpp b/js/src/jsnum.cpp
---- a/js/src/jsnum.cpp
-+++ b/js/src/jsnum.cpp
-@@ -1240,17 +1240,17 @@ js::InitNumberClass(JSContext* cx, Handl
- 
-     if (!LinkConstructorAndPrototype(cx, ctor, numberProto))
-         return nullptr;
- 
-     /*
-      * Our NaN must be one particular canonical value, because we rely on NaN
-      * encoding for our value representation.  See Value.h.
-      */
--    static JSConstDoubleSpec number_constants[] = {
-+    static const JSConstDoubleSpec number_constants[] = {
-         {"NaN",               GenericNaN()               },
-         {"POSITIVE_INFINITY", mozilla::PositiveInfinity<double>() },
-         {"NEGATIVE_INFINITY", mozilla::NegativeInfinity<double>() },
-         {"MAX_VALUE",         1.7976931348623157E+308    },
-         {"MIN_VALUE",         MinNumberValue<double>()   },
-         /* ES6 (April 2014 draft) 20.1.2.6 */
-         {"MAX_SAFE_INTEGER",  9007199254740991           },
-         /* ES6 (April 2014 draft) 20.1.2.10 */
-diff --git a/js/src/proxy/ScriptedProxyHandler.cpp b/js/src/proxy/ScriptedProxyHandler.cpp
---- a/js/src/proxy/ScriptedProxyHandler.cpp
-+++ b/js/src/proxy/ScriptedProxyHandler.cpp
-@@ -30,17 +30,17 @@ IsCompatiblePropertyDescriptor(JSContext
- {
-     // precondition:  we won't set details if checks pass, so it must be null here.
-     MOZ_ASSERT(*errorDetails == nullptr);
- 
-     // Step 2.
-     if (!current.object()) {
-         // Step 2a-b,e.  As |O| is always undefined, steps 2c-d fall away.
-         if (!extensible) {
--            static const char* DETAILS_NOT_EXTENSIBLE =
-+            static const char DETAILS_NOT_EXTENSIBLE[] =
-                 "proxy can't report an extensible object as non-extensible";
-             *errorDetails = DETAILS_NOT_EXTENSIBLE;
-         }
-         return true;
-     }
- 
-     // Step 3.
-     if (!desc.hasValue() && !desc.hasWritable() &&
-@@ -68,63 +68,63 @@ IsCompatiblePropertyDescriptor(JSContext
-         if (same)
-             return true;
-     }
- 
-     // Step 5.
-     if (!current.configurable()) {
-         // Step 5a.
-         if (desc.hasConfigurable() && desc.configurable()) {
--            static const char* DETAILS_CANT_REPORT_NC_AS_C =
-+            static const char DETAILS_CANT_REPORT_NC_AS_C[] =
-                 "proxy can't report an existing non-configurable property as configurable";
-             *errorDetails = DETAILS_CANT_REPORT_NC_AS_C;
-             return true;
-         }
- 
-         // Step 5b.
-         if (desc.hasEnumerable() && desc.enumerable() != current.enumerable()) {
--            static const char* DETAILS_ENUM_DIFFERENT =
-+            static const char DETAILS_ENUM_DIFFERENT[] =
-                 "proxy can't report a different 'enumerable' from target when target is not configurable";
-             *errorDetails = DETAILS_ENUM_DIFFERENT;
-             return true;
-         }
-     }
- 
-     // Step 6.
-     if (desc.isGenericDescriptor())
-         return true;
- 
-     // Step 7.
-     if (current.isDataDescriptor() != desc.isDataDescriptor()) {
-         // Steps 7a, 11.  As |O| is always undefined, steps 2b-c fall away.
-         if (!current.configurable()) {
--            static const char* DETAILS_CURRENT_NC_DIFF_TYPE =
-+            static const char DETAILS_CURRENT_NC_DIFF_TYPE[] =
-                 "proxy can't report a different descriptor type when target is not configurable";
-             *errorDetails = DETAILS_CURRENT_NC_DIFF_TYPE;
-         }
-         return true;
-     }
- 
-     // Step 8.
