From 88192f26e22978f114a42c0fdea73febb8abea29 Mon Sep 17 00:00:00 2001
From: Michael Comella <michael.l.comella@gmail.com>
Date: Tue, 4 Nov 2014 11:10:00 -0800
Subject: [PATCH 001/153] Bug 1085487 - Part 1: Center the reload button.
 r=lucasr

---
 .../base/resources/values-large-v11/styles.xml   | 16 +++++++++++++---
 mobile/android/base/resources/values/dimens.xml  |  1 -
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/mobile/android/base/resources/values-large-v11/styles.xml b/mobile/android/base/resources/values-large-v11/styles.xml
index 4ef0fddcdd0..12e142e9042 100644
--- a/mobile/android/base/resources/values-large-v11/styles.xml
+++ b/mobile/android/base/resources/values-large-v11/styles.xml
@@ -104,9 +104,19 @@
         <item name="android:scaleType">center</item>
         <item name="android:background">@drawable/new_tablet_action_bar_button</item>
 
-        <!-- layout_* doesn't work here, likely because it's an ImageButton, so we use padding instead. -->
-        <item name="android:paddingTop">@dimen/new_tablet_browser_toolbar_menu_item_padding_vertical</item>
-        <item name="android:paddingBottom">@dimen/new_tablet_browser_toolbar_menu_item_padding_vertical</item>
+        <!-- layout_width/height doesn't work here, likely because it's
+             an ImageButton, so we use padding instead.
+
+             Because the curve of the reload button is lower than the end of the arrow and thus
+             the top of the view, it is perceived to be slighly lower than the other buttons.
+             Thus we use padding to fill a slightly smaller height than the toolbar and let
+             android:gravity center the image with a slight offset (.5dp higher) instead. Note that
+             this offset also affects the pressed state, but it's hardly noticeable and thus negligible.
+
+             Note: the above change is done on a generic style and thus any other items added
+             to the menu bar may appear to be offset. -->
+        <item name="android:paddingTop">20dp</item>
+        <item name="android:paddingBottom">21dp</item>
         <item name="android:paddingLeft">@dimen/new_tablet_browser_toolbar_menu_item_padding_horizontal</item>
         <item name="android:paddingRight">@dimen/new_tablet_browser_toolbar_menu_item_padding_horizontal</item>
     </style>
diff --git a/mobile/android/base/resources/values/dimens.xml b/mobile/android/base/resources/values/dimens.xml
index 45daa8317af..e2ce1932917 100644
--- a/mobile/android/base/resources/values/dimens.xml
+++ b/mobile/android/base/resources/values/dimens.xml
@@ -36,7 +36,6 @@
     <dimen name="new_tablet_browser_toolbar_menu_item_width">56dp</dimen>
     <!-- Padding combines with an 18dp image to form the menu item width and height. -->
     <dimen name="new_tablet_browser_toolbar_menu_item_padding_horizontal">19dp</dimen>
-    <dimen name="new_tablet_browser_toolbar_menu_item_padding_vertical">21dp</dimen>
     <dimen name="new_tablet_browser_toolbar_menu_item_inset_vertical">5dp</dimen>
     <dimen name="new_tablet_browser_toolbar_menu_item_inset_horizontal">3dp</dimen>
     <dimen name="new_tablet_browser_toolbar_menu_item_corner_radius">5dp</dimen>

From 91c861fe5ca8fc929b271b3adb796a4c45820172 Mon Sep 17 00:00:00 2001
From: Michael Comella <michael.l.comella@gmail.com>
Date: Tue, 4 Nov 2014 11:10:11 -0800
Subject: [PATCH 002/153] Bug 1085487 - Part 2: Center tab count. r=lucasr

---
 .../newtablet/res/layout-large-v11/new_tablet_tabs_counter.xml  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mobile/android/base/newtablet/res/layout-large-v11/new_tablet_tabs_counter.xml b/mobile/android/base/newtablet/res/layout-large-v11/new_tablet_tabs_counter.xml
index 9e9df2869be..33087d8e9ab 100644
--- a/mobile/android/base/newtablet/res/layout-large-v11/new_tablet_tabs_counter.xml
+++ b/mobile/android/base/newtablet/res/layout-large-v11/new_tablet_tabs_counter.xml
@@ -6,7 +6,7 @@
 <org.mozilla.gecko.widget.ThemedTextView xmlns:android="http://schemas.android.com/apk/res/android"
                                          android:layout_width="24dip"
                                          android:layout_height="24dip"
-                                         android:paddingTop="2dip"
+                                         android:paddingTop="3dip"
                                          android:paddingLeft="4dip"
                                          android:background="@drawable/new_tablet_tabs_count_foreground"
                                          android:textAppearance="@style/TextAppearance.Micro"

From da451fde7d51124c49ab5a746e7330ad07a365ff Mon Sep 17 00:00:00 2001
From: Dave Townsend <dtownsend@oxymoronical.com>
Date: Tue, 4 Nov 2014 11:51:06 -0800
Subject: [PATCH 003/153] Bug 1091287: Switch to the right browser before
 displaying a login prompt. r=mrbkap

---
 .../metro/components/LoginManagerPrompter.js  |   2 +-
 dom/ipc/TabParent.cpp                         |  15 ++-
 .../components/LoginManagerPrompter.js        |   2 +-
 .../passwordmgr/LoginManagerParent.jsm        |   2 +-
 .../passwordmgr/nsILoginManagerPrompter.idl   |   6 +-
 .../passwordmgr/nsLoginManagerPrompter.js     |  21 ++--
 .../passwordmgr/test/browser/authenticate.sjs | 110 ++++++++++++++++++
 .../passwordmgr/test/browser/browser.ini      |   3 +
 .../browser/browser_passwordmgr_switchtab.js  |  42 +++++++
 9 files changed, 188 insertions(+), 15 deletions(-)
 create mode 100644 toolkit/components/passwordmgr/test/browser/authenticate.sjs
 create mode 100644 toolkit/components/passwordmgr/test/browser/browser_passwordmgr_switchtab.js

diff --git a/browser/metro/components/LoginManagerPrompter.js b/browser/metro/components/LoginManagerPrompter.js
index f21538714fe..818b4d48123 100644
--- a/browser/metro/components/LoginManagerPrompter.js
+++ b/browser/metro/components/LoginManagerPrompter.js
@@ -123,7 +123,7 @@ LoginManagerPrompter.prototype = {
     },
 
 
-    setE10sData : function (aBrowser) {
+    setE10sData : function (aBrowser, aOpener) {
       // XXX Implement me!
       throw new Error("Not Yet Implemented");
     },
diff --git a/dom/ipc/TabParent.cpp b/dom/ipc/TabParent.cpp
index b0234c8d966..d52eb7b40e0 100644
--- a/dom/ipc/TabParent.cpp
+++ b/dom/ipc/TabParent.cpp
@@ -71,6 +71,7 @@
 #include "nsAuthInformationHolder.h"
 #include "nsICancelable.h"
 #include "gfxPrefs.h"
+#include "nsILoginManagerPrompter.h"
 #include <algorithm>
 
 using namespace mozilla::dom;
@@ -1880,8 +1881,18 @@ TabParent::GetAuthPrompt(uint32_t aPromptReason, const nsIID& iid,
 
   // Get an auth prompter for our window so that the parenting
   // of the dialogs works as it should when using tabs.
-  return wwatch->GetPrompt(window, iid,
-                           reinterpret_cast<void**>(aResult));
+  nsCOMPtr<nsISupports> prompt;
+  rv = wwatch->GetPrompt(window, iid, getter_AddRefs(prompt));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsILoginManagerPrompter> prompter = do_QueryInterface(prompt);
+  if (prompter) {
+    nsCOMPtr<nsIDOMElement> browser = do_QueryInterface(mFrameElement);
+    prompter->SetE10sData(browser, nullptr);
+  }
+
+  *aResult = prompt.forget().take();
+  return NS_OK;
 }
 
 PColorPickerParent*
diff --git a/mobile/android/components/LoginManagerPrompter.js b/mobile/android/components/LoginManagerPrompter.js
index b49c8bbab1b..33dbc49e8e8 100644
--- a/mobile/android/components/LoginManagerPrompter.js
+++ b/mobile/android/components/LoginManagerPrompter.js
@@ -108,7 +108,7 @@ LoginManagerPrompter.prototype = {
         this.log("===== initialized =====");
     },
 
-    setE10sData : function (aBrowser) {
+    setE10sData : function (aBrowser, aOpener) {
         throw new Error("This should be filled in when Android is multiprocess");
     },
 
diff --git a/toolkit/components/passwordmgr/LoginManagerParent.jsm b/toolkit/components/passwordmgr/LoginManagerParent.jsm
index 093a2be7490..4675ff95286 100644
--- a/toolkit/components/passwordmgr/LoginManagerParent.jsm
+++ b/toolkit/components/passwordmgr/LoginManagerParent.jsm
@@ -216,7 +216,7 @@ var LoginManagerParent = {
                                 target.ownerDocument.defaultView :
                                 target.contentWindow);
             if (target.isRemoteBrowser)
-                prompterSvc.setE10sData({ browser: target, opener: opener });
+                prompterSvc.setE10sData(target, opener);
             return prompterSvc;
         }
 
diff --git a/toolkit/components/passwordmgr/nsILoginManagerPrompter.idl b/toolkit/components/passwordmgr/nsILoginManagerPrompter.idl
index 261791fec59..9ddbe787637 100644
--- a/toolkit/components/passwordmgr/nsILoginManagerPrompter.idl
+++ b/toolkit/components/passwordmgr/nsILoginManagerPrompter.idl
@@ -6,9 +6,10 @@
 #include "nsISupports.idl"
 
 interface nsILoginInfo;
+interface nsIDOMElement;
 interface nsIDOMWindow;
 
-[scriptable, uuid(88b75787-a78c-43aa-bfe8-52c3248b8dfd)]
+[scriptable, uuid(425f73b9-b2db-4e8a-88c5-9ac2512934ce)]
 interface nsILoginManagerPrompter : nsISupports {
     /**
      * Initialize the prompter. Must be called before using other interfaces.
@@ -27,8 +28,9 @@ interface nsILoginManagerPrompter : nsISupports {
      * window passed to init.
      *
      * @param aBrowser the <browser> to use for this prompter.
+     * @param aOpener the opener to use for this prompter.
      */
-    void setE10sData(in jsval aData);
+    void setE10sData(in nsIDOMElement aBrowser, in nsIDOMWindow aOpener);
 
     /**
      * Ask the user if they want to save a login (Yes, Never, Not Now)
diff --git a/toolkit/components/passwordmgr/nsLoginManagerPrompter.js b/toolkit/components/passwordmgr/nsLoginManagerPrompter.js
index daf45609723..5733b86617f 100644
--- a/toolkit/components/passwordmgr/nsLoginManagerPrompter.js
+++ b/toolkit/components/passwordmgr/nsLoginManagerPrompter.js
@@ -11,6 +11,7 @@ const Cr = Components.results;
 Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
 Components.utils.import("resource://gre/modules/Services.jsm");
 Components.utils.import("resource://gre/modules/PrivateBrowsingUtils.jsm");
+Components.utils.import("resource://gre/modules/SharedPromptUtils.jsm");
 
 /*
  * LoginManagerPromptFactory
@@ -577,10 +578,14 @@ LoginManagerPrompter.prototype = {
                 "Epic fail in promptAuth: " + e + "\n");
         }
 
-        var ok = canAutologin ||
-                 this._promptService.promptAuth(this._window,
-                                                aChannel, aLevel, aAuthInfo,
-                                                checkboxLabel, checkbox);
+        var ok = canAutologin;
+        if (!ok) {
+          if (this._window)
+            PromptUtils.fireDialogEvent(this._window, "DOMWillOpenModalDialog", this._browser);
+          ok = this._promptService.promptAuth(this._window,
+                                              aChannel, aLevel, aAuthInfo,
+                                              checkboxLabel, checkbox);
+        }
 
         // If there's a notification box, use it to allow the user to
         // determine if the login should be saved. If there isn't a
@@ -713,11 +718,11 @@ LoginManagerPrompter.prototype = {
         this.log("===== initialized =====");
     },
 
-    setE10sData : function (aData) {
+    setE10sData : function (aBrowser, aOpener) {
         if (!(this._window instanceof Ci.nsIDOMChromeWindow))
             throw new Error("Unexpected call");
-        this._browser = aData.browser;
-        this._opener = aData.opener;
+        this._browser = aBrowser;
+        this._opener = aOpener;
     },
 
 
@@ -1224,7 +1229,7 @@ LoginManagerPrompter.prototype = {
             }
 
             let browser;
-            if (useOpener && isE10s) {
+            if (useOpener && this._opener && isE10s) {
                 // In e10s, we have to reconstruct the opener browser from
                 // the CPOW passed in the message (and then passed to us in
                 // setE10sData).
diff --git a/toolkit/components/passwordmgr/test/browser/authenticate.sjs b/toolkit/components/passwordmgr/test/browser/authenticate.sjs
new file mode 100644
index 00000000000..7e4cf3c0252
--- /dev/null
+++ b/toolkit/components/passwordmgr/test/browser/authenticate.sjs
@@ -0,0 +1,110 @@
+function handleRequest(request, response)
+{
+  var match;
+  var requestAuth = true;
+
+  // Allow the caller to drive how authentication is processed via the query.
+  // Eg, http://localhost:8888/authenticate.sjs?user=foo&realm=bar
+  // The extra ? allows the user/pass/realm checks to succeed if the name is
+  // at the beginning of the query string.
+  var query = "?" + request.queryString;
+
+  var expected_user = "test", expected_pass = "testpass", realm = "mochitest";
+
+  // Look for an authentication header, if any, in the request.
+  //
+  // EG: Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==
+  //
+  // This test only supports Basic auth. The value sent by the client is
+  // "username:password", obscured with base64 encoding.
+
+  var actual_user = "", actual_pass = "", authHeader, authPresent = false;
+  if (request.hasHeader("Authorization")) {
+    authPresent = true;
+    authHeader = request.getHeader("Authorization");
+    match = /Basic (.+)/.exec(authHeader);
+    if (match.length != 2)
+        throw "Couldn't parse auth header: " + authHeader;
+
+    var userpass = base64ToString(match[1]); // no atob() :-(
+    match = /(.*):(.*)/.exec(userpass);
+    if (match.length != 3)
+        throw "Couldn't decode auth header: " + userpass;
+    actual_user = match[1];
+    actual_pass = match[2];
+  }
+
+  // Don't request authentication if the credentials we got were what we
+  // expected.
+  if (expected_user == actual_user &&
+    expected_pass == actual_pass) {
+    requestAuth = false;
+  }
+
+  if (requestAuth) {
+    response.setStatusLine("1.0", 401, "Authentication required");
+    response.setHeader("WWW-Authenticate", "basic realm=\"" + realm + "\"", true);
+  } else {
+    response.setStatusLine("1.0", 200, "OK");
+  }
+
+  response.setHeader("Content-Type", "application/xhtml+xml", false);
+  response.write("<html xmlns='http://www.w3.org/1999/xhtml'>");
+  response.write("<p>Login: <span id='ok'>" + (requestAuth ? "FAIL" : "PASS") + "</span></p>\n");
+  response.write("<p>Auth: <span id='auth'>" + authHeader + "</span></p>\n");
+  response.write("<p>User: <span id='user'>" + actual_user + "</span></p>\n");
+  response.write("<p>Pass: <span id='pass'>" + actual_pass + "</span></p>\n");
+  response.write("</html>");
+}
+
+
+// base64 decoder
+//
+// Yoinked from extensions/xml-rpc/src/nsXmlRpcClient.js because btoa()
+// doesn't seem to exist. :-(
+/* Convert Base64 data to a string */
+const toBinaryTable = [
+    -1,-1,-1,-1, -1,-1,-1,-1, -1,-1,-1,-1, -1,-1,-1,-1,
+    -1,-1,-1,-1, -1,-1,-1,-1, -1,-1,-1,-1, -1,-1,-1,-1,
+    -1,-1,-1,-1, -1,-1,-1,-1, -1,-1,-1,62, -1,-1,-1,63,
+    52,53,54,55, 56,57,58,59, 60,61,-1,-1, -1, 0,-1,-1,
+    -1, 0, 1, 2,  3, 4, 5, 6,  7, 8, 9,10, 11,12,13,14,
+    15,16,17,18, 19,20,21,22, 23,24,25,-1, -1,-1,-1,-1,
+    -1,26,27,28, 29,30,31,32, 33,34,35,36, 37,38,39,40,
+    41,42,43,44, 45,46,47,48, 49,50,51,-1, -1,-1,-1,-1
+];
+const base64Pad = '=';
+
+function base64ToString(data) {
+
+    var result = '';
+    var leftbits = 0; // number of bits decoded, but yet to be appended
+    var leftdata = 0; // bits decoded, but yet to be appended
+
+    // Convert one by one.
+    for (var i = 0; i < data.length; i++) {
+        var c = toBinaryTable[data.charCodeAt(i) & 0x7f];
+        var padding = (data[i] == base64Pad);
+        // Skip illegal characters and whitespace
+        if (c == -1) continue;
+
+        // Collect data into leftdata, update bitcount
+        leftdata = (leftdata << 6) | c;
+        leftbits += 6;
+
+        // If we have 8 or more bits, append 8 bits to the result
+        if (leftbits >= 8) {
+            leftbits -= 8;
+            // Append if not padding.
+            if (!padding)
+                result += String.fromCharCode((leftdata >> leftbits) & 0xff);
+            leftdata &= (1 << leftbits) - 1;
+        }
+    }
+
+    // If there are any bits left, the base64 string was corrupted
+    if (leftbits)
+        throw Components.Exception('Corrupted base64 string');
+
+    return result;
+}
diff --git a/toolkit/components/passwordmgr/test/browser/browser.ini b/toolkit/components/passwordmgr/test/browser/browser.ini
index e4c39d27320..430fc39d386 100644
--- a/toolkit/components/passwordmgr/test/browser/browser.ini
+++ b/toolkit/components/passwordmgr/test/browser/browser.ini
@@ -1,7 +1,10 @@
 [DEFAULT]
+support-files =
+  authenticate.sjs
 
 [browser_passwordmgr_fields.js]
 [browser_passwordmgr_observers.js]
 [browser_passwordmgr_sort.js]
+[browser_passwordmgr_switchtab.js]
 [browser_passwordmgrcopypwd.js]
 [browser_passwordmgrdlg.js]
diff --git a/toolkit/components/passwordmgr/test/browser/browser_passwordmgr_switchtab.js b/toolkit/components/passwordmgr/test/browser/browser_passwordmgr_switchtab.js
new file mode 100644
index 00000000000..72efde5d6ac
--- /dev/null
+++ b/toolkit/components/passwordmgr/test/browser/browser_passwordmgr_switchtab.js
@@ -0,0 +1,42 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+const PROMPT_URL = "chrome://global/content/commonDialog.xul";
+const { interfaces: Ci } = Components;
+
+function test() {
+  waitForExplicitFinish();
+
+  let tab = gBrowser.addTab();
+  isnot(tab, gBrowser.selectedTab, "New tab shouldn't be selected");
+
+  let listener = {
+    onOpenWindow: function(window) {
+      var domwindow = window.QueryInterface(Ci.nsIInterfaceRequestor)
+                            .getInterface(Ci.nsIDOMWindow);
+      waitForFocus(() => {
+        is(domwindow.document.location.href, PROMPT_URL, "Should have seen a prompt window");
+        is(domwindow.args.promptType, "promptUserAndPass", "Should be an authenticate prompt");
+
+        is(gBrowser.selectedTab, tab, "Should have selected the new tab");
+
+        domwindow.document.documentElement.cancelDialog()
+      }, domwindow);
+    },
+
+    onCloseWindow: function() {
+    }
+  }
+
+  Services.wm.addListener(listener);
+  registerCleanupFunction(() => {
+    Services.wm.removeListener(listener);
+    gBrowser.removeTab(tab);
+  })
+
+  tab.linkedBrowser.addEventListener("load", () => {
+    finish();
+  }, true);
+  tab.linkedBrowser.loadURI("http://example.com/browser/toolkit/components/passwordmgr/test/browser/authenticate.sjs");
+}

From 0694c8dcd906d13e661a9951ac39cdce319ff4b2 Mon Sep 17 00:00:00 2001
From: Dave Townsend <dtownsend@oxymoronical.com>
Date: Tue, 4 Nov 2014 12:05:08 -0800
Subject: [PATCH 004/153] Bug 1093221: RemoteWebNavigation.loadURI should
 accept and pass referrer argument. r=mconley

---
 toolkit/content/browser-child.js              |   8 +-
 toolkit/modules/RemoteWebNavigation.jsm       |  13 +-
 toolkit/modules/tests/browser/browser.ini     |   3 +
 .../browser/browser_RemoteWebNavigation.js    | 150 ++++++++++++++++++
 toolkit/modules/tests/browser/dummy_page.html |   7 +
 5 files changed, 174 insertions(+), 7 deletions(-)
 create mode 100644 toolkit/modules/tests/browser/browser_RemoteWebNavigation.js
 create mode 100644 toolkit/modules/tests/browser/dummy_page.html

diff --git a/toolkit/content/browser-child.js b/toolkit/content/browser-child.js
index ac62758a472..38aee8e295c 100644
--- a/toolkit/content/browser-child.js
+++ b/toolkit/content/browser-child.js
@@ -166,7 +166,7 @@ let WebNavigation =  {
         this.gotoIndex(message.data.index);
         break;
       case "WebNavigation:LoadURI":
-        this.loadURI(message.data.uri, message.data.flags);
+        this.loadURI(message.data.uri, message.data.flags, message.data.referrer);
         break;
       case "WebNavigation:Reload":
         this.reload(message.data.flags);
@@ -192,12 +192,14 @@ let WebNavigation =  {
     this._webNavigation.gotoIndex(index);
   },
 
-  loadURI: function(uri, flags) {
+  loadURI: function(uri, flags, referrer) {
 #ifdef MOZ_CRASHREPORTER
     if (CrashReporter.enabled)
       CrashReporter.annotateCrashReport("URL", uri);
 #endif
-    this._webNavigation.loadURI(uri, flags, null, null, null);
+    if (referrer)
+      referrer = Services.io.newURI(referrer, null, null);
+    this._webNavigation.loadURI(uri, flags, referrer, null, null);
   },
 
   reload: function(flags) {
diff --git a/toolkit/modules/RemoteWebNavigation.jsm b/toolkit/modules/RemoteWebNavigation.jsm
index 04181e202b3..6e5a9339c37 100644
--- a/toolkit/modules/RemoteWebNavigation.jsm
+++ b/toolkit/modules/RemoteWebNavigation.jsm
@@ -5,9 +5,7 @@
 
 this.EXPORTED_SYMBOLS = ["RemoteWebNavigation"];
 
-const Ci = Components.interfaces;
-const Cc = Components.classes;
-const Cu = Components.utils;
+const { interfaces: Ci, classes: Cc, utils: Cu, results: Cr } = Components;
 
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 
@@ -60,8 +58,15 @@ RemoteWebNavigation.prototype = {
     this._sendMessage("WebNavigation:GotoIndex", {index: aIndex});
   },
   loadURI: function(aURI, aLoadFlags, aReferrer, aPostData, aHeaders) {
+    if (aPostData || aHeaders)
+      throw Components.Exception("RemoteWebNavigation doesn't accept postdata or headers.", Cr.NS_ERROR_INVALID_ARGS);
+
     this._browser._contentTitle = "";
-    this._sendMessage("WebNavigation:LoadURI", {uri: aURI, flags: aLoadFlags});
+    this._sendMessage("WebNavigation:LoadURI", {
+      uri: aURI,
+      flags: aLoadFlags,
+      referrer: aReferrer ? aReferrer.spec : null
+    });
   },
   reload: function(aReloadFlags) {
     this._sendMessage("WebNavigation:Reload", {flags: aReloadFlags});
diff --git a/toolkit/modules/tests/browser/browser.ini b/toolkit/modules/tests/browser/browser.ini
index 8341d51d499..49893eac5e3 100644
--- a/toolkit/modules/tests/browser/browser.ini
+++ b/toolkit/modules/tests/browser/browser.ini
@@ -1,4 +1,6 @@
 [DEFAULT]
+support-files =
+  dummy_page.html
 
 [browser_Battery.js]
 [browser_Deprecated.js]
@@ -6,4 +8,5 @@
 skip-if = e10s # Bug ?????? - test already uses content scripts, but still fails only under e10s.
 [browser_Geometry.js]
 [browser_InlineSpellChecker.js]
+[browser_RemoteWebNavigation.js]
 [browser_Troubleshoot.js]
diff --git a/toolkit/modules/tests/browser/browser_RemoteWebNavigation.js b/toolkit/modules/tests/browser/browser_RemoteWebNavigation.js
new file mode 100644
index 00000000000..0ce612ebd29
--- /dev/null
+++ b/toolkit/modules/tests/browser/browser_RemoteWebNavigation.js
@@ -0,0 +1,150 @@
+const { interfaces: Ci, classes: Cc, utils: Cu, results: Cr } = Components;
+
+const DUMMY1 = "http://example.com/browser/toolkit/modules/tests/browser/dummy_page.html";
+const DUMMY2 = "http://example.org/browser/toolkit/modules/tests/browser/dummy_page.html"
+
+function waitForLoad(browser = gBrowser.selectedBrowser) {
+  return new Promise(resolve => {
+    browser.addEventListener("load", function listener() {
+      browser.removeEventListener("load", listener, true);
+      resolve();
+    }, true);
+  });
+}
+
+function waitForPageShow(browser = gBrowser.selectedBrowser) {
+  return new Promise(resolve => {
+    browser.addEventListener("pageshow", function listener() {
+      browser.removeEventListener("pageshow", listener, true);
+      resolve();
+    }, true);
+  });
+}
+
+function makeURI(url) {
+  return Cc["@mozilla.org/network/io-service;1"].
+         getService(Ci.nsIIOService).
+         newURI(url, null, null);
+}
+
+// Tests that loadURI accepts a referrer and it is included in the load.
+add_task(function* test_referrer() {
+  gBrowser.selectedTab = gBrowser.addTab();
+  let browser = gBrowser.selectedBrowser;
+
+  browser.webNavigation.loadURI(DUMMY1,
+                                Ci.nsIWebNavigation.LOAD_FLAGS_NONE,
+                                makeURI(DUMMY2),
+                                null, null);
+  yield waitForLoad();
+  is(browser.contentWindow.location, DUMMY1, "Should have loaded the right URL");
+  is(browser.contentDocument.referrer, DUMMY2, "Should have the right referrer");
+
+  gBrowser.removeCurrentTab();
+});
+
+// Tests that remote access to webnavigation.sessionHistory works.
+add_task(function* test_history() {
+  gBrowser.selectedTab = gBrowser.addTab();
+  let browser = gBrowser.selectedBrowser;
+
+  browser.webNavigation.loadURI(DUMMY1,
+                                Ci.nsIWebNavigation.LOAD_FLAGS_NONE,
+                                null, null, null);
+  yield waitForLoad();
+
+  browser.webNavigation.loadURI(DUMMY2,
+                                Ci.nsIWebNavigation.LOAD_FLAGS_NONE,
+                                null, null, null);
+  yield waitForLoad();
+
+  let history = browser.webNavigation.sessionHistory;
+  is(history.count, 2, "Should be two history items");
+  is(history.index, 1, "Should be at the right place in history");
+  let entry = history.getEntryAtIndex(0, false);
+  is(entry.URI.spec, DUMMY1, "Should have the right history entry");
+  entry = history.getEntryAtIndex(1, false);
+  is(entry.URI.spec, DUMMY2, "Should have the right history entry");
+
+  let promise = waitForPageShow();
+  browser.webNavigation.goBack();
+  yield promise;
+  is(history.index, 0, "Should be at the right place in history");
+
+  promise = waitForPageShow();
+  browser.webNavigation.goForward();
+  yield promise;
+  is(history.index, 1, "Should be at the right place in history");
+
+  promise = waitForPageShow();
+  browser.webNavigation.gotoIndex(0);
+  yield promise;
+  is(history.index, 0, "Should be at the right place in history");
+
+  gBrowser.removeCurrentTab();
+});
+
+// Tests that load flags are passed through to the content process.
+add_task(function* test_flags() {
+  gBrowser.selectedTab = gBrowser.addTab();
+  let browser = gBrowser.selectedBrowser;
+
+  browser.webNavigation.loadURI(DUMMY1,
+                                Ci.nsIWebNavigation.LOAD_FLAGS_NONE,
+                                null, null, null);
+  yield waitForLoad();
+
+  browser.webNavigation.loadURI(DUMMY2,
+                                Ci.nsIWebNavigation.LOAD_FLAGS_REPLACE_HISTORY,
+                                null, null, null);
+  yield waitForLoad();
+
+  let history = browser.webNavigation.sessionHistory;
+  is(history.count, 1, "Should be one history item");
+  is(history.index, 0, "Should be at the right place in history");
+  let entry = history.getEntryAtIndex(0, false);
+  is(entry.URI.spec, DUMMY2, "Should have the right history entry");
+
+  browser.webNavigation.loadURI(DUMMY1,
+                                Ci.nsIWebNavigation.LOAD_FLAGS_BYPASS_HISTORY,
+                                null, null, null);
+  yield waitForLoad();
+
+  is(history.count, 1, "Should still be one history item");
+  is(history.index, 0, "Should be at the right place in history");
+  entry = history.getEntryAtIndex(0, false);
+  is(entry.URI.spec, DUMMY2, "Should have the right history entry");
+
+  gBrowser.removeCurrentTab();
+});
+
+// Tests that attempts to use unsupported arguments throw an exception.
+add_task(function* test_badarguments() {
+  if (!gMultiProcessBrowser)
+    return;
+
+  gBrowser.selectedTab = gBrowser.addTab();
+  let browser = gBrowser.selectedBrowser;
+
+  try {
+    browser.webNavigation.loadURI(DUMMY1,
+                                  Ci.nsIWebNavigation.LOAD_FLAGS_NONE,
+                                  null, {}, null);
+    ok(false, "Should have seen an exception from trying to pass some postdata");
+  }
+  catch (e) {
+    ok(true, "Should have seen an exception from trying to pass some postdata");
+  }
+
+  try {
+    browser.webNavigation.loadURI(DUMMY1,
+                                  Ci.nsIWebNavigation.LOAD_FLAGS_NONE,
+                                  null, null, {});
+    ok(false, "Should have seen an exception from trying to pass some headers");
+  }
+  catch (e) {
+    ok(true, "Should have seen an exception from trying to pass some headers");
+  }
+
+  gBrowser.removeCurrentTab();
+});
diff --git a/toolkit/modules/tests/browser/dummy_page.html b/toolkit/modules/tests/browser/dummy_page.html
new file mode 100644
index 00000000000..c1c9a4e0434
--- /dev/null
+++ b/toolkit/modules/tests/browser/dummy_page.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+
+<html>
+<body>
+<p>Page</p>
+</body>
+</html>

From e168ce3f3df27451c7d465f17f45c2c795dc5e69 Mon Sep 17 00:00:00 2001
From: Mike Conley <mconley@mozilla.com>
Date: Tue, 4 Nov 2014 12:10:15 -0500
Subject: [PATCH 005/153] Bug 1089815 - View source print preview browser does
 not have a message manager. r=Mossop.

<xul:browser>'s do not get messageManager's constructed for them unless they
have their type attribute set to "content", "content-targetable", or
"content-primary". This patch updates the view source print preview browser
with that type attribute, and also updates the PrintUtils documentation to
mention this requirement.

--HG--
extra : amend_source : 12638e8fd0c0da9b3036d7892d02a360b7513ec5
---
 toolkit/components/printing/content/printUtils.js | 15 ++++++++++++---
 .../components/viewsource/content/viewSource.js   |  2 ++
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/toolkit/components/printing/content/printUtils.js b/toolkit/components/printing/content/printUtils.js
index 6f7ead241ba..65d5fafd186 100644
--- a/toolkit/components/printing/content/printUtils.js
+++ b/toolkit/components/printing/content/printUtils.js
@@ -19,6 +19,10 @@
  * the object that listens and responds to the messages that PrintUtils
  * sends.
  *
+ * This also means that <xul:browser>'s that hope to use PrintUtils must have
+ * their type attribute set to either "content", "content-targetable", or
+ * "content-primary".
+ *
  * PrintUtils sends messages at different points in its implementation, but
  * their documentation is consolidated here for ease-of-access.
  *
@@ -122,7 +126,9 @@ var PrintUtils = {
    *        The remote <xul:browser> that contains aWindow. This argument is
    *        not necessary if aWindow came from a non-remote browser, but is
    *        strictly required otherwise. This function will throw if aWindow
-   *        comes from a remote browser and aBrowser is not provided.
+   *        comes from a remote browser and aBrowser is not provided. This
+   *        browser must have its type attribute set to "content",
+   *        "content-targetable", or "content-primary".
    */
   print: function (aWindow, aBrowser)
   {
@@ -176,11 +182,14 @@ var PrintUtils = {
    *        An object that defines the following functions:
    *
    *        getPrintPreviewBrowser:
-   *          Returns the <xul:browser> to display the print preview in.
+   *          Returns the <xul:browser> to display the print preview in. This
+   *          <xul:browser> must have its type attribute set to "content",
+   *          "content-targetable", or "content-primary".
    *
    *        getSourceBrowser:
    *          Returns the <xul:browser> that contains the document being
-   *          printed.
+   *          printed. This <xul:browser> must have its type attribute set to
+   *          "content", "content-targetable", or "content-primary".
    *
    *        getNavToolbox:
    *          Returns the primary toolbox for this window.
diff --git a/toolkit/components/viewsource/content/viewSource.js b/toolkit/components/viewsource/content/viewSource.js
index a6dea499b34..2adbf442c68 100644
--- a/toolkit/components/viewsource/content/viewSource.js
+++ b/toolkit/components/viewsource/content/viewSource.js
@@ -335,9 +335,11 @@ var PrintPreviewListener = {
       browser = document.createElement("browser");
       browser.setAttribute("id", "ppBrowser");
       browser.setAttribute("flex", "1");
+      browser.setAttribute("type", "content");
       document.getElementById("appcontent").
         insertBefore(browser, document.getElementById("FindToolbar"));
     }
+
     return browser;
   },
   getSourceBrowser: function () {

From d61f2761ec05cd56f07d61dab62cfa1dcbd58f54 Mon Sep 17 00:00:00 2001
From: Richard Newman <rnewman@mozilla.com>
Date: Tue, 4 Nov 2014 12:42:58 -0800
Subject: [PATCH 006/153] Bug 1019726 - Part 2: exclude Maithili from locale
 switcher on Android < 21. r=margaret

---
 .../base/preferences/LocaleListPreference.java      | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/mobile/android/base/preferences/LocaleListPreference.java b/mobile/android/base/preferences/LocaleListPreference.java
index 206fecbbefe..5259354821f 100644
--- a/mobile/android/base/preferences/LocaleListPreference.java
+++ b/mobile/android/base/preferences/LocaleListPreference.java
@@ -172,6 +172,12 @@ public class LocaleListPreference extends ListPreference {
          *         on this device without known issues.
          */
         public boolean isUsable(CharacterValidator validator) {
+            if (Versions.preLollipop && this.tag.matches("[a-zA-Z]{3}.*")) {
+                // Earlier versions of Android can't load three-char locale code
+                // resources.
+                return false;
+            }
+
             // Oh, for Java 7 switch statements.
             if (this.tag.equals("bn-IN")) {
                 // Bengali sometimes has an English label if the Bengali script
@@ -295,8 +301,11 @@ public class LocaleListPreference extends ListPreference {
         values[0] = "";
 
         for (int i = 0; i < count; ++i) {
-            entries[i + 1] = descriptors[i].getDisplayName();
-            values[i + 1] = descriptors[i].getTag();
+            final String displayName = descriptors[i].getDisplayName();
+            final String tag = descriptors[i].getTag();
+            Log.v(LOG_TAG, displayName + " => " + tag);
+            entries[i + 1] = displayName;
+            values[i + 1] = tag;
         }
 
         setEntries(entries);

From 3b48e0e71a394efe9659315caa11f2636732654f Mon Sep 17 00:00:00 2001
From: Stephen Gowan <sgowzilla@gmail.com>
Date: Tue, 4 Nov 2014 12:42:59 -0800
Subject: [PATCH 007/153] Bug 685944 - Warn if response body doesn't match
 Content-Length header. r=rnewman

---
 services/sync/modules/resource.js             |  8 ++
 services/sync/modules/rest.js                 | 16 ++++
 .../unit/test_warn_on_truncated_response.js   | 95 +++++++++++++++++++
 services/sync/tests/unit/xpcshell.ini         |  2 +
 4 files changed, 121 insertions(+)
 create mode 100644 services/sync/tests/unit/test_warn_on_truncated_response.js

diff --git a/services/sync/modules/resource.js b/services/sync/modules/resource.js
index d2a7f728738..d53353eaff9 100644
--- a/services/sync/modules/resource.js
+++ b/services/sync/modules/resource.js
@@ -302,6 +302,14 @@ AsyncResource.prototype = {
         Observers.notify("weave:service:quota:remaining",
                          parseInt(headers["x-weave-quota-remaining"], 10));
       }
+
+      let contentLength = headers["content-length"];
+      if (success && contentLength && data &&
+          contentLength != data.length) {
+        this._log.warn("The response body's length of: " + data.length +
+                       " doesn't match the header's content-length of: " +
+                       contentLength + ".");
+      }
     } catch (ex) {
       this._log.debug("Caught exception " + CommonUtils.exceptionStr(ex) +
                       " visiting headers in _onComplete.");
diff --git a/services/sync/modules/rest.js b/services/sync/modules/rest.js
index bb5757a21b5..34382eed5fa 100644
--- a/services/sync/modules/rest.js
+++ b/services/sync/modules/rest.js
@@ -86,5 +86,21 @@ SyncStorageRequest.prototype = {
       Svc.Obs.notify("weave:service:quota:remaining",
                      parseInt(headers["x-weave-quota-remaining"], 10));
     }
+  },
+
+  onStopRequest: function onStopRequest(channel, context, statusCode) {
+    if (this.status != this.ABORTED) {
+      let resp = this.response;
+      let contentLength = resp.headers ? resp.headers["content-length"] : "";
+
+      if (resp.success && contentLength &&
+          contentLength != resp.body.length) {
+        this._log.warn("The response body's length of: " + resp.body.length +
+                       " doesn't match the header's content-length of: " +
+                       contentLength + ".");
+      }
+    }
+
+    RESTRequest.prototype.onStopRequest.apply(this, arguments);
   }
 };
diff --git a/services/sync/tests/unit/test_warn_on_truncated_response.js b/services/sync/tests/unit/test_warn_on_truncated_response.js
new file mode 100644
index 00000000000..a9f070ee418
--- /dev/null
+++ b/services/sync/tests/unit/test_warn_on_truncated_response.js
@@ -0,0 +1,95 @@
+/* Any copyright is dedicated to the Public Domain.
+   http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+Cu.import("resource://testing-common/httpd.js");
+Cu.import("resource://services-sync/resource.js");
+Cu.import("resource://services-sync/rest.js");
+
+function run_test() {
+  initTestLogging("Trace");
+  run_next_test();
+}
+
+let BODY = "response body";
+// contentLength needs to be longer than the response body
+// length in order to get a mismatch between what is sent in
+// the response and the content-length header value.
+let contentLength = BODY.length + 1;
+
+function contentHandler(request, response) {
+  _("Handling request.");
+  response.setHeader("Content-Type", "text/plain");
+  response.setStatusLine(request.httpVersion, 200, "OK");
+  response.bodyOutputStream.write(BODY, contentLength);
+}
+
+function getWarningMessages(log) {
+  let warnMessages = [];
+  let warn = log.warn;
+  log.warn = function (message) {
+    let regEx = /The response body\'s length of: \d+ doesn\'t match the header\'s content-length of: \d+/i
+    if (message.match(regEx)) {
+      warnMessages.push(message);
+    }
+    warn.call(log, message);
+  }
+  return warnMessages;
+}
+
+add_test(function test_resource_logs_content_length_mismatch() {
+  _("Issuing request.");
+  let httpServer = httpd_setup({"/content": contentHandler});
+  let resource = new Resource(httpServer.baseURI + "/content");
+
+  let warnMessages = getWarningMessages(resource._log);
+  let result = resource.get();
+
+  notEqual(warnMessages.length, 0, "test that a warning was logged");
+  notEqual(result.length, contentLength);
+  equal(result, BODY);
+
+  httpServer.stop(run_next_test);
+});
+
+add_test(function test_async_resource_logs_content_length_mismatch() {
+  _("Issuing request.");
+  let httpServer = httpd_setup({"/content": contentHandler});
+  let asyncResource = new AsyncResource(httpServer.baseURI + "/content");
+
+  let warnMessages = getWarningMessages(asyncResource._log);
+
+  asyncResource.get(function (error, content) {
+    equal(error, null);
+    equal(content, BODY);
+    notEqual(warnMessages.length, 0, "test that warning was logged");
+    notEqual(content.length, contentLength);
+    httpServer.stop(run_next_test);
+  });
+});
+
+add_test(function test_sync_storage_request_logs_content_length_mismatch() {
+  _("Issuing request.");
+  let httpServer = httpd_setup({"/content": contentHandler});
+  let request = new SyncStorageRequest(httpServer.baseURI + "/content");
+  let warnMessages = getWarningMessages(request._log);
+
+  // Setting this affects how received data is read from the underlying
+  // nsIHttpChannel in rest.js.  If it's left as UTF-8 (the default) an
+  // nsIConverterInputStream is used and the data read from channel's stream
+  // isn't truncated at the null byte mark (\u0000). Therefore the
+  // content-length mismatch being tested for doesn't occur.  Setting it to
+  // a falsy value results in an nsIScriptableInputStream being used to read
+  // the stream, which stops reading at the null byte mark resulting in a
+  // content-length mismatch.
+  request.charset = "";
+
+  request.get(function (error) {
+    equal(error, null);
+    equal(this.response.body, BODY);
+    notEqual(warnMessages.length, 0, "test that a warning was logged");
+    notEqual(BODY.length, contentLength);
+    httpServer.stop(run_next_test);
+  });
+});
diff --git a/services/sync/tests/unit/xpcshell.ini b/services/sync/tests/unit/xpcshell.ini
index 89bcb9cf371..ab750423b67 100644
--- a/services/sync/tests/unit/xpcshell.ini
+++ b/services/sync/tests/unit/xpcshell.ini
@@ -170,3 +170,5 @@ skip-if = debug
 
 [test_healthreport.js]
 skip-if = ! healthreport
+
+[test_warn_on_truncated_response.js]

From 7ccee6d40bcae806a06a6f8239f3198a2d5915a0 Mon Sep 17 00:00:00 2001
From: Richard Newman <rnewman@mozilla.com>
Date: Tue, 4 Nov 2014 13:23:16 -0800
Subject: [PATCH 008/153] Bug 1093708 - Include mdpi assets in constrained
 builds. r=nalexander