-     if (current.isDataDescriptor()) {
-         MOZ_ASSERT(desc.isDataDescriptor()); // by step 7
-         if (!current.configurable() && !current.writable()) {
-             if (desc.hasWritable() && desc.writable()) {
--                static const char* DETAILS_CANT_REPORT_NW_AS_W =
-+                static const char DETAILS_CANT_REPORT_NW_AS_W[] =
-                     "proxy can't report a non-configurable, non-writable property as writable";
-                 *errorDetails = DETAILS_CANT_REPORT_NW_AS_W;
-                 return true;
-             }
- 
-             if (desc.hasValue()) {
-                 bool same;
-                 if (!SameValue(cx, desc.value(), current.value(), &same))
-                     return false;
-                 if (!same) {
--                    static const char* DETAILS_DIFFERENT_VALUE =
-+                    static const char DETAILS_DIFFERENT_VALUE[] =
-                         "proxy must report the same value for the non-writable, non-configurable property";
-                     *errorDetails = DETAILS_DIFFERENT_VALUE;
-                     return true;
-                 }
-             }
-         }
- 
-         return true;
-@@ -132,22 +132,22 @@ IsCompatiblePropertyDescriptor(JSContext
- 
-     // Step 9.
-     MOZ_ASSERT(current.isAccessorDescriptor()); // by step 8
-     MOZ_ASSERT(desc.isAccessorDescriptor()); // by step 7
- 
-     if (current.configurable())
-         return true;
-     if (desc.hasSetterObject() && (desc.setter() != current.setter())) {
--        static const char* DETAILS_SETTERS_DIFFERENT =
-+        static const char DETAILS_SETTERS_DIFFERENT[] =
-             "proxy can't report different setters for a currently non-configurable property";
-         *errorDetails = DETAILS_SETTERS_DIFFERENT;
-     }
-     else if (desc.hasGetterObject() && (desc.getter() != current.getter())) {
--        static const char* DETAILS_GETTERS_DIFFERENT =
-+        static const char DETAILS_GETTERS_DIFFERENT[] =
-             "proxy can't report different getters for a currently non-configurable property";
-         *errorDetails = DETAILS_GETTERS_DIFFERENT;
-     }
-     return true;
- }
- 
- // Get the [[ProxyHandler]] of a scripted proxy.
- /* static */ JSObject*
-@@ -651,17 +651,17 @@ ScriptedProxyHandler::defineProperty(JSC
-                                             &errorDetails))
-             return false;
- 
-         if (errorDetails)
-             return js::Throw(cx, id, JSMSG_CANT_DEFINE_INVALID, errorDetails);
- 
-         // Step 16b.
-         if (settingConfigFalse && targetDesc.configurable()) {
--            static const char* DETAILS_CANT_REPORT_C_AS_NC =
-+            static const char DETAILS_CANT_REPORT_C_AS_NC[] =
-                 "proxy can't define an existing configurable property as non-configurable";
-             return js::Throw(cx, id, JSMSG_CANT_DEFINE_INVALID, DETAILS_CANT_REPORT_C_AS_NC);
-         }
-     }
- 
-     // Step 17.
-     return result.succeed();
- }
-diff --git a/js/src/vm/ArrayBufferObject.cpp b/js/src/vm/ArrayBufferObject.cpp
---- a/js/src/vm/ArrayBufferObject.cpp
-+++ b/js/src/vm/ArrayBufferObject.cpp
-@@ -1487,17 +1487,17 @@ ArrayBufferObject::addView(JSContext* cx
-     }
-     return ObjectRealm::get(this).innerViews.get().addView(cx, this, view);
- }
- 
- /*
-  * InnerViewTable
-  */
- 
--static size_t VIEW_LIST_MAX_LENGTH = 500;
-+constexpr size_t VIEW_LIST_MAX_LENGTH = 500;
- 
- bool
- InnerViewTable::addView(JSContext* cx, ArrayBufferObject* buffer, ArrayBufferViewObject* view)
- {
-     // ArrayBufferObject entries are only added when there are multiple views.
-     MOZ_ASSERT(buffer->firstView());
- 
-     Map::AddPtr p = map.lookupForAdd(buffer);
-diff --git a/js/src/vm/BytecodeUtil.cpp b/js/src/vm/BytecodeUtil.cpp
---- a/js/src/vm/BytecodeUtil.cpp
-+++ b/js/src/vm/BytecodeUtil.cpp
-@@ -68,27 +68,27 @@ const JSCodeSpec js::CodeSpec[] = {
-     FOR_EACH_OPCODE(MAKE_CODESPEC)
- #undef MAKE_CODESPEC
- };
- 
- /*
-  * Each element of the array is either a source literal associated with JS
-  * bytecode or null.
-  */
--static const char * const CodeToken[] = {
-+static const char* const CodeToken[] = {
- #define TOKEN(op, val, name, token, ...)  token,
-     FOR_EACH_OPCODE(TOKEN)
- #undef TOKEN
- };
- 
- /*
-  * Array of JS bytecode names used by PC count JSON, DEBUG-only Disassemble
-  * and JIT debug spew.