---
 mobile/android/base/Makefile.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mobile/android/base/Makefile.in b/mobile/android/base/Makefile.in
index 32555de9d0b..e168594f927 100644
--- a/mobile/android/base/Makefile.in
+++ b/mobile/android/base/Makefile.in
@@ -372,7 +372,7 @@ $(1): $$(call mkdir_deps,$(filter-out ./,$(dir $(3) $(4) $(5)))) $(2)
 		-F $(3) \
 		-J $(4) \
 		--output-text-symbols $(5) \
-		$(if $(MOZ_ANDROID_RESOURCE_CONSTRAINED),-c hdpi,) \
+		$(if $(MOZ_ANDROID_RESOURCE_CONSTRAINED),-c mdpi,hdpi,) \
 		--ignore-assets "$$(ANDROID_AAPT_IGNORE)"
 endef
 

From 2683d1a61ac1a6a2bec5caba27a8d8f35a229376 Mon Sep 17 00:00:00 2001
From: Brian Grinstead <bgrinstead@mozilla.com>
Date: Tue, 4 Nov 2014 13:31:44 -0800
Subject: [PATCH 009/153] Bug 1093766 - Change background color for about
 dialog on aurora;r=jaws

---
 browser/branding/aurora/content/aboutDialog.css | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/browser/branding/aurora/content/aboutDialog.css b/browser/branding/aurora/content/aboutDialog.css
index 6ac51e3d34b..209c53244eb 100644
--- a/browser/branding/aurora/content/aboutDialog.css
+++ b/browser/branding/aurora/content/aboutDialog.css
@@ -5,7 +5,7 @@
 #aboutDialogContainer {
   background-image: url("chrome://branding/content/about-background.png");
   background-repeat: no-repeat;
-  background-color: rgb(19,8,36);
+  background-color: rgb(26,58,99);
   color: #fff;
 }
 

From c1da8b281375943276d921ba952e72db9854b158 Mon Sep 17 00:00:00 2001
From: Margaret Leibovic <margaret.leibovic@gmail.com>
Date: Tue, 4 Nov 2014 13:34:45 -0800
Subject: [PATCH 010/153] Bug 1007409 - Cache reading list articles in files,
 not indexedDB. r=rnewman

---
 mobile/android/chrome/content/Reader.js  | 308 +++++++++++------------
 mobile/android/chrome/content/browser.js |   2 +-
 2 files changed, 146 insertions(+), 164 deletions(-)

diff --git a/mobile/android/chrome/content/Reader.js b/mobile/android/chrome/content/Reader.js
index fbf60365d62..f8632e5643d 100644
--- a/mobile/android/chrome/content/Reader.js
+++ b/mobile/android/chrome/content/Reader.js
@@ -4,9 +4,12 @@
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 "use strict";
 
+XPCOMUtils.defineLazyModuleGetter(this, "CommonUtils",
+                                  "resource://services-common/utils.js");
+
 let Reader = {
-  // Version of the cache database schema
-  DB_VERSION: 1,
+  // Version of the cache schema.
+  CACHE_VERSION: 1,
 
   DEBUG: 0,
 
@@ -76,7 +79,8 @@ let Reader = {
   observe: function(aMessage, aTopic, aData) {
     switch(aTopic) {
       case "Reader:Removed": {
-        this.removeArticleFromCache(aData);
+        let uri = Services.io.newURI(aData, null, null);
+        this.removeArticleFromCache(uri).catch(e => Cu.reportError("Error removing article from cache: " + e));
         break;
       }
 
@@ -91,10 +95,13 @@ let Reader = {
 
   _addTabToReadingList: function(tabID) {
     let tab = BrowserApp.getTabForId(tabID);
-    let currentURI = tab.browser.currentURI;
-    let urlWithoutRef = currentURI.specIgnoringRef;
+    if (!tab) {
+      Cu.reportError("Can't add tab to reading list because no tab found for ID: " + tabID);
+      return;
+    }
+    let uri = tab.browser.currentURI;
 
-    this.getArticleFromCache(urlWithoutRef, (article) => {
+    this.getArticleFromCache(uri).then(article => {
       // If the article is already in the cache, just use that.
       if (article) {
         this.addArticleToReadingList(article);
@@ -102,7 +109,7 @@ let Reader = {
       }
 
       // Otherwise, get the article data from the tab.
-      this.getArticleForTab(tabID, urlWithoutRef, (article) => {
+      this.getArticleForTab(tabID, uri.specIgnoringRef, article => {
         if (article) {
           this.addArticleToReadingList(article);
         } else {
@@ -114,7 +121,7 @@ let Reader = {
           });
         }
       });
-    });
+    }, e => Cu.reportError("Error trying to get article from cache: " + e));
   },
 
   addArticleToReadingList: function(article) {
@@ -131,7 +138,7 @@ let Reader = {
       excerpt: article.excerpt || "",
     });
 
-    this.storeArticleInCache(article);
+    this.storeArticleInCache(article).catch(e => Cu.reportError("Error storing article in cache: " + e));
   },
 
   getStateForParseOnLoad: function Reader_getStateForParseOnLoad() {
@@ -154,30 +161,28 @@ let Reader = {
     let request = { url: url, callbacks: [callback] };
     this._requests[url] = request;
 
-    try {
-      this.log("parseDocumentFromURL: " + url);
+    let uri = Services.io.newURI(url, null, null);
 
-      // First, try to find a cached parsed article in the DB
-      this.getArticleFromCache(url, function(article) {
-        if (article) {
-          this.log("Page found in cache, return article immediately");
-          this._runCallbacksAndFinish(request, article);
-          return;
-        }
+    // First, try to find a parsed article in the cache.
+    this.getArticleFromCache(uri).then(article => {
+      if (article) {
+        this.log("Page found in cache, return article immediately");
+        this._runCallbacksAndFinish(request, article);
+        return;
+      }
 
-        if (!this._requests) {
-          this.log("Reader has been destroyed, abort");
-          return;
-        }
+      if (!this._requests) {
+        this.log("Reader has been destroyed, abort");
+        return;
+      }
 
-        // Article hasn't been found in the cache DB, we need to
-        // download the page and parse the article out of it.
-        this._downloadAndParseDocument(url, request);
-      }.bind(this));
-    } catch (e) {
-      this.log("Error parsing document from URL: " + e);
+      // Article hasn't been found in the cache, we need to
+      // download the page and parse the article out of it.
+      this._downloadAndParseDocument(url, request);
+    }, e => {
+      Cu.reportError("Error trying to get article from cache: " + e);
       this._runCallbacksAndFinish(request, null);
-    }
+    });
   },
 
   getArticleForTab: function Reader_getArticleForTab(tabId, url, callback) {
@@ -194,109 +199,81 @@ let Reader = {
     this.parseDocumentFromURL(url, callback);
   },
 
-  parseDocumentFromTab: function(tabId, callback) {
-    try {
-      this.log("parseDocumentFromTab: " + tabId);
+  parseDocumentFromTab: function (tab, callback) {
+    let uri = tab.browser.currentURI;
+    if (!this._shouldCheckUri(uri)) {
+      callback(null);
+      return;
+    }
 
-      let tab = BrowserApp.getTabForId(tabId);
-      let url = tab.browser.contentWindow.location.href;
-      let uri = Services.io.newURI(url, null, null);
-
-      if (!this._shouldCheckUri(uri)) {
-        callback(null);
+    // First, try to find a parsed article in the cache.
+    this.getArticleFromCache(uri).then(article => {
+      if (article) {
+        this.log("Page found in cache, return article immediately");
+        callback(article);
         return;
       }
 
-      // First, try to find a cached parsed article in the DB
-      this.getArticleFromCache(url, function(article) {
-        if (article) {
-          this.log("Page found in cache, return article immediately");
-          callback(article);
+      let doc = tab.browser.contentWindow.document;
+      this._readerParse(uri, doc, article => {
+        if (!article) {
+          this.log("Failed to parse page");
+          callback(null);
           return;
         }
-
-        let doc = tab.browser.contentWindow.document;
-        this._readerParse(uri, doc, function (article) {
-          if (!article) {
-            this.log("Failed to parse page");
-            callback(null);
-            return;
-          }
-
-          callback(article);
-        }.bind(this));
-      }.bind(this));
-    } catch (e) {
-      this.log("Error parsing document from tab: " + e);
+        callback(article);
+      });
+    }, e => {
+      Cu.reportError("Error trying to get article from cache: " + e);
       callback(null);
+    });
+  },
+
+  /**
+   * Retrieves an article from the cache given an article URI.
+   *
+   * @param uri The article URI.
+   * @return Promise
+   * @resolve JS object representing the article, or null if no article is found.
+   * @rejects OS.File.Error
+   */
+  getArticleFromCache: Task.async(function* (uri) {
+    let path = this._toHashedPath(uri.specIgnoringRef);
+    try {
+      let array = yield OS.File.read(path);
+      return JSON.parse(new TextDecoder().decode(array));
+    } catch (e if e instanceof OS.File.Error && e.becauseNoSuchFile) {
+      return null;
     }
-  },
+  }),
 
-  getArticleFromCache: function Reader_getArticleFromCache(url, callback) {
-    this._getCacheDB(function(cacheDB) {
-      if (!cacheDB) {
-        callback(false);
-        return;
-      }
+  /**
+   * Stores an article in the cache.
+   *
+   * @param article JS object representing article.
+   * @return Promise
+   * @resolve When the article is stored.
+   * @rejects OS.File.Error
+   */
+  storeArticleInCache: Task.async(function* (article) {
+    let array = new TextEncoder().encode(JSON.stringify(article));
+    let path = this._toHashedPath(article.url);
+    yield this._ensureCacheDir();
+    yield OS.File.writeAtomic(path, array, { tmpPath: path + ".tmp" });
+  }),
 
-      let transaction = cacheDB.transaction(cacheDB.objectStoreNames);
-      let articles = transaction.objectStore(cacheDB.objectStoreNames[0]);
-
-      let request = articles.get(url);
-
-      request.onerror = function(event) {
-        this.log("Error getting article from the cache DB: " + url);
-        callback(null);
-      }.bind(this);
-
-      request.onsuccess = function(event) {
-        this.log("Got article from the cache DB: " + event.target.result);
-        callback(event.target.result);
-      }.bind(this);
-    }.bind(this));
-  },
-
-  storeArticleInCache: function Reader_storeArticleInCache(article) {
-    this._getCacheDB(function(cacheDB) {
-      if (!cacheDB) {
-        return;
-      }
-
-      let transaction = cacheDB.transaction(cacheDB.objectStoreNames, "readwrite");
-      let articles = transaction.objectStore(cacheDB.objectStoreNames[0]);
-
-      let request = articles.add(article);
-
-      request.onerror = function(event) {
-        this.log("Error storing article in the cache DB: " + article.url);
-      }.bind(this);
-
-      request.onsuccess = function(event) {
-        this.log("Stored article in the cache DB: " + article.url);
-      }.bind(this);
-    }.bind(this));
-  },
-
-  removeArticleFromCache: function Reader_removeArticleFromCache(url) {
-    this._getCacheDB(function(cacheDB) {
-      if (!cacheDB) {
-        return;
-      }
-
-      let transaction = cacheDB.transaction(cacheDB.objectStoreNames, "readwrite");
-      let articles = transaction.objectStore(cacheDB.objectStoreNames[0]);
-
-      let request = articles.delete(url);
-
-      request.onerror = function(event) {
-        this.log("Error removing article from the cache DB: " + url);
-      }.bind(this);
-
-      request.onsuccess = function(event) {
-        this.log("Removed article from the cache DB: " + url);
-      }.bind(this);
-    }.bind(this));
-  },
+  /**
+   * Removes an article from the cache given an article URI.
+   *
+   * @param uri The article URI.
+   * @return Promise
+   * @resolve When the article is removed.
+   * @rejects OS.File.Error
+   */
+  removeArticleFromCache: Task.async(function* (uri) {
+    let path = this._toHashedPath(uri.specIgnoringRef);
+    yield OS.File.remove(path);
+  }),
 
   uninit: function Reader_uninit() {
     Services.prefs.removeObserver("reader.parse-on-load.", this);
@@ -312,11 +289,6 @@ let Reader = {
       }
     }
     delete this._requests;
-
-    if (this._cacheDB) {
-      this._cacheDB.close();
-      delete this._cacheDB;
-    }
   },
 
   log: function(msg) {
@@ -374,7 +346,7 @@ let Reader = {
         doc: new XMLSerializer().serializeToString(doc)
       });
     } catch (e) {
-      dump("Reader: could not build Readability arguments: " + e);
+      Cu.reportError("Reader: could not build Readability arguments: " + e);
       callback(null);
     }
   },
@@ -406,7 +378,7 @@ let Reader = {
     browser.webNavigation.allowMetaRedirects = true;
     browser.webNavigation.allowPlugins = false;
 
-    browser.addEventListener("DOMContentLoaded", function (event) {
+    browser.addEventListener("DOMContentLoaded", event => {
       let doc = event.originalTarget;
 
       // ignore on frames and other documents
@@ -423,7 +395,7 @@ let Reader = {
       }
 
       callback(doc);
-    }.bind(this));
+    });
 
     browser.loadURIWithFlags(url, Ci.nsIWebNavigation.LOAD_FLAGS_NONE,
                              null, null, null);
@@ -435,7 +407,7 @@ let Reader = {
     try {
       this.log("Needs to fetch page, creating request: " + url);
 
-      request.browser = this._downloadDocument(url, function(doc) {
+      request.browser = this._downloadDocument(url, doc => {
         this.log("Finished loading page: " + doc);
 
         if (!doc) {
@@ -447,7 +419,7 @@ let Reader = {
         this.log("Parsing response with Readability");
 
         let uri = Services.io.newURI(url, null, null);
-        this._readerParse(uri, doc, function (article) {
+        this._readerParse(uri, doc, article => {
           // Delete reference to the browser element as we've finished parsing.
           let browser = request.browser;
           if (browser) {
@@ -462,47 +434,57 @@ let Reader = {
           }
 
           this.log("Parsing has been successful");
-
           this._runCallbacksAndFinish(request, article);
-        }.bind(this));
-      }.bind(this));
+        });
+      });
     } catch (e) {
       this.log("Error downloading and parsing document: " + e);
       this._runCallbacksAndFinish(request, null);
     }
   },
 
-  _getCacheDB: function Reader_getCacheDB(callback) {
-    if (this._cacheDB) {
-      callback(this._cacheDB);
-      return;
-    }
+  get _cryptoHash() {
+    delete this._cryptoHash;
+    return this._cryptoHash = Cc["@mozilla.org/security/hash;1"].createInstance(Ci.nsICryptoHash);
+  },
 
-    let request = window.indexedDB.open("about:reader", this.DB_VERSION);
+  get _unicodeConverter() {
+    delete this._unicodeConverter;
+    this._unicodeConverter = Cc["@mozilla.org/intl/scriptableunicodeconverter"]
+                              .createInstance(Ci.nsIScriptableUnicodeConverter);
+    this._unicodeConverter.charset = "utf8";
+    return this._unicodeConverter;
+  },
 
-    request.onerror = function(event) {
-      this.log("Error connecting to the cache DB");
-      this._cacheDB = null;
-      callback(null);
-    }.bind(this);
+  /**
+   * Calculate the hashed path for a stripped article URL.
+   *
+   * @param url The article URL. This should have referrers removed.
+   * @return The file path to the cached article.
+   */
+  _toHashedPath: function (url) {
+    let value = this._unicodeConverter.convertToByteArray(url);
+    this._cryptoHash.init(this._cryptoHash.MD5);
+    this._cryptoHash.update(value, value.length);
 
-    request.onsuccess = function(event) {
-      this.log("Successfully connected to the cache DB");
-      this._cacheDB = event.target.result;
-      callback(this._cacheDB);
-    }.bind(this);
+    let hash = CommonUtils.encodeBase32(this._cryptoHash.finish(false));
+    let fileName = hash.substring(0, hash.indexOf("=")) + ".json";
+    return OS.Path.join(OS.Constants.Path.profileDir, "readercache", fileName);
+  },
 
-    request.onupgradeneeded = function(event) {
-      this.log("Database schema upgrade from " +
-           event.oldVersion + " to " + event.newVersion);
-
-      let cacheDB = event.target.result;
-
-      // Create the articles object store
-      this.log("Creating articles object store");
-      cacheDB.createObjectStore("articles", { keyPath: "url" });
-
-      this.log("Database upgrade done: " + this.DB_VERSION);
-    }.bind(this);
+  /**
+   * Ensures the cache directory exists.
+   *
+   * @return Promise
+   * @resolves When the cache directory exists.
+   * @rejects OS.File.Error
+   */
+  _ensureCacheDir: function () {
+    let dir = OS.Path.join(OS.Constants.Path.profileDir, "readercache");
+    return OS.File.exists(dir).then(exists => {
+      if (!exists) {
+        return OS.File.makeDir(dir);
+      }
+    });
   }
 };
diff --git a/mobile/android/chrome/content/browser.js b/mobile/android/chrome/content/browser.js
index 6dd5d269211..4f84f3724d0 100644
--- a/mobile/android/chrome/content/browser.js
+++ b/mobile/android/chrome/content/browser.js
@@ -4225,7 +4225,7 @@ Tab.prototype = {
           return;
 
         // Once document is fully loaded, parse it
-        Reader.parseDocumentFromTab(this.id, function (article) {
+        Reader.parseDocumentFromTab(this, function (article) {
           // The loaded page may have changed while we were parsing the document. 
           // Make sure we've got the current one.
           let uri = this.browser.currentURI;

From 1ed30aacead3eefd5d2e93c68c80f63b33f525f1 Mon Sep 17 00:00:00 2001
From: Margaret Leibovic <margaret.leibovic@gmail.com>
Date: Tue, 4 Nov 2014 13:34:47 -0800
Subject: [PATCH 011/153] Bug 1007409 - Test for reading list cache. r=rnewman

---
 mobile/android/base/tests/robocop.ini         |  1 +
 .../android/base/tests/robocop_article.html   | 16 +++++
 .../base/tests/testReadingListCache.java      |  8 +++
 .../base/tests/testReadingListCache.js        | 68 +++++++++++++++++++
 4 files changed, 93 insertions(+)
 create mode 100644 mobile/android/base/tests/robocop_article.html
 create mode 100644 mobile/android/base/tests/testReadingListCache.java
 create mode 100644 mobile/android/base/tests/testReadingListCache.js

diff --git a/mobile/android/base/tests/robocop.ini b/mobile/android/base/tests/robocop.ini
index f4da9b48122..8c19d6aafaa 100644
--- a/mobile/android/base/tests/robocop.ini
+++ b/mobile/android/base/tests/robocop.ini
@@ -72,6 +72,7 @@ skip-if = processor == "x86"
 # bug 957185 for x86, bug 1001657 for 2.3
 skip-if = android_version == "10" || processor == "x86"
 # [testReaderMode] # see bug 913254, 936224
+[testReadingListCache]
 [testReadingListProvider]
 [testSearchHistoryProvider]
 [testSearchSuggestions]
diff --git a/mobile/android/base/tests/robocop_article.html b/mobile/android/base/tests/robocop_article.html
new file mode 100644
index 00000000000..f34cbece4e1
--- /dev/null
+++ b/mobile/android/base/tests/robocop_article.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Article title</title>
+<meta name="description" content="This is the article description." />
+</head>
+<body>
+<header>Site header</header>
+<div>
+<h1>Article title</h1>
+<h2 class="author">by Jane Doe</h2>
+<p>Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec a diam lectus. Sed sit amet ipsum mauris. Maecenas congue ligula ac quam viverra nec consectetur ante hendrerit. Donec et mollis dolor. Praesent et diam eget libero egestas mattis sit amet vitae augue. Nam tincidunt congue enim, ut porta lorem lacinia consectetur. Donec ut libero sed arcu vehicula ultricies a non tortor. Lorem ipsum dolor sit amet, consectetur adipiscing elit. Aenean ut gravida lorem. Ut turpis felis, pulvinar a semper sed, adipiscing id dolor. Pellentesque auctor nisi id magna consequat sagittis. Curabitur dapibus enim sit amet elit pharetra tincidunt feugiat nisl imperdiet. Ut convallis libero in urna ultrices accumsan. Donec sed odio eros. Donec viverra mi quis quam pulvinar at malesuada arcu rhoncus. Cum sociis natoque penatibus et magnis dis parturient montes, nascetur ridiculus mus. In rutrum accumsan ultricies. Mauris vitae nisi at sem facilisis semper ac in est.</p>
+<p>Vivamus fermentum semper porta. Nunc diam velit, adipiscing ut tristique vitae, sagittis vel odio. Maecenas convallis ullamcorper ultricies. Curabitur ornare, ligula semper consectetur sagittis, nisi diam iaculis velit, id fringilla sem nunc vel mi. Nam dictum, odio nec pretium volutpat, arcu ante placerat erat, non tristique elit urna et turpis. Quisque mi metus, ornare sit amet fermentum et, tincidunt et orci. Fusce eget orci a orci congue vestibulum. Ut dolor diam, elementum et vestibulum eu, porttitor vel elit. Curabitur venenatis pulvinar tellus gravida ornare. Sed et erat faucibus nunc euismod ultricies ut id justo. Nullam cursus suscipit nisi, et ultrices justo sodales nec. Fusce venenatis facilisis lectus ac semper. Aliquam at massa ipsum. Quisque bibendum purus convallis nulla ultrices ultricies. Nullam aliquam, mi eu aliquam tincidunt, purus velit laoreet tortor, viverra pretium nisi quam vitae mi. Fusce vel volutpat elit. Nam sagittis nisi dui.</p>
+</div>
+</body>
+</html>
diff --git a/mobile/android/base/tests/testReadingListCache.java b/mobile/android/base/tests/testReadingListCache.java
new file mode 100644
index 00000000000..e47ba555fc1
--- /dev/null
+++ b/mobile/android/base/tests/testReadingListCache.java
@@ -0,0 +1,8 @@
+package org.mozilla.gecko.tests;
+
+
+public class testReadingListCache extends JavascriptTest {
+    public testReadingListCache() {
+        super("testReadingListCache.js");
+    }
+}
diff --git a/mobile/android/base/tests/testReadingListCache.js b/mobile/android/base/tests/testReadingListCache.js
new file mode 100644
index 00000000000..d9b7e1a9113
--- /dev/null
+++ b/mobile/android/base/tests/testReadingListCache.js
@@ -0,0 +1,68 @@
+// -*- indent-tabs-mode: nil; js-indent-level: 2 -*-
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+const { utils: Cu } = Components;
+
+Cu.import("resource://gre/modules/osfile.jsm");
+Cu.import("resource://gre/modules/Services.jsm");
+Cu.import("resource://gre/modules/Task.jsm");
+
+// Values from robocop_article.html
+const ARTICLE = {
+  url: "http://mochi.test:8888/tests/robocop/robocop_article.html",
+  title: "Article title",
+  byline: "by Jane Doe",
+  excerpt: "This is the article description.",
+  length: 1931,
+  content: "Lorem ipsum..." // This test doesn't actually compare content strings
+};
+
+const ARTICLE_URI = Services.io.newURI(ARTICLE.url, null, null);
+
+add_task(function test_article_not_found() {
+  let Reader = Services.wm.getMostRecentWindow("navigator:browser").Reader;
+
+  let article = yield Reader.getArticleFromCache(ARTICLE_URI);
+  do_check_eq(article, null);
+});
+
+add_task(function test_store_article() {
+  let Reader = Services.wm.getMostRecentWindow("navigator:browser").Reader;
+
+  yield Reader.storeArticleInCache(ARTICLE);
+
+  let article = yield Reader.getArticleFromCache(ARTICLE_URI);
+  checkArticle(article);
+});
+
+add_task(function test_remove_article() {
+  let Reader = Services.wm.getMostRecentWindow("navigator:browser").Reader;
+
+  yield Reader.removeArticleFromCache(ARTICLE_URI);
+
+  let article = yield Reader.getArticleFromCache(ARTICLE_URI);
+  do_check_eq(article, null);
+});
+
+add_test(function test_parse_article() {
+  let Reader = Services.wm.getMostRecentWindow("navigator:browser").Reader;
+
+  Reader.parseDocumentFromURL(ARTICLE.url, function parseCallback(article) {
+    checkArticle(article);
+    run_next_test();
+  });
+});
+
+function checkArticle(article) {
+  do_check_neq(article, null);
+  do_check_neq(article.content, null);
+  do_check_eq(article.url, ARTICLE.url);
+  do_check_eq(article.title, ARTICLE.title);
+  do_check_eq(article.byline, ARTICLE.byline);
+  do_check_eq(article.excerpt, ARTICLE.excerpt);
+  do_check_eq(article.length, ARTICLE.length);
+}
+
+run_next_test();

From 459d47ca20ccadda58cb2858cc9b501a67c726af Mon Sep 17 00:00:00 2001
From: Chris Kitching <chriskitching@linux.com>
Date: Fri, 19 Sep 2014 18:10:01 -0700
Subject: [PATCH 012/153] Bug 961600: Use the favicon cache for search engine
 icons. r=rnewman

---
 mobile/android/base/GeckoAppShell.java        | 20 +++++----
 .../favicons/decoders/FaviconDecoder.java     | 44 -------------------
 .../preferences/SearchEnginePreference.java   | 30 ++++++++++---
 3 files changed, 37 insertions(+), 57 deletions(-)

diff --git a/mobile/android/base/GeckoAppShell.java b/mobile/android/base/GeckoAppShell.java
index 86ab8703788..3f338e40a39 100644
--- a/mobile/android/base/GeckoAppShell.java
+++ b/mobile/android/base/GeckoAppShell.java
@@ -31,6 +31,7 @@ import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentLinkedQueue;
 
 import org.mozilla.gecko.AppConstants.Versions;
+import org.mozilla.gecko.favicons.Favicons;
 import org.mozilla.gecko.favicons.OnFaviconLoadedListener;
 import org.mozilla.gecko.favicons.decoders.FaviconDecoder;
 import org.mozilla.gecko.gfx.BitmapUtils;
@@ -806,21 +807,24 @@ public class GeckoAppShell
     // This is the entry point from nsIShellService.
     @WrapElementForJNI
     static void createShortcut(final String aTitle, final String aURI, final String aIconData) {
-        ThreadUtils.postToBackgroundThread(new Runnable() {
-            @Override
-            public void run() {
-                // TODO: use the cache. Bug 961600.
-                Bitmap icon = FaviconDecoder.getMostSuitableBitmapFromDataURI(aIconData, getPreferredIconSize());
-                GeckoAppShell.doCreateShortcut(aTitle, aURI, icon);
+        // We have the favicon data (base64) decoded on the background thread, callback here, then
+        // call the other createShortcut method with the decoded favicon.
+        // This is slightly contrived, but makes the images available to the favicon cache.
+        Favicons.getSizedFavicon(getContext(), aURI, aIconData, Integer.MAX_VALUE, 0,
+            new OnFaviconLoadedListener() {
+                @Override
+                public void onFaviconLoaded(String url, String faviconURL, Bitmap favicon) {
+                    createShortcut(aTitle, url, favicon);
+                }
             }
-        });
+        );
     }
 
     public static void createShortcut(final String aTitle, final String aURI, final Bitmap aBitmap) {
         ThreadUtils.postToBackgroundThread(new Runnable() {
             @Override
             public void run() {
-                GeckoAppShell.doCreateShortcut(aTitle, aURI, aBitmap);
+                doCreateShortcut(aTitle, aURI, aBitmap);
             }
         });
     }
diff --git a/mobile/android/base/favicons/decoders/FaviconDecoder.java b/mobile/android/base/favicons/decoders/FaviconDecoder.java
index 4bd0da212af..a1a8e4c354a 100644
--- a/mobile/android/base/favicons/decoders/FaviconDecoder.java
+++ b/mobile/android/base/favicons/decoders/FaviconDecoder.java
@@ -151,50 +151,6 @@ public class FaviconDecoder {
         return decodeFavicon(buffer, 0, buffer.length);
     }
 
-    /**
-     * Returns the smallest bitmap in the icon represented by the provided
-     * data: URI that's larger than the desired width, or the largest if
-     * there is no larger icon.
-     *
-     * Returns null if no bitmap could be extracted.
-     *
-     * Bug 961600: we shouldn't be doing all of this work. The favicon cache
-     * should be used, and will give us the right size icon.
-     */
-    public static Bitmap getMostSuitableBitmapFromDataURI(String iconURI, int desiredWidth) {
-        LoadFaviconResult result = FaviconDecoder.decodeDataURI(iconURI);
-        if (result == null) {
-            // Nothing we can do.
-            Log.w(LOG_TAG, "Unable to decode icon URI.");
-            return null;
-        }
-
-        final Iterator<Bitmap> bitmaps = result.getBitmaps();
-        if (!bitmaps.hasNext()) {
-            Log.w(LOG_TAG, "No bitmaps in decoded icon.");
-            return null;
-        }
-
-        Bitmap bitmap = bitmaps.next();
-        if (!bitmaps.hasNext()) {
-            // We're done! There was only one, so this is as big as it gets.
-            return bitmap;
-        }
-
-        // Find a bitmap of the most suitable size.
-        int currentWidth = bitmap.getWidth();
-        while ((currentWidth < desiredWidth) &&
-               bitmaps.hasNext()) {
-            final Bitmap b = bitmaps.next();
-            if (b.getWidth() > currentWidth) {
-                currentWidth = b.getWidth();
-                bitmap = b;
-            }
-        }
-
-        return bitmap;
-    }
-
     /**
      * Iterator to hold a single bitmap.
      */
diff --git a/mobile/android/base/preferences/SearchEnginePreference.java b/mobile/android/base/preferences/SearchEnginePreference.java
index ce0fab15fd1..bf0946a79f2 100644
--- a/mobile/android/base/preferences/SearchEnginePreference.java
+++ b/mobile/android/base/preferences/SearchEnginePreference.java
@@ -8,6 +8,7 @@ import org.json.JSONException;
 import org.json.JSONObject;
 import org.mozilla.gecko.R;
 import org.mozilla.gecko.favicons.Favicons;
+import org.mozilla.gecko.favicons.OnFaviconLoadedListener;
 import org.mozilla.gecko.favicons.decoders.FaviconDecoder;
 import org.mozilla.gecko.util.ThreadUtils;
 import org.mozilla.gecko.widget.FaviconView;
@@ -34,6 +35,7 @@ public class SearchEnginePreference extends CustomListPreference {
 
     // The bitmap backing the drawable above - needed separately for the FaviconView.
     private Bitmap mIconBitmap;
+    private final Object bitmapLock = new Object();
 
     private FaviconView mFaviconView;
 
@@ -55,9 +57,16 @@ public class SearchEnginePreference extends CustomListPreference {
     protected void onBindView(View view) {
         super.onBindView(view);
 
-        // Set the icon in the FaviconView.
-        mFaviconView = ((FaviconView) view.findViewById(R.id.search_engine_icon));
-        mFaviconView.updateAndScaleImage(mIconBitmap, getTitle().toString());
+        // We synchronise to avoid a race condition between this and the favicon loading callback in
+        // setSearchEngineFromJSON.
+        synchronized (bitmapLock) {
+            // Set the icon in the FaviconView.
+            mFaviconView = ((FaviconView) view.findViewById(R.id.search_engine_icon));
+
+            if (mIconBitmap != null) {
+                mFaviconView.updateAndScaleImage(mIconBitmap, getTitle().toString());
+            }
+        }
     }
 
     @Override
@@ -161,9 +170,20 @@ public class SearchEnginePreference extends CustomListPreference {
                 }
             }
 
-            // TODO: use the cache. Bug 961600.
-            mIconBitmap = FaviconDecoder.getMostSuitableBitmapFromDataURI(iconURI, desiredWidth);
+            Favicons.getSizedFavicon(getContext(), mIdentifier, iconURI, desiredWidth, 0,
+                new OnFaviconLoadedListener() {
+                    @Override
+                    public void onFaviconLoaded(String url, String faviconURL, Bitmap favicon) {
+                        synchronized (bitmapLock) {
+                            mIconBitmap = favicon;
 
+                            if (mFaviconView != null) {
+                                mFaviconView.updateAndScaleImage(mIconBitmap, getTitle().toString());
+                            }
+                        }
+                    }
+                }
+            );
         } catch (IllegalArgumentException e) {
             Log.e(LOGTAG, "IllegalArgumentException creating Bitmap. Most likely a zero-length bitmap.", e);
         } catch (NullPointerException e) {

From 801d787ceaa45fba7f2f1704c1fdabfa8cbce98b Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Tue, 4 Nov 2014 08:34:56 -0800
Subject: [PATCH 013/153] Bug 1088831 - Count storebuffer compactions, r=jonco

--HG--
extra : rebase_source : e9bb802708fe5813377ce09f487a6304a8c265d7
---
 js/src/gc/Statistics.cpp  | 3 +++
 js/src/gc/Statistics.h    | 1 +
 js/src/gc/StoreBuffer.cpp | 9 +++++++++
 js/src/gc/StoreBuffer.h   | 6 ++++++
 4 files changed, 19 insertions(+)

diff --git a/js/src/gc/Statistics.cpp b/js/src/gc/Statistics.cpp
index af9602d1a23..9624251b986 100644
--- a/js/src/gc/Statistics.cpp
+++ b/js/src/gc/Statistics.cpp
@@ -385,6 +385,7 @@ Statistics::formatData(StatisticsSerializer &ss, uint64_t timestamp)
     ss.appendNumber("Total Zones", "%d", "", zoneStats.zoneCount);
     ss.appendNumber("Total Compartments", "%d", "", zoneStats.compartmentCount);
     ss.appendNumber("Minor GCs", "%d", "", counts[STAT_MINOR_GC]);
+    ss.appendNumber("Store Buffer Compactions", "%d", "", counts[STAT_COMPACT_STOREBUFFER]);
     ss.appendNumber("MMU (20ms)", "%d", "%", int(mmu20 * 100));
     ss.appendNumber("MMU (50ms)", "%d", "%", int(mmu50 * 100));
     ss.appendDecimal("SCC Sweep Total", "ms", t(sccTotal));
@@ -476,6 +477,7 @@ Statistics::formatDescription()
   Zones Collected: %d of %d\n\
   Compartments Collected: %d of %d\n\
   MinorGCs since last GC: %d\n\
+  Store Buffer Compactions: %d\n\
   MMU 20ms:%.1f%%; 50ms:%.1f%%\n\
   SCC Sweep Total (MaxPause): %.3fms (%.3fms)\n\
   HeapSize: %.3f MiB\n\
@@ -491,6 +493,7 @@ Statistics::formatDescription()
                 zoneStats.collectedZoneCount, zoneStats.zoneCount,
                 zoneStats.collectedCompartmentCount, zoneStats.compartmentCount,
                 counts[STAT_MINOR_GC],
+                counts[STAT_COMPACT_STOREBUFFER],
                 mmu20 * 100., mmu50 * 100.,
                 t(sccTotal), t(sccLongest),
                 double(preBytes) / 1024. / 1024.,
diff --git a/js/src/gc/Statistics.h b/js/src/gc/Statistics.h
index 933d449aefe..88c7b338ee9 100644
--- a/js/src/gc/Statistics.h
+++ b/js/src/gc/Statistics.h
@@ -78,6 +78,7 @@ enum Stat {
     STAT_NEW_CHUNK,
     STAT_DESTROY_CHUNK,
     STAT_MINOR_GC,
+    STAT_COMPACT_STOREBUFFER,
 
     STAT_LIMIT
 };
diff --git a/js/src/gc/StoreBuffer.cpp b/js/src/gc/StoreBuffer.cpp
index 0587e434f03..c9bb351897f 100644
--- a/js/src/gc/StoreBuffer.cpp
+++ b/js/src/gc/StoreBuffer.cpp
@@ -19,6 +19,12 @@ using namespace js;
 using namespace js::gc;
 using mozilla::ReentrancyGuard;
 
+gcstats::Statistics&
+StoreBuffer::stats()
+{
+    return runtime_->gc.stats;
+}
+
 /*** Edges ***/
 
 void
@@ -110,6 +116,8 @@ template <typename T>
 void
 StoreBuffer::MonoTypeBuffer<T>::compactRemoveDuplicates(StoreBuffer *owner)
 {
+    Statistics& stats = owner->stats();
+
     typedef HashSet<T, typename T::Hasher, SystemAllocPolicy> DedupSet;
 
     DedupSet duplicates;
@@ -130,6 +138,7 @@ StoreBuffer::MonoTypeBuffer<T>::compactRemoveDuplicates(StoreBuffer *owner)
     storage_->release(insert.mark());
 
     duplicates.clear();
+    stats.count(gcstats::STAT_COMPACT_STOREBUFFER);
 }
 
 template <typename T>
diff --git a/js/src/gc/StoreBuffer.h b/js/src/gc/StoreBuffer.h
index b5b19fb6345..2a1458c71dc 100644
--- a/js/src/gc/StoreBuffer.h
+++ b/js/src/gc/StoreBuffer.h
@@ -22,6 +22,10 @@
 
 namespace js {
 
+namespace gcstats {
+struct Statistics;
+}
+
 MOZ_NORETURN void
 CrashAtUnhandlableOOM(const char *reason);
 
@@ -489,6 +493,8 @@ class StoreBuffer
         putFromAnyThread(bufferGeneric, CallbackRef<Key>(callback, key, data));
     }
 
+    gcstats::Statistics& stats();
+
     /* Methods to mark the source of all edges in the store buffer. */
     void markAll(JSTracer *trc);
     void markValues(JSTracer *trc)            { bufferVal.mark(this, trc); }

From 9a6efa67bc98c9d244f0e194ea39d1ef83feafab Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Tue, 4 Nov 2014 13:23:10 -0800
Subject: [PATCH 014/153] Bug 1088831 - Account for the storebuffer compaction
 time, r=jonco

--HG--
extra : rebase_source : c6dc383197f0abd01eb9bdaf49fb2ac9d370a1b4
---
 js/src/gc/Statistics.cpp  | 25 ++++++++++++++++++++-----
 js/src/gc/Statistics.h    |  9 +++++++++
 js/src/gc/StoreBuffer.cpp | 21 +++++++++++++--------
 js/src/gc/StoreBuffer.h   |  2 +-
 js/src/gc/Verifier.cpp    |  5 ++++-
 js/src/jsgc.cpp           |  2 ++
 6 files changed, 49 insertions(+), 15 deletions(-)

diff --git a/js/src/gc/Statistics.cpp b/js/src/gc/Statistics.cpp
index 9624251b986..5c415c03b87 100644
--- a/js/src/gc/Statistics.cpp
+++ b/js/src/gc/Statistics.cpp
@@ -326,6 +326,9 @@ static const PhaseInfo phases[] = {
         { PHASE_COMPACT_UPDATE, "Compact Update", PHASE_COMPACT, },
             { PHASE_COMPACT_UPDATE_GRAY, "Compact Update Gray", PHASE_COMPACT_UPDATE, },
     { PHASE_GC_END, "End Callback", PHASE_NO_PARENT },
+    { PHASE_MINOR_GC, "Minor GC", PHASE_NO_PARENT },
+        { PHASE_COMPACT_STOREBUFFER_IN_MINOR_GC, "Compact Store Buffers", PHASE_MINOR_GC },
+    { PHASE_COMPACT_STOREBUFFER_NO_PARENT, "Compact Store Buffers (toplevel)", PHASE_NO_PARENT },
     { PHASE_LIMIT, nullptr, PHASE_NO_PARENT }
 };
 
@@ -386,6 +389,7 @@ Statistics::formatData(StatisticsSerializer &ss, uint64_t timestamp)
     ss.appendNumber("Total Compartments", "%d", "", zoneStats.compartmentCount);
     ss.appendNumber("Minor GCs", "%d", "", counts[STAT_MINOR_GC]);
     ss.appendNumber("Store Buffer Compactions", "%d", "", counts[STAT_COMPACT_STOREBUFFER]);
+    ss.appendNumber("Store Buffer Overflows", "%d", "", counts[STAT_STOREBUFFER_OVERFLOW]);
     ss.appendNumber("MMU (20ms)", "%d", "%", int(mmu20 * 100));
     ss.appendNumber("MMU (50ms)", "%d", "%", int(mmu50 * 100));
     ss.appendDecimal("SCC Sweep Total", "ms", t(sccTotal));
@@ -478,6 +482,7 @@ Statistics::formatDescription()
   Compartments Collected: %d of %d\n\
   MinorGCs since last GC: %d\n\
   Store Buffer Compactions: %d\n\
+  Store Buffer Overflows: %d\n\
   MMU 20ms:%.1f%%; 50ms:%.1f%%\n\
   SCC Sweep Total (MaxPause): %.3fms (%.3fms)\n\
   HeapSize: %.3f MiB\n\
@@ -494,6 +499,7 @@ Statistics::formatDescription()
                 zoneStats.collectedCompartmentCount, zoneStats.compartmentCount,
                 counts[STAT_MINOR_GC],
                 counts[STAT_COMPACT_STOREBUFFER],
+                counts[STAT_STOREBUFFER_OVERFLOW],
                 mmu20 * 100., mmu50 * 100.,
                 t(sccTotal), t(sccLongest),
                 double(preBytes) / 1024. / 1024.,
@@ -643,6 +649,8 @@ Statistics::Statistics(JSRuntime *rt)
 {
     PodArrayZero(phaseTotals);
     PodArrayZero(counts);
+    PodArrayZero(phaseStartTimes);
+    PodArrayZero(phaseTimes);
 
     char *env = getenv("MOZ_GCTIMER");
     if (!env || strcmp(env, "none") == 0) {
@@ -726,9 +734,6 @@ Statistics::printStats()
 void
 Statistics::beginGC(JSGCInvocationKind kind)
 {
-    PodArrayZero(phaseStartTimes);
-    PodArrayZero(phaseTimes);
-
     slices.clearAndFree();
     sccTimes.clearAndFree();
     gckind = kind;
@@ -770,6 +775,11 @@ Statistics::endGC()
 
     if (fp)
         printStats();
+
+    // Clear the timers at the end of a GC because we accumulate time for some
+    // phases (eg storebuffer compaction) during the mutator's run.
+    PodArrayZero(phaseStartTimes);
+    PodArrayZero(phaseTimes);
 }
 
 void
@@ -837,6 +847,9 @@ Statistics::beginPhase(Phase phase)
     Phase parent = phaseNestingDepth ? phaseNesting[phaseNestingDepth - 1] : PHASE_NO_PARENT;
     MOZ_ASSERT(phaseNestingDepth < MAX_NESTING);
     MOZ_ASSERT_IF(gcDepth == 1, phases[phase].parent == parent);
+    MOZ_ASSERT_IF(phase == PHASE_COMPACT_STOREBUFFER_IN_MINOR_GC, parent == PHASE_MINOR_GC);
+    MOZ_ASSERT_IF(phase == PHASE_COMPACT_STOREBUFFER_NO_PARENT, parent == PHASE_NO_PARENT);
+
     phaseNesting[phaseNestingDepth] = phase;
     phaseNestingDepth++;
 #endif
@@ -849,8 +862,10 @@ Statistics::endPhase(Phase phase)
 {
     phaseNestingDepth--;
 