-  */
--const char * const js::CodeName[] = {
-+const char* const js::CodeName[] = {
- #define OPNAME(op, val, name, ...)  name,
-     FOR_EACH_OPCODE(OPNAME)
- #undef OPNAME
- };
- 
- /************************************************************************/
- 
- static bool
-@@ -109,17 +109,18 @@ js::GetVariableBytecodeLength(jsbytecode
-         unsigned ncases = unsigned(high - low + 1);
-         return 1 + 3 * JUMP_OFFSET_LEN + ncases * JUMP_OFFSET_LEN;
-       }
-       default:
-         MOZ_CRASH("Unexpected op");
-     }
- }
- 
--const char * PCCounts::numExecName = "interp";
-+/* static */ const char
-+PCCounts::numExecName[] = "interp";
- 
- static MOZ_MUST_USE bool
- DumpIonScriptCounts(Sprinter* sp, HandleScript script, jit::IonScriptCounts* ionCounts)
- {
-     if (!sp->jsprintf("IonScript [%zu blocks]:\n", ionCounts->numBlocks()))
-         return false;
- 
-     for (size_t i = 0; i < ionCounts->numBlocks(); i++) {
-diff --git a/js/src/vm/BytecodeUtil.h b/js/src/vm/BytecodeUtil.h
---- a/js/src/vm/BytecodeUtil.h
-+++ b/js/src/vm/BytecodeUtil.h
-@@ -807,17 +807,17 @@ class PCCounts
- 
-     uint64_t& numExec() {
-         return numExec_;
-     }
-     uint64_t numExec() const {
-         return numExec_;
-     }
- 
--    static const char* numExecName;
-+    static const char numExecName[];
- };
- 
- static inline jsbytecode*
- GetNextPc(jsbytecode* pc)
- {
-     return pc + GetBytecodeLength(pc);
- }
- 
-diff --git a/js/src/vm/TraceLoggingGraph.cpp b/js/src/vm/TraceLoggingGraph.cpp
---- a/js/src/vm/TraceLoggingGraph.cpp
-+++ b/js/src/vm/TraceLoggingGraph.cpp
-@@ -51,17 +51,17 @@ TraceLoggerGraphState* traceLoggerGraphS
- // Return a filename relative to the output directory. %u and %d substitutions
- // are allowed, with %u standing for a full 32-bit number and %d standing for
- // an up to 3-digit number.
- static js::UniqueChars
- MOZ_FORMAT_PRINTF(1, 2)
- AllocTraceLogFilename(const char* pattern, ...) {
-     va_list ap;
- 
--    static const char* outdir = getenv("TLDIR") ? getenv("TLDIR") : DEFAULT_TRACE_LOG_DIR;
-+    static const char* const outdir = getenv("TLDIR") ? getenv("TLDIR") : DEFAULT_TRACE_LOG_DIR;
-     size_t len = strlen(outdir) + 1; // "+ 1" is for the '/'
- 
-     for (const char* p = pattern; *p; p++) {
-         if (*p == '%') {
-             p++;
-             if (*p == 'u')
-                 len += sizeof("4294967295") - 1;
-             else if (*p == 'd')
-diff --git a/js/src/wasm/WasmFrameIter.cpp b/js/src/wasm/WasmFrameIter.cpp
---- a/js/src/wasm/WasmFrameIter.cpp
-+++ b/js/src/wasm/WasmFrameIter.cpp
-@@ -1280,21 +1280,21 @@ ThunkedNativeToDescription(SymbolicAddre
- const char*
- ProfilingFrameIterator::label() const
- {
-     MOZ_ASSERT(!done());
- 
-     // Use the same string for both time inside and under so that the two
-     // entries will be coalesced by the profiler.