-    int64_t t = PRMJ_Now() - phaseStartTimes[phase];
-    slices.back().phaseTimes[phase] += t;
+    int64_t now = PRMJ_Now();
+    int64_t t = now - phaseStartTimes[phase];
+    if (!slices.empty())
+        slices.back().phaseTimes[phase] += t;
     phaseTimes[phase] += t;
     phaseStartTimes[phase] = 0;
 }
diff --git a/js/src/gc/Statistics.h b/js/src/gc/Statistics.h
index 88c7b338ee9..6793d024f61 100644
--- a/js/src/gc/Statistics.h
+++ b/js/src/gc/Statistics.h
@@ -70,6 +70,9 @@ enum Phase {
     PHASE_COMPACT_UPDATE,
     PHASE_COMPACT_UPDATE_GRAY,
     PHASE_GC_END,
+    PHASE_MINOR_GC,
+    PHASE_COMPACT_STOREBUFFER_IN_MINOR_GC,
+    PHASE_COMPACT_STOREBUFFER_NO_PARENT,
 
     PHASE_LIMIT
 };
@@ -78,8 +81,14 @@ enum Stat {
     STAT_NEW_CHUNK,
     STAT_DESTROY_CHUNK,
     STAT_MINOR_GC,
+
+    // Number of times the storebuffers were compacted
     STAT_COMPACT_STOREBUFFER,
 
+    // Number of times a 'put' into a storebuffer overflowed, triggering a
+    // compaction
+    STAT_STOREBUFFER_OVERFLOW,
+
     STAT_LIMIT
 };
 
diff --git a/js/src/gc/StoreBuffer.cpp b/js/src/gc/StoreBuffer.cpp
index c9bb351897f..4462549b115 100644
--- a/js/src/gc/StoreBuffer.cpp
+++ b/js/src/gc/StoreBuffer.cpp
@@ -99,6 +99,8 @@ StoreBuffer::MonoTypeBuffer<T>::handleOverflow(StoreBuffer *owner)
          * Compact the buffer now, and if that fails to free enough space then
          * trigger a minor collection.
          */
+        gcstats::AutoPhase ap(owner->stats(), PHASE_COMPACT_STOREBUFFER_NO_PARENT);
+        owner->stats().count(gcstats::STAT_STOREBUFFER_OVERFLOW);
         compact(owner);
         if (isLowOnSpace())
             owner->setAboutToOverflow();
@@ -107,8 +109,10 @@ StoreBuffer::MonoTypeBuffer<T>::handleOverflow(StoreBuffer *owner)
           * A minor GC has already been triggered, so there's no point
           * compacting unless the buffer is totally full.
           */
-        if (storage_->availableInCurrentChunk() < sizeof(T))
-            maybeCompact(owner);
+        if (storage_->availableInCurrentChunk() < sizeof(T)) {
+            owner->stats().count(gcstats::STAT_STOREBUFFER_OVERFLOW);
+            maybeCompact(owner, PHASE_COMPACT_STOREBUFFER_NO_PARENT);
+        }
     }
 }
 
@@ -116,8 +120,6 @@ template <typename T>
 void
 StoreBuffer::MonoTypeBuffer<T>::compactRemoveDuplicates(StoreBuffer *owner)
 {
-    Statistics& stats = owner->stats();
-
     typedef HashSet<T, typename T::Hasher, SystemAllocPolicy> DedupSet;
 
     DedupSet duplicates;
@@ -138,7 +140,7 @@ StoreBuffer::MonoTypeBuffer<T>::compactRemoveDuplicates(StoreBuffer *owner)
     storage_->release(insert.mark());
 
     duplicates.clear();
-    stats.count(gcstats::STAT_COMPACT_STOREBUFFER);
+    owner->stats().count(gcstats::STAT_COMPACT_STOREBUFFER);
 }
 
 template <typename T>
@@ -152,11 +154,13 @@ StoreBuffer::MonoTypeBuffer<T>::compact(StoreBuffer *owner)
 
 template <typename T>
 void
-StoreBuffer::MonoTypeBuffer<T>::maybeCompact(StoreBuffer *owner)
+StoreBuffer::MonoTypeBuffer<T>::maybeCompact(StoreBuffer *owner, gcstats::Phase phase)
 {
     MOZ_ASSERT(storage_);
-    if (storage_->used() != usedAtLastCompact_)
+    if (storage_->used() != usedAtLastCompact_) {
+        gcstats::AutoPhase ap(owner->stats(), phase);
         compact(owner);
+    }
 }
 
 template <typename T>
@@ -168,7 +172,8 @@ StoreBuffer::MonoTypeBuffer<T>::mark(StoreBuffer *owner, JSTracer *trc)
     if (!storage_)
         return;
 
-    maybeCompact(owner);
+    maybeCompact(owner, PHASE_COMPACT_STOREBUFFER_IN_MINOR_GC);
+
     for (LifoAlloc::Enum e(*storage_); !e.empty(); e.popFront<T>()) {
         T *edge = e.get<T>();
         edge->mark(trc);
diff --git a/js/src/gc/StoreBuffer.h b/js/src/gc/StoreBuffer.h
index 2a1458c71dc..94e4b88e713 100644
--- a/js/src/gc/StoreBuffer.h
+++ b/js/src/gc/StoreBuffer.h
@@ -144,7 +144,7 @@ class StoreBuffer
         virtual void compact(StoreBuffer *owner);
 
         /* Compacts if any entries have been added since the last compaction. */
-        void maybeCompact(StoreBuffer *owner);
+        void maybeCompact(StoreBuffer *owner, gcstats::Phase phase);
 
         /* Add one item to the buffer. */
         void put(StoreBuffer *owner, const T &t) {
diff --git a/js/src/gc/Verifier.cpp b/js/src/gc/Verifier.cpp
index f092b5e116a..0428252db9b 100644
--- a/js/src/gc/Verifier.cpp
+++ b/js/src/gc/Verifier.cpp
@@ -503,7 +503,10 @@ js::gc::GCRuntime::endVerifyPostBarriers()
     if (!edges.init())
         goto oom;
     trc->edges = &edges;
-    storeBuffer.markAll(trc);
+    {
+        gcstats::AutoPhase ap(stats, gcstats::PHASE_MINOR_GC);
+        storeBuffer.markAll(trc);
+    }
 
     /* Walk the heap to find any edges not the the |edges| set. */
     trc->setTraceCallback(PostVerifierVisitEdge);
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index 1ffacbdb245..80cd4fb77f7 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -6217,6 +6217,7 @@ void
 GCRuntime::minorGC(JS::gcreason::Reason reason)
 {
 #ifdef JSGC_GENERATIONAL
+    gcstats::AutoPhase ap(stats, gcstats::PHASE_MINOR_GC);
     minorGCRequested = false;
     TraceLogger *logger = TraceLoggerForMainThread(rt);
     AutoTraceLog logMinorGC(logger, TraceLogger::MinorGC);
@@ -6231,6 +6232,7 @@ GCRuntime::minorGC(JSContext *cx, JS::gcreason::Reason reason)
     // Alternate to the runtime-taking form above which allows marking type
     // objects as needing pretenuring.
 #ifdef JSGC_GENERATIONAL
+    gcstats::AutoPhase ap(stats, gcstats::PHASE_MINOR_GC);
     minorGCRequested = false;
     TraceLogger *logger = TraceLoggerForMainThread(rt);
     AutoTraceLog logMinorGC(logger, TraceLogger::MinorGC);

From 3fde6a2537c0e269916d3143734db8cf26b35c54 Mon Sep 17 00:00:00 2001
From: Steve Fink <sfink@mozilla.com>
Date: Tue, 4 Nov 2014 13:23:13 -0800
Subject: [PATCH 015/153] Bug 1088831 - Track mutator vs GC time in specified
 intervals, r=jonco

--HG--
extra : rebase_source : 44313ac31315dbebde12bd76ade8f0cfb4d7ce5a
---
 js/src/gc/Statistics.cpp  | 53 +++++++++++++++++++++++++++++++++++++--
 js/src/gc/Statistics.h    | 15 ++++++++---
 js/src/gc/StoreBuffer.cpp | 11 ++++----
 js/src/gc/StoreBuffer.h   |  2 +-
 js/src/shell/js.cpp       | 45 +++++++++++++++++++++++++++++++++
 5 files changed, 115 insertions(+), 11 deletions(-)

diff --git a/js/src/gc/Statistics.cpp b/js/src/gc/Statistics.cpp
index 5c415c03b87..bc897c8bc46 100644
--- a/js/src/gc/Statistics.cpp
+++ b/js/src/gc/Statistics.cpp
@@ -27,6 +27,7 @@ using namespace js::gc;
 using namespace js::gcstats;
 
 using mozilla::PodArrayZero;
+using mozilla::PodZero;
 
 /* Except for the first and last, slices of less than 10ms are not reported. */
 static const int64_t SLICE_MIN_REPORT_TIME = 10 * PRMJ_USEC_PER_MSEC;
@@ -283,6 +284,7 @@ struct PhaseInfo
 static const Phase PHASE_NO_PARENT = PHASE_LIMIT;
 
 static const PhaseInfo phases[] = {
+    { PHASE_MUTATOR, "Mutator Running", PHASE_NO_PARENT },
     { PHASE_GC_BEGIN, "Begin Callback", PHASE_NO_PARENT },
     { PHASE_WAIT_BACKGROUND_THREAD, "Wait Background Thread", PHASE_NO_PARENT },
     { PHASE_MARK_DISCARD_CODE, "Mark Discard Code", PHASE_NO_PARENT },
@@ -642,6 +644,8 @@ Statistics::Statistics(JSRuntime *rt)
     fullFormat(false),
     gcDepth(0),
     nonincrementalReason(nullptr),
+    timingMutator(false),
+    timedGCStart(0),
     preBytes(0),
     maxPauseInInterval(0),
     phaseNestingDepth(0),
@@ -778,8 +782,8 @@ Statistics::endGC()
 
     // Clear the timers at the end of a GC because we accumulate time for some
     // phases (eg storebuffer compaction) during the mutator's run.
-    PodArrayZero(phaseStartTimes);
-    PodArrayZero(phaseTimes);
+    PodZero(&phaseStartTimes[PHASE_GC_BEGIN], PHASE_LIMIT - PHASE_GC_BEGIN);
+    PodZero(&phaseTimes[PHASE_GC_BEGIN], PHASE_LIMIT - PHASE_GC_BEGIN);
 }
 
 void
@@ -836,12 +840,50 @@ Statistics::endSlice()
         PodArrayZero(counts);
 }
 
+void
+Statistics::startTimingMutator()
+{
+    MOZ_ASSERT(!timingMutator);
+
+    // Should only be called from outside of GC
+    MOZ_ASSERT(phaseNestingDepth == 0);
+
+    timingMutator = true;
+    timedGCTime = 0;
+    phaseStartTimes[PHASE_MUTATOR] = 0;
+    phaseTimes[PHASE_MUTATOR] = 0;
+    timedGCStart = 0;
+
+    beginPhase(PHASE_MUTATOR);
+}
+
+void
+Statistics::stopTimingMutator(double &mutator_ms, double &gc_ms)
+{
+    MOZ_ASSERT(timingMutator);
+
+    // Should only be called from outside of GC
+    MOZ_ASSERT(phaseNestingDepth == 1 && phaseNesting[0] == PHASE_MUTATOR);
+
+    endPhase(PHASE_MUTATOR);
+    mutator_ms = t(phaseTimes[PHASE_MUTATOR]);
+    gc_ms = t(timedGCTime);
+    timingMutator = false;
+}
+
 void
 Statistics::beginPhase(Phase phase)
 {
     /* Guard against re-entry */
     MOZ_ASSERT(!phaseStartTimes[phase]);
 
+    if (timingMutator) {
+        if (phaseNestingDepth == 1 && phaseNesting[0] == PHASE_MUTATOR) {
+            endPhase(PHASE_MUTATOR);
+            timedGCStart = PRMJ_Now();
+        }
+    }
+
 #ifdef DEBUG
     MOZ_ASSERT(phases[phase].index == phase);
     Phase parent = phaseNestingDepth ? phaseNesting[phaseNestingDepth - 1] : PHASE_NO_PARENT;
@@ -868,6 +910,13 @@ Statistics::endPhase(Phase phase)
         slices.back().phaseTimes[phase] += t;
     phaseTimes[phase] += t;
     phaseStartTimes[phase] = 0;
+
+    if (timingMutator) {
+        if (phaseNestingDepth == 0 && phase != PHASE_MUTATOR) {
+            timedGCTime += now - timedGCStart;
+            beginPhase(PHASE_MUTATOR);
+        }
+    }
 }
 
 void
diff --git a/js/src/gc/Statistics.h b/js/src/gc/Statistics.h
index 6793d024f61..cffc33a2b58 100644
--- a/js/src/gc/Statistics.h
+++ b/js/src/gc/Statistics.h
@@ -27,6 +27,7 @@ class GCParallelTask;
 namespace gcstats {
 
 enum Phase {
+    PHASE_MUTATOR,
     PHASE_GC_BEGIN,
     PHASE_WAIT_BACKGROUND_THREAD,
     PHASE_MARK_DISCARD_CODE,
@@ -128,6 +129,9 @@ struct Statistics
                     JS::gcreason::Reason reason);
     void endSlice();
 
+    void startTimingMutator();
+    void stopTimingMutator(double &mutator_ms, double &gc_ms);
+
     void reset(const char *reason) { slices.back().resetReason = reason; }
     void nonincremental(const char *reason) { nonincrementalReason = reason; }
 
@@ -189,6 +193,13 @@ struct Statistics
     /* Most recent time when the given phase started. */
     int64_t phaseStartTimes[PHASE_LIMIT];
 
+    /* Are we currently timing mutator vs GC time? */
+    bool timingMutator;
+
+    /* Bookkeeping for GC timings when timingMutator is true */
+    int64_t timedGCStart;
+    int64_t timedGCTime;
+
     /* Total time in a given phase for this GC. */
     int64_t phaseTimes[PHASE_LIMIT];
 
@@ -204,12 +215,10 @@ struct Statistics
     /* Records the maximum GC pause in an API-controlled interval (in us). */
     int64_t maxPauseInInterval;
 
-#ifdef DEBUG
     /* Phases that are currently on stack. */
     static const size_t MAX_NESTING = 8;
     Phase phaseNesting[MAX_NESTING];
-#endif
-    mozilla::DebugOnly<size_t> phaseNestingDepth;
+    size_t phaseNestingDepth;
 
     /* Sweep times for SCCs of compartments. */
     Vector<int64_t, 0, SystemAllocPolicy> sccTimes;
diff --git a/js/src/gc/StoreBuffer.cpp b/js/src/gc/StoreBuffer.cpp
index 4462549b115..23efde94426 100644
--- a/js/src/gc/StoreBuffer.cpp
+++ b/js/src/gc/StoreBuffer.cpp
@@ -10,6 +10,7 @@
 
 #include "mozilla/Assertions.h"
 
+#include "gc/Statistics.h"
 #include "vm/ArgumentsObject.h"
 #include "vm/ForkJoin.h"
 
@@ -99,7 +100,7 @@ StoreBuffer::MonoTypeBuffer<T>::handleOverflow(StoreBuffer *owner)
          * Compact the buffer now, and if that fails to free enough space then
          * trigger a minor collection.
          */
-        gcstats::AutoPhase ap(owner->stats(), PHASE_COMPACT_STOREBUFFER_NO_PARENT);
+        gcstats::AutoPhase ap(owner->stats(), gcstats::PHASE_COMPACT_STOREBUFFER_NO_PARENT);
         owner->stats().count(gcstats::STAT_STOREBUFFER_OVERFLOW);
         compact(owner);
         if (isLowOnSpace())
@@ -111,7 +112,7 @@ StoreBuffer::MonoTypeBuffer<T>::handleOverflow(StoreBuffer *owner)
           */
         if (storage_->availableInCurrentChunk() < sizeof(T)) {
             owner->stats().count(gcstats::STAT_STOREBUFFER_OVERFLOW);
-            maybeCompact(owner, PHASE_COMPACT_STOREBUFFER_NO_PARENT);
+            maybeCompact(owner, gcstats::PHASE_COMPACT_STOREBUFFER_NO_PARENT);
         }
     }
 }
@@ -154,11 +155,11 @@ StoreBuffer::MonoTypeBuffer<T>::compact(StoreBuffer *owner)
 
 template <typename T>
 void
-StoreBuffer::MonoTypeBuffer<T>::maybeCompact(StoreBuffer *owner, gcstats::Phase phase)
+StoreBuffer::MonoTypeBuffer<T>::maybeCompact(StoreBuffer *owner, int phase)
 {
     MOZ_ASSERT(storage_);
     if (storage_->used() != usedAtLastCompact_) {
-        gcstats::AutoPhase ap(owner->stats(), phase);
+        gcstats::AutoPhase ap(owner->stats(), static_cast<gcstats::Phase>(phase));
         compact(owner);
     }
 }
@@ -172,7 +173,7 @@ StoreBuffer::MonoTypeBuffer<T>::mark(StoreBuffer *owner, JSTracer *trc)
     if (!storage_)
         return;
 
-    maybeCompact(owner, PHASE_COMPACT_STOREBUFFER_IN_MINOR_GC);
+    maybeCompact(owner, gcstats::PHASE_COMPACT_STOREBUFFER_IN_MINOR_GC);
 
     for (LifoAlloc::Enum e(*storage_); !e.empty(); e.popFront<T>()) {
         T *edge = e.get<T>();
diff --git a/js/src/gc/StoreBuffer.h b/js/src/gc/StoreBuffer.h
index 94e4b88e713..09276e8665a 100644
--- a/js/src/gc/StoreBuffer.h
+++ b/js/src/gc/StoreBuffer.h
@@ -144,7 +144,7 @@ class StoreBuffer
         virtual void compact(StoreBuffer *owner);
 
         /* Compacts if any entries have been added since the last compaction. */
-        void maybeCompact(StoreBuffer *owner, gcstats::Phase phase);
+        void maybeCompact(StoreBuffer *owner, int phase);
 
         /* Add one item to the buffer. */
         void put(StoreBuffer *owner, const T &t) {
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index e063c9a984f..ffa6fc5bcf6 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -1660,6 +1660,43 @@ Quit(JSContext *cx, unsigned argc, jsval *vp)
     return false;
 }
 
+static bool
+StartTimingMutator(JSContext *cx, unsigned argc, jsval *vp)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+    if (args.length() > 0) {
+        JS_ReportErrorNumber(cx, my_GetErrorMessage, nullptr,
+                             JSSMSG_TOO_MANY_ARGS, "startTimingMutator");
+        return false;
+    }
+
+    cx->runtime()->gc.stats.startTimingMutator();
+    args.rval().setUndefined();
+    return true;
+}
+
+static bool
+StopTimingMutator(JSContext *cx, unsigned argc, jsval *vp)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+    if (args.length() > 0) {
+        JS_ReportErrorNumber(cx, my_GetErrorMessage, nullptr,
+                             JSSMSG_TOO_MANY_ARGS, "stopTimingMutator");
+        return false;
+    }
+
+    double mutator_ms, gc_ms;
+    cx->runtime()->gc.stats.stopTimingMutator(mutator_ms, gc_ms);
+    double total_ms = mutator_ms + gc_ms;
+    if (total_ms > 0) {
+        fprintf(gOutFile, "Mutator: %.3fms (%.1f%%), GC: %.3fms (%.1f%%)\n",
+                mutator_ms, mutator_ms / total_ms * 100.0, gc_ms, gc_ms / total_ms * 100.0);
+    }
+
+    args.rval().setUndefined();
+    return true;
+}
+
 static const char *
 ToSource(JSContext *cx, MutableHandleValue vp, JSAutoByteString *bytes)
 {
@@ -4458,6 +4495,14 @@ static const JSFunctionSpecWithHelp shell_functions[] = {
 "  Throw if the first two arguments are not the same (both +0 or both -0,\n"
 "  both NaN, or non-zero and ===)."),
 
+    JS_FN_HELP("startTimingMutator", StartTimingMutator, 0, 0,
+"startTimingMutator()",
+"  Start accounting time to mutator vs GC."),
+
+    JS_FN_HELP("stopTimingMutator", StopTimingMutator, 0, 0,
+"stopTimingMutator()",
+"  Stop accounting time to mutator vs GC and dump the results."),
+
     JS_FN_HELP("throwError", ThrowError, 0, 0,
 "throwError()",
 "  Throw an error from JS_ReportError."),

From 0470baff841b5d241ec345f2be4e0c7bf23f0987 Mon Sep 17 00:00:00 2001
From: Benoit Girard <b56girard@gmail.com>
Date: Fri, 31 Oct 2014 16:34:30 -0400
Subject: [PATCH 016/153] Bug 1089380 - Remove ClipRectInLayersCoordinates.
 r=mattwoodrow

--HG--
extra : rebase_source : d20c08c804f45f2a6baee9063d0e73bf755054ae
---
 gfx/layers/Compositor.cpp                        | 16 ----------------
 gfx/layers/Compositor.h                          |  9 ---------
 gfx/layers/composite/ContainerLayerComposite.cpp | 13 +------------
 gfx/layers/composite/TiledContentHost.cpp        |  9 ---------
 4 files changed, 1 insertion(+), 46 deletions(-)

diff --git a/gfx/layers/Compositor.cpp b/gfx/layers/Compositor.cpp
index 6d8764c47a8..494f90adfa1 100644
--- a/gfx/layers/Compositor.cpp
+++ b/gfx/layers/Compositor.cpp
@@ -104,22 +104,6 @@ Compositor::DrawDiagnostics(DiagnosticFlags aFlags,
                           aFlashCounter);
 }
 
-RenderTargetRect
-Compositor::ClipRectInLayersCoordinates(Layer* aLayer, RenderTargetIntRect aClip) const {
-  ContainerLayer* parent = aLayer->AsContainerLayer() ? aLayer->AsContainerLayer() : aLayer->GetParent();
-  while (!parent->UseIntermediateSurface() && parent->GetParent()) {
-    parent = parent->GetParent();
-  }
-
-  RenderTargetIntPoint renderTargetOffset = RenderTargetIntRect::FromUntyped(
-    parent->GetEffectiveVisibleRegion().GetBounds()).TopLeft();
-
-  RenderTargetRect result;
-  aClip = aClip + renderTargetOffset;
-  result = RenderTargetRect(aClip.x, aClip.y, aClip.width, aClip.height);
-  return result;
-}
-
 void
 Compositor::DrawDiagnosticsInternal(DiagnosticFlags aFlags,
                                     const gfx::Rect& aVisibleRect,
diff --git a/gfx/layers/Compositor.h b/gfx/layers/Compositor.h
index 0168a767ff7..2ce3680b6a4 100644
--- a/gfx/layers/Compositor.h
+++ b/gfx/layers/Compositor.h
@@ -478,15 +478,6 @@ public:
     mScreenRotation = aRotation;
   }
 
-  // On b2g the clip rect is in the coordinate space of the physical screen
-  // independently of its rotation, while the coordinate space of the layers,
-  // on the other hand, depends on the screen orientation.
-  // This only applies to b2g as with other platforms, orientation is handled
-  // at the OS level rather than in Gecko.
-  // In addition, the clip rect needs to be offset by the rendering origin.
-  // This becomes important if intermediate surfaces are used.
-  RenderTargetRect ClipRectInLayersCoordinates(Layer* aLayer, RenderTargetIntRect aClip) const;
-
 protected:
   void DrawDiagnosticsInternal(DiagnosticFlags aFlags,
                                const gfx::Rect& aVisibleRect,
diff --git a/gfx/layers/composite/ContainerLayerComposite.cpp b/gfx/layers/composite/ContainerLayerComposite.cpp
index b854831be57..6a5bb578b09 100644
--- a/gfx/layers/composite/ContainerLayerComposite.cpp
+++ b/gfx/layers/composite/ContainerLayerComposite.cpp
@@ -163,18 +163,6 @@ ContainerPrepare(ContainerT* aContainer,
       continue;
     }
 
-    RenderTargetRect quad = layerToRender->GetLayer()->
-      TransformRectToRenderTarget(LayerPixel::FromUntyped(
-        layerToRender->GetLayer()->GetEffectiveVisibleRegion().GetBounds()));
-
-    Compositor* compositor = aManager->GetCompositor();
-    if (!layerToRender->GetLayer()->AsContainerLayer() &&
-        !quad.Intersects(compositor->ClipRectInLayersCoordinates(layerToRender->GetLayer(), clipRect)) &&
-        !LayerHasCheckerboardingAPZC(layerToRender->GetLayer(), nullptr)) {
-      CULLING_LOG("Sublayer %p is clipped entirely\n", layerToRender->GetLayer());
-      continue;
-    }
-
     CULLING_LOG("Preparing sublayer %p\n", layerToRender->GetLayer());
 
     layerToRender->Prepare(clipRect);
@@ -328,6 +316,7 @@ RenderIntermediate(ContainerT* aContainer,
   if (!surface) {
     return;
   }
+
   compositor->SetRenderTarget(surface);
   // pre-render all of the layers into our temporary
   RenderLayers(aContainer, aManager, RenderTargetPixel::FromUntyped(aClipRect));
diff --git a/gfx/layers/composite/TiledContentHost.cpp b/gfx/layers/composite/TiledContentHost.cpp
index 0d7cdb400dd..1cff1ea1e3d 100644
--- a/gfx/layers/composite/TiledContentHost.cpp
+++ b/gfx/layers/composite/TiledContentHost.cpp
@@ -461,15 +461,6 @@ TiledContentHost::RenderTile(const TileHost& aTile,
     return;
   }
 
-  nsIntRect screenBounds = aScreenRegion.GetBounds();
-  Rect layerQuad(screenBounds.x, screenBounds.y, screenBounds.width, screenBounds.height);
-  RenderTargetRect quad = RenderTargetRect::FromUnknown(aTransform.TransformBounds(layerQuad));
-
-  if (!quad.Intersects(mCompositor->ClipRectInLayersCoordinates(mLayer,
-      RenderTargetIntRect(aClipRect.x, aClipRect.y, aClipRect.width, aClipRect.height)))) {
-    return;
-  }
-
   if (aBackgroundColor) {
     aEffectChain.mPrimaryEffect = new EffectSolidColor(ToColor(*aBackgroundColor));
     nsIntRegionRectIterator it(aScreenRegion);

From ba4692a8b66c4741ecaf3ffd18bb71ec72b71110 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Wed, 22 Oct 2014 14:26:17 +1300
Subject: [PATCH 017/153] Bug 1084672. Call NotifyDidPaint from the refresh
 driver to ensure it gets called regardless of whether OMTC is used or not.
 r=mattwoodrow

--HG--
extra : rebase_source : 51cc908538bd127c0af9089ae92aa82146032015
---
 layout/base/nsPresShell.cpp     | 4 ----
 layout/base/nsRefreshDriver.cpp | 4 ++++
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/layout/base/nsPresShell.cpp b/layout/base/nsPresShell.cpp
index edc80a1f473..1154e465533 100644
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -8803,10 +8803,6 @@ PresShell::DidPaintWindow()
     // about compositing of popups.
     return;
   }
-
-  if (nsContentUtils::XPConnect()) {
-    nsContentUtils::XPConnect()->NotifyDidPaint();
-  }
 }
 
 bool
diff --git a/layout/base/nsRefreshDriver.cpp b/layout/base/nsRefreshDriver.cpp
index eec500d89dc..5de68a374f4 100644
--- a/layout/base/nsRefreshDriver.cpp
+++ b/layout/base/nsRefreshDriver.cpp
@@ -1362,6 +1362,10 @@ nsRefreshDriver::Tick(int64_t aNowEpoch, TimeStamp aNowTime)
                                                       TRACING_INTERVAL_END);
     }
     profiler_tracing("Paint", "DisplayList", TRACING_INTERVAL_END);
+
+    if (nsContentUtils::XPConnect()) {
+      nsContentUtils::XPConnect()->NotifyDidPaint();
+    }
   }
 
   for (uint32_t i = 0; i < mPostRefreshObservers.Length(); ++i) {

From 543509b815c93a68c03c00df92f719f497b2086c Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Tue, 4 Nov 2014 14:19:14 +1300
Subject: [PATCH 018/153] Bug 1093399. Fire UpdateReadyStateForData every time
 we get new data. r=cpearce

--HG--
extra : rebase_source : e243ecb8a72615cdf697228f30e631144cde129d
---
 dom/media/MediaDecoder.cpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dom/media/MediaDecoder.cpp b/dom/media/MediaDecoder.cpp
index e768ff9bde4..bdb28990768 100644
--- a/dom/media/MediaDecoder.cpp
+++ b/dom/media/MediaDecoder.cpp
@@ -1474,6 +1474,7 @@ void MediaDecoder::NotifyDataArrived(const char* aBuffer, uint32_t aLength, int6
   if (mDecoderStateMachine) {
     mDecoderStateMachine->NotifyDataArrived(aBuffer, aLength, aOffset);
   }
+  UpdateReadyStateForData();
 }
 
 void MediaDecoder::UpdatePlaybackPosition(int64_t aTime)

From 1ba600aa1f0c8ef6ccf1d618427aad078ce9aaeb Mon Sep 17 00:00:00 2001
From: Eric Faust <efaustbmo@gmail.com>
Date: Thu, 30 Oct 2014 17:27:01 -0700
Subject: [PATCH 019/153] Bug 611388 - Part 0: Sanify how const is handled by
 Reflect.parse. (r=shu)

---
 js/src/jsreflect.cpp | 59 ++++++++++++++++++--------------------------
 js/src/jsreflect.h   |  1 -
 2 files changed, 24 insertions(+), 36 deletions(-)

diff --git a/js/src/jsreflect.cpp b/js/src/jsreflect.cpp
index d897df76ea9..1208bc976f8 100644
--- a/js/src/jsreflect.cpp
+++ b/js/src/jsreflect.cpp
@@ -1733,7 +1733,7 @@ class ASTSerializer
 
     bool declaration(ParseNode *pn, MutableHandleValue dst);
     bool variableDeclaration(ParseNode *pn, bool let, MutableHandleValue dst);
-    bool variableDeclarator(ParseNode *pn, VarDeclKind *pkind, MutableHandleValue dst);
+    bool variableDeclarator(ParseNode *pn, MutableHandleValue dst);
     bool let(ParseNode *pn, bool expr, MutableHandleValue dst);
     bool importDeclaration(ParseNode *pn, MutableHandleValue dst);
     bool importSpecifier(ParseNode *pn, MutableHandleValue dst);
@@ -1785,9 +1785,9 @@ class ASTSerializer
     bool identifier(ParseNode *pn, MutableHandleValue dst);
     bool literal(ParseNode *pn, MutableHandleValue dst);
 
-    bool pattern(ParseNode *pn, VarDeclKind *pkind, MutableHandleValue dst);
-    bool arrayPattern(ParseNode *pn, VarDeclKind *pkind, MutableHandleValue dst);
-    bool objectPattern(ParseNode *pn, VarDeclKind *pkind, MutableHandleValue dst);
+    bool pattern(ParseNode *pn, MutableHandleValue dst);
+    bool arrayPattern(ParseNode *pn, MutableHandleValue dst);
+    bool objectPattern(ParseNode *pn, MutableHandleValue dst);
 
     bool function(ParseNode *pn, ASTType type, MutableHandleValue dst);
     bool functionArgsAndBody(ParseNode *pn, NodeVector &args, NodeVector &defaults,
@@ -2023,15 +2023,14 @@ ASTSerializer::variableDeclaration(ParseNode *pn, bool let, MutableHandleValue d
 {
     MOZ_ASSERT(let ? pn->isKind(PNK_LET) : (pn->isKind(PNK_VAR) || pn->isKind(PNK_CONST)));
 
-    /* Later updated to VARDECL_CONST if we find a PND_CONST declarator. */
-    VarDeclKind kind = let ? VARDECL_LET : VARDECL_VAR;
+    VarDeclKind kind = let ? VARDECL_LET : pn->isKind(PNK_VAR) ? VARDECL_VAR : VARDECL_CONST;
 
     NodeVector dtors(cx);
     if (!dtors.reserve(pn->pn_count))
         return false;
     for (ParseNode *next = pn->pn_head; next; next = next->pn_next) {
         RootedValue child(cx);
-        if (!variableDeclarator(next, &kind, &child))
+        if (!variableDeclarator(next, &child))
             return false;
         dtors.infallibleAppend(child);
     }
@@ -2039,7 +2038,7 @@ ASTSerializer::variableDeclaration(ParseNode *pn, bool let, MutableHandleValue d
 }
 
 bool
-ASTSerializer::variableDeclarator(ParseNode *pn, VarDeclKind *pkind, MutableHandleValue dst)
+ASTSerializer::variableDeclarator(ParseNode *pn, MutableHandleValue dst)
 {
     ParseNode *pnleft;
     ParseNode *pnright;
@@ -2060,7 +2059,7 @@ ASTSerializer::variableDeclarator(ParseNode *pn, VarDeclKind *pkind, MutableHand
     }
 
     RootedValue left(cx), right(cx);
-    return pattern(pnleft, pkind, &left) &&
+    return pattern(pnleft, &left) &&
            optExpression(pnright, &right) &&
            builder.variableDeclarator(left, right, &pn->pn_pos, dst);
 }
@@ -2081,15 +2080,10 @@ ASTSerializer::let(ParseNode *pn, bool expr, MutableHandleValue dst)
     if (!dtors.reserve(letHead->pn_count))
         return false;
 
-    VarDeclKind kind = VARDECL_LET_HEAD;
-
     for (ParseNode *next = letHead->pn_head; next; next = next->pn_next) {
         RootedValue child(cx);
-        /*
-         * Unlike in |variableDeclaration|, this does not update |kind|; since let-heads do
-         * not contain const declarations, declarators should never have PND_CONST set.
-         */
-        if (!variableDeclarator(next, &kind, &child))
+
+        if (!variableDeclarator(next, &child))
             return false;
         dtors.infallibleAppend(child);
     }
@@ -2260,7 +2254,7 @@ ASTSerializer::catchClause(ParseNode *pn, bool *isGuarded, MutableHandleValue ds
 
     RootedValue var(cx), guard(cx), body(cx);
 
-    if (!pattern(pn->pn_kid1, nullptr, &var) ||
+    if (!pattern(pn->pn_kid1, &var) ||
         !optExpression(pn->pn_kid2, &guard)) {
         return false;
     }
@@ -2448,7 +2442,7 @@ ASTSerializer::statement(ParseNode *pn, MutableHandleValue dst)
         if (head->isKind(PNK_FORIN)) {
             RootedValue var(cx);
             return (!head->pn_kid1
-                    ? pattern(head->pn_kid2, nullptr, &var)
+                    ? pattern(head->pn_kid2, &var)
                     : head->pn_kid1->isKind(PNK_LEXICALSCOPE)
                     ? variableDeclaration(head->pn_kid1->pn_expr, true, &var)
                     : variableDeclaration(head->pn_kid1, false, &var)) &&
@@ -2458,7 +2452,7 @@ ASTSerializer::statement(ParseNode *pn, MutableHandleValue dst)
         if (head->isKind(PNK_FOROF)) {
             RootedValue var(cx);
             return (!head->pn_kid1
-                    ? pattern(head->pn_kid2, nullptr, &var)
+                    ? pattern(head->pn_kid2, &var)
                     : head->pn_kid1->isKind(PNK_LEXICALSCOPE)
                     ? variableDeclaration(head->pn_kid1->pn_expr, true, &var)
                     : variableDeclaration(head->pn_kid1, false, &var)) &&
@@ -2591,7 +2585,7 @@ ASTSerializer::comprehensionBlock(ParseNode *pn, MutableHandleValue dst)
     bool isForOf = in->isKind(PNK_FOROF);
 
     RootedValue patt(cx), src(cx);
-    return pattern(in->pn_kid2, nullptr, &patt) &&
+    return pattern(in->pn_kid2, &patt) &&
            expression(in->pn_kid3, &src) &&
            builder.comprehensionBlock(patt, src, isForEach, isForOf, &in->pn_pos, dst);
 }
@@ -2762,7 +2756,7 @@ ASTSerializer::expression(ParseNode *pn, MutableHandleValue dst)
         LOCAL_ASSERT(op > AOP_ERR && op < AOP_LIMIT);
 
         RootedValue lhs(cx), rhs(cx);
-        return pattern(pn->pn_left, nullptr, &lhs) &&
+        return pattern(pn->pn_left, &lhs) &&
                expression(pn->pn_right, &rhs) &&
                builder.assignmentExpression(op, lhs, rhs, &pn->pn_pos, dst);
       }
@@ -3122,7 +3116,7 @@ ASTSerializer::literal(ParseNode *pn, MutableHandleValue dst)
 }
 
 bool
-ASTSerializer::arrayPattern(ParseNode *pn, VarDeclKind *pkind, MutableHandleValue dst)
+ASTSerializer::arrayPattern(ParseNode *pn, MutableHandleValue dst)
 {
     MOZ_ASSERT(pn->isKind(PNK_ARRAY));
 
@@ -3136,14 +3130,14 @@ ASTSerializer::arrayPattern(ParseNode *pn, VarDeclKind *pkind, MutableHandleValu
         } else if (next->isKind(PNK_SPREAD)) {
             RootedValue target(cx);
             RootedValue spread(cx);
-            if (!pattern(next->pn_kid, pkind, &target))
+            if (!pattern(next->pn_kid, &target))
                 return false;
             if(!builder.spreadExpression(target, &next->pn_pos, &spread))
                 return false;
             elts.infallibleAppend(spread);
         } else {
             RootedValue patt(cx);
-            if (!pattern(next, pkind, &patt))
+            if (!pattern(next, &patt))
                 return false;
             elts.infallibleAppend(patt);
         }
@@ -3153,7 +3147,7 @@ ASTSerializer::arrayPattern(ParseNode *pn, VarDeclKind *pkind, MutableHandleValu
 }
 
 bool
-ASTSerializer::objectPattern(ParseNode *pn, VarDeclKind *pkind, MutableHandleValue dst)
+ASTSerializer::objectPattern(ParseNode *pn, MutableHandleValue dst)
 {
     MOZ_ASSERT(pn->isKind(PNK_OBJECT));
 
@@ -3178,7 +3172,7 @@ ASTSerializer::objectPattern(ParseNode *pn, VarDeclKind *pkind, MutableHandleVal
         }
 
         RootedValue patt(cx), prop(cx);
-        if (!pattern(target, pkind, &patt) ||
+        if (!pattern(target, &patt) ||
             !builder.propertyPattern(key, patt, propdef->isKind(PNK_SHORTHAND), &propdef->pn_pos,
                                      &prop))
         {
@@ -3192,20 +3186,15 @@ ASTSerializer::objectPattern(ParseNode *pn, VarDeclKind *pkind, MutableHandleVal
 }
 
 bool
-ASTSerializer::pattern(ParseNode *pn, VarDeclKind *pkind, MutableHandleValue dst)
+ASTSerializer::pattern(ParseNode *pn, MutableHandleValue dst)
 {
     JS_CHECK_RECURSION(cx, return false);
     switch (pn->getKind()) {
       case PNK_OBJECT:
-        return objectPattern(pn, pkind, dst);
+        return objectPattern(pn, dst);
 
       case PNK_ARRAY:
-        return arrayPattern(pn, pkind, dst);
-
-      case PNK_NAME:
-        if (pkind && (pn->pn_dflags & PND_CONST))
-            *pkind = VARDECL_CONST;
-        /* FALL THROUGH */
+        return arrayPattern(pn, dst);
 
       default:
         return expression(pn, dst);
@@ -3348,7 +3337,7 @@ ASTSerializer::functionArgs(ParseNode *pn, ParseNode *pnargs, ParseNode *pndestr
      */
     while ((arg && arg != pnbody) || destruct) {
         if (destruct && destruct->pn_right->frameSlot() == i) {
-            if (!pattern(destruct->pn_left, nullptr, &node) || !args.append(node))
+            if (!pattern(destruct->pn_left, &node) || !args.append(node))
                 return false;
             destruct = destruct->pn_next;
         } else if (arg && arg != pnbody) {
diff --git a/js/src/jsreflect.h b/js/src/jsreflect.h
index aed8b12408e..a592bfe0cb2 100644
--- a/js/src/jsreflect.h
+++ b/js/src/jsreflect.h
@@ -73,7 +73,6 @@ enum VarDeclKind {
     VARDECL_VAR = 0,
     VARDECL_CONST,
     VARDECL_LET,
-    VARDECL_LET_HEAD,
     VARDECL_LIMIT
 };
 

From 3859ec66a31419e09a9a0ce6d785ff3b12da4d57 Mon Sep 17 00:00:00 2001
From: Eric Faust <efaustbmo@gmail.com>
Date: Thu, 30 Oct 2014 17:27:03 -0700
Subject: [PATCH 020/153] Bug 611388 - |const| should be block scoped and
 require an initializer. (r=shu)

---
 b2g/chrome/content/identity.js                |  16 +-
 .../tests/chrome/templates_shared.js          |  23 +-
 js/src/frontend/BytecodeEmitter.cpp           |  20 +-
 js/src/frontend/FullParseHandler.h            |   4 +-
 js/src/frontend/ParseNode.cpp                 |   4 +-
 js/src/frontend/ParseNode.h                   |  16 +-
 js/src/frontend/Parser.cpp                    | 219 ++++++++++++------
 js/src/frontend/Parser.h                      |  13 +-
 js/src/jit-test/tests/asm.js/testGlobals.js   |   1 -
 .../jit-test/tests/auto-regress/bug487570.js  |   2 +-
 .../jit-test/tests/auto-regress/bug495843.js  |   2 +-
 js/src/jit-test/tests/basic/bug639797.js      |   2 +-
 .../tests/basic/functionRedeclConst.js        |   5 +
 .../tests/basic/functionRedeclGlobalConst.js  |   3 +
 .../jit-test/tests/basic/functionRedeclLet.js |   5 +
 js/src/jit-test/tests/basic/letTDZDelete.js   |  13 +-
 .../jit-test/tests/basic/letTDZEffectful.js   |  13 +-
 .../basic/syntax-error-illegal-character.js   |   8 +-
 .../basic/testDestructuringVarInsideWith.js   |   2 +-
 .../tests/jaeger/recompile/bug641269.js       |   2 +
 js/src/js.msg                                 |   7 +-
 js/src/jsreflect.cpp                          |  26 ++-
 js/src/jsscript.cpp                           |   4 +-
 js/src/jsscript.h                             |   5 +
 .../ecma_5/Object/freeze-global-eval-const.js |   2 +-
 .../tests/js1_5/Regress/regress-360969-03.js  |   2 +-
 .../tests/js1_5/Regress/regress-360969-04.js  |   2 +-
 .../tests/js1_5/extensions/regress-452565.js  |   2 +-
 js/src/tests/js1_6/Regress/regress-372565.js  |   4 +-
 js/src/tests/js1_7/block/regress-349507.js    |   3 +-
 js/src/tests/js1_8/genexps/regress-384991.js  |   2 +-
 .../js1_8_1/regress/regress-452498-068.js     |   2 +-
 .../js1_8_1/regress/regress-452498-092.js     |   2 +-
 .../js1_8_1/regress/regress-452498-101.js     |   2 +-
 .../js1_8_1/regress/regress-452498-102.js     |   4 +-
 .../js1_8_1/regress/regress-452498-112.js     |   4 +-
 .../js1_8_1/regress/regress-452498-117.js     |   6 +-
 .../js1_8_1/regress/regress-452498-160.js     |   2 +-
 .../js1_8_1/regress/regress-452498-185.js     |   2 +-
 .../js1_8_1/regress/regress-452498-187.js     |   2 +-
 .../js1_8_1/regress/regress-452498-192.js     |   3 +-
 js/src/tests/js1_8_1/strict/12.2.1.js         |   8 +-
 .../redeclaration-of-catch-warning.js         |   2 +-
 .../tests/js1_8_5/extensions/reflect-parse.js |  12 +-
 js/src/vm/ScopeObject.cpp                     |  30 ++-
 js/src/vm/ScopeObject.h                       |   2 +-
 js/src/vm/Xdr.h                               |   2 +-
 .../modules/osfile_shared_allthreads.jsm      |  10 +-
 .../components/places/tests/head_common.js    |   5 +-
 49 files changed, 320 insertions(+), 212 deletions(-)
 create mode 100644 js/src/jit-test/tests/basic/functionRedeclConst.js
 create mode 100644 js/src/jit-test/tests/basic/functionRedeclGlobalConst.js
 create mode 100644 js/src/jit-test/tests/basic/functionRedeclLet.js

diff --git a/b2g/chrome/content/identity.js b/b2g/chrome/content/identity.js
index 1d87844ad4d..548ecf54d8f 100644
--- a/b2g/chrome/content/identity.js
+++ b/b2g/chrome/content/identity.js
@@ -31,15 +31,15 @@ function log(...aMessageArgs) {
 log("\n\n======================= identity.js =======================\n\n");
 
 // This script may be injected more than once into an iframe.
-// Ensure we don't redefine contstants
+// It's hard to do this with |const| like we should, so use var instead.
 if (typeof kIdentityJSLoaded === 'undefined') {
-  const kIdentityDelegateWatch = "identity-delegate-watch";
-  const kIdentityDelegateRequest = "identity-delegate-request";
-  const kIdentityDelegateLogout = "identity-delegate-logout";
-  const kIdentityDelegateReady = "identity-delegate-ready";
-  const kIdentityDelegateFinished = "identity-delegate-finished";
-  const kIdentityControllerDoMethod = "identity-controller-doMethod";
-  const kIdentktyJSLoaded = true;
+  var kIdentityDelegateWatch = "identity-delegate-watch";
+  var kIdentityDelegateRequest = "identity-delegate-request";
+  var kIdentityDelegateLogout = "identity-delegate-logout";
+  var kIdentityDelegateReady = "identity-delegate-ready";
+  var kIdentityDelegateFinished = "identity-delegate-finished";
+  var kIdentityControllerDoMethod = "identity-controller-doMethod";
+  var kIdentktyJSLoaded = true;
 }
 
 var showUI = false;
diff --git a/dom/xul/templates/tests/chrome/templates_shared.js b/dom/xul/templates/tests/chrome/templates_shared.js
index 93b13d316af..a73e602424d 100644
--- a/dom/xul/templates/tests/chrome/templates_shared.js
+++ b/dom/xul/templates/tests/chrome/templates_shared.js
@@ -54,12 +54,23 @@ const debug = false;
 var expectedConsoleMessages = [];
 var expectLoggedMessages = null;
 
-try {
-  const RDF = Components.classes["@mozilla.org/rdf/rdf-service;1"].
-                getService(Components.interfaces.nsIRDFService);
-  const ContainerUtils = Components.classes["@mozilla.org/rdf/container-utils;1"].
-                           getService(Components.interfaces.nsIRDFContainerUtils);
-} catch(ex) { }
+function get_RDF() {
+  try {
+    return Components.classes["@mozilla.org/rdf/rdf-service;1"].
+             getService(Components.interfaces.nsIRDFService);
+  } catch (ex) { }
+}
+
+function get_ContainerUtils()
+{
+  try {
+    return Components.classes["@mozilla.org/rdf/container-utils;1"].
+             getService(Components.interfaces.nsIRDFContainerUtils);
+  } catch(ex) { }
+}
+
+const RDF = get_RDF();
+const ContainerUtils = get_ContainerUtils();
 
 var xmlDoc;
 
diff --git a/js/src/frontend/BytecodeEmitter.cpp b/js/src/frontend/BytecodeEmitter.cpp
index e79883ec966..645e31e89ab 100644
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@@ -1240,7 +1240,7 @@ LookupAliasedName(BytecodeEmitter *bce, HandleScript script, PropertyName *name,
                             if (freeVariables[i].isHoistedUse() && bindingIndex >= lexicalBegin) {
                                 MOZ_ASSERT(pn);
                                 MOZ_ASSERT(pn->isUsed());
-                                pn->pn_dflags |= PND_LET;
+                                pn->pn_dflags |= PND_LEXICAL;
                             }
 
                             break;
@@ -1289,7 +1289,7 @@ AssignHops(BytecodeEmitter *bce, ParseNode *pn, unsigned src, ScopeCoordinate *d
 static inline MaybeCheckLexical
 NodeNeedsCheckLexical(ParseNode *pn)
 {
-    return pn->isHoistedLetUse() ? CheckLexical : DontCheckLexical;
+    return pn->isHoistedLexicalUse() ? CheckLexical : DontCheckLexical;
 }
 
 static bool
@@ -1461,6 +1461,7 @@ BytecodeEmitter::isAliasedName(ParseNode *pn)
 
     switch (dn->kind()) {
       case Definition::LET:
+      case Definition::CONST:
         /*
          * There are two ways to alias a let variable: nested functions and
          * dynamic scope operations. (This is overly conservative since the
@@ -1485,7 +1486,7 @@ BytecodeEmitter::isAliasedName(ParseNode *pn)
          */
         return script->formalIsAliased(pn->pn_cookie.slot());
       case Definition::VAR:
-      case Definition::CONST:
+      case Definition::GLOBALCONST:
         MOZ_ASSERT_IF(sc->allLocalsAliased(), script->varIsAliased(pn->pn_cookie.slot()));
         return script->varIsAliased(pn->pn_cookie.slot());
       case Definition::PLACEHOLDER:
@@ -1777,6 +1778,7 @@ BindNameToSlotHelper(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         break;
 
       case Definition::VAR:
+      case Definition::GLOBALCONST:
       case Definition::CONST:
       case Definition::LET:
         switch (op) {
@@ -2077,7 +2079,7 @@ CheckSideEffects(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, bool
             }
         }
 
-        if (pn->isHoistedLetUse()) {
+        if (pn->isHoistedLexicalUse()) {
             // Hoisted uses of lexical bindings throw on access.
             *answer = true;
         }
@@ -4663,7 +4665,7 @@ EmitLet(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pnLet)
     ParseNode *varList = pnLet->pn_left;
     MOZ_ASSERT(varList->isArity(PN_LIST));
     ParseNode *letBody = pnLet->pn_right;
-    MOZ_ASSERT(letBody->isLet() && letBody->isKind(PNK_LEXICALSCOPE));
+    MOZ_ASSERT(letBody->isLexical() && letBody->isKind(PNK_LEXICALSCOPE));
 
     int letHeadDepth = bce->stackDepth;
 
@@ -4753,7 +4755,7 @@ static bool
 EmitForInOrOfVariables(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn, bool *letDecl)
 {
     *letDecl = pn->isKind(PNK_LEXICALSCOPE);
-    MOZ_ASSERT_IF(*letDecl, pn->isLet());
+    MOZ_ASSERT_IF(*letDecl, pn->isLexical());
 
     // If the left part is 'var x', emit code to define x if necessary using a
     // prolog opcode, but do not emit a pop. If it is 'let x', EnterBlockScope
@@ -6706,7 +6708,7 @@ frontend::EmitTree(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
             // Assign the destructuring arguments before defining any functions,
             // see bug 419662.
             MOZ_ASSERT(pnchild->isKind(PNK_SEMI));
-            MOZ_ASSERT(pnchild->pn_kid->isKind(PNK_VAR) || pnchild->pn_kid->isKind(PNK_CONST));
+            MOZ_ASSERT(pnchild->pn_kid->isKind(PNK_VAR) || pnchild->pn_kid->isKind(PNK_GLOBALCONST));
             if (!EmitTree(cx, bce, pnchild))
                 return false;
             pnchild = pnchild->pn_next;
@@ -6839,7 +6841,7 @@ frontend::EmitTree(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         break;
 
       case PNK_VAR:
-      case PNK_CONST:
+      case PNK_GLOBALCONST:
         if (!EmitVariables(cx, bce, pn, InitializeVars))
             return false;
         break;
@@ -7002,6 +7004,8 @@ frontend::EmitTree(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
         break;
 
       case PNK_LET:
+      case PNK_CONST:
+        MOZ_ASSERT_IF(pn->isKind(PNK_CONST), !pn->isArity(PN_BINARY));
         ok = pn->isArity(PN_BINARY)
              ? EmitLet(cx, bce, pn)
              : EmitVariables(cx, bce, pn, InitializeVars);
diff --git a/js/src/frontend/FullParseHandler.h b/js/src/frontend/FullParseHandler.h
index a86dcff80a9..9ed975ddcef 100644
--- a/js/src/frontend/FullParseHandler.h
+++ b/js/src/frontend/FullParseHandler.h
@@ -667,8 +667,8 @@ class FullParseHandler
                                                   uint16_t firstDominatingLexicalSlot)
     {
         MOZ_ASSERT(pn->isUsed());
-        if (dn->isLet() && dn->pn_cookie.slot() < firstDominatingLexicalSlot)
-            pn->pn_dflags |= PND_LET;
+        if (dn->isLexical() && dn->pn_cookie.slot() < firstDominatingLexicalSlot)
+            pn->pn_dflags |= PND_LEXICAL;
     }
 
     static uintptr_t definitionToBits(Definition *dn) {
diff --git a/js/src/frontend/ParseNode.cpp b/js/src/frontend/ParseNode.cpp
index a51bc7b7af4..8327cc2f03f 100644
--- a/js/src/frontend/ParseNode.cpp
+++ b/js/src/frontend/ParseNode.cpp
@@ -308,7 +308,7 @@ const char *
 Definition::kindString(Kind kind)
 {
     static const char * const table[] = {
-        "", js_var_str, js_const_str, js_let_str, js_function_str, "argument", "unknown"
+        "", js_var_str, js_const_str, js_const_str, js_let_str, "argument", js_function_str, "unknown"
     };
 
     MOZ_ASSERT(unsigned(kind) <= unsigned(ARG));
@@ -505,7 +505,7 @@ Parser<FullParseHandler>::cloneLeftHandSide(ParseNode *opn)
         if (opn->isDefn()) {
             /* We copied some definition-specific state into pn. Clear it out. */
             pn->pn_cookie.makeFree();
-            pn->pn_dflags &= ~(PND_LET | PND_BOUND);
+            pn->pn_dflags &= ~(PND_LEXICAL | PND_BOUND);
             pn->setDefn(false);
 
             handler.linkUseToDef(pn, (Definition *) opn);
diff --git a/js/src/frontend/ParseNode.h b/js/src/frontend/ParseNode.h
index 2a4d7392229..4ef509ec9bf 100644
--- a/js/src/frontend/ParseNode.h
+++ b/js/src/frontend/ParseNode.h
@@ -114,6 +114,7 @@ class UpvarCookie
     F(CONTINUE) \
     F(VAR) \
     F(CONST) \
+    F(GLOBALCONST) \
     F(WITH) \
     F(RETURN) \
     F(NEW) \
@@ -682,7 +683,8 @@ class ParseNode
     Definition *resolve();
 
 /* PN_CODE and PN_NAME pn_dflags bits. */
-#define PND_LET                 0x01    /* let (block-scoped) binding or use of a hoisted let */
+#define PND_LEXICAL             0x01    /* lexical (block-scoped) binding or use of a hoisted
+                                           let or const */
 #define PND_CONST               0x02    /* const binding (orthogonal to let) */
 #define PND_ASSIGNED            0x04    /* set if ever LHS of assignment */
 #define PND_PLACEHOLDER         0x08    /* placeholder definition for lexdep */
@@ -764,7 +766,7 @@ class ParseNode
 
     inline bool test(unsigned flag) const;
 
-    bool isLet() const          { return test(PND_LET) && !isUsed(); }
+    bool isLexical() const      { return test(PND_LEXICAL) && !isUsed(); }
     bool isConst() const        { return test(PND_CONST); }
     bool isPlaceholder() const  { return test(PND_PLACEHOLDER); }
     bool isDeoptimized() const  { return test(PND_DEOPTIMIZED); }
@@ -772,7 +774,7 @@ class ParseNode
     bool isClosed() const       { return test(PND_CLOSED); }
     bool isBound() const        { return test(PND_BOUND); }
     bool isImplicitArguments() const { return test(PND_IMPLICITARGUMENTS); }
-    bool isHoistedLetUse() const { return test(PND_LET) && isUsed(); }
+    bool isHoistedLexicalUse() const { return test(PND_LEXICAL) && isUsed(); }
 
     /* True if pn is a parsenode representing a literal constant. */
     bool isLiteral() const {
@@ -1414,7 +1416,7 @@ struct Definition : public ParseNode
         return pn_cookie.isFree();
     }
 
-    enum Kind { MISSING = 0, VAR, CONST, LET, ARG, NAMED_LAMBDA, PLACEHOLDER };
+    enum Kind { MISSING = 0, VAR, GLOBALCONST, CONST, LET, ARG, NAMED_LAMBDA, PLACEHOLDER };
 
     bool canHaveInitializer() { return int(kind()) <= int(ARG); }
 
@@ -1433,10 +1435,10 @@ struct Definition : public ParseNode
             return PLACEHOLDER;
         if (isOp(JSOP_GETARG))
             return ARG;
+        if (isLexical())
+            return isConst() ? CONST : LET;
         if (isConst())
-            return CONST;
-        if (isLet())
-            return LET;
+            return GLOBALCONST;
         return VAR;
     }
 };
diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp
index cc435cbe7e6..819ac036d42 100644
--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -122,7 +122,7 @@ MarkUsesAsHoistedLexical(ParseNode *pn)
     // Distinguish hoisted uses as a different JSOp for easier compilation.
     while ((pnu = *pnup) != nullptr && pnu->pn_blockid >= start) {
         MOZ_ASSERT(pnu->isUsed());
-        pnu->pn_dflags |= PND_LET;
+        pnu->pn_dflags |= PND_LEXICAL;
         pnup = &pnu->pn_link;
     }
 }
@@ -137,7 +137,7 @@ ParseContext<FullParseHandler>::define(TokenStream &ts,
     MOZ_ASSERT_IF(pn->isDefn(), pn->isPlaceholder());
 
     Definition *prevDef = nullptr;
-    if (kind == Definition::LET)
+    if (kind == Definition::LET || kind == Definition::CONST)
         prevDef = decls_.lookupFirst(name);
     else
         MOZ_ASSERT(!decls_.lookupFirst(name));
@@ -148,7 +148,8 @@ ParseContext<FullParseHandler>::define(TokenStream &ts,
     if (prevDef) {
         ParseNode **pnup = &prevDef->dn_uses;
         ParseNode *pnu;
-        unsigned start = (kind == Definition::LET) ? pn->pn_blockid : bodyid;
+        unsigned start = (kind == Definition::LET || kind == Definition::CONST) ? pn->pn_blockid
+                                                                                : bodyid;
 
         while ((pnu = *pnup) != nullptr && pnu->pn_blockid >= start) {
             MOZ_ASSERT(pnu->pn_blockid >= bodyid);
@@ -170,7 +171,7 @@ ParseContext<FullParseHandler>::define(TokenStream &ts,
         pn->pn_dflags |= prevDef->pn_dflags & PND_CLOSED;
     }
 
-    MOZ_ASSERT_IF(kind != Definition::LET, !lexdeps->lookup(name));
+    MOZ_ASSERT_IF(kind != Definition::LET && kind != Definition::CONST, !lexdeps->lookup(name));
     pn->setDefn(true);
     pn->pn_dflags &= ~PND_PLACEHOLDER;
     if (kind == Definition::CONST)
@@ -197,7 +198,7 @@ ParseContext<FullParseHandler>::define(TokenStream &ts,
             return false;
         break;
 
-      case Definition::CONST:
+      case Definition::GLOBALCONST:
       case Definition::VAR:
         if (sc->isFunctionBox()) {
             dn->setOp((js_CodeSpec[dn->getOp()].format & JOF_SET) ? JSOP_SETLOCAL : JSOP_GETLOCAL);
@@ -215,8 +216,9 @@ ParseContext<FullParseHandler>::define(TokenStream &ts,
         break;
 
       case Definition::LET:
+      case Definition::CONST:
         dn->setOp(JSOP_INITLEXICAL);
-        dn->pn_dflags |= (PND_LET | PND_BOUND);
+        dn->pn_dflags |= (PND_LEXICAL | PND_BOUND);
         MOZ_ASSERT(dn->pn_cookie.level() == staticLevel); /* see bindLet */
         if (atBodyLevel()) {
             if (!bodyLevelLexicals_.append(dn))
@@ -314,7 +316,8 @@ template <typename ParseHandler>
 void
 ParseContext<ParseHandler>::popLetDecl(JSAtom *atom)
 {
-    MOZ_ASSERT(ParseHandler::getDefinitionKind(decls_.lookupFirst(atom)) == Definition::LET);
+    MOZ_ASSERT(ParseHandler::getDefinitionKind(decls_.lookupFirst(atom)) == Definition::LET ||
+               ParseHandler::getDefinitionKind(decls_.lookupFirst(atom)) == Definition::CONST);
     decls_.remove(atom);
 }
 
@@ -338,6 +341,7 @@ AppendPackedBindings(const ParseContext<ParseHandler> *pc, const DeclVector &vec
             kind = Binding::VARIABLE;
             break;
           case Definition::CONST:
+          case Definition::GLOBALCONST:
             kind = Binding::CONSTANT;
             break;
           case Definition::ARG:
@@ -1169,6 +1173,7 @@ struct BindData
 
     JSOp            op;         /* prolog bytecode or nop */
     Binder          binder;     /* binder, discriminates u */
+    bool            isConst;    /* const binding? */
 
     struct LetData {
         explicit LetData(ExclusiveContext *cx) : blockObj(cx) {}
@@ -1177,18 +1182,21 @@ struct BindData
         unsigned   overflow;
     } let;
 
-    void initLet(VarContext varContext, StaticBlockObject *blockObj, unsigned overflow) {
+    void initLexical(VarContext varContext, StaticBlockObject *blockObj, unsigned overflow,
+                     bool isConst = false) {
         this->pn = ParseHandler::null();
         this->op = JSOP_INITLEXICAL;
-        this->binder = Parser<ParseHandler>::bindLet;
+        this->isConst = isConst;
+        this->binder = Parser<ParseHandler>::bindLexical;
         this->let.varContext = varContext;
         this->let.blockObj = blockObj;
         this->let.overflow = overflow;
     }
 
-    void initVarOrConst(JSOp op) {
+    void initVarOrGlobalConst(JSOp op) {
         this->op = op;
-        this->binder = Parser<ParseHandler>::bindVarOrConst;
+        this->isConst = op == JSOP_DEFCONST;
+        this->binder = Parser<ParseHandler>::bindVarOrGlobalConst;
     }
 };
 
@@ -1289,7 +1297,7 @@ static bool
 IsNonDominatingInScopedSwitch(ParseContext<FullParseHandler> *pc, HandleAtom name,
                               Definition *dn)
 {
-    MOZ_ASSERT(dn->isLet());
+    MOZ_ASSERT(dn->isLexical());
     StmtInfoPC *stmt = LexicalLookup(pc, name, nullptr, (StmtInfoPC *)nullptr);
     if (stmt && stmt->type == STMT_SWITCH)
         return dn->pn_cookie.slot() < stmt->firstDominatingLexicalInCase;
@@ -1298,9 +1306,9 @@ IsNonDominatingInScopedSwitch(ParseContext<FullParseHandler> *pc, HandleAtom nam
 
 static void
 AssociateUsesWithOuterDefinition(ParseNode *pnu, Definition *dn, Definition *outer_dn,
-                                 bool markUsesAsLet)
+                                 bool markUsesAsLexical)
 {
-    uint32_t dflags = markUsesAsLet ? PND_LET : 0;
+    uint32_t dflags = markUsesAsLexical ? PND_LEXICAL : 0;
     while (true) {
         pnu->pn_lexdef = outer_dn;
         pnu->pn_dflags |= dflags;
@@ -1412,10 +1420,10 @@ Parser<FullParseHandler>::leaveFunction(ParseNode *fn, ParseContext<FullParseHan
                     // from another case in a switch, those uses also need to
                     // be marked as needing dead zone checks.
                     RootedAtom name(context, atom);
-                    bool markUsesAsLet = outer_dn->isLet() &&
-                                         (bodyLevelHoistedUse ||
-                                          IsNonDominatingInScopedSwitch(outerpc, name, outer_dn));
-                    AssociateUsesWithOuterDefinition(pnu, dn, outer_dn, markUsesAsLet);
+                    bool markUsesAsLexical = outer_dn->isLexical() &&
+                                             (bodyLevelHoistedUse ||
+                                              IsNonDominatingInScopedSwitch(outerpc, name, outer_dn));
+                    AssociateUsesWithOuterDefinition(pnu, dn, outer_dn, markUsesAsLexical);
                 }
 
                 outer_dn->pn_dflags |= dn->pn_dflags & ~PND_PLACEHOLDER;
@@ -1764,7 +1772,8 @@ Parser<FullParseHandler>::checkFunctionDefinition(HandlePropertyName funName,
             MOZ_ASSERT(!dn->isUsed());
             MOZ_ASSERT(dn->isDefn());
 
-            bool throwRedeclarationError = dn->kind() == Definition::CONST ||
+            bool throwRedeclarationError = dn->kind() == Definition::GLOBALCONST ||
+                                           dn->kind() == Definition::CONST ||
                                            dn->kind() == Definition::LET;
             if (options().extraWarningsOption || throwRedeclarationError) {
                 JSAutoByteString name;
@@ -1993,7 +2002,10 @@ Parser<SyntaxParseHandler>::checkFunctionDefinition(HandlePropertyName funName,
          * function (thereby avoiding JSOP_DEFFUN and dynamic name lookup).
          */
         if (DefinitionNode dn = pc->decls().lookupFirst(funName)) {
-            if (dn == Definition::CONST) {
+            if (dn == Definition::GLOBALCONST ||
+                dn == Definition::CONST       ||
+                dn == Definition::LET)
+            {
                 JSAutoByteString name;
                 if (!AtomToPrintableString(context, funName, &name) ||
                     !report(ParseError, false, null(), JSMSG_REDECLARED_VAR,
@@ -2847,7 +2859,7 @@ Parser<ParseHandler>::matchLabel(MutableHandle<PropertyName*> label)
 
 template <typename ParseHandler>
 bool
-Parser<ParseHandler>::reportRedeclaration(Node pn, bool isConst, HandlePropertyName name)
+Parser<ParseHandler>::reportRedeclaration(Node pn, Definition::Kind redeclKind, HandlePropertyName name)
 {
     JSAutoByteString printable;
     if (!AtomToPrintableString(context, name, &printable))
@@ -2857,14 +2869,18 @@ Parser<ParseHandler>::reportRedeclaration(Node pn, bool isConst, HandlePropertyN
     if (stmt && stmt->type == STMT_CATCH) {
         report(ParseError, false, pn, JSMSG_REDECLARED_CATCH_IDENTIFIER, printable.ptr());
     } else {
-        report(ParseError, false, pn, JSMSG_REDECLARED_VAR, isConst ? "const" : "variable",
-               printable.ptr());
+        if (redeclKind == Definition::ARG) {
+            report(ParseError, false, pn, JSMSG_REDECLARED_PARAM, printable.ptr());
+        } else {
+            report(ParseError, false, pn, JSMSG_REDECLARED_VAR, Definition::kindString(redeclKind),
+                   printable.ptr());
+        }
     }
     return false;
 }
 
 /*
- * Define a let-variable in a block, let-expression, or comprehension scope. pc
+ * Define a lexical binding in a block, let-expression, or comprehension scope. pc
  * must already be in such a scope.
  *
  * Throw a SyntaxError if 'atom' is an invalid name. Otherwise create a
@@ -2874,8 +2890,8 @@ Parser<ParseHandler>::reportRedeclaration(Node pn, bool isConst, HandlePropertyN
  */
 template <>
 /* static */ bool
-Parser<FullParseHandler>::bindLet(BindData<FullParseHandler> *data,
-                                  HandlePropertyName name, Parser<FullParseHandler> *parser)
+Parser<FullParseHandler>::bindLexical(BindData<FullParseHandler> *data,
+                                      HandlePropertyName name, Parser<FullParseHandler> *parser)
 {
     ParseContext<FullParseHandler> *pc = parser->pc;
     ParseNode *pn = data->pn;
@@ -2912,25 +2928,34 @@ Parser<FullParseHandler>::bindLet(BindData<FullParseHandler> *data,
     if (!pn->pn_cookie.set(parser->tokenStream, pc->staticLevel, index))
         return false;
 
+    Definition *dn = pc->decls().lookupFirst(name);
+    Definition::Kind bindingKind = data->isConst ? Definition::CONST : Definition::LET;
+
     /*
      * For bindings that are hoisted to the beginning of the block/function,
      * define() right now. Otherwise, delay define until PushLetScope.
      */
     if (data->let.varContext == HoistVars) {
-        Definition *dn = pc->decls().lookupFirst(name);
         if (dn && dn->pn_blockid == pc->blockid())
-            return parser->reportRedeclaration(pn, dn->isConst(), name);
-        if (!pc->define(parser->tokenStream, name, pn, Definition::LET))
+            return parser->reportRedeclaration(pn, dn->kind(), name);
+        if (!pc->define(parser->tokenStream, name, pn, bindingKind))
             return false;
     }
 
     if (blockObj) {
         bool redeclared;
         RootedId id(cx, NameToId(name));
-        RootedShape shape(cx, StaticBlockObject::addVar(cx, blockObj, id, index, &redeclared));
+        RootedShape shape(cx, StaticBlockObject::addVar(cx, blockObj, id,
+                                                        data->isConst, index, &redeclared));
         if (!shape) {
-            if (redeclared)
-                parser->reportRedeclaration(pn, false, name);
+            if (redeclared) {
+                // The only way to be redeclared without a previous definition is if we're in a
+                // comma separated list in a DontHoistVars block, so a let block of for header. In
+                // that case, we must be redeclaring the same type of definition as we're trying to
+                // make.
+                Definition::Kind dnKind = dn ? dn->kind() : bindingKind;
+                parser->reportRedeclaration(pn, dnKind, name);
+            }
             return false;
         }
 
@@ -2948,8 +2973,8 @@ Parser<FullParseHandler>::bindLet(BindData<FullParseHandler> *data,
 
 template <>
 /* static */ bool
-Parser<SyntaxParseHandler>::bindLet(BindData<SyntaxParseHandler> *data,
-                                    HandlePropertyName name, Parser<SyntaxParseHandler> *parser)
+Parser<SyntaxParseHandler>::bindLexical(BindData<SyntaxParseHandler> *data,
+                                        HandlePropertyName name, Parser<SyntaxParseHandler> *parser)
 {
     if (!parser->checkStrictBinding(name, data->pn))
         return false;
@@ -3091,8 +3116,8 @@ OuterLet(ParseContext<ParseHandler> *pc, StmtInfoPC *stmt, HandleAtom atom)
 
 template <typename ParseHandler>
 /* static */ bool
-Parser<ParseHandler>::bindVarOrConst(BindData<ParseHandler> *data,
-                                     HandlePropertyName name, Parser<ParseHandler> *parser)
+Parser<ParseHandler>::bindVarOrGlobalConst(BindData<ParseHandler> *data,
+                                           HandlePropertyName name, Parser<ParseHandler> *parser)
 {
     ExclusiveContext *cx = parser->context;
     ParseContext<ParseHandler> *pc = parser->pc;
@@ -3132,7 +3157,7 @@ Parser<ParseHandler>::bindVarOrConst(BindData<ParseHandler> *data,
 
     if (defs.empty()) {
         return pc->define(parser->tokenStream, name, pn,
-                          isConstDecl ? Definition::CONST : Definition::VAR);
+                          isConstDecl ? Definition::GLOBALCONST : Definition::VAR);
     }
 
     /*
@@ -3159,6 +3184,7 @@ Parser<ParseHandler>::bindVarOrConst(BindData<ParseHandler> *data,
         bool inCatchBody = (stmt && stmt->type == STMT_CATCH);
         bool error = (isConstDecl ||
                       dn_kind == Definition::CONST ||
+                      dn_kind == Definition::GLOBALCONST ||
                       (dn_kind == Definition::LET &&
                        (!inCatchBody || OuterLet(pc, stmt, name))));
 
@@ -3505,7 +3531,7 @@ Parser<FullParseHandler>::pushLetScope(HandleStaticBlockObject blockObj, StmtInf
     if (!pn)
         return null();
 
-    pn->pn_dflags |= PND_LET;
+    pn->pn_dflags |= PND_LEXICAL;
 
     /* Populate the new scope with decls found in the head with updated blockid. */
     if (!ForEachLetDef(tokenStream, pc, blockObj, AddLetDecl(stmt->blockid)))
@@ -3692,10 +3718,10 @@ Parser<ParseHandler>::variables(ParseNodeKind kind, bool *psimple,
      * The four options here are:
      * - PNK_VAR:   We're parsing var declarations.
      * - PNK_CONST: We're parsing const declarations.
+     * - PNK_GLOBALCONST: We're parsing const declarations at toplevel (see bug 589119).
      * - PNK_LET:   We are parsing a let declaration.
-     * - PNK_CALL:  We are parsing the head of a let block.
      */
-    MOZ_ASSERT(kind == PNK_VAR || kind == PNK_CONST || kind == PNK_LET || kind == PNK_CALL);
+    MOZ_ASSERT(kind == PNK_VAR || kind == PNK_CONST || kind == PNK_LET || kind == PNK_GLOBALCONST);
 
     /*
      * The simple flag is set if the declaration has the form 'var x', with
@@ -3703,7 +3729,11 @@ Parser<ParseHandler>::variables(ParseNodeKind kind, bool *psimple,
      */
     MOZ_ASSERT_IF(psimple, *psimple);
 
-    JSOp op = kind == PNK_LET ? JSOP_NOP : kind == PNK_VAR ? JSOP_DEFVAR : JSOP_DEFCONST;
+    JSOp op = JSOP_NOP;
+    if (kind == PNK_VAR)
+        op = JSOP_DEFVAR;
+    else if (kind == PNK_GLOBALCONST)
+        op = JSOP_DEFCONST;
 
     Node pn = handler.newList(kind, null(), op);
     if (!pn)
@@ -3715,10 +3745,12 @@ Parser<ParseHandler>::variables(ParseNodeKind kind, bool *psimple,
      * this code will change soon.
      */
     BindData<ParseHandler> data(context);
-    if (kind == PNK_LET)
-        data.initLet(varContext, blockObj, JSMSG_TOO_MANY_LOCALS);
-    else
-        data.initVarOrConst(op);
+    if (kind == PNK_VAR || kind == PNK_GLOBALCONST) {
+        data.initVarOrGlobalConst(op);
+    } else {
+        data.initLexical(varContext, blockObj, JSMSG_TOO_MANY_LOCALS,
+                         /* isConst = */ kind == PNK_CONST);
+    }
 
     bool first = true;
     Node pn2;
@@ -3751,7 +3783,8 @@ Parser<ParseHandler>::variables(ParseNodeKind kind, bool *psimple,
 
                 // See comment below for bindBeforeInitializer in the code that
                 // handles the non-destructuring case.
-                bool bindBeforeInitializer = kind != PNK_LET || parsingForInOrOfInit;
+                bool bindBeforeInitializer = (kind != PNK_LET && kind != PNK_CONST) ||
+                                             parsingForInOrOfInit;
                 if (bindBeforeInitializer && !checkDestructuring(&data, pn2))
                     return null();
 
@@ -3788,10 +3821,10 @@ Parser<ParseHandler>::variables(ParseNodeKind kind, bool *psimple,
             }
 
             RootedPropertyName name(context, tokenStream.currentName());
-            pn2 = newBindingNode(name, kind == PNK_VAR || kind == PNK_CONST, varContext);
+            pn2 = newBindingNode(name, kind == PNK_VAR || kind == PNK_GLOBALCONST, varContext);
             if (!pn2)
                 return null();
-            if (data.op == JSOP_DEFCONST)
+            if (data.isConst)
                 handler.setFlag(pn2, PND_CONST);
             data.pn = pn2;
 
@@ -3812,7 +3845,7 @@ Parser<ParseHandler>::variables(ParseNodeKind kind, bool *psimple,
                 // If we are not parsing a let declaration, bind the name
                 // now. Otherwise we must wait until after parsing the initializing
                 // assignment.
-                bool bindBeforeInitializer = kind != PNK_LET;
+                bool bindBeforeInitializer = kind != PNK_LET && kind != PNK_CONST;
                 if (bindBeforeInitializer && !data.binder(&data, name, this))
                     return null();
 
@@ -3826,6 +3859,11 @@ Parser<ParseHandler>::variables(ParseNodeKind kind, bool *psimple,
                 if (!handler.finishInitializerAssignment(pn2, init, data.op))
                     return null();
             } else {
+                if (data.isConst && !pc->parsingForInit) {
+                    report(ParseError, false, null(), JSMSG_BAD_CONST_DECL);
+                    return null();
+                }
+
                 if (!data.binder(&data, name, this))
                     return null();
             }
@@ -3843,7 +3881,7 @@ Parser<ParseHandler>::variables(ParseNodeKind kind, bool *psimple,
 
 template <>
 ParseNode *
-Parser<FullParseHandler>::letDeclaration()
+Parser<FullParseHandler>::lexicalDeclaration(bool isConst)
 {
     handler.disableSyntaxParser();
 
@@ -3863,7 +3901,8 @@ Parser<FullParseHandler>::letDeclaration()
          */
         StmtInfoPC *stmt = pc->topStmt;
         if (stmt && (!stmt->maybeScope() || stmt->isForLetBlock)) {
-            report(ParseError, false, null(), JSMSG_LET_DECL_NOT_IN_BLOCK);
+            report(ParseError, false, null(), JSMSG_LEXICAL_DECL_NOT_IN_BLOCK,
+                   isConst ? "const" : "let");
             return null();
         }
 
@@ -3882,9 +3921,10 @@ Parser<FullParseHandler>::letDeclaration()
                  * conflicting slots.  Forbid top-level let declarations to
                  * prevent such conflicts from ever occurring.
                  */
-                bool globalLet = !pc->sc->isFunctionBox() && stmt == pc->topScopeStmt;
-                if (options().selfHostingMode && globalLet) {
-                    report(ParseError, false, null(), JSMSG_SELFHOSTED_TOP_LEVEL_LET);
+                bool isGlobal = !pc->sc->isFunctionBox() && stmt == pc->topScopeStmt;
+                if (options().selfHostingMode && isGlobal) {
+                    report(ParseError, false, null(), JSMSG_SELFHOSTED_TOP_LEVEL_LEXICAL,
+                           isConst ? "'const'" : "'let'");
                     return null();
                 }
 
@@ -3902,7 +3942,12 @@ Parser<FullParseHandler>::letDeclaration()
                  * FIXME global-level lets are still considered vars until
                  * other bugs are fixed.
                  */
-                pn = variables(globalLet ? PNK_VAR : PNK_LET);
+                ParseNodeKind kind = PNK_LET;
+                if (isGlobal)
+                    kind = isConst ? PNK_GLOBALCONST : PNK_VAR;
+                else if (isConst)
+                    kind = PNK_CONST;
+                pn = variables(kind);
                 if (!pn)
                     return null();
                 pn->pn_xflags |= PNX_POPVAR;
@@ -3962,7 +4007,8 @@ Parser<FullParseHandler>::letDeclaration()
             pc->blockNode = pn1;
         }
 
-        pn = variables(PNK_LET, nullptr, &pc->staticScope->as<StaticBlockObject>(), HoistVars);
+        pn = variables(isConst ? PNK_CONST : PNK_LET, nullptr,
+                       &pc->staticScope->as<StaticBlockObject>(), HoistVars);
         if (!pn)
             return null();
         pn->pn_xflags = PNX_POPVAR;
@@ -3973,7 +4019,7 @@ Parser<FullParseHandler>::letDeclaration()
 
 template <>
 SyntaxParseHandler::Node
-Parser<SyntaxParseHandler>::letDeclaration()
+Parser<SyntaxParseHandler>::lexicalDeclaration(bool)
 {
     JS_ALWAYS_FALSE(abortIfSyntaxParser());
     return SyntaxParseHandler::NodeFailure;
@@ -3994,7 +4040,7 @@ Parser<FullParseHandler>::letStatement()
         pn = letBlock(LetStatement);
         MOZ_ASSERT_IF(pn, pn->isKind(PNK_LET) || pn->isKind(PNK_SEMI));
     } else {
-        pn = letDeclaration();
+        pn = lexicalDeclaration(/* isConst = */ false);
     }
     return pn;
 }
@@ -4251,8 +4297,7 @@ Parser<ParseHandler>::exportDeclaration()
         break;
 
       case TOK_VAR:
-      case TOK_CONST:
-        kid = variables(tt == TOK_VAR ? PNK_VAR : PNK_CONST);
+        kid = variables(PNK_VAR);
         if (!kid)
             return null();
         kid->pn_xflags = PNX_POPVAR;
@@ -4268,7 +4313,8 @@ Parser<ParseHandler>::exportDeclaration()
         // and fall through.
         tokenStream.ungetToken();
       case TOK_LET:
-        kid = letDeclaration();
+      case TOK_CONST:
+        kid = lexicalDeclaration(tt == TOK_CONST);
         if (!kid)
             return null();
         break;
@@ -4412,7 +4458,7 @@ Parser<FullParseHandler>::isValidForStatementLHS(ParseNode *pn1, JSVersion versi
     if (isForDecl) {
         if (pn1->pn_count > 1)
             return false;
-        if (pn1->isOp(JSOP_DEFCONST))
+        if (pn1->isKind(PNK_CONST))
             return false;
 
         // In JS 1.7 only, for (var [K, V] in EXPR) has a special meaning.
@@ -4450,6 +4496,22 @@ Parser<FullParseHandler>::isValidForStatementLHS(ParseNode *pn1, JSVersion versi
     }
 }
 
+template <>
+bool
+Parser<FullParseHandler>::checkForHeadConstInitializers(ParseNode *pn1)
+{
+    if (!pn1->isKind(PNK_CONST))
+        return true;
+
+    for (ParseNode *assign = pn1->pn_head; assign; assign = assign->pn_next) {
+        MOZ_ASSERT(assign->isKind(PNK_ASSIGN) || assign->isKind(PNK_NAME));
+        if (assign->isKind(PNK_NAME) && !assign->isAssigned())
+            return false;
+        // PNK_ASSIGN nodes (destructuring assignment) are always assignments.
+    }
+    return true;
+}
+
 template <>
 ParseNode *
 Parser<FullParseHandler>::forStatement()
@@ -4509,11 +4571,11 @@ Parser<FullParseHandler>::forStatement()
              * clause of an ordinary for loop.
              */
             pc->parsingForInit = true;
-            if (tt == TOK_VAR || tt == TOK_CONST) {
+            if (tt == TOK_VAR) {
                 isForDecl = true;
                 tokenStream.consumeKnownToken(tt);
-                pn1 = variables(tt == TOK_VAR ? PNK_VAR : PNK_CONST);
-            } else if (tt == TOK_LET) {
+                pn1 = variables(PNK_VAR);
+            } else if (tt == TOK_LET || tt == TOK_CONST) {
                 handler.disableSyntaxParser();
                 tokenStream.consumeKnownToken(tt);
                 if (!tokenStream.peekToken(&tt))
@@ -4525,7 +4587,8 @@ Parser<FullParseHandler>::forStatement()
                     blockObj = StaticBlockObject::create(context);
                     if (!blockObj)
                         return null();
-                    pn1 = variables(PNK_LET, nullptr, blockObj, DontHoistVars);
+                    pn1 = variables(tt == TOK_CONST ? PNK_CONST: PNK_LET, nullptr, blockObj,
+                                    DontHoistVars);
                 }
             } else {
                 pn1 = expr();
@@ -4717,8 +4780,14 @@ Parser<FullParseHandler>::forStatement()
         if (blockObj) {
             /*
              * Desugar 'for (let A; B; C) D' into 'let (A) { for (; B; C) D }'
-             * to induce the correct scoping for A.
+             * to induce the correct scoping for A. Ensure here that the previously
+             * unchecked assignment mandate for const declarations holds.
              */
+            if (!checkForHeadConstInitializers(pn1)) {
+                report(ParseError, false, nullptr, JSMSG_BAD_CONST_DECL);
+                return null();
+            }
+
             forLetImpliedBlock = pushLetScope(blockObj, &letStmt);
             if (!forLetImpliedBlock)
                 return null();
@@ -4843,7 +4912,7 @@ Parser<SyntaxParseHandler>::forStatement()
             if (tt == TOK_VAR) {
                 isForDecl = true;
                 tokenStream.consumeKnownToken(tt);
-                lhsNode = variables(tt == TOK_VAR ? PNK_VAR : PNK_CONST, &simpleForDecl);
+                lhsNode = variables(PNK_VAR, &simpleForDecl);
             }
             else if (tt == TOK_CONST || tt == TOK_LET) {
                 JS_ALWAYS_FALSE(abortIfSyntaxParser());
@@ -5512,8 +5581,8 @@ Parser<ParseHandler>::tryStatement()
              * scoped, not a property of a new Object instance.  This is
              * an intentional change that anticipates ECMA Ed. 4.
              */
-            data.initLet(HoistVars, &pc->staticScope->template as<StaticBlockObject>(),
-                         JSMSG_TOO_MANY_CATCH_VARS);
+            data.initLexical(HoistVars, &pc->staticScope->template as<StaticBlockObject>(),
+                             JSMSG_TOO_MANY_CATCH_VARS);
             MOZ_ASSERT(data.let.blockObj);
 
             if (!tokenStream.getToken(&tt))
@@ -5640,9 +5709,10 @@ Parser<ParseHandler>::statement(bool canHaveDirectives)
       case TOK_CONST:
         if (!abortIfSyntaxParser())
             return null();
-        // FALL THROUGH
+        return lexicalDeclaration(/* isConst = */ true);
+
       case TOK_VAR: {
-        Node pn = variables(tt == TOK_CONST ? PNK_CONST : PNK_VAR);
+        Node pn = variables(PNK_VAR);
         if (!pn)
             return null();
 
@@ -6619,7 +6689,8 @@ Parser<FullParseHandler>::legacyComprehensionTail(ParseNode *bodyExpr, unsigned
         return null();
 