-     // Must be kept in sync with /tools/profiler/tests/test_asm.js
--    static const char* importJitDescription = "fast exit trampoline (in wasm)";
--    static const char* importInterpDescription = "slow exit trampoline (in wasm)";
--    static const char* builtinNativeDescription = "fast exit trampoline to native (in wasm)";
--    static const char* trapDescription = "trap handling (in wasm)";
--    static const char* debugTrapDescription = "debug trap handling (in wasm)";
-+    static const char importJitDescription[] = "fast exit trampoline (in wasm)";
-+    static const char importInterpDescription[] = "slow exit trampoline (in wasm)";
-+    static const char builtinNativeDescription[] = "fast exit trampoline to native (in wasm)";
-+    static const char trapDescription[] = "trap handling (in wasm)";
-+    static const char debugTrapDescription[] = "debug trap handling (in wasm)";
- 
-     if (!exitReason_.isFixed())
-         return ThunkedNativeToDescription(exitReason_.symbolic());
- 
-     switch (exitReason_.fixed()) {
-       case ExitReason::Fixed::None:
-         break;
-       case ExitReason::Fixed::ImportJit:

frg/work-js/mozilla-release/patches/mozilla-central-push_431428.patch

@@ -1,210 +0,0 @@
-# HG changeset patch
-# User Ted Campbell <tcampbell@mozilla.com>
-# Date 1534172604 14400
-#      Mon Aug 13 11:03:24 2018 -0400
-# Node ID a77d82cbe1cc5af755402e6c853c4ab36522f1e8
-# Parent  490b0d605859e612832f6b655d4168e39a30ceb1
-Bug 1482931 - Simplify some static initializers in js/src. r=jandem
-
-MozReview-Commit-ID: JLNqziLmGrx
-
-diff --git a/js/src/jit/JitSpewer.cpp b/js/src/jit/JitSpewer.cpp
---- a/js/src/jit/JitSpewer.cpp
-+++ b/js/src/jit/JitSpewer.cpp
-@@ -81,49 +81,51 @@ class IonSpewer
- // IonSpewer singleton.
- static IonSpewer ionspewer;
- 
- static bool LoggingChecked = false;
- static_assert(JitSpew_Terminator <= 64, "Increase the size of the LoggingBits global.");
- static uint64_t LoggingBits = 0;
- static mozilla::Atomic<uint32_t, mozilla::Relaxed> filteredOutCompilations(0);
- 
--static const char * const ChannelNames[] =
-+static const char* const ChannelNames[] =
- {
- #define JITSPEW_CHANNEL(name) #name,
-     JITSPEW_CHANNEL_LIST(JITSPEW_CHANNEL)
- #undef JITSPEW_CHANNEL
- };
- 
- static size_t ChannelIndentLevel[] =
- {
- #define JITSPEW_CHANNEL(name) 0,
-     JITSPEW_CHANNEL_LIST(JITSPEW_CHANNEL)
- #undef JITSPEW_CHANNEL
- };
- 
-+// The IONFILTER environment variable specifies an expression to select only
-+// certain functions for spewing to reduce amount of log data generated.
-+static const char* gSpewFilter = nullptr;
-+
- static bool
- FilterContainsLocation(JSScript* function)
- {
--    static const char* const filter = getenv("IONFILTER");
--
-     // If there is no filter we accept all outputs.
--    if (!filter || !filter[0])
-+    if (!gSpewFilter || !gSpewFilter[0])
-         return true;
- 
-     // Disable wasm output when filter is set.
-     if (!function)
-         return false;
- 
-     const char* filename = function->filename();
-     const size_t line = function->lineno();
-     const size_t filelen = strlen(filename);
--    const char* index = strstr(filter, filename);
-+    const char* index = strstr(gSpewFilter, filename);
-     while (index) {
--        if (index == filter || index[-1] == ',') {
-+        if (index == gSpewFilter || index[-1] == ',') {
-             if (index[filelen] == 0 || index[filelen] == ',')
-                 return true;
-             if (index[filelen] == ':' && line != size_t(-1)) {
-                 size_t read_line = strtoul(&index[filelen + 1], nullptr, 10);
-                 if (read_line == line)
-                     return true;
-             }
-         }
-@@ -158,16 +160,19 @@ IonSpewer::release()
- }
- 
- bool
- IonSpewer::init()
- {
-     if (inited_)
-         return true;
- 
-+    // Filter expression for spewing
-+    gSpewFilter = getenv("IONFILTER");
-+
-     const size_t bufferLength = 256;
-     char c1Buffer[bufferLength];