     MOZ_ASSERT(pc->staticScope && pc->staticScope == pn->pn_objbox->object);
-    data.initLet(HoistVars, &pc->staticScope->as<StaticBlockObject>(), JSMSG_ARRAY_INIT_TOO_BIG);
+    data.initLexical(HoistVars, &pc->staticScope->as<StaticBlockObject>(),
+                     JSMSG_ARRAY_INIT_TOO_BIG);
 
     while (true) {
         /*
@@ -7062,7 +7133,7 @@ Parser<ParseHandler>::comprehensionFor(GeneratorKind comprehensionKind)
     RootedStaticBlockObject blockObj(context, StaticBlockObject::create(context));
     if (!blockObj)
         return null();
-    data.initLet(DontHoistVars, blockObj, JSMSG_TOO_MANY_LOCALS);
+    data.initLexical(DontHoistVars, blockObj, JSMSG_TOO_MANY_LOCALS);
     Node lhs = newName(name);
     if (!lhs)
         return null();
diff --git a/js/src/frontend/Parser.h b/js/src/frontend/Parser.h
index 06293e08f8d..c28f0f03607 100644
--- a/js/src/frontend/Parser.h
+++ b/js/src/frontend/Parser.h
@@ -542,7 +542,7 @@ class Parser : private JS::AutoGCRooter, public StrictModeGetter
     Node tryStatement();
     Node debuggerStatement();
 
-    Node letDeclaration();
+    Node lexicalDeclaration(bool isConst);
     Node letStatement();
     Node importDeclaration();
     Node exportDeclaration();
@@ -634,6 +634,7 @@ class Parser : private JS::AutoGCRooter, public StrictModeGetter
 
     bool isValidForStatementLHS(Node pn1, JSVersion version, bool forDecl, bool forEach,
                                 ParseNodeKind headKind);
+    bool checkForHeadConstInitializers(Node pn1);
     bool checkAndMarkAsIncOperand(Node kid, TokenKind tt, bool preorder);
     bool checkStrictAssignment(Node lhs);
     bool checkStrictBinding(PropertyName *name, Node pn);
@@ -667,16 +668,16 @@ class Parser : private JS::AutoGCRooter, public StrictModeGetter
                          HandlePropertyName name, Parser<ParseHandler> *parser);
 
     static bool
-    bindLet(BindData<ParseHandler> *data,
-            HandlePropertyName name, Parser<ParseHandler> *parser);
+    bindLexical(BindData<ParseHandler> *data,
+                HandlePropertyName name, Parser<ParseHandler> *parser);
 
     static bool
-    bindVarOrConst(BindData<ParseHandler> *data,
-                   HandlePropertyName name, Parser<ParseHandler> *parser);
+    bindVarOrGlobalConst(BindData<ParseHandler> *data,
+                         HandlePropertyName name, Parser<ParseHandler> *parser);
 
     static Node null() { return ParseHandler::null(); }
 
-    bool reportRedeclaration(Node pn, bool isConst, HandlePropertyName name);
+    bool reportRedeclaration(Node pn, Definition::Kind redeclKind, HandlePropertyName name);
     bool reportBadReturn(Node pn, ParseReportKind kind, unsigned errnum, unsigned anonerrnum);
     DefinitionNode getOrCreateLexicalDependency(ParseContext<ParseHandler> *pc, JSAtom *atom);
 
diff --git a/js/src/jit-test/tests/asm.js/testGlobals.js b/js/src/jit-test/tests/asm.js/testGlobals.js
index a41c6fe95ab..3ceea961205 100644
--- a/js/src/jit-test/tests/asm.js/testGlobals.js
+++ b/js/src/jit-test/tests/asm.js/testGlobals.js
@@ -2,7 +2,6 @@ load(libdir + "asm.js");
 load(libdir + "asserts.js");
 
 assertAsmTypeFail(USE_ASM + "var i; function f(){} return f");
-assertAsmTypeFail(USE_ASM + "const i; function f(){} return f");
 assertEq(asmLink(asmCompile(USE_ASM + "var i=0; function f(){} return f"))(), undefined);
 assertEq(asmLink(asmCompile(USE_ASM + "const i=0; function f(){} return f"))(), undefined);
 assertEq(asmLink(asmCompile(USE_ASM + "var i=42; function f(){ return i|0 } return f"))(), 42);
diff --git a/js/src/jit-test/tests/auto-regress/bug487570.js b/js/src/jit-test/tests/auto-regress/bug487570.js
index 9e4a7b34961..d8f0b09d176 100644
--- a/js/src/jit-test/tests/auto-regress/bug487570.js
+++ b/js/src/jit-test/tests/auto-regress/bug487570.js
@@ -9,5 +9,5 @@
     for each (y in [])
   )
 )
-{const functional}
+{const functional=undefined}
 })()
diff --git a/js/src/jit-test/tests/auto-regress/bug495843.js b/js/src/jit-test/tests/auto-regress/bug495843.js
index 137e4bb2631..673e8294eca 100644
--- a/js/src/jit-test/tests/auto-regress/bug495843.js
+++ b/js/src/jit-test/tests/auto-regress/bug495843.js
@@ -1,5 +1,5 @@
 // Binary: cache/js-dbg-64-fe91973cc783-linux
 // Flags:
 //
-const x;[x]='';
+const [x]='';
 for(;[] && false;){}
diff --git a/js/src/jit-test/tests/basic/bug639797.js b/js/src/jit-test/tests/basic/bug639797.js
index c1511ba1790..f061fac46d1 100644
--- a/js/src/jit-test/tests/basic/bug639797.js
+++ b/js/src/jit-test/tests/basic/bug639797.js
@@ -1 +1 @@
-Function("with([])const x=0")()
+Function("with([]){const x=0}")()
diff --git a/js/src/jit-test/tests/basic/functionRedeclConst.js b/js/src/jit-test/tests/basic/functionRedeclConst.js
new file mode 100644
index 00000000000..8b0af654650
--- /dev/null
+++ b/js/src/jit-test/tests/basic/functionRedeclConst.js
@@ -0,0 +1,5 @@
+// |jit-test| error: TypeError
+{
+    const x = 0;
+    function x() { }
+}
diff --git a/js/src/jit-test/tests/basic/functionRedeclGlobalConst.js b/js/src/jit-test/tests/basic/functionRedeclGlobalConst.js
new file mode 100644
index 00000000000..90784cc1802
--- /dev/null
+++ b/js/src/jit-test/tests/basic/functionRedeclGlobalConst.js
@@ -0,0 +1,3 @@
+// |jit-test| error: TypeError
+const x = 0;
+function x() { }
diff --git a/js/src/jit-test/tests/basic/functionRedeclLet.js b/js/src/jit-test/tests/basic/functionRedeclLet.js
new file mode 100644
index 00000000000..6ec6dfd499a
--- /dev/null
+++ b/js/src/jit-test/tests/basic/functionRedeclLet.js
@@ -0,0 +1,5 @@
+// |jit-test| error: TypeError
+{
+    let x;
+    function x() { }
+}
diff --git a/js/src/jit-test/tests/basic/letTDZDelete.js b/js/src/jit-test/tests/basic/letTDZDelete.js
index 6fb1048f0cb..966ee0ef1f6 100644
--- a/js/src/jit-test/tests/basic/letTDZDelete.js
+++ b/js/src/jit-test/tests/basic/letTDZDelete.js
@@ -9,15 +9,4 @@ function assertThrowsReferenceError(f) {
 }
 
 assertThrowsReferenceError(function () { delete x; let x; });
-
-// FIXME do this unconditionally once bug 611388 lands.
-function constIsLexical() {
-  try {
-    (function () { z++; const z; })();
-    return false;
-  } catch (e) {
-    return true;
-  }
-}
-if (constIsLexical())
-  assertThrowsReferenceError(function () { delete x; const x; });
+assertThrowsReferenceError(function () { delete x; const x = undefined; });
diff --git a/js/src/jit-test/tests/basic/letTDZEffectful.js b/js/src/jit-test/tests/basic/letTDZEffectful.js
index e2f859bf1e4..62245d8c16b 100644
--- a/js/src/jit-test/tests/basic/letTDZEffectful.js
+++ b/js/src/jit-test/tests/basic/letTDZEffectful.js
@@ -10,15 +10,4 @@ function assertThrowsReferenceError(f) {
 
 // TDZ is effectful, don't optimize out x.
 assertThrowsReferenceError(function () { x; let x; });
-
-// FIXME do this unconditionally once bug 611388 lands.
-function constIsLexical() {
-  try {
-    (function () { z++; const z; })();
-    return false;
-  } catch (e) {
-    return true;
-  }
-}
-if (constIsLexical())
-  assertThrowsReferenceError(function () { x; const x; });
+assertThrowsReferenceError(function () { x; const x = undefined; });
diff --git a/js/src/jit-test/tests/basic/syntax-error-illegal-character.js b/js/src/jit-test/tests/basic/syntax-error-illegal-character.js
index 3544308c912..1f186667f6d 100644
--- a/js/src/jit-test/tests/basic/syntax-error-illegal-character.js
+++ b/js/src/jit-test/tests/basic/syntax-error-illegal-character.js
@@ -235,10 +235,10 @@ test("const x = 1 @");
 test("const x = 1 + @");
 test("const x = 1 + 2 @");
 test("const x = 1 + 2, @");
-test("const x = 1 + 2, y @");
-test("const x = 1 + 2, y, @");
-test("const x = 1 + 2, y, z @");
-test("const x = 1 + 2, y, z; @");
+test("const x = 1 + 2, y = 0@");
+test("const x = 1 + 2, y = 0, @");
+test("const x = 1 + 2, y = 0, z = 0 @");
+test("const x = 1 + 2, y = 0, z = 0; @");
 
 test("const [ @");
 test("const [ x @");
diff --git a/js/src/jit-test/tests/basic/testDestructuringVarInsideWith.js b/js/src/jit-test/tests/basic/testDestructuringVarInsideWith.js
index 54cae4a2112..b233c9ceb2f 100644
--- a/js/src/jit-test/tests/basic/testDestructuringVarInsideWith.js
+++ b/js/src/jit-test/tests/basic/testDestructuringVarInsideWith.js
@@ -1,4 +1,4 @@
 with ({b:1}) {
     const [ b ] = [];
+    assertEq(b, undefined);
 }
-assertEq(b, undefined);
diff --git a/js/src/jit-test/tests/jaeger/recompile/bug641269.js b/js/src/jit-test/tests/jaeger/recompile/bug641269.js
index 64a2429efdd..7eca2e2d8c1 100644
--- a/js/src/jit-test/tests/jaeger/recompile/bug641269.js
+++ b/js/src/jit-test/tests/jaeger/recompile/bug641269.js
@@ -1,3 +1,5 @@
+// |jit-test| error: ReferenceError
+
 var g = newGlobal();
 var dbg = new g.Debugger(this);
 
diff --git a/js/src/js.msg b/js/src/js.msg
index 7e9845c9ac8..abb167d2740 100644
--- a/js/src/js.msg
+++ b/js/src/js.msg
@@ -110,7 +110,7 @@ MSG_DEF(JSMSG_BAD_PROTOTYPE,           1, JSEXN_TYPEERR, "'prototype' property o
 MSG_DEF(JSMSG_IN_NOT_OBJECT,           1, JSEXN_TYPEERR, "invalid 'in' operand {0}")
 MSG_DEF(JSMSG_TOO_MANY_CON_SPREADARGS, 0, JSEXN_RANGEERR, "too many constructor arguments")
 MSG_DEF(JSMSG_TOO_MANY_FUN_SPREADARGS, 0, JSEXN_RANGEERR, "too many function arguments")
-MSG_DEF(JSMSG_UNINITIALIZED_LEXICAL,   1, JSEXN_REFERENCEERR, "can't access let declaration `{0}' before initialization")
+MSG_DEF(JSMSG_UNINITIALIZED_LEXICAL,   1, JSEXN_REFERENCEERR, "can't access lexical declaration `{0}' before initialization")
 
 // Date
 MSG_DEF(JSMSG_INVALID_DATE,            0, JSEXN_RANGEERR, "invalid date")
@@ -181,6 +181,7 @@ MSG_DEF(JSMSG_AS_AFTER_RESERVED_WORD,  1, JSEXN_SYNTAXERR, "missing keyword 'as'
 MSG_DEF(JSMSG_BAD_ANON_GENERATOR_RETURN, 0, JSEXN_TYPEERR, "anonymous generator function returns a value")
 MSG_DEF(JSMSG_BAD_ARROW_ARGS,          0, JSEXN_SYNTAXERR, "invalid arrow-function arguments (parentheses around the arrow-function may help)")
 MSG_DEF(JSMSG_BAD_BINDING,             1, JSEXN_SYNTAXERR, "redefining {0} is deprecated")
+MSG_DEF(JSMSG_BAD_CONST_DECL,          0, JSEXN_SYNTAXERR, "missing = in const declaration")
 MSG_DEF(JSMSG_BAD_CONTINUE,            0, JSEXN_SYNTAXERR, "continue must be inside loop")
 MSG_DEF(JSMSG_BAD_DESTRUCT_ASS,        0, JSEXN_REFERENCEERR, "invalid destructuring assignment operator")
 MSG_DEF(JSMSG_BAD_DESTRUCT_TARGET,     0, JSEXN_SYNTAXERR, "invalid destructuring target")
@@ -244,7 +245,7 @@ MSG_DEF(JSMSG_INVALID_FOR_OF_INIT,     0, JSEXN_SYNTAXERR, "for-of loop variable
 MSG_DEF(JSMSG_IN_AFTER_FOR_NAME,       0, JSEXN_SYNTAXERR, "missing 'in' or 'of' after for")
 MSG_DEF(JSMSG_LABEL_NOT_FOUND,         0, JSEXN_SYNTAXERR, "label not found")
 MSG_DEF(JSMSG_LET_COMP_BINDING,        0, JSEXN_SYNTAXERR, "'let' is not a valid name for a comprehension variable")
-MSG_DEF(JSMSG_LET_DECL_NOT_IN_BLOCK,   0, JSEXN_SYNTAXERR, "let declaration not directly within block")
+MSG_DEF(JSMSG_LEXICAL_DECL_NOT_IN_BLOCK,   1, JSEXN_SYNTAXERR, "{0} declaration not directly within block")
 MSG_DEF(JSMSG_LINE_BREAK_AFTER_THROW,  0, JSEXN_SYNTAXERR, "no line break is allowed between 'throw' and its expression")
 MSG_DEF(JSMSG_MALFORMED_ESCAPE,        1, JSEXN_SYNTAXERR, "malformed {0} character escape sequence")
 MSG_DEF(JSMSG_MISSING_BINARY_DIGITS,   0, JSEXN_SYNTAXERR, "missing binary digits after '0b'")
@@ -285,7 +286,7 @@ MSG_DEF(JSMSG_REDECLARED_CATCH_IDENTIFIER, 1, JSEXN_TYPEERR, "redeclaration of i
 MSG_DEF(JSMSG_REDECLARED_PARAM,        1, JSEXN_TYPEERR, "redeclaration of formal parameter {0}")
 MSG_DEF(JSMSG_RESERVED_ID,             1, JSEXN_SYNTAXERR, "{0} is a reserved identifier")
 MSG_DEF(JSMSG_REST_WITH_DEFAULT,       0, JSEXN_SYNTAXERR, "rest parameter may not have a default")
-MSG_DEF(JSMSG_SELFHOSTED_TOP_LEVEL_LET,0, JSEXN_SYNTAXERR, "self-hosted code cannot contain top-level 'let' declarations")
+MSG_DEF(JSMSG_SELFHOSTED_TOP_LEVEL_LEXICAL, 1, JSEXN_SYNTAXERR, "self-hosted code cannot contain top-level {0} declarations")
 MSG_DEF(JSMSG_SELFHOSTED_UNBOUND_NAME, 0, JSEXN_TYPEERR, "self-hosted code may not contain unbound name lookups")
 MSG_DEF(JSMSG_SEMI_AFTER_FOR_COND,     0, JSEXN_SYNTAXERR, "missing ; after for-loop condition")
 MSG_DEF(JSMSG_SEMI_AFTER_FOR_INIT,     0, JSEXN_SYNTAXERR, "missing ; after for-loop initializer")
diff --git a/js/src/jsreflect.cpp b/js/src/jsreflect.cpp
index 1208bc976f8..0ad286e2290 100644
--- a/js/src/jsreflect.cpp
+++ b/js/src/jsreflect.cpp
@@ -1732,7 +1732,7 @@ class ASTSerializer
     bool sourceElement(ParseNode *pn, MutableHandleValue dst);
 
     bool declaration(ParseNode *pn, MutableHandleValue dst);
-    bool variableDeclaration(ParseNode *pn, bool let, MutableHandleValue dst);
+    bool variableDeclaration(ParseNode *pn, bool lexical, MutableHandleValue dst);
     bool variableDeclarator(ParseNode *pn, MutableHandleValue dst);
     bool let(ParseNode *pn, bool expr, MutableHandleValue dst);
     bool importDeclaration(ParseNode *pn, MutableHandleValue dst);
@@ -2001,6 +2001,7 @@ ASTSerializer::declaration(ParseNode *pn, MutableHandleValue dst)
 {
     MOZ_ASSERT(pn->isKind(PNK_FUNCTION) ||
                pn->isKind(PNK_VAR) ||
+               pn->isKind(PNK_GLOBALCONST) ||
                pn->isKind(PNK_LET) ||
                pn->isKind(PNK_CONST));
 
@@ -2009,21 +2010,28 @@ ASTSerializer::declaration(ParseNode *pn, MutableHandleValue dst)
         return function(pn, AST_FUNC_DECL, dst);
 
       case PNK_VAR:
-      case PNK_CONST:
+      case PNK_GLOBALCONST:
         return variableDeclaration(pn, false, dst);
 
       default:
-        MOZ_ASSERT(pn->isKind(PNK_LET));
+        MOZ_ASSERT(pn->isKind(PNK_LET) || pn->isKind(PNK_CONST));
         return variableDeclaration(pn, true, dst);
     }
 }
 
 bool
-ASTSerializer::variableDeclaration(ParseNode *pn, bool let, MutableHandleValue dst)
+ASTSerializer::variableDeclaration(ParseNode *pn, bool lexical, MutableHandleValue dst)
 {
-    MOZ_ASSERT(let ? pn->isKind(PNK_LET) : (pn->isKind(PNK_VAR) || pn->isKind(PNK_CONST)));
+    MOZ_ASSERT_IF(lexical, pn->isKind(PNK_LET) || pn->isKind(PNK_CONST));
+    MOZ_ASSERT_IF(!lexical, pn->isKind(PNK_VAR) || pn->isKind(PNK_GLOBALCONST));
 
-    VarDeclKind kind = let ? VARDECL_LET : pn->isKind(PNK_VAR) ? VARDECL_VAR : VARDECL_CONST;
+    VarDeclKind kind = VARDECL_ERR;
+    // Treat both the toplevel const binding (secretly var-like) and the lexical const
+    // the same way
+    if (lexical)
+        kind = pn->isKind(PNK_LET) ? VARDECL_LET : VARDECL_CONST;
+    else
+        kind = pn->isKind(PNK_VAR) ? VARDECL_VAR : VARDECL_CONST;
 
     NodeVector dtors(cx);
     if (!dtors.reserve(pn->pn_count))
@@ -2166,6 +2174,7 @@ ASTSerializer::exportDeclaration(ParseNode *pn, MutableHandleValue dst)
 
       case PNK_VAR:
       case PNK_CONST:
+      case PNK_GLOBALCONST:
       case PNK_LET:
         if (!variableDeclaration(kid, kind == PNK_LET, &decl))
             return false;
@@ -2308,7 +2317,7 @@ ASTSerializer::forInit(ParseNode *pn, MutableHandleValue dst)
         return true;
     }
 
-    return (pn->isKind(PNK_VAR) || pn->isKind(PNK_CONST))
+    return (pn->isKind(PNK_VAR) || pn->isKind(PNK_GLOBALCONST))
            ? variableDeclaration(pn, false, dst)
            : expression(pn, dst);
 }
@@ -2341,10 +2350,11 @@ ASTSerializer::statement(ParseNode *pn, MutableHandleValue dst)
     switch (pn->getKind()) {
       case PNK_FUNCTION:
       case PNK_VAR:
-      case PNK_CONST:
+      case PNK_GLOBALCONST:
         return declaration(pn, dst);
 
       case PNK_LET:
+      case PNK_CONST:
         return pn->isArity(PN_BINARY)
                ? let(pn, false, dst)
                : declaration(pn, dst);
diff --git a/js/src/jsscript.cpp b/js/src/jsscript.cpp
index 2014bb0c225..733a8d68400 100644
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -129,11 +129,11 @@ Bindings::initWithTemporaryStorage(ExclusiveContext *cx, InternalBindingsHandle
         if (bi->aliased()) {
             // Per ES6, lexical bindings cannot be accessed until
             // initialized. Remember the first aliased slot that is a
-            // body-level let, so that they may be initialized to sentinel
+            // body-level lexical, so that they may be initialized to sentinel
             // magic values.
             if (numBodyLevelLexicals > 0 &&
                 nslots < aliasedBodyLevelLexicalBegin &&
-                bi->kind() == Binding::VARIABLE &&
+                bi.isBodyLevelLexical() &&
                 bi.localIndex() >= numVars)
             {
                 aliasedBodyLevelLexicalBegin = nslots;
diff --git a/js/src/jsscript.h b/js/src/jsscript.h
index a19e80697eb..5dc1f5c4253 100644
--- a/js/src/jsscript.h
+++ b/js/src/jsscript.h
@@ -1744,6 +1744,11 @@ class BindingIter
         MOZ_ASSERT(i_ >= bindings_->numArgs());
         return i_ - bindings_->numArgs();
     }
+    bool isBodyLevelLexical() const {
+        MOZ_ASSERT(!done());
+        const Binding &binding = **this;
+        return binding.kind() != Binding::ARGUMENT;
+    }
 
     const Binding &operator*() const { MOZ_ASSERT(!done()); return bindings_->bindingArray()[i_]; }
     const Binding *operator->() const { MOZ_ASSERT(!done()); return &bindings_->bindingArray()[i_]; }
diff --git a/js/src/tests/ecma_5/Object/freeze-global-eval-const.js b/js/src/tests/ecma_5/Object/freeze-global-eval-const.js
index 0fb507c2d76..a43f5c51c9b 100644
--- a/js/src/tests/ecma_5/Object/freeze-global-eval-const.js
+++ b/js/src/tests/ecma_5/Object/freeze-global-eval-const.js
@@ -5,7 +5,7 @@
  */
 
 try {
-    evalcx("Object.freeze(this); eval('const q;')");
+    evalcx("Object.freeze(this); eval('const q = undefined;')");
 } catch (e) {
     assertEq(e.message, "({lazy:false}) is not extensible");
 }
diff --git a/js/src/tests/js1_5/Regress/regress-360969-03.js b/js/src/tests/js1_5/Regress/regress-360969-03.js
index 8f5c0ece416..19f29362260 100644
--- a/js/src/tests/js1_5/Regress/regress-360969-03.js
+++ b/js/src/tests/js1_5/Regress/regress-360969-03.js
@@ -28,7 +28,7 @@ function test()
 
   for (var i = 0; i < limit; i++)
   {
-    eval('const pv' + i + ';');
+    eval('const pv' + i + ' = undefined;');
   }
 
   reportCompare(expect, actual, summary);
diff --git a/js/src/tests/js1_5/Regress/regress-360969-04.js b/js/src/tests/js1_5/Regress/regress-360969-04.js
index 110fea217e2..ea53e0ebaf8 100644
--- a/js/src/tests/js1_5/Regress/regress-360969-04.js
+++ b/js/src/tests/js1_5/Regress/regress-360969-04.js
@@ -21,7 +21,7 @@ var limit = 2 << 16;
 
 for (var i = 0; i < limit; i++)
 {
-  eval('const pv' + i + ';');
+  eval('const pv' + i + ' = undefined;');
 }
 
 reportCompare(expect, actual, summary);
diff --git a/js/src/tests/js1_5/extensions/regress-452565.js b/js/src/tests/js1_5/extensions/regress-452565.js
index a51f6016e99..9a68f2ae417 100644
--- a/js/src/tests/js1_5/extensions/regress-452565.js
+++ b/js/src/tests/js1_5/extensions/regress-452565.js
@@ -14,7 +14,7 @@ printStatus (summary);
 
 jit(true);
 
-const c; (function() { for (var j=0;j<5;++j) { c = 1; } })();
+const c = undefined; (function() { for (var j=0;j<5;++j) { c = 1; } })();
 
 jit(false);
 
diff --git a/js/src/tests/js1_6/Regress/regress-372565.js b/js/src/tests/js1_6/Regress/regress-372565.js
index 1e105620132..e5c0e1b07bf 100644
--- a/js/src/tests/js1_6/Regress/regress-372565.js
+++ b/js/src/tests/js1_6/Regress/regress-372565.js
@@ -19,8 +19,8 @@ function test()
   enterFunc ('test');
   printBugNumber(BUGNUMBER);
   printStatus (summary);
- 
-  (function() { for each(x in y) { } const x; });
+
+  (function() { for each(x in y) { } const x = undefined; });
 
   reportCompare(expect, actual, summary);
 
diff --git a/js/src/tests/js1_7/block/regress-349507.js b/js/src/tests/js1_7/block/regress-349507.js
index dba51204a6b..e0c4dc4daf9 100644
--- a/js/src/tests/js1_7/block/regress-349507.js
+++ b/js/src/tests/js1_7/block/regress-349507.js
@@ -20,7 +20,6 @@ function test()
   printBugNumber(BUGNUMBER);
   printStatus (summary);
 
-  expect = /TypeError: redeclaration of const b/;
   try
   {
     eval('(function() { let(x = 1) { const b = 2 }; let b = 3; })');
@@ -30,7 +29,7 @@ function test()
     actual = ex + '';
   }
 
-  reportMatch(expect, actual, summary);
+  reportCompare(expect, actual, summary);
 
   exitFunc ('test');
 }
diff --git a/js/src/tests/js1_8/genexps/regress-384991.js b/js/src/tests/js1_8/genexps/regress-384991.js
index 7dd1cef7be3..a34adfb3fe6 100644
--- a/js/src/tests/js1_8/genexps/regress-384991.js
+++ b/js/src/tests/js1_8/genexps/regress-384991.js
@@ -47,7 +47,7 @@ function test()
   try
   {
     actual = 'No Error';
-    (function () { f(x = yield); const x; });
+    (function () { f(x = yield); const x = undefined; });
   }
   catch(ex)
   {
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-068.js b/js/src/tests/js1_8_1/regress/regress-452498-068.js
index 5143fd38948..352ada492c6 100644
--- a/js/src/tests/js1_8_1/regress/regress-452498-068.js
+++ b/js/src/tests/js1_8_1/regress/regress-452498-068.js
@@ -46,7 +46,7 @@ function test()
 // =====
 
   for(
-    const NaN;
+    const NaN = undefined;
     this.__defineSetter__("x4", function(){});
     (eval("", (p={})))) let ({} = (((x ))(function ([]) {})), x1) y;
 
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-092.js b/js/src/tests/js1_8_1/regress/regress-452498-092.js
index 383c8360929..40347f29e59 100644
--- a/js/src/tests/js1_8_1/regress/regress-452498-092.js
+++ b/js/src/tests/js1_8_1/regress/regress-452498-092.js
@@ -25,7 +25,7 @@ function test()
   expect = 'TypeError: redeclaration of formal parameter e';
   try
   {
-    eval('(function (e) { var e; const e; });');
+    eval('(function (e) { var e; const e = undefined; });');
   }
   catch(ex)
   {
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-101.js b/js/src/tests/js1_8_1/regress/regress-452498-101.js
index c8cea7feb3f..5bd15b2b74a 100644
--- a/js/src/tests/js1_8_1/regress/regress-452498-101.js
+++ b/js/src/tests/js1_8_1/regress/regress-452498-101.js
@@ -22,7 +22,7 @@ function test()
 
 // ------- Comment #101 From Gary Kwong [:nth10sd]
 
-  uneval(function(){with({functional: []}){x5, y = this;const y }});
+  uneval(function(){with({functional: []}){x5, y = this;const y = undefined }});
 // Assertion failure: strcmp(rval, with_cookie) == 0, at ../jsopcode.cpp:2567
 
   reportCompare(expect, actual, summary);
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-102.js b/js/src/tests/js1_8_1/regress/regress-452498-102.js
index 2e5212d2eda..81e6ae5dbfc 100644
--- a/js/src/tests/js1_8_1/regress/regress-452498-102.js
+++ b/js/src/tests/js1_8_1/regress/regress-452498-102.js
@@ -32,9 +32,9 @@ function test()
   function f() {
     "" + (function(){
         for( ; [function(){}] ; x = 0)
-          with({x: ""})
+          with({x: ""}) {
             const x = []
-            });
+           }});
   }
   f();
 
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-112.js b/js/src/tests/js1_8_1/regress/regress-452498-112.js
index 0d274ab7eff..19aa63b10ec 100644
--- a/js/src/tests/js1_8_1/regress/regress-452498-112.js
+++ b/js/src/tests/js1_8_1/regress/regress-452498-112.js
@@ -22,11 +22,11 @@ function test()
 
 // ------- Comment #112 From Jesse Ruderman
 
-  expect = 'TypeError: q is not a function';
+  expect = 'ReferenceError: can\'t access lexical declaration `q\' before initialization';
 
   try
   {
-    q = new Function("(function() { q(3); })(); const q;"); q();
+    q = new Function("(function() { q(3); })(); const q = undefined;"); q();
   }
   catch(ex)
   {
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-117.js b/js/src/tests/js1_8_1/regress/regress-452498-117.js
index 6ede09562d8..b52a5f55465 100644
--- a/js/src/tests/js1_8_1/regress/regress-452498-117.js
+++ b/js/src/tests/js1_8_1/regress/regress-452498-117.js
@@ -28,7 +28,7 @@ function test()
 
   try
   {
-    eval('x; function  x(){}; const x;');
+    eval('x; function  x(){}; const x = undefined;');
   }
   catch(ex)
   {
@@ -46,7 +46,7 @@ function test()
 // =====
     try
     {
-      (function(){(yield []) (function(){with({}){x} }); const x;})();
+      (function(){(yield []) (function(){with({}){x} }); const x = undefined;})();
     }
     catch(ex)
     {
@@ -81,7 +81,7 @@ function test()
 // =====
   try
   {
-    eval('(function(){{for(c in (function (){ for(x in (x1))window} )()) {const x;} }})();');
+    eval('(function(){{for(c in (function (){ for(x in (x1))window} )()) {const x = undefined;} }})();');
   }
   catch(ex)
   {
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-160.js b/js/src/tests/js1_8_1/regress/regress-452498-160.js
index a42f4926450..6498a0b5aaa 100644
--- a/js/src/tests/js1_8_1/regress/regress-452498-160.js
+++ b/js/src/tests/js1_8_1/regress/regress-452498-160.js
@@ -22,7 +22,7 @@ function test()
   printStatus (summary);
 
 // crash [@ js_Interpret]
-  (eval("(function(){ this.watch(\"x\", function () { new function ()y } ); const y });"))();
+  (eval("(function(){ this.watch(\"x\", function () { new function ()y } ); const y = undefined });"))();
   x = NaN;
   reportCompare(expect, actual, summary + ': 2');
 
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-185.js b/js/src/tests/js1_8_1/regress/regress-452498-185.js
index 72c0844aa5f..f8ca37f6f9b 100644
--- a/js/src/tests/js1_8_1/regress/regress-452498-185.js
+++ b/js/src/tests/js1_8_1/regress/regress-452498-185.js
@@ -21,7 +21,7 @@ function test()
   printBugNumber(BUGNUMBER);
   printStatus (summary);
 
-  expect = 'TypeError: redeclaration of variable e';
+  expect = 'TypeError: redeclaration of var e';
   try
   {
     eval('{ var e = 3; let e = ""; } print(typeof e);');
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-187.js b/js/src/tests/js1_8_1/regress/regress-452498-187.js
index 0f9a011d4d0..d1d0ffdf276 100644
--- a/js/src/tests/js1_8_1/regress/regress-452498-187.js
+++ b/js/src/tests/js1_8_1/regress/regress-452498-187.js
@@ -24,7 +24,7 @@ function test()
   expect = 'SyntaxError: invalid for/in left-hand side';
   try
   {
-    eval('const x; for (x in []);');
+    eval('const x = undefined; for (x in []);');
   }
   catch(ex)
   {
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-192.js b/js/src/tests/js1_8_1/regress/regress-452498-192.js
index 32835b1122e..6f176788b1f 100644
--- a/js/src/tests/js1_8_1/regress/regress-452498-192.js
+++ b/js/src/tests/js1_8_1/regress/regress-452498-192.js
@@ -21,7 +21,8 @@ function test()
   printBugNumber(BUGNUMBER);
   printStatus (summary);
 
-  with({x: (x -= 0)}){([]); const x }
+  let x;
+  with({x: (x -= 0)}){([]); const x = undefined; }
 
   reportCompare(expect, actual, summary);
 
diff --git a/js/src/tests/js1_8_1/strict/12.2.1.js b/js/src/tests/js1_8_1/strict/12.2.1.js
index f57d7f4a50a..674c7a7c605 100644
--- a/js/src/tests/js1_8_1/strict/12.2.1.js
+++ b/js/src/tests/js1_8_1/strict/12.2.1.js
@@ -26,19 +26,19 @@ assertEq(testLenientAndStrict('let x,arguments;',
                               parsesSuccessfully,
                               parseRaisesException(SyntaxError)),
          true);
-assertEq(testLenientAndStrict('const eval;',
+assertEq(testLenientAndStrict('const eval = undefined;',
                               parsesSuccessfully,
                               parseRaisesException(SyntaxError)),
          true);
-assertEq(testLenientAndStrict('const x,eval;',
+assertEq(testLenientAndStrict('const x = undefined,eval = undefined;',
                               parsesSuccessfully,
                               parseRaisesException(SyntaxError)),
          true);
-assertEq(testLenientAndStrict('const arguments;',
+assertEq(testLenientAndStrict('const arguments = undefined;',
                               parsesSuccessfully,
                               parseRaisesException(SyntaxError)),
          true);
-assertEq(testLenientAndStrict('const x,arguments;',
+assertEq(testLenientAndStrict('const x = undefined,arguments = undefined;',
                               parsesSuccessfully,
                               parseRaisesException(SyntaxError)),
          true);
diff --git a/js/src/tests/js1_8_5/extensions/redeclaration-of-catch-warning.js b/js/src/tests/js1_8_5/extensions/redeclaration-of-catch-warning.js
index b9951693a1c..30d1a201e02 100644
--- a/js/src/tests/js1_8_5/extensions/redeclaration-of-catch-warning.js
+++ b/js/src/tests/js1_8_5/extensions/redeclaration-of-catch-warning.js
@@ -30,7 +30,7 @@ function assertRedeclarationErrorThrown(expression)
   }
 }
 
-assertRedeclarationErrorThrown("try {} catch(e) { const e; }");
+assertRedeclarationErrorThrown("try {} catch(e) { const e = undefined; }");
 assertRedeclarationErrorThrown("try {} catch(e) { let e; }");
 
 if (typeof reportCompare === "function")
diff --git a/js/src/tests/js1_8_5/extensions/reflect-parse.js b/js/src/tests/js1_8_5/extensions/reflect-parse.js
index a380e1aa5bd..7e7d73c2259 100644
--- a/js/src/tests/js1_8_5/extensions/reflect-parse.js
+++ b/js/src/tests/js1_8_5/extensions/reflect-parse.js
@@ -686,6 +686,10 @@ testParamPatternCombinations(function(n) ("[a" + n + ", ..." + "b" + n + "]"),
 function testVarPatternCombinations(makePattSrc, makePattPatt) {
     var pattSrcs = makePatternCombinations(function(n) ("x" + n), makePattSrc);
     var pattPatts = makePatternCombinations(function(n) ({ id: ident("x" + n), init: null }), makePattPatt);
+    // It's illegal to have uninitialized const declarations, so we need a
+    // separate set of patterns and sources.
+    var constSrcs = makePatternCombinations(function(n) ("x" + n + " = undefined"), makePattSrc);
+    var constPatts = makePatternCombinations(function(n) ({ id: ident("x" + n), init: ident("undefined") }), makePattPatt);
 
     for (var i = 0; i < pattSrcs.length; i++) {
         // variable declarations in blocks
@@ -695,15 +699,15 @@ function testVarPatternCombinations(makePattSrc, makePattPatt) {
         assertLocalDecl("let " + pattSrcs[i].join(",") + ";", letDecl(pattPatts[i]));
         assertBlockDecl("let " + pattSrcs[i].join(",") + ";", letDecl(pattPatts[i]));
 
-        assertDecl("const " + pattSrcs[i].join(",") + ";", constDecl(pattPatts[i]));
+        assertDecl("const " + constSrcs[i].join(",") + ";", constDecl(constPatts[i]));
 
         // variable declarations in for-loop heads
         assertStmt("for (var " + pattSrcs[i].join(",") + "; foo; bar);",
                    forStmt(varDecl(pattPatts[i]), ident("foo"), ident("bar"), emptyStmt));
         assertStmt("for (let " + pattSrcs[i].join(",") + "; foo; bar);",
                    letStmt(pattPatts[i], forStmt(null, ident("foo"), ident("bar"), emptyStmt)));
-        assertStmt("for (const " + pattSrcs[i].join(",") + "; foo; bar);",
-                   forStmt(constDecl(pattPatts[i]), ident("foo"), ident("bar"), emptyStmt));
+        assertStmt("for (const " + constSrcs[i].join(",") + "; foo; bar);",
+                   letStmt(constPatts[i], forStmt(null, ident("foo"), ident("bar"), emptyStmt)));
     }
 }
 
@@ -1075,7 +1079,7 @@ assertGlobalStmt("for (;;) continue", forStmt(null, null, null, 15), { continueS
 
 assertBlockDecl("var x", "var", { variableDeclaration: function(kind) kind });
 assertBlockDecl("let x", "let", { variableDeclaration: function(kind) kind });
-assertBlockDecl("const x", "const", { variableDeclaration: function(kind) kind });
+assertBlockDecl("const x = undefined", "const", { variableDeclaration: function(kind) kind });
 assertBlockDecl("function f() { }", "function", { functionDeclaration: function() "function" });
 
 assertGlobalExpr("(x,y,z)", 1, { sequenceExpression: function() 1 });
diff --git a/js/src/vm/ScopeObject.cpp b/js/src/vm/ScopeObject.cpp
index f079cd9b8ce..f4fdfc2b21e 100644
--- a/js/src/vm/ScopeObject.cpp
+++ b/js/src/vm/ScopeObject.cpp
@@ -682,7 +682,7 @@ StaticBlockObject::create(ExclusiveContext *cx)
 
 /* static */ Shape *
 StaticBlockObject::addVar(ExclusiveContext *cx, Handle<StaticBlockObject*> block, HandleId id,
-                          unsigned index, bool *redeclared)
+                          bool constant, unsigned index, bool *redeclared)
 {
     MOZ_ASSERT(JSID_IS_ATOM(id));
     MOZ_ASSERT(index < LOCAL_INDEX_LIMIT);
@@ -701,11 +701,13 @@ StaticBlockObject::addVar(ExclusiveContext *cx, Handle<StaticBlockObject*> block
      * block's shape later.
      */
     uint32_t slot = JSSLOT_FREE(&BlockObject::class_) + index;
+    uint32_t readonly = constant ? JSPROP_READONLY : 0;
+    uint32_t propFlags = readonly | JSPROP_ENUMERATE | JSPROP_PERMANENT;
     return NativeObject::addPropertyInternal<SequentialExecution>(cx, block, id,
                                                                   /* getter = */ nullptr,
                                                                   /* setter = */ nullptr,
                                                                   slot,
-                                                                  JSPROP_ENUMERATE | JSPROP_PERMANENT,
+                                                                  propFlags,
                                                                   /* attrs = */ 0,
                                                                   spp,
                                                                   /* allowDictionary = */ false);
@@ -773,18 +775,20 @@ js::XDRStaticBlockObject(XDRState<mode> *xdr, HandleObject enclosingScope,
                             ? AtomToId(atom)
                             : INT_TO_JSID(i));
 
+            uint32_t propFlags;
+            if (!xdr->codeUint32(&propFlags))
+                return false;
+
+            bool readonly = !!(propFlags & 1);
+
             bool redeclared;
-            if (!StaticBlockObject::addVar(cx, obj, id, i, &redeclared)) {
+            if (!StaticBlockObject::addVar(cx, obj, id, readonly, i, &redeclared)) {
                 MOZ_ASSERT(!redeclared);
                 return false;
             }
 
-            uint32_t aliased;
-            if (!xdr->codeUint32(&aliased))
-                return false;
-
-            MOZ_ASSERT(aliased == 0 || aliased == 1);
-            obj->setAliased(i, !!aliased);
+            bool aliased = !!(propFlags >> 1);
+            obj->setAliased(i, aliased);
         }
     } else {
         AutoShapeVector shapes(cx);
@@ -811,8 +815,10 @@ js::XDRStaticBlockObject(XDRState<mode> *xdr, HandleObject enclosingScope,
             if (!XDRAtom(xdr, &atom))
                 return false;
 
-            uint32_t aliased = obj->isAliased(i);
-            if (!xdr->codeUint32(&aliased))
+            bool aliased = obj->isAliased(i);
+            bool readonly = !shape->writable();
+            uint32_t propFlags = (aliased << 1) | readonly;
+            if (!xdr->codeUint32(&propFlags))
                 return false;
         }
     }
@@ -850,7 +856,7 @@ CloneStaticBlockObject(JSContext *cx, HandleObject enclosingScope, Handle<Static
         unsigned i = srcBlock->shapeToIndex(**p);
 
         bool redeclared;
-        if (!StaticBlockObject::addVar(cx, clone, id, i, &redeclared)) {
+        if (!StaticBlockObject::addVar(cx, clone, id, !(*p)->writable(), i, &redeclared)) {
             MOZ_ASSERT(!redeclared);
             return nullptr;
         }
diff --git a/js/src/vm/ScopeObject.h b/js/src/vm/ScopeObject.h
index 493ccad644a..ffe2ab67ddf 100644
--- a/js/src/vm/ScopeObject.h
+++ b/js/src/vm/ScopeObject.h
@@ -570,7 +570,7 @@ class StaticBlockObject : public BlockObject
     static const unsigned LOCAL_INDEX_LIMIT = JS_BIT(16);
 
     static Shape *addVar(ExclusiveContext *cx, Handle<StaticBlockObject*> block, HandleId id,
-                         unsigned index, bool *redeclared);
+                         bool constant, unsigned index, bool *redeclared);
 };
 
 class ClonedBlockObject : public BlockObject
diff --git a/js/src/vm/Xdr.h b/js/src/vm/Xdr.h
index 2de2bb99592..09b04f99611 100644
--- a/js/src/vm/Xdr.h
+++ b/js/src/vm/Xdr.h
@@ -34,7 +34,7 @@ namespace js {
  * Nightly) and without (all others).  FIXME: Bug 1066322 - Enable ES6 symbols
  * in all builds.
  */
-static const uint32_t XDR_BYTECODE_VERSION_SUBTRAHEND = 190;
+static const uint32_t XDR_BYTECODE_VERSION_SUBTRAHEND = 192;
 static_assert(XDR_BYTECODE_VERSION_SUBTRAHEND % 2 == 0, "see the comment above");
 static const uint32_t XDR_BYTECODE_VERSION =
     uint32_t(0xb973c0de - (XDR_BYTECODE_VERSION_SUBTRAHEND
diff --git a/toolkit/components/osfile/modules/osfile_shared_allthreads.jsm b/toolkit/components/osfile/modules/osfile_shared_allthreads.jsm
index 1faa07b9f56..a6110bb5fd6 100644
--- a/toolkit/components/osfile/modules/osfile_shared_allthreads.jsm
+++ b/toolkit/components/osfile/modules/osfile_shared_allthreads.jsm
@@ -19,16 +19,18 @@
 
 // Boilerplate used to be able to import this module both from the main
 // thread and from worker threads.
+
+// Since const is lexically scoped, hoist the
+// conditionally-useful definition ourselves.
+const Cu = typeof Components != "undefined" ? Components.utils : undefined;
+const Ci = typeof Components != "undefined" ? Components.interfaces : undefined;
+const Cc = typeof Components != "undefined" ? Components.classes : undefined;
 if (typeof Components != "undefined") {
   // Global definition of |exports|, to keep everybody happy.
   // In non-main thread, |exports| is provided by the module
   // loader.
   this.exports = {};
 
-  const Cu = Components.utils;
-  const Ci = Components.interfaces;
-  const Cc = Components.classes;
-
   Cu.import("resource://gre/modules/Services.jsm", this);
 }
 
diff --git a/toolkit/components/places/tests/head_common.js b/toolkit/components/places/tests/head_common.js
index a9da6abbf14..421c1508307 100644
--- a/toolkit/components/places/tests/head_common.js
+++ b/toolkit/components/places/tests/head_common.js
@@ -410,9 +410,8 @@ function shutdownPlaces(aKeepAliveConnection)
 }
 
 const FILENAME_BOOKMARKS_HTML = "bookmarks.html";
-let (backup_date = new Date().toLocaleFormat("%Y-%m-%d")) {
-  const FILENAME_BOOKMARKS_JSON = "bookmarks-" + backup_date + ".json";
-}
+const FILENAME_BOOKMARKS_JSON = "bookmarks-" +
+  (new Date().toLocaleFormat("%Y-%m-%d")) + ".json";
 
 /**
  * Creates a bookmarks.html file in the profile folder from a given source file.

From adfa6449dc0037667f0b3783ccca6748127586df Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Tue, 4 Nov 2014 15:19:46 -0700
Subject: [PATCH 021/153] Bug 1091015 - Inline allocation of Typed Objects in
 IonMonkey, r=nmatsakis,jandem.

---
 js/src/builtin/TypedObject.cpp        |  47 +++++---
 js/src/builtin/TypedObject.h          |  16 ++-
 js/src/jit/BaselineDebugModeOSR.cpp   |   1 +
 js/src/jit/BaselineIC.cpp             | 162 +++++++++++++++++++++++++-
 js/src/jit/BaselineIC.h               |  79 +++++++++++++
 js/src/jit/BaselineInspector.cpp      |  15 +++
 js/src/jit/BaselineInspector.h        |   1 +
 js/src/jit/CodeGenerator.cpp          |  24 ++++
 js/src/jit/CodeGenerator.h            |   1 +
 js/src/jit/IonBuilder.cpp             |  76 +++++++-----
 js/src/jit/IonBuilder.h               |   8 +-
 js/src/jit/IonMacroAssembler.cpp      | 107 ++++++++++-------
 js/src/jit/IonMacroAssembler.h        |   4 +-
 js/src/jit/LIR-Common.h               |  18 +++
 js/src/jit/LOpcodes.h                 |   1 +
 js/src/jit/Lowering.cpp               |   7 ++
 js/src/jit/Lowering.h                 |   1 +
 js/src/jit/MCallOptimize.cpp          |  40 +++++++
 js/src/jit/MIR.h                      |  39 +++++++
 js/src/jit/MOpcodes.h                 |   1 +
 js/src/jit/ParallelSafetyAnalysis.cpp |   1 +
 js/src/jit/VMFunctions.h              |   9 ++
 22 files changed, 558 insertions(+), 100 deletions(-)

diff --git a/js/src/builtin/TypedObject.cpp b/js/src/builtin/TypedObject.cpp
index d9c8ea66f54..a3019df00d4 100644
--- a/js/src/builtin/TypedObject.cpp
+++ b/js/src/builtin/TypedObject.cpp
@@ -535,7 +535,7 @@ const Class SizedArrayTypeDescr::class_ = {
     nullptr,
     nullptr,
     nullptr,
-    OutlineTypedObject::constructSized,
+    TypedObject::constructSized,
     nullptr
 };
 
@@ -641,7 +641,7 @@ ArrayMetaTypeDescr::create(JSContext *cx,
                            int32_t size)
 {
     Rooted<T*> obj(cx);
-    obj = NewObjectWithProto<T>(cx, arrayTypePrototype, nullptr, TenuredObject);
+    obj = NewObjectWithProto<T>(cx, arrayTypePrototype, nullptr, SingletonObject);
     if (!obj)
         return nullptr;
 
@@ -832,7 +832,7 @@ const Class StructTypeDescr::class_ = {
     nullptr, /* finalize */
     nullptr, /* call */
     nullptr, /* hasInstance */
-    OutlineTypedObject::constructSized,
+    TypedObject::constructSized,
     nullptr  /* trace */
 };
 
@@ -1011,7 +1011,7 @@ StructMetaTypeDescr::create(JSContext *cx,
 
     Rooted<StructTypeDescr*> descr(cx);
     descr = NewObjectWithProto<StructTypeDescr>(cx, structTypePrototype, nullptr,
-                                                TenuredObject);
+                                                SingletonObject);
     if (!descr)
         return nullptr;
 
@@ -1251,7 +1251,7 @@ DefineSimpleTypeDescr(JSContext *cx,
         return false;
 
     Rooted<T*> descr(cx);
-    descr = NewObjectWithProto<T>(cx, funcProto, global, TenuredObject);
+    descr = NewObjectWithProto<T>(cx, funcProto, global, SingletonObject);
     if (!descr)
         return false;
 
@@ -1562,12 +1562,13 @@ TypedObject::GetByteOffset(JSContext *cx, unsigned argc, Value *vp)
 /*static*/ OutlineTypedObject *
 OutlineTypedObject::createUnattached(JSContext *cx,
                                      HandleTypeDescr descr,
-                                     int32_t length)
+                                     int32_t length,
+                                     gc::InitialHeap heap)
 {
     if (descr->opaque())
-        return createUnattachedWithClass(cx, &OutlineOpaqueTypedObject::class_, descr, length);
+        return createUnattachedWithClass(cx, &OutlineOpaqueTypedObject::class_, descr, length, heap);
     else
-        return createUnattachedWithClass(cx, &OutlineTransparentTypedObject::class_, descr, length);
+        return createUnattachedWithClass(cx, &OutlineTransparentTypedObject::class_, descr, length, heap);
 }
 
 static JSObject *
@@ -1606,7 +1607,8 @@ OutlineTypedObject::setOwnerAndData(JSObject *owner, uint8_t *data)
 OutlineTypedObject::createUnattachedWithClass(JSContext *cx,
                                               const Class *clasp,
                                               HandleTypeDescr type,
-                                              int32_t length)
+                                              int32_t length,
+                                              gc::InitialHeap heap)
 {
     MOZ_ASSERT(clasp == &OutlineTransparentTypedObject::class_ ||
                clasp == &OutlineOpaqueTypedObject::class_);
@@ -1616,7 +1618,8 @@ OutlineTypedObject::createUnattachedWithClass(JSContext *cx,
         return nullptr;
 
     gc::AllocKind allocKind = allocKindForTypeDescriptor(type);
-    JSObject *obj = NewObjectWithClassProto(cx, clasp, proto, nullptr, allocKind);
+    NewObjectKind newKind = (heap == gc::TenuredHeap) ? MaybeSingletonObject : GenericObject;
+    JSObject *obj = NewObjectWithClassProto(cx, clasp, proto, nullptr, allocKind, newKind);
     if (!obj)
         return nullptr;
 
@@ -1707,19 +1710,19 @@ OutlineTypedObject::createDerived(JSContext *cx, HandleSizedTypeDescr type,
 }
 
 /*static*/ TypedObject *
-TypedObject::createZeroed(JSContext *cx, HandleTypeDescr descr, int32_t length)
+TypedObject::createZeroed(JSContext *cx, HandleTypeDescr descr, int32_t length, gc::InitialHeap heap)
 {
     // If possible, create an object with inline data.
     if (descr->is<SizedTypeDescr>() &&
         (size_t) descr->as<SizedTypeDescr>().size() <= InlineTypedObject::MaximumSize)
     {
-        InlineTypedObject *obj = InlineTypedObject::create(cx, descr);
+        InlineTypedObject *obj = InlineTypedObject::create(cx, descr, heap);
         descr->as<SizedTypeDescr>().initInstances(cx->runtime(), obj->inlineTypedMem(), 1);
         return obj;
     }
 
     // Create unattached wrapper object.
-    Rooted<OutlineTypedObject*> obj(cx, OutlineTypedObject::createUnattached(cx, descr, length));
+    Rooted<OutlineTypedObject*> obj(cx, OutlineTypedObject::createUnattached(cx, descr, length, heap));
     if (!obj)
         return nullptr;
 
@@ -2373,7 +2376,7 @@ OutlineTypedObject::neuter(void *newData)
  */
 
 /* static */ InlineTypedObject *
-InlineTypedObject::create(JSContext *cx, HandleTypeDescr descr)
+InlineTypedObject::create(JSContext *cx, HandleTypeDescr descr, gc::InitialHeap heap)
 {
     gc::AllocKind allocKind = allocKindForTypeDescriptor(descr);
 
@@ -2385,13 +2388,27 @@ InlineTypedObject::create(JSContext *cx, HandleTypeDescr descr)
                          ? &InlineOpaqueTypedObject::class_
                          : &InlineTransparentTypedObject::class_;
 
-    RootedObject obj(cx, NewObjectWithClassProto(cx, clasp, proto, nullptr, allocKind));
+    NewObjectKind newKind = (heap == gc::TenuredHeap) ? MaybeSingletonObject : GenericObject;
+    RootedObject obj(cx, NewObjectWithClassProto(cx, clasp, proto, nullptr, allocKind, newKind));
     if (!obj)
         return nullptr;
 
     return &obj->as<InlineTypedObject>();
 }
 
+/* static */ InlineTypedObject *
+InlineTypedObject::createCopy(JSContext *cx, Handle<InlineTypedObject *> templateObject,
+                              gc::InitialHeap heap)
+{
+    Rooted<TypeDescr *> descr(cx, &templateObject->typeDescr());
+    InlineTypedObject *res = create(cx, descr, heap);
+    if (!res)
+        return nullptr;
+
+    memcpy(res->inlineTypedMem(), templateObject->inlineTypedMem(), templateObject->size());
+    return res;
+}
+
 /* static */ void
 InlineTypedObject::obj_trace(JSTracer *trc, JSObject *object)
 {
diff --git a/js/src/builtin/TypedObject.h b/js/src/builtin/TypedObject.h
index 02af9c11769..80f09624a43 100644
--- a/js/src/builtin/TypedObject.h
+++ b/js/src/builtin/TypedObject.h
@@ -676,7 +676,8 @@ class TypedObject : public JSObject
     // Creates a new typed object whose memory is freshly allocated and
     // initialized with zeroes (or, in the case of references, an appropriate
     // default value).
-    static TypedObject *createZeroed(JSContext *cx, HandleTypeDescr typeObj, int32_t length);
+    static TypedObject *createZeroed(JSContext *cx, HandleTypeDescr typeObj, int32_t length,
+                                     gc::InitialHeap heap = gc::DefaultHeap);
 
     // User-accessible constructor (`new TypeDescriptor(...)`) used for sized
     // types. Note that the callee here is the type descriptor.
@@ -753,7 +754,8 @@ class OutlineTypedObject : public TypedObject
     static OutlineTypedObject *createUnattachedWithClass(JSContext *cx,
                                                          const Class *clasp,
                                                          HandleTypeDescr type,
-                                                         int32_t length);
+                                                         int32_t length,
+                                                         gc::InitialHeap heap = gc::DefaultHeap);
 
     // Creates an unattached typed object or handle (depending on the
     // type parameter T). Note that it is only legal for unattached
@@ -764,7 +766,7 @@ class OutlineTypedObject : public TypedObject
     // - type: type object for resulting object
     // - length: 0 unless this is an array, otherwise the length
     static OutlineTypedObject *createUnattached(JSContext *cx, HandleTypeDescr type,
-                                                int32_t length);
+                                                int32_t length, gc::InitialHeap heap = gc::DefaultHeap);
 
     // Creates a typedObj that aliases the memory pointed at by `owner`
     // at the given offset. The typedObj will be a handle iff type is a
@@ -810,7 +812,8 @@ class InlineTypedObject : public TypedObject
     uint8_t data_[1];
 
   public:
-    static const size_t MaximumSize = NativeObject::MAX_FIXED_SLOTS * sizeof(Value);
+    static const size_t MaximumSize =
+        sizeof(NativeObject) - sizeof(TypedObject) + NativeObject::MAX_FIXED_SLOTS * sizeof(Value);
 
     static gc::AllocKind allocKindForTypeDescriptor(TypeDescr *descr) {
         size_t nbytes = descr->as<SizedTypeDescr>().size();
@@ -833,7 +836,10 @@ class InlineTypedObject : public TypedObject
         return offsetof(InlineTypedObject, data_);
     }
 
-    static InlineTypedObject *create(JSContext *cx, HandleTypeDescr descr);
+    static InlineTypedObject *create(JSContext *cx, HandleTypeDescr descr,
+                                     gc::InitialHeap heap = gc::DefaultHeap);
+    static InlineTypedObject *createCopy(JSContext *cx, Handle<InlineTypedObject *> templateObject,
+                                         gc::InitialHeap heap);
 };
 
 // Class for a transparent typed object with inline data, which may have a
diff --git a/js/src/jit/BaselineDebugModeOSR.cpp b/js/src/jit/BaselineDebugModeOSR.cpp
index a558e6b6a5b..b6f784b6ff3 100644
--- a/js/src/jit/BaselineDebugModeOSR.cpp
+++ b/js/src/jit/BaselineDebugModeOSR.cpp
@@ -533,6 +533,7 @@ RecompileBaselineScriptForDebugMode(JSContext *cx, JSScript *script)
     _(Call_Scripted)                            \
     _(Call_AnyScripted)                         \
     _(Call_Native)                              \
+    _(Call_ClassHook)                           \
     _(Call_ScriptedApplyArray)                  \
     _(Call_ScriptedApplyArguments)              \
     _(Call_ScriptedFunCall)                     \
diff --git a/js/src/jit/BaselineIC.cpp b/js/src/jit/BaselineIC.cpp
index 6b37e6998ad..7325f26deb2 100644
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@@ -201,6 +201,12 @@ ICStub::trace(JSTracer *trc)
             MarkObject(trc, &callStub->templateObject(), "baseline-callnative-template");
         break;
       }
+      case ICStub::Call_ClassHook: {
+        ICCall_ClassHook *callStub = toCall_ClassHook();
+        if (callStub->templateObject())
+            MarkObject(trc, &callStub->templateObject(), "baseline-callclasshook-template");
+        break;
+      }
       case ICStub::Call_StringSplit: {
         ICCall_StringSplit *callStub = toCall_StringSplit();
         MarkObject(trc, &callStub->templateObject(), "baseline-callstringsplit-template");
@@ -704,6 +710,7 @@ ICStubCompiler::guardProfilingEnabled(MacroAssembler &masm, Register scratch, La
     MOZ_ASSERT(kind == ICStub::Call_Scripted                             ||
                kind == ICStub::Call_AnyScripted                          ||
                kind == ICStub::Call_Native                               ||
+               kind == ICStub::Call_ClassHook                            ||
                kind == ICStub::Call_ScriptedApplyArray                   ||
                kind == ICStub::Call_ScriptedApplyArguments               ||
                kind == ICStub::Call_ScriptedFunCall                      ||
@@ -8582,6 +8589,22 @@ GetTemplateObjectForNative(JSContext *cx, HandleScript script, jsbytecode *pc,
     return true;
 }
 
+static bool
+GetTemplateObjectForClassHook(JSContext *cx, JSNative hook, CallArgs &args,
+                              MutableHandleObject templateObject)
+{
+    if (hook == TypedObject::constructSized) {
+        Rooted<TypeDescr *> descr(cx, &args.callee().as<TypeDescr>());
+        JSObject *obj = TypedObject::createZeroed(cx, descr, 1, gc::TenuredHeap);
+        if (!obj)
+            return false;
+        templateObject.set(obj);
+        return true;
+    }
+
+    return true;
+}
+
 static bool
 IsOptimizableCallStringSplit(Value callee, Value thisv, int argc, Value *args)
 {
@@ -8631,8 +8654,27 @@ TryAttachCallStub(JSContext *cx, ICCall_Fallback *stub, HandleScript script, jsb
         return true;
 
     RootedObject obj(cx, &callee.toObject());
-    if (!obj->is<JSFunction>())
+    if (!obj->is<JSFunction>()) {
+        if (JSNative hook = constructing ? obj->constructHook() : obj->callHook()) {
+            if (op != JSOP_FUNAPPLY && !isSpread && !useNewType) {
+                RootedObject templateObject(cx);
+                CallArgs args = CallArgsFromVp(argc, vp);
+                if (!GetTemplateObjectForClassHook(cx, hook, args, &templateObject))
+                    return false;
+
+                JitSpew(JitSpew_BaselineIC, "  Generating Call_ClassHook stub");
+                ICCall_ClassHook::Compiler compiler(cx, stub->fallbackMonitorStub()->firstMonitorStub(),
+                                                    obj->getClass(), hook, templateObject, constructing);
+                ICStub *newStub = compiler.getStub(compiler.getStubSpace(script));
+                if (!newStub)
+                    return false;
+
+                stub->addNewStub(newStub);
+                return true;
+            }
+        }
         return true;
+    }
 
     RootedFunction fun(cx, &obj->as<JSFunction>());
 
@@ -9810,6 +9852,97 @@ ICCall_Native::Compiler::generateStubCode(MacroAssembler &masm)
     return true;
 }
 
+bool
+ICCall_ClassHook::Compiler::generateStubCode(MacroAssembler &masm)
+{
+    Label failure;
+    GeneralRegisterSet regs(availableGeneralRegs(0));
+
+    Register argcReg = R0.scratchReg();
+    regs.take(argcReg);
+    regs.takeUnchecked(BaselineTailCallReg);
+
+    // Load the callee in R1.
+    BaseIndex calleeSlot(BaselineStackReg, argcReg, TimesEight, ICStackValueOffset + sizeof(Value));
+    masm.loadValue(calleeSlot, R1);
+    regs.take(R1);
+
+    masm.branchTestObject(Assembler::NotEqual, R1, &failure);
+
+    // Ensure the callee's class matches the one in this stub.
+    Register callee = masm.extractObject(R1, ExtractTemp0);
+    Register scratch = regs.takeAny();
+    masm.loadObjClass(callee, scratch);
+    masm.branchPtr(Assembler::NotEqual,
+                   Address(BaselineStubReg, ICCall_ClassHook::offsetOfClass()),
+                   scratch, &failure);
+
+    regs.add(R1);
+    regs.takeUnchecked(callee);
+
+    // Push a stub frame so that we can perform a non-tail call.
+    // Note that this leaves the return address in TailCallReg.
+    enterStubFrame(masm, regs.getAny());
+
+    regs.add(scratch);
+    pushCallArguments(masm, regs, argcReg);
+    regs.take(scratch);
+
+    if (isConstructing_) {
+        // Stack looks like: [ ..., Arg0Val, ThisVal, CalleeVal ]
+        // Replace ThisVal with MagicValue(JS_IS_CONSTRUCTING)
+        masm.storeValue(MagicValue(JS_IS_CONSTRUCTING), Address(BaselineStackReg, sizeof(Value)));
+    }
+
+    masm.checkStackAlignment();
+
+    // Native functions have the signature:
+    //
+    //    bool (*)(JSContext *, unsigned, Value *vp)
+    //
+    // Where vp[0] is space for callee/return value, vp[1] is |this|, and vp[2] onward
+    // are the function arguments.
+
+    // Initialize vp.
+    Register vpReg = regs.takeAny();
+    masm.movePtr(StackPointer, vpReg);
+
+    // Construct a native exit frame.
+    masm.push(argcReg);
+
+    EmitCreateStubFrameDescriptor(masm, scratch);
+    masm.push(scratch);
+    masm.push(BaselineTailCallReg);
+    masm.enterFakeExitFrame(IonNativeExitFrameLayout::Token());
+
+    // If needed, update SPS Profiler frame entry.  At this point, BaselineTailCallReg
+    // and scratch can be clobbered.
+    emitProfilingUpdate(masm, BaselineTailCallReg, scratch, ICCall_Native::offsetOfPCOffset());
+
+    // Execute call.
+    masm.setupUnalignedABICall(3, scratch);
+    masm.loadJSContext(scratch);
+    masm.passABIArg(scratch);
+    masm.passABIArg(argcReg);
+    masm.passABIArg(vpReg);
+    masm.callWithABI(Address(BaselineStubReg, ICCall_ClassHook::offsetOfNative()));
+
+    // Test for failure.
+    masm.branchIfFalseBool(ReturnReg, masm.exceptionLabel());
+
+    // Load the return value into R0.
+    masm.loadValue(Address(StackPointer, IonNativeExitFrameLayout::offsetOfResult()), R0);
+
+    leaveStubFrame(masm);
+
+    // Enter type monitor IC to type-check result.
+    EmitEnterTypeMonitorIC(masm);
+
+    masm.bind(&failure);
+    EmitStubGuardFailure(masm);
+    return true;
+}
+
 bool
 ICCall_ScriptedApplyArray::Compiler::generateStubCode(MacroAssembler &masm)
 {
@@ -11157,6 +11290,33 @@ ICCall_Native::Clone(JSContext *cx, ICStubSpace *space, ICStub *firstMonitorStub
                other.pcOffset_);
 }
 
+ICCall_ClassHook::ICCall_ClassHook(JitCode *stubCode, ICStub *firstMonitorStub,
+                                   const Class *clasp, Native native, HandleObject templateObject)
+  : ICMonitoredStub(ICStub::Call_ClassHook, stubCode, firstMonitorStub),
+    clasp_(clasp),
+    native_(JS_FUNC_TO_DATA_PTR(void *, native)),
+    templateObject_(templateObject)
+{
+#if defined(JS_ARM_SIMULATOR) || defined(JS_MIPS_SIMULATOR)
+    // The simulator requires VM calls to be redirected to a special swi
+    // instruction to handle them. To make this work, we store the redirected
+    // pointer in the stub.
+    native_ = Simulator::RedirectNativeFunction(native_, Args_General3);
+#endif
+}
+
+/* static */ ICCall_ClassHook *
+ICCall_ClassHook::Clone(JSContext *cx, ICStubSpace *space, ICStub *firstMonitorStub,
+                        ICCall_ClassHook &other)
+{
+    RootedObject templateObject(cx, other.templateObject_);
+    ICCall_ClassHook *res = New(space, other.jitCode(), firstMonitorStub,
+                                other.clasp(), nullptr, templateObject);
+    if (res)
+        res->native_ = other.native();
+    return res;
+}
+
 /* static */ ICCall_ScriptedApplyArray *
 ICCall_ScriptedApplyArray::Clone(JSContext *, ICStubSpace *space, ICStub *firstMonitorStub,
                                  ICCall_ScriptedApplyArray &other)
diff --git a/js/src/jit/BaselineIC.h b/js/src/jit/BaselineIC.h
index d027875395f..e30b067a7bb 100644
--- a/js/src/jit/BaselineIC.h
+++ b/js/src/jit/BaselineIC.h
@@ -375,6 +375,7 @@ class ICEntry
     _(Call_Scripted)            \
     _(Call_AnyScripted)         \
     _(Call_Native)              \
+    _(Call_ClassHook)           \
     _(Call_ScriptedApplyArray)  \
     _(Call_ScriptedApplyArguments) \
     _(Call_ScriptedFunCall)     \
@@ -790,6 +791,7 @@ class ICStub
           case Call_Scripted:
           case Call_AnyScripted:
           case Call_Native:
+          case Call_ClassHook:
           case Call_ScriptedApplyArray:
           case Call_ScriptedApplyArguments:
           case Call_ScriptedFunCall:
@@ -5897,6 +5899,83 @@ class ICCall_Native : public ICMonitoredStub
     };
 };
 
+class ICCall_ClassHook : public ICMonitoredStub
+{
+    friend class ICStubSpace;
+
+  protected:
+    const Class *clasp_;
+    void *native_;
+    HeapPtrObject templateObject_;
+
+    ICCall_ClassHook(JitCode *stubCode, ICStub *firstMonitorStub,
+                     const Class *clasp, Native native, HandleObject templateObject);
+
+  public:
+    static inline ICCall_ClassHook *New(ICStubSpace *space,
+                                        JitCode *code, ICStub *firstMonitorStub,
+                                        const Class *clasp, Native native,
+                                        HandleObject templateObject)
+    {
+        if (!code)
+            return nullptr;
+        return space->allocate<ICCall_ClassHook>(code, firstMonitorStub,
+                                                 clasp, native, templateObject);
+    }
+
+    static ICCall_ClassHook *Clone(JSContext *cx, ICStubSpace *space, ICStub *firstMonitorStub,
+                                   ICCall_ClassHook &other);
+
+    const Class *clasp() {
+        return clasp_;
+    }
+    void *native() {
+        return native_;
+    }
+    HeapPtrObject &templateObject() {
+        return templateObject_;
+    }
+
+    static size_t offsetOfClass() {
+        return offsetof(ICCall_ClassHook, clasp_);
+    }
+    static size_t offsetOfNative() {
+        return offsetof(ICCall_ClassHook, native_);
+    }
+
+    // Compiler for this stub kind.
+    class Compiler : public ICCallStubCompiler {
+      protected:
+        ICStub *firstMonitorStub_;
+        bool isConstructing_;
+        const Class *clasp_;
+        Native native_;
+        RootedObject templateObject_;
+        bool generateStubCode(MacroAssembler &masm);
+
+        virtual int32_t getKey() const {
+            return static_cast<int32_t>(kind) | (static_cast<int32_t>(isConstructing_) << 16);
+        }
+
+      public:
+        Compiler(JSContext *cx, ICStub *firstMonitorStub,
+                 const Class *clasp, Native native, HandleObject templateObject,
+                 bool isConstructing)
+          : ICCallStubCompiler(cx, ICStub::Call_ClassHook),
+            firstMonitorStub_(firstMonitorStub),
+            isConstructing_(isConstructing),
+            clasp_(clasp),
+            native_(native),
+            templateObject_(cx, templateObject)
+        { }
+
+        ICStub *getStub(ICStubSpace *space) {
+            return ICCall_ClassHook::New(space, getStubCode(), firstMonitorStub_,
+                                         clasp_, native_, templateObject_);
+        }
+    };
+};
+
 class ICCall_ScriptedApplyArray : public ICMonitoredStub
 {
     friend class ICStubSpace;
diff --git a/js/src/jit/BaselineInspector.cpp b/js/src/jit/BaselineInspector.cpp
index 0a896afca0b..240088d1b0c 100644
--- a/js/src/jit/BaselineInspector.cpp
+++ b/js/src/jit/BaselineInspector.cpp
@@ -455,6 +455,21 @@ BaselineInspector::getTemplateObjectForNative(jsbytecode *pc, Native native)
     return nullptr;
 }
 
+JSObject *
+BaselineInspector::getTemplateObjectForClassHook(jsbytecode *pc, const Class *clasp)
+{
+    if (!hasBaselineScript())
+        return nullptr;
+
+    const ICEntry &entry = icEntryFromPC(pc);
+    for (ICStub *stub = entry.firstStub(); stub; stub = stub->next()) {
+        if (stub->isCall_ClassHook() && stub->toCall_ClassHook()->clasp() == clasp)
+            return stub->toCall_ClassHook()->templateObject();
+    }
+
+    return nullptr;
+}
+
 DeclEnvObject *
 BaselineInspector::templateDeclEnvObject()
 {
diff --git a/js/src/jit/BaselineInspector.h b/js/src/jit/BaselineInspector.h
index 40f83042782..abcf1acf256 100644
--- a/js/src/jit/BaselineInspector.h
+++ b/js/src/jit/BaselineInspector.h
@@ -111,6 +111,7 @@ class BaselineInspector
 
     NativeObject *getTemplateObject(jsbytecode *pc);
     NativeObject *getTemplateObjectForNative(jsbytecode *pc, Native native);
+    JSObject *getTemplateObjectForClassHook(jsbytecode *pc, const Class *clasp);
 
     DeclEnvObject *templateDeclEnvObject();
     CallObject *templateCallObject();
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index 3a2bffc66e1..88c72fb731f 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -4452,6 +4452,30 @@ CodeGenerator::visitOutOfLineNewObject(OutOfLineNewObject *ool)
     return true;
 }
 
+typedef InlineTypedObject *(*NewTypedObjectFn)(JSContext *, Handle<InlineTypedObject *>, gc::InitialHeap);
+static const VMFunction NewTypedObjectInfo =
+    FunctionInfo<NewTypedObjectFn>(InlineTypedObject::createCopy);
+
+bool
+CodeGenerator::visitNewTypedObject(LNewTypedObject *lir)
+{
+    Register object = ToRegister(lir->output());
+    Register temp = ToRegister(lir->temp());
+    InlineTypedObject *templateObject = lir->mir()->templateObject();
+    gc::InitialHeap initialHeap = lir->mir()->initialHeap();
+
+    OutOfLineCode *ool = oolCallVM(NewTypedObjectInfo, lir,
+                                   (ArgList(), ImmGCPtr(templateObject), Imm32(initialHeap)),
+                                   StoreRegisterTo(object));
+    if (!ool)
+        return false;
+
+    masm.createGCObject(object, temp, templateObject, initialHeap, ool->entry());
+
+    masm.bind(ool->rejoin());
+    return true;
+}
+
 typedef js::DeclEnvObject *(*NewDeclEnvObjectFn)(JSContext *, HandleFunction, gc::InitialHeap);
 static const VMFunction NewDeclEnvObjectInfo =
     FunctionInfo<NewDeclEnvObjectFn>(DeclEnvObject::createTemplateObject);
diff --git a/js/src/jit/CodeGenerator.h b/js/src/jit/CodeGenerator.h
index 40a0b38ac21..4e24d799c61 100644
--- a/js/src/jit/CodeGenerator.h
+++ b/js/src/jit/CodeGenerator.h
@@ -155,6 +155,7 @@ class CodeGenerator : public CodeGeneratorSpecific
     bool visitNewObjectVMCall(LNewObject *lir);
     bool visitNewObject(LNewObject *lir);
     bool visitOutOfLineNewObject(OutOfLineNewObject *ool);
+    bool visitNewTypedObject(LNewTypedObject *lir);
     bool visitNewDeclEnvObject(LNewDeclEnvObject *lir);
     bool visitNewCallObject(LNewCallObject *lir);
     bool visitNewSingletonCallObject(LNewSingletonCallObject *lir);
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index ac3dbc73230..b31a236c3f0 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -292,14 +292,7 @@ IonBuilder::getPolyCallTargets(types::TemporaryTypeSet *calleeTypes, bool constr
         return false;
     for(unsigned i = 0; i < objCount; i++) {
         JSObject *obj = calleeTypes->getSingleObject(i);
-        JSFunction *fun;
-        if (obj) {
-            if (!obj->is<JSFunction>()) {
-                targets.clear();
-                return true;
-            }
-            fun = &obj->as<JSFunction>();
-        } else {
+        if (!obj) {
             types::TypeObject *typeObj = calleeTypes->getTypeObject(i);
             MOZ_ASSERT(typeObj);
             if (!typeObj->interpretedFunction) {
@@ -307,19 +300,19 @@ IonBuilder::getPolyCallTargets(types::TemporaryTypeSet *calleeTypes, bool constr
                 return true;
             }
 
-            fun = typeObj->interpretedFunction;
+            obj = typeObj->interpretedFunction;
             *gotLambda = true;
         }
 
-        // Don't optimize if we're constructing and the callee is not a
-        // constructor, so that CallKnown does not have to handle this case
-        // (it should always throw).
-        if (constructing && !fun->isInterpretedConstructor() && !fun->isNativeConstructor()) {
+        // Don't optimize if the callee is not callable or constructable per
+        // the manner it is being invoked, so that CallKnown does not have to
+        // handle these cases (they will always throw).
+        if (constructing ? !obj->isConstructor() : !obj->isCallable()) {
             targets.clear();
             return true;
         }
 
-        DebugOnly<bool> appendOk = targets.append(fun);
+        DebugOnly<bool> appendOk = targets.append(obj);
         MOZ_ASSERT(appendOk);
     }
 
@@ -4417,12 +4410,18 @@ IonBuilder::patchInlinedReturns(CallInfo &callInfo, MIRGraphReturns &returns, MB
 }
 
 IonBuilder::InliningDecision
-IonBuilder::makeInliningDecision(JSFunction *target, CallInfo &callInfo)
+IonBuilder::makeInliningDecision(JSObject *targetArg, CallInfo &callInfo)
 {
     // When there is no target, inlining is impossible.
-    if (target == nullptr)
+    if (targetArg == nullptr)
         return InliningDecision_DontInline;
 
+    // Inlining non-function targets is handled by inlineNonFunctionCall().
+    if (!targetArg->is<JSFunction>())
+        return InliningDecision_Inline;
+
+    JSFunction *target = &targetArg->as<JSFunction>();
+
     // Never inline during the arguments usage analysis.
     if (info().executionMode() == ArgumentsUsageAnalysis)
         return InliningDecision_DontInline;
@@ -4525,7 +4524,7 @@ IonBuilder::selectInliningTargets(ObjectVector &targets, CallInfo &callInfo, Boo
         return true;
 
     for (size_t i = 0; i < targets.length(); i++) {
-        JSFunction *target = &targets[i]->as<JSFunction>();
+        JSObject *target = targets[i];
         bool inlineable;
         InliningDecision decision = makeInliningDecision(target, callInfo);
         switch (decision) {
@@ -4542,11 +4541,16 @@ IonBuilder::selectInliningTargets(ObjectVector &targets, CallInfo &callInfo, Boo
             MOZ_CRASH("Unhandled InliningDecision value!");
         }
 
-        // Enforce a maximum inlined bytecode limit at the callsite.
-        if (inlineable && target->isInterpreted()) {
-            totalSize += target->nonLazyScript()->length();
-            if (totalSize > optimizationInfo().inlineMaxTotalBytecodeLength())
-                inlineable = false;
+        if (target->is<JSFunction>()) {
+            // Enforce a maximum inlined bytecode limit at the callsite.
+            if (inlineable && target->as<JSFunction>().isInterpreted()) {
+                totalSize += target->as<JSFunction>().nonLazyScript()->length();
+                if (totalSize > optimizationInfo().inlineMaxTotalBytecodeLength())
+                    inlineable = false;
+            }
+        } else {
+            // Non-function targets are not supported by polymorphic inlining.
+            inlineable = false;
         }
 
         choiceSet.append(inlineable);
@@ -4674,9 +4678,12 @@ IonBuilder::getInlineableGetPropertyCache(CallInfo &callInfo)
 }
 
 IonBuilder::InliningStatus
-IonBuilder::inlineSingleCall(CallInfo &callInfo, JSFunction *target)
+IonBuilder::inlineSingleCall(CallInfo &callInfo, JSObject *targetArg)
 {
-    // Expects formals to be popped and wrapped.
+    if (!targetArg->is<JSFunction>())
+        return inlineNonFunctionCall(callInfo, targetArg);
+
+    JSFunction *target = &targetArg->as<JSFunction>();
     if (target->isNative())
         return inlineNativeCall(callInfo, target);
 
@@ -4701,7 +4708,7 @@ IonBuilder::inlineCallsite(ObjectVector &targets, ObjectVector &originals,
     // Inline single targets -- unless they derive from a cache, in which case
     // avoiding the cache and guarding is still faster.
     if (!propCache.get() && targets.length() == 1) {
-        JSFunction *target = &targets[0]->as<JSFunction>();
+        JSObject *target = targets[0];
         InliningDecision decision = makeInliningDecision(target, callInfo);
         switch (decision) {
           case InliningDecision_Error:
@@ -5506,14 +5513,19 @@ IonBuilder::jsop_call(uint32_t argc, bool constructing)
     bool hasClones = false;
     ObjectVector targets(alloc());
     for (uint32_t i = 0; i < originals.length(); i++) {
-        JSFunction *fun = &originals[i]->as<JSFunction>();
-        if (fun->hasScript() && fun->nonLazyScript()->shouldCloneAtCallsite()) {
-            if (JSFunction *clone = ExistingCloneFunctionAtCallsite(compartment->callsiteClones(), fun, script(), pc)) {
-                fun = clone;
-                hasClones = true;
+        JSObject *obj = originals[i];
+        if (obj->is<JSFunction>()) {
+            JSFunction *fun = &obj->as<JSFunction>();
+            if (fun->hasScript() && fun->nonLazyScript()->shouldCloneAtCallsite()) {
+                if (JSFunction *clone = ExistingCloneFunctionAtCallsite(compartment->callsiteClones(),
+                                                                        fun, script(), pc))
+                {
+                    obj = clone;
+                    hasClones = true;
+                }
             }
         }
-        if (!targets.append(fun))
+        if (!targets.append(obj))
             return false;
     }
 
@@ -5530,7 +5542,7 @@ IonBuilder::jsop_call(uint32_t argc, bool constructing)
 
     // No inline, just make the call.
     JSFunction *target = nullptr;
-    if (targets.length() == 1)
+    if (targets.length() == 1 && targets[0]->is<JSFunction>())
         target = &targets[0]->as<JSFunction>();
 
     if (target && status == InliningStatus_WarmUpCountTooLow) {
diff --git a/js/src/jit/IonBuilder.h b/js/src/jit/IonBuilder.h
index 3b66ebd7f6b..6a7fc3027d0 100644
--- a/js/src/jit/IonBuilder.h
+++ b/js/src/jit/IonBuilder.h
@@ -676,7 +676,7 @@ class IonBuilder
 
     // Oracles.
     InliningDecision canInlineTarget(JSFunction *target, CallInfo &callInfo);
-    InliningDecision makeInliningDecision(JSFunction *target, CallInfo &callInfo);
+    InliningDecision makeInliningDecision(JSObject *target, CallInfo &callInfo);
     bool selectInliningTargets(ObjectVector &targets, CallInfo &callInfo,
                                BoolVector &choiceSet, uint32_t *numInlineable);
 
@@ -746,11 +746,12 @@ class IonBuilder
     // ForkJoin intrinsics
     InliningStatus inlineForkJoinGetSlice(CallInfo &callInfo);
 
-    // TypedObject intrinsics.
+    // TypedObject intrinsics and natives.
     InliningStatus inlineObjectIsTypeDescr(CallInfo &callInfo);
     InliningStatus inlineSetTypedObjectOffset(CallInfo &callInfo);
     bool elementAccessIsTypedObjectArrayOfScalarType(MDefinition* obj, MDefinition* id,
                                                      ScalarTypeDescr::Type *arrayType);
+    InliningStatus inlineConstructTypedObject(CallInfo &callInfo, SizedTypeDescr *target);
 
     // Utility intrinsics.
     InliningStatus inlineIsCallable(CallInfo &callInfo);
@@ -777,8 +778,9 @@ class IonBuilder
     // Main inlining functions
     InliningStatus inlineNativeCall(CallInfo &callInfo, JSFunction *target);
     InliningStatus inlineNativeGetter(CallInfo &callInfo, JSFunction *target);
+    InliningStatus inlineNonFunctionCall(CallInfo &callInfo, JSObject *target);
     bool inlineScriptedCall(CallInfo &callInfo, JSFunction *target);
-    InliningStatus inlineSingleCall(CallInfo &callInfo, JSFunction *target);
+    InliningStatus inlineSingleCall(CallInfo &callInfo, JSObject *target);
 
     // Call functions
     InliningStatus inlineCallsite(ObjectVector &targets, ObjectVector &originals,
diff --git a/js/src/jit/IonMacroAssembler.cpp b/js/src/jit/IonMacroAssembler.cpp
index 879c8c40f2b..397bd044f7e 100644
--- a/js/src/jit/IonMacroAssembler.cpp
+++ b/js/src/jit/IonMacroAssembler.cpp
@@ -787,18 +787,22 @@ MacroAssembler::newGCThing(Register result, Register temp, NativeObject *templat
 }
 
 void
-MacroAssembler::createGCObject(Register obj, Register temp, NativeObject *templateObj,
+MacroAssembler::createGCObject(Register obj, Register temp, JSObject *templateObj,
                                gc::InitialHeap initialHeap, Label *fail, bool initFixedSlots)
 {
-    uint32_t nDynamicSlots = templateObj->numDynamicSlots();
     gc::AllocKind allocKind = templateObj->asTenured().getAllocKind();
     MOZ_ASSERT(allocKind >= gc::FINALIZE_OBJECT0 && allocKind <= gc::FINALIZE_OBJECT_LAST);
 
-    // Arrays with copy on write elements do not need fixed space for an
-    // elements header. The template object, which owns the original elements,
-    // might have another allocation kind.
-    if (templateObj->denseElementsAreCopyOnWrite())
-        allocKind = gc::FINALIZE_OBJECT0_BACKGROUND;
+    uint32_t nDynamicSlots = 0;
+    if (templateObj->isNative()) {
+        nDynamicSlots = templateObj->as<NativeObject>().numDynamicSlots();
+
+        // Arrays with copy on write elements do not need fixed space for an
+        // elements header. The template object, which owns the original
+        // elements, might have another allocation kind.
+        if (templateObj->as<NativeObject>().denseElementsAreCopyOnWrite())
+            allocKind = gc::FINALIZE_OBJECT0_BACKGROUND;
+    }
 
     allocateObject(obj, temp, allocKind, nDynamicSlots, initialHeap, fail);
     initGCThing(obj, temp, templateObj, initFixedSlots);
@@ -1030,54 +1034,73 @@ MacroAssembler::initGCSlots(Register obj, Register slots, NativeObject *template
 }
 
 void
-MacroAssembler::initGCThing(Register obj, Register slots, NativeObject *templateObj,
+MacroAssembler::initGCThing(Register obj, Register slots, JSObject *templateObj,
                             bool initFixedSlots)
 {
     // Fast initialization of an empty object returned by allocateObject().
 