-     char jsonBuffer[bufferLength];
-     const char *c1Filename = JIT_SPEW_DIR "/ion.cfg";
-     const char *jsonFilename = JIT_SPEW_DIR "/ion.json";
- 
-     const char* usePid = getenv("ION_SPEW_BY_PID");
-     if (usePid && *usePid != 0) {
-diff --git a/js/src/jsfriendapi.cpp b/js/src/jsfriendapi.cpp
---- a/js/src/jsfriendapi.cpp
-+++ b/js/src/jsfriendapi.cpp
-@@ -1135,18 +1135,17 @@ JS::ForceLexicalInitialization(JSContext
-     }
-     return initializedAny;
- }
- 
- extern JS_FRIEND_API(int)
- JS::IsGCPoisoning()
- {
- #ifdef JS_GC_POISONING
--    static bool disablePoison = bool(getenv("JSGC_DISABLE_POISONING"));
--    return !disablePoison;
-+    return !js::gDisablePoisoning;
- #else
-     return false;
- #endif
- }
- 
- struct DumpHeapTracer : public JS::CallbackTracer, public WeakMapTracer
- {
-     const char* prefix;
-diff --git a/js/src/jsutil.cpp b/js/src/jsutil.cpp
---- a/js/src/jsutil.cpp
-+++ b/js/src/jsutil.cpp
-@@ -159,16 +159,18 @@ ResetSimulatedInterrupt()
-     maxInterruptChecks = UINT64_MAX;
-     interruptCheckFailAlways = false;
- }
- 
- } // namespace oom
- } // namespace js
- #endif // defined(DEBUG) || defined(JS_OOM_BREAKPOINT)
- 
-+bool js::gDisablePoisoning = false;
-+
- JS_PUBLIC_DATA(arena_id_t) js::MallocArena;
- JS_PUBLIC_DATA(arena_id_t) js::ArrayBufferContentsArena;
- 
- void
- js::InitMallocAllocator()
- {
-     MallocArena = moz_create_arena();
-     ArrayBufferContentsArena = moz_create_arena();
-diff --git a/js/src/jsutil.h b/js/src/jsutil.h
---- a/js/src/jsutil.h
-+++ b/js/src/jsutil.h
-@@ -338,22 +338,23 @@ AlwaysPoison(void* ptr, uint8_t value, s
-     }
- #else // !DEBUG
-     memset(ptr, value, num);
- #endif // !DEBUG
- 
-     SetMemCheckKind(ptr, num, kind);
- }
- 
-+// JSGC_DISABLE_POISONING environment variable
-+extern bool gDisablePoisoning;
-+
- static inline void
- Poison(void* ptr, uint8_t value, size_t num, MemCheckKind kind)
- {
--    static bool disablePoison = !mozilla::recordreplay::IsRecordingOrReplaying()
--                             && bool(getenv("JSGC_DISABLE_POISONING"));
--    if (!disablePoison)
-+    if (!js::gDisablePoisoning)
-         AlwaysPoison(ptr, value, num, kind);
- }
- 
- } // namespace js
- 
- /* Crash diagnostics by default in debug and on nightly channel. */
- #if defined(DEBUG) || defined(NIGHTLY_BUILD)
- # define JS_CRASH_DIAGNOSTICS 1
-diff --git a/js/src/vm/Initialization.cpp b/js/src/vm/Initialization.cpp
---- a/js/src/vm/Initialization.cpp
-+++ b/js/src/vm/Initialization.cpp
-@@ -101,16 +101,18 @@ JS::detail::InitWithFailureDiagnostic(bo
- #endif
- 
-     RETURN_IF_FAIL(js::TlsContext.init());
- 
- #if defined(DEBUG) || defined(JS_OOM_BREAKPOINT)
-     RETURN_IF_FAIL(js::oom::InitThreadType());
- #endif
- 
-+    js::gDisablePoisoning = bool(getenv("JSGC_DISABLE_POISONING"));
-+
-     js::InitMallocAllocator();
- 
-     RETURN_IF_FAIL(js::Mutex::Init());
- 
-     js::gc::InitMemorySubsystem(); // Ensure gc::SystemPageSize() works.
- 
-     RETURN_IF_FAIL(js::jit::InitProcessExecutableMemory());
- 
-diff --git a/js/src/vm/TraceLoggingGraph.cpp b/js/src/vm/TraceLoggingGraph.cpp
---- a/js/src/vm/TraceLoggingGraph.cpp
-+++ b/js/src/vm/TraceLoggingGraph.cpp
-@@ -51,17 +51,17 @@ TraceLoggerGraphState* traceLoggerGraphS
- // Return a filename relative to the output directory. %u and %d substitutions
- // are allowed, with %u standing for a full 32-bit number and %d standing for
- // an up to 3-digit number.
- static js::UniqueChars
- MOZ_FORMAT_PRINTF(1, 2)
- AllocTraceLogFilename(const char* pattern, ...) {
-     va_list ap;
- 
--    static const char* const outdir = getenv("TLDIR") ? getenv("TLDIR") : DEFAULT_TRACE_LOG_DIR;
-+    const char* outdir = getenv("TLDIR") ? getenv("TLDIR") : DEFAULT_TRACE_LOG_DIR;
-     size_t len = strlen(outdir) + 1; // "+ 1" is for the '/'
- 
-     for (const char* p = pattern; *p; p++) {
-         if (*p == '%') {
-             p++;
-             if (*p == 'u')
-                 len += sizeof("4294967295") - 1;
-             else if (*p == 'd')