-    MOZ_ASSERT_IF(!templateObj->denseElementsAreCopyOnWrite(), !templateObj->hasDynamicElements());
-
     storePtr(ImmGCPtr(templateObj->lastProperty()), Address(obj, JSObject::offsetOfShape()));
     storePtr(ImmGCPtr(templateObj->type()), Address(obj, JSObject::offsetOfType()));
-    if (templateObj->hasDynamicSlots())
-        storePtr(slots, Address(obj, NativeObject::offsetOfSlots()));
-    else
-        storePtr(ImmPtr(nullptr), Address(obj, NativeObject::offsetOfSlots()));
 
-    if (templateObj->denseElementsAreCopyOnWrite()) {
-        storePtr(ImmPtr((const Value *) templateObj->getDenseElements()),
-                 Address(obj, NativeObject::offsetOfElements()));
-    } else if (templateObj->is<ArrayObject>()) {
-        Register temp = slots;
-        MOZ_ASSERT(!templateObj->getDenseInitializedLength());
+    if (templateObj->isNative()) {
+        NativeObject *ntemplate = &templateObj->as<NativeObject>();
+        MOZ_ASSERT_IF(!ntemplate->denseElementsAreCopyOnWrite(), !ntemplate->hasDynamicElements());
 
-        int elementsOffset = NativeObject::offsetOfFixedElements();
+        if (ntemplate->hasDynamicSlots())
+            storePtr(slots, Address(obj, NativeObject::offsetOfSlots()));
+        else
+            storePtr(ImmPtr(nullptr), Address(obj, NativeObject::offsetOfSlots()));
 
-        computeEffectiveAddress(Address(obj, elementsOffset), temp);
-        storePtr(temp, Address(obj, NativeObject::offsetOfElements()));
+        if (ntemplate->denseElementsAreCopyOnWrite()) {
+            storePtr(ImmPtr((const Value *) ntemplate->getDenseElements()),
+                     Address(obj, NativeObject::offsetOfElements()));
+        } else if (ntemplate->is<ArrayObject>()) {
+            Register temp = slots;
+            MOZ_ASSERT(!ntemplate->getDenseInitializedLength());
 
-        // Fill in the elements header.
-        store32(Imm32(templateObj->getDenseCapacity()),
-                Address(obj, elementsOffset + ObjectElements::offsetOfCapacity()));
-        store32(Imm32(templateObj->getDenseInitializedLength()),
-                Address(obj, elementsOffset + ObjectElements::offsetOfInitializedLength()));
-        store32(Imm32(templateObj->as<ArrayObject>().length()),
-                Address(obj, elementsOffset + ObjectElements::offsetOfLength()));
-        store32(Imm32(templateObj->shouldConvertDoubleElements()
-                      ? ObjectElements::CONVERT_DOUBLE_ELEMENTS
-                      : 0),
-                Address(obj, elementsOffset + ObjectElements::offsetOfFlags()));
-        MOZ_ASSERT(!templateObj->hasPrivate());
-    } else {
-        storePtr(ImmPtr(emptyObjectElements), Address(obj, NativeObject::offsetOfElements()));
+            int elementsOffset = NativeObject::offsetOfFixedElements();
 
-        initGCSlots(obj, slots, templateObj, initFixedSlots);
+            computeEffectiveAddress(Address(obj, elementsOffset), temp);
+            storePtr(temp, Address(obj, NativeObject::offsetOfElements()));
 
-        if (templateObj->hasPrivate()) {
-            uint32_t nfixed = templateObj->numFixedSlots();
-            storePtr(ImmPtr(templateObj->getPrivate()),
-                     Address(obj, NativeObject::getPrivateDataOffset(nfixed)));
+            // Fill in the elements header.
+            store32(Imm32(ntemplate->getDenseCapacity()),
+                    Address(obj, elementsOffset + ObjectElements::offsetOfCapacity()));
+            store32(Imm32(ntemplate->getDenseInitializedLength()),
+                    Address(obj, elementsOffset + ObjectElements::offsetOfInitializedLength()));
+            store32(Imm32(ntemplate->as<ArrayObject>().length()),
+                    Address(obj, elementsOffset + ObjectElements::offsetOfLength()));
+            store32(Imm32(ntemplate->shouldConvertDoubleElements()
+                          ? ObjectElements::CONVERT_DOUBLE_ELEMENTS
+                          : 0),
+                    Address(obj, elementsOffset + ObjectElements::offsetOfFlags()));
+            MOZ_ASSERT(!ntemplate->hasPrivate());
+        } else {
+            storePtr(ImmPtr(emptyObjectElements), Address(obj, NativeObject::offsetOfElements()));
+
+            initGCSlots(obj, slots, ntemplate, initFixedSlots);
+
+            if (ntemplate->hasPrivate()) {
+                uint32_t nfixed = ntemplate->numFixedSlots();
+                storePtr(ImmPtr(ntemplate->getPrivate()),
+                         Address(obj, NativeObject::getPrivateDataOffset(nfixed)));
+            }
         }
+    } else if (templateObj->is<InlineTypedObject>()) {
+        InlineTypedObject *ntemplate = &templateObj->as<InlineTypedObject>();
+
+        // Memcpy the contents of the template object to the new object.
+        size_t nbytes = ntemplate->size();
+        size_t offset = 0;
+        while (nbytes) {
+            uintptr_t value = *(uintptr_t *)(ntemplate->inlineTypedMem() + offset);
+            storePtr(ImmWord(value),
+                     Address(obj, InlineTypedObject::offsetOfDataStart() + offset));
+            nbytes = (nbytes < sizeof(uintptr_t)) ? 0 : nbytes - sizeof(uintptr_t);
+            offset += sizeof(uintptr_t);
+        }
+    } else {
+        MOZ_CRASH("Unknown object");
     }
 
 #ifdef JS_GC_TRACE
diff --git a/js/src/jit/IonMacroAssembler.h b/js/src/jit/IonMacroAssembler.h
index c1aa469a4f8..a303a814fd9 100644
--- a/js/src/jit/IonMacroAssembler.h
+++ b/js/src/jit/IonMacroAssembler.h
@@ -816,12 +816,12 @@ class MacroAssembler : public MacroAssemblerSpecific
   public:
     void callMallocStub(size_t nbytes, Register result, Label *fail);
     void callFreeStub(Register slots);
-    void createGCObject(Register result, Register temp, NativeObject *templateObj,
+    void createGCObject(Register result, Register temp, JSObject *templateObj,
                         gc::InitialHeap initialHeap, Label *fail, bool initFixedSlots = true);
 
     void newGCThing(Register result, Register temp, NativeObject *templateObj,
                      gc::InitialHeap initialHeap, Label *fail);
-    void initGCThing(Register obj, Register temp, NativeObject *templateObj,
+    void initGCThing(Register obj, Register temp, JSObject *templateObj,
                      bool initFixedSlots = true);
 
     void newGCString(Register result, Register temp, Label *fail);
diff --git a/js/src/jit/LIR-Common.h b/js/src/jit/LIR-Common.h
index 34ac5a5a1ca..686b1f792d6 100644
--- a/js/src/jit/LIR-Common.h
+++ b/js/src/jit/LIR-Common.h
@@ -730,6 +730,24 @@ class LNewObject : public LInstructionHelper<1, 0, 1>
     }
 };
 
+class LNewTypedObject : public LInstructionHelper<1, 0, 1>
+{
+  public:
+    LIR_HEADER(NewTypedObject)
+
+    explicit LNewTypedObject(const LDefinition &temp) {
+        setTemp(0, temp);
+    }
+
+    const LDefinition *temp() {
+        return getTemp(0);
+    }
+
+    MNewTypedObject *mir() const {
+        return mir_->toNewTypedObject();
+    }
+};
+
 class LNewPar : public LInstructionHelper<1, 1, 2>
 {
   public:
diff --git a/js/src/jit/LOpcodes.h b/js/src/jit/LOpcodes.h
index 5285616b66c..c93166cf408 100644
--- a/js/src/jit/LOpcodes.h
+++ b/js/src/jit/LOpcodes.h
@@ -48,6 +48,7 @@
     _(NewArrayCopyOnWrite)          \
     _(ArraySplice)                  \
     _(NewObject)                    \
+    _(NewTypedObject)               \
     _(NewDeclEnvObject)             \
     _(NewCallObject)                \
     _(NewSingletonCallObject)       \
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index 2e1c807332b..8a21c7cc263 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -175,6 +175,13 @@ LIRGenerator::visitNewObject(MNewObject *ins)
     return define(lir, ins) && assignSafepoint(lir, ins);
 }
 
+bool
+LIRGenerator::visitNewTypedObject(MNewTypedObject *ins)
+{
+    LNewTypedObject *lir = new(alloc()) LNewTypedObject(temp());
+    return define(lir, ins) && assignSafepoint(lir, ins);
+}
+
 bool
 LIRGenerator::visitNewDeclEnvObject(MNewDeclEnvObject *ins)
 {
diff --git a/js/src/jit/Lowering.h b/js/src/jit/Lowering.h
index ca8523a0091..5b9620d230f 100644
--- a/js/src/jit/Lowering.h
+++ b/js/src/jit/Lowering.h
@@ -73,6 +73,7 @@ class LIRGenerator : public LIRGeneratorSpecific
     bool visitNewArray(MNewArray *ins);
     bool visitNewArrayCopyOnWrite(MNewArrayCopyOnWrite *ins);
     bool visitNewObject(MNewObject *ins);
+    bool visitNewTypedObject(MNewTypedObject *ins);
     bool visitNewDeclEnvObject(MNewDeclEnvObject *ins);
     bool visitNewCallObject(MNewCallObject *ins);
     bool visitNewRunOnceCallObject(MNewRunOnceCallObject *ins);
diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp
index e3b9ff54c59..68bd67004b1 100644
--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -280,6 +280,18 @@ IonBuilder::inlineNativeGetter(CallInfo &callInfo, JSFunction *target)
     return InliningStatus_NotInlined;
 }
 
+IonBuilder::InliningStatus
+IonBuilder::inlineNonFunctionCall(CallInfo &callInfo, JSObject *target)
+{
+    // Inline a call to a non-function object, invoking the object's call or
+    // construct hook.
+
+    if (callInfo.constructing() && target->constructHook() == TypedObject::constructSized)
+        return inlineConstructTypedObject(callInfo, &target->as<SizedTypeDescr>());
+
+    return InliningStatus_NotInlined;
+}
+
 types::TemporaryTypeSet *
 IonBuilder::getInlineReturnTypeSet()
 {
@@ -2506,5 +2518,33 @@ IonBuilder::inlineIsConstructing(CallInfo &callInfo)
     return InliningStatus_Inlined;
 }
 
+IonBuilder::InliningStatus
+IonBuilder::inlineConstructTypedObject(CallInfo &callInfo, SizedTypeDescr *descr)
+{
+    // Only inline default constructors for now.
+    if (callInfo.argc() != 0)
+        return InliningStatus_NotInlined;
+
+    if (size_t(descr->size()) > InlineTypedObject::MaximumSize)
+        return InliningStatus_NotInlined;
+
+    JSObject *obj = inspector->getTemplateObjectForClassHook(pc, descr->getClass());
+    if (!obj || !obj->is<InlineTypedObject>())
+        return InliningStatus_NotInlined;
+
+    InlineTypedObject *templateObject = &obj->as<InlineTypedObject>();
+    if (&templateObject->typeDescr() != descr)
+        return InliningStatus_NotInlined;
+
+    callInfo.setImplicitlyUsedUnchecked();
+
+    MNewTypedObject *ins = MNewTypedObject::New(alloc(), constraints(), templateObject,
+                                                templateObject->type()->initialHeap(constraints()));
+    current->add(ins);
+    current->push(ins);
+
+    return InliningStatus_Inlined;
+}
+
 } // namespace jit
 } // namespace js
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index cade1c27621..16b3ddd6c36 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -2736,6 +2736,45 @@ class MNewPar : public MUnaryInstruction
     }
 };
 
+class MNewTypedObject : public MNullaryInstruction
+{
+    AlwaysTenured<InlineTypedObject *> templateObject_;
+    gc::InitialHeap initialHeap_;
+
+    MNewTypedObject(types::CompilerConstraintList *constraints,
+                    InlineTypedObject *templateObject,
+                    gc::InitialHeap initialHeap)
+      : templateObject_(templateObject),
+        initialHeap_(initialHeap)
+    {
+        setResultType(MIRType_Object);
+        setResultTypeSet(MakeSingletonTypeSet(constraints, templateObject));
+    }
+
+  public:
+    INSTRUCTION_HEADER(NewTypedObject)
+
+    static MNewTypedObject *New(TempAllocator &alloc,
+                                types::CompilerConstraintList *constraints,
+                                InlineTypedObject *templateObject,
+                                gc::InitialHeap initialHeap)
+    {
+        return new(alloc) MNewTypedObject(constraints, templateObject, initialHeap);
+    }
+
+    InlineTypedObject *templateObject() const {
+        return templateObject_;
+    }
+
+    gc::InitialHeap initialHeap() const {
+        return initialHeap_;
+    }
+
+    virtual AliasSet getAliasSet() const {
+        return AliasSet::None();
+    }
+};
+
 class MTypedObjectProto
   : public MUnaryInstruction,
     public SingleObjectPolicy::Data
diff --git a/js/src/jit/MOpcodes.h b/js/src/jit/MOpcodes.h
index e62645939f4..5a8dcb17348 100644
--- a/js/src/jit/MOpcodes.h
+++ b/js/src/jit/MOpcodes.h
@@ -110,6 +110,7 @@ namespace jit {
     _(NewArray)                                                             \
     _(NewArrayCopyOnWrite)                                                  \
     _(NewObject)                                                            \
+    _(NewTypedObject)                                                       \
     _(NewDeclEnvObject)                                                     \
     _(NewCallObject)                                                        \
     _(NewRunOnceCallObject)                                                 \
diff --git a/js/src/jit/ParallelSafetyAnalysis.cpp b/js/src/jit/ParallelSafetyAnalysis.cpp
index dab075fccd8..f4cb82d21e3 100644
--- a/js/src/jit/ParallelSafetyAnalysis.cpp
+++ b/js/src/jit/ParallelSafetyAnalysis.cpp
@@ -202,6 +202,7 @@ class ParallelSafetyVisitor : public MDefinitionVisitor
     CUSTOM_OP(ToString)
     CUSTOM_OP(NewArray)
     UNSAFE_OP(NewArrayCopyOnWrite)
+    UNSAFE_OP(NewTypedObject)
     CUSTOM_OP(NewObject)
     CUSTOM_OP(NewCallObject)
     CUSTOM_OP(NewRunOnceCallObject)
diff --git a/js/src/jit/VMFunctions.h b/js/src/jit/VMFunctions.h
index e2700046bbd..5ed78b34c1d 100644
--- a/js/src/jit/VMFunctions.h
+++ b/js/src/jit/VMFunctions.h
@@ -17,6 +17,7 @@ namespace js {
 class DeclEnvObject;
 class ForkJoinContext;
 class StaticWithObject;
+class InlineTypedObject;
 
 namespace jit {
 
@@ -289,6 +290,7 @@ template <class> struct TypeToDataType { /* Unexpected return type for a VMFunct
 template <> struct TypeToDataType<bool> { static const DataType result = Type_Bool; };
 template <> struct TypeToDataType<JSObject *> { static const DataType result = Type_Object; };
 template <> struct TypeToDataType<NativeObject *> { static const DataType result = Type_Object; };
+template <> struct TypeToDataType<InlineTypedObject *> { static const DataType result = Type_Object; };
 template <> struct TypeToDataType<DeclEnvObject *> { static const DataType result = Type_Object; };
 template <> struct TypeToDataType<ArrayObject *> { static const DataType result = Type_Object; };
 template <> struct TypeToDataType<JSString *> { static const DataType result = Type_Object; };
@@ -298,6 +300,7 @@ template <> struct TypeToDataType<HandleString> { static const DataType result =
 template <> struct TypeToDataType<HandlePropertyName> { static const DataType result = Type_Handle; };
 template <> struct TypeToDataType<HandleFunction> { static const DataType result = Type_Handle; };
 template <> struct TypeToDataType<Handle<NativeObject *> > { static const DataType result = Type_Handle; };
+template <> struct TypeToDataType<Handle<InlineTypedObject *> > { static const DataType result = Type_Handle; };
 template <> struct TypeToDataType<Handle<ArrayObject *> > { static const DataType result = Type_Handle; };
 template <> struct TypeToDataType<Handle<StaticWithObject *> > { static const DataType result = Type_Handle; };
 template <> struct TypeToDataType<Handle<StaticBlockObject *> > { static const DataType result = Type_Handle; };
@@ -328,6 +331,9 @@ template <> struct TypeToArgProperties<HandleFunction> {
 template <> struct TypeToArgProperties<Handle<NativeObject *> > {
     static const uint32_t result = TypeToArgProperties<NativeObject *>::result | VMFunction::ByRef;
 };
+template <> struct TypeToArgProperties<Handle<InlineTypedObject *> > {
+    static const uint32_t result = TypeToArgProperties<InlineTypedObject *>::result | VMFunction::ByRef;
+};
 template <> struct TypeToArgProperties<Handle<ArrayObject *> > {
     static const uint32_t result = TypeToArgProperties<ArrayObject *>::result | VMFunction::ByRef;
 };
@@ -396,6 +402,9 @@ template <> struct TypeToRootType<HandleScript> {
 template <> struct TypeToRootType<Handle<NativeObject *> > {
     static const uint32_t result = VMFunction::RootObject;
 };
+template <> struct TypeToRootType<Handle<InlineTypedObject *> > {
+    static const uint32_t result = VMFunction::RootObject;
+};
 template <> struct TypeToRootType<Handle<ArrayObject *> > {
     static const uint32_t result = VMFunction::RootObject;
 };

From dfaece64aca2b1f423a1f69511eb754e2316c5aa Mon Sep 17 00:00:00 2001
From: Hannes Verschore <hv1989@gmail.com>
Date: Tue, 4 Nov 2014 23:31:28 +0100
Subject: [PATCH 022/153] Bug 1052839 - Selfhost substr/slice/substring,
 r=waldo,till,jonco

---
 js/src/builtin/String.js              | 120 +++++++++++++++
 js/src/builtin/Utilities.js           |   1 +
 js/src/jit/CodeGenerator.cpp          | 104 +++++++++++++
 js/src/jit/CodeGenerator.h            |   1 +
 js/src/jit/IonBuilder.h               |   1 +
 js/src/jit/LIR-Common.h               |  30 ++++
 js/src/jit/LOpcodes.h                 |   1 +
 js/src/jit/Lowering.cpp               |  10 ++
 js/src/jit/Lowering.h                 |   1 +
 js/src/jit/MCallOptimize.cpp          |  34 +++++
 js/src/jit/MIR.h                      |  41 +++++
 js/src/jit/MOpcodes.h                 |   1 +
 js/src/jit/ParallelSafetyAnalysis.cpp |   1 +
 js/src/jscntxt.h                      |   1 +
 js/src/jsstr.cpp                      | 211 +++-----------------------
 js/src/jsstr.h                        |  11 +-
 js/src/vm/SelfHosting.cpp             |  22 ++-
 js/src/vm/String.h                    |   3 +
 18 files changed, 402 insertions(+), 192 deletions(-)

diff --git a/js/src/builtin/String.js b/js/src/builtin/String.js
index 577be1132b7..c8fa7bbc796 100644
--- a/js/src/builtin/String.js
+++ b/js/src/builtin/String.js
@@ -4,6 +4,126 @@
 
 /*global intl_Collator: false, */
 
+/* ES6 Draft Oct 14, 2014 21.1.3.19 */
+function String_substring(start, end) {
+    // Steps 1-3.
+    CheckObjectCoercible(this);
+    var str = ToString(this);
+
+    // Step 4.
+    var len = str.length;
+
+    // Step 5.
+    var intStart = ToInteger(start);
+
+    // Step 6.
+    var intEnd = (end === undefined) ? len : ToInteger(end);
+
+    // Step 7.
+    var finalStart = std_Math_min(std_Math_max(intStart, 0), len);
+
+    // Step 8.
+    var finalEnd = std_Math_min(std_Math_max(intEnd, 0), len);
+
+    // Steps 9-10.
+    var from, to;
+    if (finalStart < finalEnd) {
+        from = finalStart;
+        to = finalEnd;
+    } else {
+        from = finalEnd;
+        to = finalStart;
+    }
+
+    // Step 11.
+    // While |from| and |to - from| are bounded to the length of |str| and this
+    // and thus definitely in the int32 range, they can still be typed as
+    // double. Eagerly truncate since SubstringKernel only accepts int32.
+    return SubstringKernel(str, from | 0, (to - from) | 0);
+}
+
+function String_static_substring(string, start, end) {
+    if (arguments.length < 1)
+        ThrowError(JSMSG_MISSING_FUN_ARG, 0, 'String.substring');
+    return callFunction(String_substring, string, start, end);
+}
+
+/* ES6 Draft Oct 14, 2014 B.2.3.1 */
+function String_substr(start, length) {
+    // Steps 1-2.
+    CheckObjectCoercible(this);
+    var str = ToString(this);
+
+    // Steps 3-4.
+    var intStart = ToInteger(start);
+
+    // Steps 5-7.
+    var size = str.length;
+    // Use |size| instead of +Infinity to avoid performing calculations with
+    // doubles. (The result is the same either way.)
+    var end = (length === undefined) ? size : ToInteger(length);
+
+    // Step 8.
+    if (intStart < 0)
+        intStart = std_Math_max(intStart + size, 0);
+
+    // Step 9.
+    var resultLength = std_Math_min(std_Math_max(end, 0), size - intStart)
+
+    // Step 10.
+    if (resultLength <= 0)
+        return "";
+
+    // Step 11.
+    // While |intStart| and |resultLength| are bounded to the length of |str|
+    // and thus definitely in the int32 range, they can still be typed as
+    // double. Eagerly truncate since SubstringKernel only accepts int32.
+    return SubstringKernel(str, intStart | 0, resultLength | 0);
+}
+
+function String_static_substr(string, start, length) {
+    if (arguments.length < 1)
+        ThrowError(JSMSG_MISSING_FUN_ARG, 0, 'String.substr');
+    return callFunction(String_substr, string, start, length);
+}
+
+/* ES6 Draft Oct 14, 2014 21.1.3.16 */
+function String_slice(start, end) {
+    // Steps 1-3.
+    CheckObjectCoercible(this);
+    var str = ToString(this);
+
+    // Step 4.
+    var len = str.length;
+
+    // Step 5.
+    var intStart = ToInteger(start);
+
+    // Step 6.
+    var intEnd = (end === undefined) ? len : ToInteger(end);
+
+    // Step 7.
+    var from = (intStart < 0) ? std_Math_max(len + intStart, 0) : std_Math_min(intStart, len);
+
+    // Step 8.
+    var to = (intEnd < 0) ? std_Math_max(len + intEnd, 0) : std_Math_min(intEnd, len);
+
+    // Step 9.
+    var span = std_Math_max(to - from, 0);
+
+    // Step 10.
+    // While |from| and |span| are bounded to the length of |str|
+    // and thus definitely in the int32 range, they can still be typed as
+    // double. Eagerly truncate since SubstringKernel only accepts int32.
+    return SubstringKernel(str, from | 0, span | 0);
+}
+
+function String_static_slice(string, start, end) {
+    if (arguments.length < 1)
+        ThrowError(JSMSG_MISSING_FUN_ARG, 0, 'String.slice');
+    return callFunction(String_slice, string, start, end);
+}
+
 /* ES6 Draft September 5, 2013 21.1.3.3 */
 function String_codePointAt(pos) {
     // Steps 1-3.
diff --git a/js/src/builtin/Utilities.js b/js/src/builtin/Utilities.js
index 8425c12801e..bd1c36ace1d 100644
--- a/js/src/builtin/Utilities.js
+++ b/js/src/builtin/Utilities.js
@@ -32,6 +32,7 @@
 // The few items below here are either self-hosted or installing them under a
 // std_Foo name would require ugly contortions, so they just get aliased here.
 var std_Array_indexOf = ArrayIndexOf;
+var std_String_substring = String_substring;
 // WeakMap is a bare constructor without properties or methods.
 var std_WeakMap = WeakMap;
 // StopIteration is a bare constructor without properties or methods.
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index 88c72fb731f..13f076f0e11 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -5968,6 +5968,110 @@ ConcatFatInlineString(MacroAssembler &masm, Register lhs, Register rhs, Register
     masm.ret();
 }
 
+typedef JSString *(*SubstringKernelFn)(JSContext *cx, HandleString str, int32_t begin, int32_t len);
+static const VMFunction SubstringKernelInfo =
+    FunctionInfo<SubstringKernelFn>(SubstringKernel);
+
+bool CodeGenerator::visitSubstr(LSubstr *lir)
+{
+    Register string = ToRegister(lir->string());
+    Register begin = ToRegister(lir->begin());
+    Register length = ToRegister(lir->length());
+    Register output = ToRegister(lir->output());
+    Register temp = ToRegister(lir->temp());
+    Address stringFlags(string, JSString::offsetOfFlags());
+
+    Label isLatin1, notInline, nonZero, isInlinedLatin1;
+
+    // For every edge case use the C++ variant.
+    // Note: we also use this upon allocation failure in newGCString and
+    // newGCFatInlineString. To squeeze out even more performance those failures
+    // can be handled by allocate in ool code and returning to jit code to fill
+    // in all data.
+    OutOfLineCode *ool = oolCallVM(SubstringKernelInfo, lir,
+                                   (ArgList(), string, begin, length),
+                                    StoreRegisterTo(output));
+    if (!ool)
+        return false;
+    Label *slowPath = ool->entry();
+    Label *done = ool->rejoin();
+
+    // Zero length, return emptystring.
+    masm.branchTest32(Assembler::NonZero, length, length, &nonZero);
+    const JSAtomState &names = GetIonContext()->runtime->names();
+    masm.movePtr(ImmGCPtr(names.empty), output);
+    masm.jump(done);
+
+    // Use slow path for ropes.
+    masm.bind(&nonZero);
+    static_assert(JSString::ROPE_FLAGS == 0,
+                  "rope flags must be zero for (flags & TYPE_FLAGS_MASK) == 0 "
+                  "to be a valid is-rope check");
+    masm.branchTest32(Assembler::Zero, stringFlags, Imm32(JSString::TYPE_FLAGS_MASK), slowPath);
+
+    // Handle inlined strings by creating a FatInlineString.
+    masm.branchTest32(Assembler::Zero, stringFlags, Imm32(JSString::INLINE_CHARS_BIT), &notInline);
+    masm.newGCFatInlineString(output, temp, slowPath);
+    masm.store32(length, Address(output, JSString::offsetOfLength()));
+    Address stringStorage(string, JSInlineString::offsetOfInlineStorage());
+    Address outputStorage(output, JSInlineString::offsetOfInlineStorage());
+
+    masm.branchTest32(Assembler::NonZero, stringFlags, Imm32(JSString::LATIN1_CHARS_BIT),
+                      &isInlinedLatin1);
+    {
+        masm.store32(Imm32(JSString::INIT_FAT_INLINE_FLAGS),
+                     Address(output, JSString::offsetOfFlags()));
+        masm.computeEffectiveAddress(stringStorage, temp);
+        BaseIndex chars(temp, begin, ScaleFromElemWidth(sizeof(char16_t)));
+        masm.computeEffectiveAddress(chars, begin);
+        masm.computeEffectiveAddress(outputStorage, temp);
+        CopyStringChars(masm, temp, begin, length, string, sizeof(char16_t), sizeof(char16_t));
+        masm.store16(Imm32(0), Address(temp, 0));
+        masm.jump(done);
+    }
+    masm.bind(&isInlinedLatin1);
+    {
+        masm.store32(Imm32(JSString::INIT_FAT_INLINE_FLAGS | JSString::LATIN1_CHARS_BIT),
+                     Address(output, JSString::offsetOfFlags()));
+        masm.computeEffectiveAddress(stringStorage, temp);
+        static_assert(sizeof(char) == 1, "begin index shouldn't need scaling");
+        masm.addPtr(temp, begin);
+        masm.computeEffectiveAddress(outputStorage, temp);
+        CopyStringChars(masm, temp, begin, length, string, sizeof(char), sizeof(char));
+        masm.store8(Imm32(0), Address(temp, 0));
+        masm.jump(done);
+    }
+
+    // Handle other cases with a DependentString.
+    masm.bind(&notInline);
+    masm.newGCString(output, temp, slowPath);
+    masm.store32(length, Address(output, JSString::offsetOfLength()));
+    masm.storePtr(string, Address(output, JSDependentString::offsetOfBase()));
+
+    masm.branchTest32(Assembler::NonZero, stringFlags, Imm32(JSString::LATIN1_CHARS_BIT), &isLatin1);
+    {
+        masm.store32(Imm32(JSString::DEPENDENT_FLAGS), Address(output, JSString::offsetOfFlags()));
+        masm.loadPtr(Address(string, JSString::offsetOfNonInlineChars()), temp);
+        BaseIndex chars(temp, begin, ScaleFromElemWidth(sizeof(char16_t)));
+        masm.computeEffectiveAddress(chars, temp);
+        masm.storePtr(temp, Address(output, JSString::offsetOfNonInlineChars()));
+        masm.jump(done);
+    }
+    masm.bind(&isLatin1);
+    {
+        masm.store32(Imm32(JSString::DEPENDENT_FLAGS | JSString::LATIN1_CHARS_BIT),
+                     Address(output, JSString::offsetOfFlags()));
+        masm.loadPtr(Address(string, JSString::offsetOfNonInlineChars()), temp);
+        static_assert(sizeof(char) == 1, "begin index shouldn't need scaling");
+        masm.addPtr(begin, temp);
+        masm.storePtr(temp, Address(output, JSString::offsetOfNonInlineChars()));
+        masm.jump(done);
+    }
+
+    masm.bind(done);
+    return true;
+}
+
 JitCode *
 JitCompartment::generateStringConcatStub(JSContext *cx, ExecutionMode mode)
 {
diff --git a/js/src/jit/CodeGenerator.h b/js/src/jit/CodeGenerator.h
index 4e24d799c61..ce3db386734 100644
--- a/js/src/jit/CodeGenerator.h
+++ b/js/src/jit/CodeGenerator.h
@@ -187,6 +187,7 @@ class CodeGenerator : public CodeGeneratorSpecific
     bool visitTypedObjectProto(LTypedObjectProto *ins);
     bool visitTypedObjectUnsizedLength(LTypedObjectUnsizedLength *ins);
     bool visitStringLength(LStringLength *lir);
+    bool visitSubstr(LSubstr *lir);
     bool visitInitializedLength(LInitializedLength *lir);
     bool visitSetInitializedLength(LSetInitializedLength *lir);
     bool visitNotO(LNotO *ins);
diff --git a/js/src/jit/IonBuilder.h b/js/src/jit/IonBuilder.h
index 6a7fc3027d0..277e780b8db 100644
--- a/js/src/jit/IonBuilder.h
+++ b/js/src/jit/IonBuilder.h
@@ -766,6 +766,7 @@ class IonBuilder
                                   const Class *clasp3 = nullptr,
                                   const Class *clasp4 = nullptr);
     InliningStatus inlineIsConstructing(CallInfo &callInfo);
+    InliningStatus inlineSubstringKernel(CallInfo &callInfo);
 
     // Testing functions.
     InliningStatus inlineForceSequentialOrInParallelSection(CallInfo &callInfo);
diff --git a/js/src/jit/LIR-Common.h b/js/src/jit/LIR-Common.h
index 686b1f792d6..10bf998cfdc 100644
--- a/js/src/jit/LIR-Common.h
+++ b/js/src/jit/LIR-Common.h
@@ -3410,6 +3410,36 @@ class LStringSplit : public LCallInstructionHelper<1, 2, 0>
     }
 };
 
+class LSubstr : public LInstructionHelper<1, 3, 1>
+{
+  public:
+    LIR_HEADER(Substr)
+
+    LSubstr(const LAllocation &string, const LAllocation &begin, const LAllocation &length,
+            const LDefinition &temp)
+    {
+        setOperand(0, string);
+        setOperand(1, begin);
+        setOperand(2, length);
+        setTemp(0, temp);
+    }
+    const LAllocation *string() {
+        return getOperand(0);
+    }
+    const LAllocation *begin() {
+        return getOperand(1);
+    }
+    const LAllocation *length() {
+        return getOperand(2);
+    }
+    const LDefinition *temp() {
+        return getTemp(0);
+    }
+    const MStringSplit *mir() const {
+        return mir_->toStringSplit();
+    }
+};
+
 // Convert a 32-bit integer to a double.
 class LInt32ToDouble : public LInstructionHelper<1, 1, 0>
 {
diff --git a/js/src/jit/LOpcodes.h b/js/src/jit/LOpcodes.h
index c93166cf408..34ce62630ea 100644
--- a/js/src/jit/LOpcodes.h
+++ b/js/src/jit/LOpcodes.h
@@ -186,6 +186,7 @@
     _(RegExpTest)                   \
     _(RegExpReplace)                \
     _(StringReplace)                \
+    _(Substr)                       \
     _(Lambda)                       \
     _(LambdaArrow)                  \
     _(LambdaForSingleton)           \
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index 8a21c7cc263..9c5fa6d7b1e 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -2160,6 +2160,16 @@ LIRGenerator::visitStringReplace(MStringReplace *ins)
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 
+bool
+LIRGenerator::visitSubstr(MSubstr *ins)
+{
+    LSubstr *lir = new (alloc()) LSubstr(useFixed(ins->string(), CallTempReg1),
+                                         useRegister(ins->begin()),
+                                         useRegister(ins->length()),
+                                         temp());
+    return define(lir, ins) && assignSafepoint(lir, ins);
+}
+
 bool
 LIRGenerator::visitLambda(MLambda *ins)
 {
diff --git a/js/src/jit/Lowering.h b/js/src/jit/Lowering.h
index 5b9620d230f..dd3667210e8 100644
--- a/js/src/jit/Lowering.h
+++ b/js/src/jit/Lowering.h
@@ -145,6 +145,7 @@ class LIRGenerator : public LIRGeneratorSpecific
     bool visitCharCodeAt(MCharCodeAt *ins);
     bool visitFromCharCode(MFromCharCode *ins);
     bool visitStringSplit(MStringSplit *ins);
+    bool visitSubstr(MSubstr *ins);
     bool visitStart(MStart *start);
     bool visitOsrEntry(MOsrEntry *entry);
     bool visitNop(MNop *nop);
diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp
index 68bd67004b1..10064610fe4 100644
--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -197,6 +197,8 @@ IonBuilder::inlineNativeCall(CallInfo &callInfo, JSFunction *target)
         return inlineToString(callInfo);
     if (native == intrinsic_IsConstructing)
         return inlineIsConstructing(callInfo);
+    if (native == intrinsic_SubstringKernel)
+        return inlineSubstringKernel(callInfo);
 
     // TypedObject intrinsics.
     if (native == intrinsic_ObjectIsTypedObject)
@@ -1550,6 +1552,38 @@ IonBuilder::inlineStrReplace(CallInfo &callInfo)
     return InliningStatus_Inlined;
 }
 
+IonBuilder::InliningStatus
+IonBuilder::inlineSubstringKernel(CallInfo &callInfo)
+{
+    MOZ_ASSERT(callInfo.argc() == 3);
+    MOZ_ASSERT(!callInfo.constructing());
+
+    // Return: String.
+    if (getInlineReturnType() != MIRType_String)
+        return InliningStatus_NotInlined;
+
+    // Arg 0: String.
+    if (callInfo.getArg(0)->type() != MIRType_String)
+        return InliningStatus_NotInlined;
+
+    // Arg 1: Int.
+    if (callInfo.getArg(1)->type() != MIRType_Int32)
+        return InliningStatus_NotInlined;
+
+    // Arg 2: Int.
+    if (callInfo.getArg(2)->type() != MIRType_Int32)
+        return InliningStatus_NotInlined;
+
+    callInfo.setImplicitlyUsedUnchecked();
+
+    MSubstr *substr = MSubstr::New(alloc(), callInfo.getArg(0), callInfo.getArg(1),
+                                            callInfo.getArg(2));
+    current->add(substr);
+    current->push(substr);
+
+    return InliningStatus_Inlined;
+}
+
 IonBuilder::InliningStatus
 IonBuilder::inlineUnsafePutElements(CallInfo &callInfo)
 {
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index 16b3ddd6c36..e19cce4249c 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -6893,6 +6893,47 @@ class MStringReplace
     }
 };
 
+class MSubstr
+  : public MTernaryInstruction,
+    public Mix3Policy<StringPolicy<0>, IntPolicy<1>, IntPolicy<2>>
+{
+  private:
+
+    MSubstr(MDefinition *string, MDefinition *begin, MDefinition *length)
+      : MTernaryInstruction(string, begin, length)
+    {
+        setResultType(MIRType_String);
+    }
+
+  public:
+    INSTRUCTION_HEADER(Substr);
+
+    static MSubstr *New(TempAllocator &alloc, MDefinition *string, MDefinition *begin,
+                        MDefinition *length)
+    {
+        return new(alloc) MSubstr(string, begin, length);
+    }
+
+    MDefinition *string() {
+        return getOperand(0);
+    }
+
+    MDefinition *begin() {
+        return getOperand(1);
+    }
+
+    MDefinition *length() {
+        return getOperand(2);
+    }
+
+    bool congruentTo(const MDefinition *ins) const {
+        return congruentIfOperandsEqual(ins);
+    }
+    AliasSet getAliasSet() const {
+        return AliasSet::None();
+    }
+};
+
 struct LambdaFunctionInfo
 {
     // The functions used in lambdas are the canonical original function in
diff --git a/js/src/jit/MOpcodes.h b/js/src/jit/MOpcodes.h
index 5a8dcb17348..3d5ea4cad87 100644
--- a/js/src/jit/MOpcodes.h
+++ b/js/src/jit/MOpcodes.h
@@ -95,6 +95,7 @@ namespace jit {
     _(CharCodeAt)                                                           \
     _(FromCharCode)                                                         \
     _(StringSplit)                                                          \
+    _(Substr)                                                               \
     _(Return)                                                               \
     _(Throw)                                                                \
     _(Box)                                                                  \
diff --git a/js/src/jit/ParallelSafetyAnalysis.cpp b/js/src/jit/ParallelSafetyAnalysis.cpp
index f4cb82d21e3..96d335dbb35 100644
--- a/js/src/jit/ParallelSafetyAnalysis.cpp
+++ b/js/src/jit/ParallelSafetyAnalysis.cpp
@@ -321,6 +321,7 @@ class ParallelSafetyVisitor : public MDefinitionVisitor
     UNSAFE_OP(CallInstanceOf)
     UNSAFE_OP(ProfilerStackOp)
     UNSAFE_OP(GuardString)
+    UNSAFE_OP(Substr)
     UNSAFE_OP(NewDeclEnvObject)
     UNSAFE_OP(In)
     UNSAFE_OP(InArray)
diff --git a/js/src/jscntxt.h b/js/src/jscntxt.h
index 91e1dd45f4b..eb47e1df753 100644
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -977,6 +977,7 @@ bool intrinsic_IsCallable(JSContext *cx, unsigned argc, Value *vp);
 bool intrinsic_ThrowError(JSContext *cx, unsigned argc, Value *vp);
 bool intrinsic_NewDenseArray(JSContext *cx, unsigned argc, Value *vp);
 bool intrinsic_IsConstructing(JSContext *cx, unsigned argc, Value *vp);
+bool intrinsic_SubstringKernel(JSContext *cx, unsigned argc, Value *vp);
 
 bool intrinsic_UnsafePutElements(JSContext *cx, unsigned argc, Value *vp);
 bool intrinsic_DefineDataProperty(JSContext *cx, unsigned argc, Value *vp);
diff --git a/js/src/jsstr.cpp b/js/src/jsstr.cpp
index c74f06e6a0a..e16bc251d85 100644
--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -575,9 +575,17 @@ ValueToIntegerRange(JSContext *cx, HandleValue v, int32_t *out)
     return true;
 }
 
-static JSString *
-DoSubstr(JSContext *cx, JSString *str, size_t begin, size_t len)
+JSString *
+js::SubstringKernel(JSContext *cx, HandleString str, int32_t beginInt, int32_t lengthInt)
 {
+    MOZ_ASSERT(0 <= beginInt);
+    MOZ_ASSERT(0 <= lengthInt);
+    MOZ_ASSERT(beginInt <= str->length());
+    MOZ_ASSERT(lengthInt <= str->length() - beginInt);
+
+    uint32_t begin = beginInt;
+    uint32_t len = lengthInt;
+
     /*
      * Optimization for one level deep ropes.
      * This is common for the following pattern:
@@ -591,16 +599,13 @@ DoSubstr(JSContext *cx, JSString *str, size_t begin, size_t len)
         JSRope *rope = &str->asRope();
 
         /* Substring is totally in leftChild of rope. */
-        if (begin + len <= rope->leftChild()->length()) {
-            str = rope->leftChild();
-            return NewDependentString(cx, str, begin, len);
-        }
+        if (begin + len <= rope->leftChild()->length())
+            return NewDependentString(cx, rope->leftChild(), begin, len);
 
         /* Substring is totally in rightChild of rope. */
         if (begin >= rope->leftChild()->length()) {
-            str = rope->rightChild();
             begin -= rope->leftChild()->length();
-            return NewDependentString(cx, str, begin, len);
+            return NewDependentString(cx, rope->rightChild(), begin, len);
         }
 
         /*
@@ -628,65 +633,6 @@ DoSubstr(JSContext *cx, JSString *str, size_t begin, size_t len)
     return NewDependentString(cx, str, begin, len);
 }
 
-bool
-js::str_substring(JSContext *cx, unsigned argc, Value *vp)
-{
-    CallArgs args = CallArgsFromVp(argc, vp);
-
-    JSString *str = ThisToStringForStringProto(cx, args);
-    if (!str)
-        return false;
-
-    int32_t length, begin, end;
-    if (args.length() > 0) {
-        end = length = int32_t(str->length());
-
-        if (args[0].isInt32()) {
-            begin = args[0].toInt32();
-        } else {
-            RootedString strRoot(cx, str);
-            if (!ValueToIntegerRange(cx, args[0], &begin))
-                return false;
-            str = strRoot;
-        }
-
-        if (begin < 0)
-            begin = 0;
-        else if (begin > length)
-            begin = length;
-
-        if (args.hasDefined(1)) {
-            if (args[1].isInt32()) {
-                end = args[1].toInt32();
-            } else {
-                RootedString strRoot(cx, str);
-                if (!ValueToIntegerRange(cx, args[1], &end))
-                    return false;
-                str = strRoot;
-            }
-
-            if (end > length) {
-                end = length;
-            } else {
-                if (end < 0)
-                    end = 0;
-                if (end < begin) {
-                    int32_t tmp = begin;
-                    begin = end;
-                    end = tmp;
-                }
-            }
-        }
-
-        str = DoSubstr(cx, str, size_t(begin), size_t(end - begin));
-        if (!str)
-            return false;
-    }
-
-    args.rval().setString(str);
-    return true;
-}
-
 template <typename CharT>
 static JSString *
 ToLowerCase(JSContext *cx, JSLinearString *str)
@@ -3992,54 +3938,6 @@ js::str_split_string(JSContext *cx, HandleTypeObject type, HandleString str, Han
     return aobj;
 }
 
-static bool
-str_substr(JSContext *cx, unsigned argc, Value *vp)
-{
-    CallArgs args = CallArgsFromVp(argc, vp);
-    RootedString str(cx, ThisToStringForStringProto(cx, args));
-    if (!str)
-        return false;
-
-    int32_t length, len, begin;
-    if (args.length() > 0) {
-        length = int32_t(str->length());
-        if (!ValueToIntegerRange(cx, args[0], &begin))
-            return false;
-
-        if (begin >= length) {
-            args.rval().setString(cx->runtime()->emptyString);
-            return true;
-        }
-        if (begin < 0) {
-            begin += length; /* length + INT_MIN will always be less than 0 */
-            if (begin < 0)
-                begin = 0;
-        }
-
-        if (args.hasDefined(1)) {
-            if (!ValueToIntegerRange(cx, args[1], &len))
-                return false;
-
-            if (len <= 0) {
-                args.rval().setString(cx->runtime()->emptyString);
-                return true;
-            }
-
-            if (uint32_t(length) < uint32_t(begin + len))
-                len = length - begin;
-        } else {
-            len = length - begin;
-        }
-
-        str = DoSubstr(cx, str, size_t(begin), size_t(len));
-        if (!str)
-            return false;
-    }
-
-    args.rval().setString(str);
-    return true;
-}
-
 /*
  * Python-esque sequence operations.
  */
@@ -4076,73 +3974,6 @@ str_concat(JSContext *cx, unsigned argc, Value *vp)
     return true;
 }
 
-static bool
-str_slice(JSContext *cx, unsigned argc, Value *vp)
-{
-    CallArgs args = CallArgsFromVp(argc, vp);
-
-    if (args.length() == 1 && args.thisv().isString() && args[0].isInt32()) {
-        JSString *str = args.thisv().toString();
-        size_t begin = args[0].toInt32();
-        size_t end = str->length();
-        if (begin <= end) {
-            size_t length = end - begin;
-            if (length == 0) {
-                str = cx->runtime()->emptyString;
-            } else {
-                str = (length == 1)
-                      ? cx->staticStrings().getUnitStringForElement(cx, str, begin)
-                      : NewDependentString(cx, str, begin, length);
-                if (!str)
-                    return false;
-            }
-            args.rval().setString(str);
-            return true;
-        }
-    }
-
-    RootedString str(cx, ThisToStringForStringProto(cx, args));
-    if (!str)
-        return false;
-
-    if (args.length() != 0) {
-        double begin, end, length;
-
-        if (!ToInteger(cx, args[0], &begin))
-            return false;
-        length = str->length();
-        if (begin < 0) {
-            begin += length;
-            if (begin < 0)
-                begin = 0;
-        } else if (begin > length) {
-            begin = length;
-        }
-
-        if (args.hasDefined(1)) {
-            if (!ToInteger(cx, args[1], &end))
-                return false;
-            if (end < 0) {
-                end += length;
-                if (end < 0)
-                    end = 0;
-            } else if (end > length) {
-                end = length;
-            }
-            if (end < begin)
-                end = begin;
-        } else {
-            end = length;
-        }
-
-        str = NewDependentString(cx, str, size_t(begin), size_t(end - begin));
-        if (!str)
-            return false;
-    }
-    args.rval().setString(str);
-    return true;
-}
-
 static const JSFunctionSpec string_methods[] = {
 #if JS_HAS_TOSOURCE
     JS_FN("quote",             str_quote,             0,JSFUN_GENERIC_NATIVE),
@@ -4152,11 +3983,11 @@ static const JSFunctionSpec string_methods[] = {
     /* Java-like methods. */
     JS_FN(js_toString_str,     js_str_toString,       0,0),
     JS_FN(js_valueOf_str,      js_str_toString,       0,0),
-    JS_FN("substring",         str_substring,         2,JSFUN_GENERIC_NATIVE),
     JS_FN("toLowerCase",       str_toLowerCase,       0,JSFUN_GENERIC_NATIVE),
     JS_FN("toUpperCase",       str_toUpperCase,       0,JSFUN_GENERIC_NATIVE),
     JS_FN("charAt",            js_str_charAt,         1,JSFUN_GENERIC_NATIVE),
     JS_FN("charCodeAt",        js_str_charCodeAt,     1,JSFUN_GENERIC_NATIVE),
+    JS_SELF_HOSTED_FN("substring", "String_substring", 2,0),
     JS_SELF_HOSTED_FN("codePointAt", "String_codePointAt", 1,0),
     JS_FN("contains",          str_contains,          1,JSFUN_GENERIC_NATIVE),
     JS_FN("indexOf",           str_indexOf,           1,JSFUN_GENERIC_NATIVE),
@@ -4183,11 +4014,11 @@ static const JSFunctionSpec string_methods[] = {
     JS_FN("search",            str_search,            1,JSFUN_GENERIC_NATIVE),
     JS_FN("replace",           str_replace,           2,JSFUN_GENERIC_NATIVE),
     JS_FN("split",             str_split,             2,JSFUN_GENERIC_NATIVE),
-    JS_FN("substr",            str_substr,            2,JSFUN_GENERIC_NATIVE),
+    JS_SELF_HOSTED_FN("substr", "String_substr",      2,0),
 
     /* Python-esque sequence methods. */
     JS_FN("concat",            str_concat,            1,JSFUN_GENERIC_NATIVE),
-    JS_FN("slice",             str_slice,             2,JSFUN_GENERIC_NATIVE),
+    JS_SELF_HOSTED_FN("slice", "String_slice",        2,0),
 
     /* HTML string methods. */
     JS_SELF_HOSTED_FN("bold",     "String_bold",       0,0),
@@ -4293,13 +4124,17 @@ js::str_fromCharCode_one_arg(JSContext *cx, HandleValue code, MutableHandleValue
 
 static const JSFunctionSpec string_static_methods[] = {
     JS_FN("fromCharCode", js::str_fromCharCode, 1, 0),
-    JS_SELF_HOSTED_FN("fromCodePoint", "String_static_fromCodePoint", 1, 0),
-    JS_SELF_HOSTED_FN("raw", "String_static_raw", 2, 0),
+
+    JS_SELF_HOSTED_FN("fromCodePoint",   "String_static_fromCodePoint", 1,0),
+    JS_SELF_HOSTED_FN("raw",             "String_static_raw",           2,0),
+    JS_SELF_HOSTED_FN("substring",       "String_static_substring",     3,0),
+    JS_SELF_HOSTED_FN("substr",          "String_static_substr",        3,0),
+    JS_SELF_HOSTED_FN("slice",           "String_static_slice",         3,0),
 
     // This must be at the end because of bug 853075: functions listed after
     // self-hosted methods aren't available in self-hosted code.
 #if EXPOSE_INTL_API
-    JS_SELF_HOSTED_FN("localeCompare", "String_static_localeCompare", 2,0),
+    JS_SELF_HOSTED_FN("localeCompare",   "String_static_localeCompare", 2,0),
 #endif
     JS_FS_END
 };
diff --git a/js/src/jsstr.h b/js/src/jsstr.h
index 5231ab13369..e262ace82aa 100644
--- a/js/src/jsstr.h
+++ b/js/src/jsstr.h
@@ -249,6 +249,14 @@ EqualChars(const Char1 *s1, const Char2 *s2, size_t len)
     return true;
 }
 
+/*
+ * Computes |str|'s substring for the range [beginInt, beginInt + lengthInt).
+ * Negative, overlarge, swapped, etc. |beginInt| and |lengthInt| are forbidden
+ * and constitute API misuse.
+ */
+JSString *
+SubstringKernel(JSContext *cx, HandleString str, int32_t beginInt, int32_t lengthInt);
+
 /*
  * Inflate bytes in ASCII encoding to char16_t code units. Return null on error,
  * otherwise return the char16_t buffer that was malloc'ed. length is updated to
@@ -311,9 +319,6 @@ str_lastIndexOf(JSContext *cx, unsigned argc, Value *vp);
 extern bool
 str_startsWith(JSContext *cx, unsigned argc, Value *vp);
 
-extern bool
-str_substring(JSContext *cx, unsigned argc, Value *vp);
-
 extern bool
 str_toLowerCase(JSContext *cx, unsigned argc, Value *vp);
 
diff --git a/js/src/vm/SelfHosting.cpp b/js/src/vm/SelfHosting.cpp
index 1be699b9659..17ef9e321f1 100644
--- a/js/src/vm/SelfHosting.cpp
+++ b/js/src/vm/SelfHosting.cpp
@@ -120,6 +120,26 @@ intrinsic_IsConstructor(JSContext *cx, unsigned argc, Value *vp)
     return true;
 }
 
+bool
+js::intrinsic_SubstringKernel(JSContext *cx, unsigned argc, Value *vp)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+    MOZ_ASSERT(args[0].isString());
+    MOZ_ASSERT(args[1].isInt32());
+    MOZ_ASSERT(args[2].isInt32());
+
+    RootedString str(cx, args[0].toString());
+    int32_t begin = args[1].toInt32();
+    int32_t length = args[2].toInt32();
+
+    JSString *substr = SubstringKernel(cx, str, begin, length);
+    if (!substr)
+        return false;
+
+    args.rval().setString(substr);
+    return true;
+}
+
 static bool
 intrinsic_OwnPropertyKeys(JSContext *cx, unsigned argc, Value *vp)
 {
@@ -1016,7 +1036,6 @@ static const JSFunctionSpec intrinsic_functions[] = {
     JS_FN("std_String_replace",                  str_replace,                  2,0),
     JS_FN("std_String_split",                    str_split,                    2,0),
     JS_FN("std_String_startsWith",               str_startsWith,               1,0),
-    JS_FN("std_String_substring",                str_substring,                2,0),
     JS_FN("std_String_toLowerCase",              str_toLowerCase,              0,0),
     JS_FN("std_String_toUpperCase",              str_toUpperCase,              0,0),
 
@@ -1041,6 +1060,7 @@ static const JSFunctionSpec intrinsic_functions[] = {
     JS_FN("_IsConstructing",         intrinsic_IsConstructing,          0,0),
     JS_FN("DecompileArg",            intrinsic_DecompileArg,            2,0),
     JS_FN("RuntimeDefaultLocale",    intrinsic_RuntimeDefaultLocale,    0,0),
+    JS_FN("SubstringKernel",         intrinsic_SubstringKernel,         3,0),
 
     JS_FN("UnsafePutElements",       intrinsic_UnsafePutElements,       3,0),
     JS_FN("_DefineDataProperty",     intrinsic_DefineDataProperty,      4,0),
diff --git a/js/src/vm/String.h b/js/src/vm/String.h
index 5cd432afef6..5f134309050 100644
--- a/js/src/vm/String.h
+++ b/js/src/vm/String.h
@@ -475,6 +475,9 @@ class JSString : public js::gc::TenuredCell
     }
 
     static size_t offsetOfNonInlineChars() {
+        static_assert(offsetof(JSString, d.s.u2.nonInlineCharsTwoByte) ==
+                      offsetof(JSString, d.s.u2.nonInlineCharsLatin1),
+                      "nonInlineCharsTwoByte and nonInlineCharsLatin1 must have same offset");
         return offsetof(JSString, d.s.u2.nonInlineCharsTwoByte);
     }
 

From 655a37a8b592e16f7c341506d3f8888ca3f9a4eb Mon Sep 17 00:00:00 2001
From: Benoit Jacob <bjacob@mozilla.com>
Date: Tue, 4 Nov 2014 18:17:11 -0500
Subject: [PATCH 023/153] Bug 1021265 - Add AppNotes about blacklisting
 DisplayLink - r=jrmuizel

---
 gfx/thebes/gfxWindowsPlatform.cpp | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/gfx/thebes/gfxWindowsPlatform.cpp b/gfx/thebes/gfxWindowsPlatform.cpp
index 8c44ecd92a8..5692dc7d586 100644
--- a/gfx/thebes/gfxWindowsPlatform.cpp
+++ b/gfx/thebes/gfxWindowsPlatform.cpp
@@ -70,6 +70,10 @@
 #include "SurfaceCache.h"
 #include "gfxPrefs.h"
 
+#if defined(MOZ_CRASHREPORTER)
+#include "nsExceptionHandler.h"
+#endif
+
 using namespace mozilla;
 using namespace mozilla::gfx;
 using namespace mozilla::layers;
@@ -1522,9 +1526,15 @@ bool DoesD3D11DeviceWork(ID3D11Device *device)
     gfxWindowsPlatform::GetDLLVersion(L"dlumd32.dll", displayLinkModuleVersionString);
     uint64_t displayLinkModuleVersion;
     if (!ParseDriverVersion(displayLinkModuleVersionString, &displayLinkModuleVersion)) {
+#if defined(MOZ_CRASHREPORTER)
+      CrashReporter::AppendAppNotesToCrashReport(NS_LITERAL_CSTRING("DisplayLink: could not parse version\n"));
+#endif
       return false;
     }
     if (displayLinkModuleVersion <= GFX_DRIVER_VERSION(8,6,1,36484)) {
+#if defined(MOZ_CRASHREPORTER)
+      CrashReporter::AppendAppNotesToCrashReport(NS_LITERAL_CSTRING("DisplayLink: too old version\n"));
+#endif
       return false;
     }
   }

From f8116d592ab662f66458d4e4618c1e117b8354fd Mon Sep 17 00:00:00 2001
From: Nicholas Nethercote <nnethercote@mozilla.com>
Date: Thu, 30 Oct 2014 19:48:10 -0700
Subject: [PATCH 024/153] Bug 1091986 (part 1) - Remove an over-zealous
 assertion in Vector.h.

---
 mfbt/Vector.h | 2 --
 1 file changed, 2 deletions(-)

diff --git a/mfbt/Vector.h b/mfbt/Vector.h
index 36cb70c00cd..a258227a7e7 100644
--- a/mfbt/Vector.h
+++ b/mfbt/Vector.h
@@ -724,8 +724,6 @@ MOZ_NEVER_INLINE bool
 VectorBase<T, N, AP, TV>::growStorageBy(size_t aIncr)
 {
   MOZ_ASSERT(mLength + aIncr > mCapacity);
-  MOZ_ASSERT_IF(!usingInlineStorage(),
-                !detail::CapacityHasExcessSpace<T>(mCapacity));
 
   /*
    * When choosing a new capacity, its size should is as close to 2**N bytes

From b7aca515ce1552e7e393175f594de4542b949723 Mon Sep 17 00:00:00 2001
From: Nicholas Nethercote <nnethercote@mozilla.com>
Date: Thu, 30 Oct 2014 19:48:30 -0700
Subject: [PATCH 025/153] Bug 1091986 (part 2) - Change nsStreamLoader::mData
 to a mozilla::Vector. r=mcmanus.

---
 netwerk/base/src/nsStreamLoader.cpp | 60 ++++++++++-------------------
 netwerk/base/src/nsStreamLoader.h   |  9 ++---
 2 files changed, 24 insertions(+), 45 deletions(-)

diff --git a/netwerk/base/src/nsStreamLoader.cpp b/netwerk/base/src/nsStreamLoader.cpp
index 245b91524e1..5d9cc774523 100644
--- a/netwerk/base/src/nsStreamLoader.cpp
+++ b/netwerk/base/src/nsStreamLoader.cpp
@@ -9,16 +9,15 @@
 #include "nsError.h"
 #include "GeckoProfiler.h"
 
+#include <limits>
+
 nsStreamLoader::nsStreamLoader()
-  : mData(nullptr),
-    mAllocated(0),
-    mLength(0)
+  : mData()
 {
 }
 
 nsStreamLoader::~nsStreamLoader()
 {
-  ReleaseData();
 }
 
 NS_IMETHODIMP
@@ -49,7 +48,7 @@ NS_IMPL_ISUPPORTS(nsStreamLoader, nsIStreamLoader,
 NS_IMETHODIMP 
 nsStreamLoader::GetNumBytesRead(uint32_t* aNumBytes)
 {
-  *aNumBytes = mLength;
+  *aNumBytes = mData.length();
   return NS_OK;
 }
 
@@ -61,7 +60,7 @@ nsStreamLoader::GetRequest(nsIRequest **aRequest)
   return NS_OK;
 }
 
-NS_IMETHODIMP 
+NS_IMETHODIMP
 nsStreamLoader::OnStartRequest(nsIRequest* request, nsISupports *ctxt)
 {
   nsCOMPtr<nsIChannel> chan( do_QueryInterface(request) );
@@ -69,25 +68,21 @@ nsStreamLoader::OnStartRequest(nsIRequest* request, nsISupports *ctxt)
     int64_t contentLength = -1;
     chan->GetContentLength(&contentLength);
     if (contentLength >= 0) {
-      if (contentLength > UINT32_MAX) {
-        // Too big to fit into uint32, so let's bail.
-        // XXX we should really make mAllocated and mLength 64-bit instead.
+      if (uint64_t(contentLength) > std::numeric_limits<size_t>::max()) {
+        // Too big to fit into size_t, so let's bail.
         return NS_ERROR_OUT_OF_MEMORY;
       }
-      uint32_t contentLength32 = uint32_t(contentLength);
       // preallocate buffer
-      mData = static_cast<uint8_t*>(moz_malloc(contentLength32));
-      if (!mData) {
+      if (!mData.initCapacity(contentLength)) {
         return NS_ERROR_OUT_OF_MEMORY;
       }
-      mAllocated = contentLength32;
     }
   }
   mContext = ctxt;
   return NS_OK;
 }
 
-NS_IMETHODIMP 
+NS_IMETHODIMP
 nsStreamLoader::OnStopRequest(nsIRequest* request, nsISupports *ctxt,
                               nsresult aStatus)
 {
@@ -97,12 +92,14 @@ nsStreamLoader::OnStopRequest(nsIRequest* request, nsISupports *ctxt,
   if (mObserver) {
     // provide nsIStreamLoader::request during call to OnStreamComplete
     mRequest = request;
+    size_t length = mData.length();
+    uint8_t* elems = mData.extractRawBuffer();
     nsresult rv = mObserver->OnStreamComplete(this, mContext, aStatus,
-                                              mLength, mData);
-    if (rv == NS_SUCCESS_ADOPTED_DATA) {
-      // the observer now owns the data buffer, and the loader must
-      // not deallocate it
-      mData = nullptr;
+                                              length, elems);
+    if (rv != NS_SUCCESS_ADOPTED_DATA) {
+      // The observer didn't take ownership of the extracted data buffer, so
+      // put it back into mData.
+      mData.replaceRawBuffer(elems, length);
     }
     // done.. cleanup
     ReleaseData();
@@ -123,23 +120,11 @@ nsStreamLoader::WriteSegmentFun(nsIInputStream *inStr,
 {
   nsStreamLoader *self = (nsStreamLoader *) closure;
 
-  if (count > UINT32_MAX - self->mLength) {
-    return NS_ERROR_ILLEGAL_VALUE; // is there a better error to use here?
+  if (!self->mData.append(fromSegment, count)) {
+    self->mData.clearAndFree();
+    return NS_ERROR_OUT_OF_MEMORY;
   }
 
-  if (self->mLength + count > self->mAllocated) {
-    self->mData = static_cast<uint8_t*>(moz_realloc(self->mData,
-                                                    self->mLength + count));
-    if (!self->mData) {
-      self->ReleaseData();
-      return NS_ERROR_OUT_OF_MEMORY;
-    }
-    self->mAllocated = self->mLength + count;
-  }
-
-  ::memcpy(self->mData + self->mLength, fromSegment, count);
-  self->mLength += count;
-
   *writeCount = count;
 
   return NS_OK;
@@ -157,10 +142,5 @@ nsStreamLoader::OnDataAvailable(nsIRequest* request, nsISupports *ctxt,
 void
 nsStreamLoader::ReleaseData()
 {
-  if (mData) {
-    moz_free(mData);
-    mData = nullptr;
-  }
-  mLength = 0;
-  mAllocated = 0;
+  mData.clearAndFree();
 }
diff --git a/netwerk/base/src/nsStreamLoader.h b/netwerk/base/src/nsStreamLoader.h
index a42116c75da..791bc5375a3 100644
--- a/netwerk/base/src/nsStreamLoader.h
+++ b/netwerk/base/src/nsStreamLoader.h
@@ -9,6 +9,7 @@
 #include "nsIStreamLoader.h"
 #include "nsCOMPtr.h"
 #include "mozilla/Attributes.h"
+#include "mozilla/Vector.h"
 
 class nsIRequest;
 
@@ -39,11 +40,9 @@ protected:
   nsCOMPtr<nsISupports>             mContext;  // the observer's context
   nsCOMPtr<nsIRequest>              mRequest;
 
-  uint8_t  *mData;      // buffer to accumulate incoming data
-  uint32_t  mAllocated; // allocated size of data buffer (we preallocate if
-                        //   contentSize is available)
-  uint32_t  mLength;    // actual length of data in buffer
-                        //   (must be <= mAllocated)
+  // Buffer to accumulate incoming data. We preallocate if contentSize is
+  // available.
+  mozilla::Vector<uint8_t, 0> mData;
 };
 
 #endif // nsStreamLoader_h__

From 63b2f474490964f71c20652bb4ce09907fdc6ea8 Mon Sep 17 00:00:00 2001
From: Wes Kocher <wkocher@mozilla.com>
Date: Tue, 4 Nov 2014 16:39:12 -0800
Subject: [PATCH 026/153] Backed out 3 changesets (bug 1088831) for mochitest-2
 failures

---
 js/src/gc/Statistics.cpp  | 77 +++------------------------------------
 js/src/gc/Statistics.h    | 25 ++-----------
 js/src/gc/StoreBuffer.cpp | 25 +++----------
 js/src/gc/StoreBuffer.h   |  8 +---
 js/src/gc/Verifier.cpp    |  5 +--
 js/src/jsgc.cpp           |  2 -
 js/src/shell/js.cpp       | 45 -----------------------
 7 files changed, 15 insertions(+), 172 deletions(-)

diff --git a/js/src/gc/Statistics.cpp b/js/src/gc/Statistics.cpp
index bc897c8bc46..af9602d1a23 100644
--- a/js/src/gc/Statistics.cpp
+++ b/js/src/gc/Statistics.cpp
@@ -27,7 +27,6 @@ using namespace js::gc;
 using namespace js::gcstats;
 
 using mozilla::PodArrayZero;
-using mozilla::PodZero;
 
 /* Except for the first and last, slices of less than 10ms are not reported. */
 static const int64_t SLICE_MIN_REPORT_TIME = 10 * PRMJ_USEC_PER_MSEC;
@@ -284,7 +283,6 @@ struct PhaseInfo
 static const Phase PHASE_NO_PARENT = PHASE_LIMIT;
 
 static const PhaseInfo phases[] = {
-    { PHASE_MUTATOR, "Mutator Running", PHASE_NO_PARENT },
     { PHASE_GC_BEGIN, "Begin Callback", PHASE_NO_PARENT },
     { PHASE_WAIT_BACKGROUND_THREAD, "Wait Background Thread", PHASE_NO_PARENT },
     { PHASE_MARK_DISCARD_CODE, "Mark Discard Code", PHASE_NO_PARENT },
@@ -328,9 +326,6 @@ static const PhaseInfo phases[] = {
         { PHASE_COMPACT_UPDATE, "Compact Update", PHASE_COMPACT, },
             { PHASE_COMPACT_UPDATE_GRAY, "Compact Update Gray", PHASE_COMPACT_UPDATE, },
     { PHASE_GC_END, "End Callback", PHASE_NO_PARENT },
-    { PHASE_MINOR_GC, "Minor GC", PHASE_NO_PARENT },
-        { PHASE_COMPACT_STOREBUFFER_IN_MINOR_GC, "Compact Store Buffers", PHASE_MINOR_GC },
-    { PHASE_COMPACT_STOREBUFFER_NO_PARENT, "Compact Store Buffers (toplevel)", PHASE_NO_PARENT },
     { PHASE_LIMIT, nullptr, PHASE_NO_PARENT }
 };
 
@@ -390,8 +385,6 @@ Statistics::formatData(StatisticsSerializer &ss, uint64_t timestamp)
     ss.appendNumber("Total Zones", "%d", "", zoneStats.zoneCount);
     ss.appendNumber("Total Compartments", "%d", "", zoneStats.compartmentCount);
     ss.appendNumber("Minor GCs", "%d", "", counts[STAT_MINOR_GC]);
-    ss.appendNumber("Store Buffer Compactions", "%d", "", counts[STAT_COMPACT_STOREBUFFER]);
-    ss.appendNumber("Store Buffer Overflows", "%d", "", counts[STAT_STOREBUFFER_OVERFLOW]);
     ss.appendNumber("MMU (20ms)", "%d", "%", int(mmu20 * 100));
     ss.appendNumber("MMU (50ms)", "%d", "%", int(mmu50 * 100));
     ss.appendDecimal("SCC Sweep Total", "ms", t(sccTotal));
@@ -483,8 +476,6 @@ Statistics::formatDescription()
   Zones Collected: %d of %d\n\
   Compartments Collected: %d of %d\n\
   MinorGCs since last GC: %d\n\
-  Store Buffer Compactions: %d\n\
-  Store Buffer Overflows: %d\n\
   MMU 20ms:%.1f%%; 50ms:%.1f%%\n\
   SCC Sweep Total (MaxPause): %.3fms (%.3fms)\n\
   HeapSize: %.3f MiB\n\
@@ -500,8 +491,6 @@ Statistics::formatDescription()
                 zoneStats.collectedZoneCount, zoneStats.zoneCount,
                 zoneStats.collectedCompartmentCount, zoneStats.compartmentCount,
                 counts[STAT_MINOR_GC],
-                counts[STAT_COMPACT_STOREBUFFER],
-                counts[STAT_STOREBUFFER_OVERFLOW],
                 mmu20 * 100., mmu50 * 100.,
                 t(sccTotal), t(sccLongest),
                 double(preBytes) / 1024. / 1024.,
@@ -644,8 +633,6 @@ Statistics::Statistics(JSRuntime *rt)
     fullFormat(false),
     gcDepth(0),
     nonincrementalReason(nullptr),
-    timingMutator(false),
-    timedGCStart(0),
     preBytes(0),
     maxPauseInInterval(0),
     phaseNestingDepth(0),
@@ -653,8 +640,6 @@ Statistics::Statistics(JSRuntime *rt)
 {
     PodArrayZero(phaseTotals);
     PodArrayZero(counts);
-    PodArrayZero(phaseStartTimes);
-    PodArrayZero(phaseTimes);
 
     char *env = getenv("MOZ_GCTIMER");
     if (!env || strcmp(env, "none") == 0) {
@@ -738,6 +723,9 @@ Statistics::printStats()
 void
 Statistics::beginGC(JSGCInvocationKind kind)
 {
+    PodArrayZero(phaseStartTimes);
+    PodArrayZero(phaseTimes);
+
     slices.clearAndFree();
     sccTimes.clearAndFree();
     gckind = kind;
@@ -779,11 +767,6 @@ Statistics::endGC()
 
     if (fp)
         printStats();
-
-    // Clear the timers at the end of a GC because we accumulate time for some
-    // phases (eg storebuffer compaction) during the mutator's run.
-    PodZero(&phaseStartTimes[PHASE_GC_BEGIN], PHASE_LIMIT - PHASE_GC_BEGIN);
-    PodZero(&phaseTimes[PHASE_GC_BEGIN], PHASE_LIMIT - PHASE_GC_BEGIN);
 }
 
 void
@@ -840,58 +823,17 @@ Statistics::endSlice()
         PodArrayZero(counts);
 }
 
-void
-Statistics::startTimingMutator()
-{
-    MOZ_ASSERT(!timingMutator);
-
-    // Should only be called from outside of GC
-    MOZ_ASSERT(phaseNestingDepth == 0);
-
-    timingMutator = true;
-    timedGCTime = 0;
-    phaseStartTimes[PHASE_MUTATOR] = 0;
-    phaseTimes[PHASE_MUTATOR] = 0;
-    timedGCStart = 0;
-
-    beginPhase(PHASE_MUTATOR);
-}
-
-void
-Statistics::stopTimingMutator(double &mutator_ms, double &gc_ms)
-{
-    MOZ_ASSERT(timingMutator);
-
-    // Should only be called from outside of GC
-    MOZ_ASSERT(phaseNestingDepth == 1 && phaseNesting[0] == PHASE_MUTATOR);
-
-    endPhase(PHASE_MUTATOR);
-    mutator_ms = t(phaseTimes[PHASE_MUTATOR]);
-    gc_ms = t(timedGCTime);
-    timingMutator = false;
-}
-
 void
 Statistics::beginPhase(Phase phase)
 {
     /* Guard against re-entry */
     MOZ_ASSERT(!phaseStartTimes[phase]);
 
-    if (timingMutator) {
-        if (phaseNestingDepth == 1 && phaseNesting[0] == PHASE_MUTATOR) {
-            endPhase(PHASE_MUTATOR);
-            timedGCStart = PRMJ_Now();
-        }
-    }
-
 #ifdef DEBUG
     MOZ_ASSERT(phases[phase].index == phase);
     Phase parent = phaseNestingDepth ? phaseNesting[phaseNestingDepth - 1] : PHASE_NO_PARENT;
     MOZ_ASSERT(phaseNestingDepth < MAX_NESTING);
     MOZ_ASSERT_IF(gcDepth == 1, phases[phase].parent == parent);
-    MOZ_ASSERT_IF(phase == PHASE_COMPACT_STOREBUFFER_IN_MINOR_GC, parent == PHASE_MINOR_GC);
-    MOZ_ASSERT_IF(phase == PHASE_COMPACT_STOREBUFFER_NO_PARENT, parent == PHASE_NO_PARENT);
-
     phaseNesting[phaseNestingDepth] = phase;
     phaseNestingDepth++;
 #endif
@@ -904,19 +846,10 @@ Statistics::endPhase(Phase phase)
 {
     phaseNestingDepth--;
 
-    int64_t now = PRMJ_Now();
-    int64_t t = now - phaseStartTimes[phase];
-    if (!slices.empty())
-        slices.back().phaseTimes[phase] += t;
+    int64_t t = PRMJ_Now() - phaseStartTimes[phase];
+    slices.back().phaseTimes[phase] += t;
     phaseTimes[phase] += t;
     phaseStartTimes[phase] = 0;
-
-    if (timingMutator) {
-        if (phaseNestingDepth == 0 && phase != PHASE_MUTATOR) {
-            timedGCTime += now - timedGCStart;
-            beginPhase(PHASE_MUTATOR);
-        }
-    }
 }
 
 void
diff --git a/js/src/gc/Statistics.h b/js/src/gc/Statistics.h
index cffc33a2b58..933d449aefe 100644
--- a/js/src/gc/Statistics.h
+++ b/js/src/gc/Statistics.h
@@ -27,7 +27,6 @@ class GCParallelTask;
 namespace gcstats {
 
 enum Phase {
-    PHASE_MUTATOR,
     PHASE_GC_BEGIN,
     PHASE_WAIT_BACKGROUND_THREAD,
     PHASE_MARK_DISCARD_CODE,
@@ -71,9 +70,6 @@ enum Phase {
     PHASE_COMPACT_UPDATE,
     PHASE_COMPACT_UPDATE_GRAY,
     PHASE_GC_END,
-    PHASE_MINOR_GC,
-    PHASE_COMPACT_STOREBUFFER_IN_MINOR_GC,
-    PHASE_COMPACT_STOREBUFFER_NO_PARENT,
 
     PHASE_LIMIT
 };
@@ -83,13 +79,6 @@ enum Stat {
     STAT_DESTROY_CHUNK,
     STAT_MINOR_GC,
 
-    // Number of times the storebuffers were compacted
-    STAT_COMPACT_STOREBUFFER,
-
-    // Number of times a 'put' into a storebuffer overflowed, triggering a
-    // compaction
-    STAT_STOREBUFFER_OVERFLOW,
-
     STAT_LIMIT
 };
 
@@ -129,9 +118,6 @@ struct Statistics
                     JS::gcreason::Reason reason);
     void endSlice();
 
-    void startTimingMutator();
-    void stopTimingMutator(double &mutator_ms, double &gc_ms);
-
     void reset(const char *reason) { slices.back().resetReason = reason; }
     void nonincremental(const char *reason) { nonincrementalReason = reason; }
 
@@ -193,13 +179,6 @@ struct Statistics
     /* Most recent time when the given phase started. */
     int64_t phaseStartTimes[PHASE_LIMIT];
 
-    /* Are we currently timing mutator vs GC time? */
-    bool timingMutator;
-
-    /* Bookkeeping for GC timings when timingMutator is true */
-    int64_t timedGCStart;
-    int64_t timedGCTime;
-
     /* Total time in a given phase for this GC. */
     int64_t phaseTimes[PHASE_LIMIT];
 
@@ -215,10 +194,12 @@ struct Statistics
     /* Records the maximum GC pause in an API-controlled interval (in us). */
     int64_t maxPauseInInterval;
 
+#ifdef DEBUG
     /* Phases that are currently on stack. */
     static const size_t MAX_NESTING = 8;
     Phase phaseNesting[MAX_NESTING];
-    size_t phaseNestingDepth;
+#endif
+    mozilla::DebugOnly<size_t> phaseNestingDepth;
 
     /* Sweep times for SCCs of compartments. */
     Vector<int64_t, 0, SystemAllocPolicy> sccTimes;
diff --git a/js/src/gc/StoreBuffer.cpp b/js/src/gc/StoreBuffer.cpp
index 23efde94426..0587e434f03 100644
--- a/js/src/gc/StoreBuffer.cpp
+++ b/js/src/gc/StoreBuffer.cpp
@@ -10,7 +10,6 @@
 
 #include "mozilla/Assertions.h"
 
-#include "gc/Statistics.h"
 #include "vm/ArgumentsObject.h"
 #include "vm/ForkJoin.h"
 
@@ -20,12 +19,6 @@ using namespace js;
 using namespace js::gc;
 using mozilla::ReentrancyGuard;
 
-gcstats::Statistics&
-StoreBuffer::stats()
-{
-    return runtime_->gc.stats;
-}
-
 /*** Edges ***/
 
 void
@@ -100,8 +93,6 @@ StoreBuffer::MonoTypeBuffer<T>::handleOverflow(StoreBuffer *owner)
          * Compact the buffer now, and if that fails to free enough space then
          * trigger a minor collection.
          */
-        gcstats::AutoPhase ap(owner->stats(), gcstats::PHASE_COMPACT_STOREBUFFER_NO_PARENT);
-        owner->stats().count(gcstats::STAT_STOREBUFFER_OVERFLOW);
         compact(owner);
         if (isLowOnSpace())
             owner->setAboutToOverflow();
@@ -110,10 +101,8 @@ StoreBuffer::MonoTypeBuffer<T>::handleOverflow(StoreBuffer *owner)
           * A minor GC has already been triggered, so there's no point
           * compacting unless the buffer is totally full.
           */
-        if (storage_->availableInCurrentChunk() < sizeof(T)) {
-            owner->stats().count(gcstats::STAT_STOREBUFFER_OVERFLOW);
-            maybeCompact(owner, gcstats::PHASE_COMPACT_STOREBUFFER_NO_PARENT);
-        }
+        if (storage_->availableInCurrentChunk() < sizeof(T))
+            maybeCompact(owner);
     }
 }
 
@@ -141,7 +130,6 @@ StoreBuffer::MonoTypeBuffer<T>::compactRemoveDuplicates(StoreBuffer *owner)
     storage_->release(insert.mark());
 
     duplicates.clear();
-    owner->stats().count(gcstats::STAT_COMPACT_STOREBUFFER);
 }
 
 template <typename T>
@@ -155,13 +143,11 @@ StoreBuffer::MonoTypeBuffer<T>::compact(StoreBuffer *owner)
 
 template <typename T>
 void
-StoreBuffer::MonoTypeBuffer<T>::maybeCompact(StoreBuffer *owner, int phase)
+StoreBuffer::MonoTypeBuffer<T>::maybeCompact(StoreBuffer *owner)
 {
     MOZ_ASSERT(storage_);
-    if (storage_->used() != usedAtLastCompact_) {
-        gcstats::AutoPhase ap(owner->stats(), static_cast<gcstats::Phase>(phase));
+    if (storage_->used() != usedAtLastCompact_)
         compact(owner);
-    }
 }
 
 template <typename T>
@@ -173,8 +159,7 @@ StoreBuffer::MonoTypeBuffer<T>::mark(StoreBuffer *owner, JSTracer *trc)
     if (!storage_)
         return;
 
-    maybeCompact(owner, gcstats::PHASE_COMPACT_STOREBUFFER_IN_MINOR_GC);
-
+    maybeCompact(owner);
     for (LifoAlloc::Enum e(*storage_); !e.empty(); e.popFront<T>()) {
         T *edge = e.get<T>();
         edge->mark(trc);
diff --git a/js/src/gc/StoreBuffer.h b/js/src/gc/StoreBuffer.h
index 09276e8665a..b5b19fb6345 100644
--- a/js/src/gc/StoreBuffer.h
+++ b/js/src/gc/StoreBuffer.h
@@ -22,10 +22,6 @@
 
 namespace js {
 
-namespace gcstats {
-struct Statistics;
-}
-
 MOZ_NORETURN void
 CrashAtUnhandlableOOM(const char *reason);
 
@@ -144,7 +140,7 @@ class StoreBuffer
         virtual void compact(StoreBuffer *owner);
 
         /* Compacts if any entries have been added since the last compaction. */
-        void maybeCompact(StoreBuffer *owner, int phase);
+        void maybeCompact(StoreBuffer *owner);
 
         /* Add one item to the buffer. */
         void put(StoreBuffer *owner, const T &t) {
@@ -493,8 +489,6 @@ class StoreBuffer
         putFromAnyThread(bufferGeneric, CallbackRef<Key>(callback, key, data));
     }
 
-    gcstats::Statistics& stats();
-
     /* Methods to mark the source of all edges in the store buffer. */
     void markAll(JSTracer *trc);
     void markValues(JSTracer *trc)            { bufferVal.mark(this, trc); }
diff --git a/js/src/gc/Verifier.cpp b/js/src/gc/Verifier.cpp
index 0428252db9b..f092b5e116a 100644
--- a/js/src/gc/Verifier.cpp
+++ b/js/src/gc/Verifier.cpp
@@ -503,10 +503,7 @@ js::gc::GCRuntime::endVerifyPostBarriers()
     if (!edges.init())
         goto oom;
     trc->edges = &edges;
-    {
-        gcstats::AutoPhase ap(stats, gcstats::PHASE_MINOR_GC);
-        storeBuffer.markAll(trc);
-    }
+    storeBuffer.markAll(trc);
 
     /* Walk the heap to find any edges not the the |edges| set. */
     trc->setTraceCallback(PostVerifierVisitEdge);
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index 80cd4fb77f7..1ffacbdb245 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -6217,7 +6217,6 @@ void
 GCRuntime::minorGC(JS::gcreason::Reason reason)
 {
 #ifdef JSGC_GENERATIONAL
-    gcstats::AutoPhase ap(stats, gcstats::PHASE_MINOR_GC);
     minorGCRequested = false;
     TraceLogger *logger = TraceLoggerForMainThread(rt);
     AutoTraceLog logMinorGC(logger, TraceLogger::MinorGC);
@@ -6232,7 +6231,6 @@ GCRuntime::minorGC(JSContext *cx, JS::gcreason::Reason reason)
     // Alternate to the runtime-taking form above which allows marking type
     // objects as needing pretenuring.
 #ifdef JSGC_GENERATIONAL
-    gcstats::AutoPhase ap(stats, gcstats::PHASE_MINOR_GC);
     minorGCRequested = false;
     TraceLogger *logger = TraceLoggerForMainThread(rt);
     AutoTraceLog logMinorGC(logger, TraceLogger::MinorGC);
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index ffa6fc5bcf6..e063c9a984f 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -1660,43 +1660,6 @@ Quit(JSContext *cx, unsigned argc, jsval *vp)
     return false;
 }
 
-static bool
-StartTimingMutator(JSContext *cx, unsigned argc, jsval *vp)
-{
-    CallArgs args = CallArgsFromVp(argc, vp);
-    if (args.length() > 0) {
-        JS_ReportErrorNumber(cx, my_GetErrorMessage, nullptr,
-                             JSSMSG_TOO_MANY_ARGS, "startTimingMutator");
-        return false;
-    }
-
-    cx->runtime()->gc.stats.startTimingMutator();
-    args.rval().setUndefined();
-    return true;
-}
-
-static bool
-StopTimingMutator(JSContext *cx, unsigned argc, jsval *vp)
-{
-    CallArgs args = CallArgsFromVp(argc, vp);
-    if (args.length() > 0) {
-        JS_ReportErrorNumber(cx, my_GetErrorMessage, nullptr,
-                             JSSMSG_TOO_MANY_ARGS, "stopTimingMutator");
-        return false;
-    }
-
-    double mutator_ms, gc_ms;
-    cx->runtime()->gc.stats.stopTimingMutator(mutator_ms, gc_ms);
-    double total_ms = mutator_ms + gc_ms;
-    if (total_ms > 0) {
-        fprintf(gOutFile, "Mutator: %.3fms (%.1f%%), GC: %.3fms (%.1f%%)\n",
-                mutator_ms, mutator_ms / total_ms * 100.0, gc_ms, gc_ms / total_ms * 100.0);
-    }
-
-    args.rval().setUndefined();
-    return true;
-}
-
 static const char *
 ToSource(JSContext *cx, MutableHandleValue vp, JSAutoByteString *bytes)
 {
@@ -4495,14 +4458,6 @@ static const JSFunctionSpecWithHelp shell_functions[] = {
 "  Throw if the first two arguments are not the same (both +0 or both -0,\n"
 "  both NaN, or non-zero and ===)."),
 
-    JS_FN_HELP("startTimingMutator", StartTimingMutator, 0, 0,
-"startTimingMutator()",
-"  Start accounting time to mutator vs GC."),
-
-    JS_FN_HELP("stopTimingMutator", StopTimingMutator, 0, 0,
-"stopTimingMutator()",
-"  Stop accounting time to mutator vs GC and dump the results."),
-
     JS_FN_HELP("throwError", ThrowError, 0, 0,
 "throwError()",
 "  Throw an error from JS_ReportError."),

From 986a44f67e746b0ee39b1c3e221737e5f1c69c19 Mon Sep 17 00:00:00 2001
From: Shu-yu Guo <shu@rfrn.org>
Date: Tue, 4 Nov 2014 16:52:38 -0800
Subject: [PATCH 027/153] Bug 1092833 - Deal with uninitialized slots in
 MacroAssembler::initGCSlots. (r=terrence)

---
 js/src/jit-test/tests/ion/bug1092833.js | 49 +++++++++++++++++
 js/src/jit/IonMacroAssembler.cpp        | 71 ++++++++++++++++++++-----
 js/src/jit/IonMacroAssembler.h          |  3 ++
 3 files changed, 111 insertions(+), 12 deletions(-)
 create mode 100644 js/src/jit-test/tests/ion/bug1092833.js

diff --git a/js/src/jit-test/tests/ion/bug1092833.js b/js/src/jit-test/tests/ion/bug1092833.js
new file mode 100644
index 00000000000..64a74fb28fd
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1092833.js
@@ -0,0 +1,49 @@
+// Test that lexicals work with functions with many bindings.
+
+(function() {
+    var a01
+    var b02
+    var c03
+    var d04
+    var e05
+    var f06
+    var g07
+    var h08
+    let i09
+    var j10
+    var k11
+    var l12
+    var m13
+    var n14
+    var o15
+    (function n14() {
+      assertEq(i09, undefined);
+    })()
+})();
+
+try {
+  (function() {
+      var a01
+      var b02
+      var c03
+      var d04
+      var e05
+      var f06
+      var g07
+      var h08
+      let i09
+      var j10
+      var k11
+      var l12
+      var m13
+      var n14
+      var o15
+      (function n14() {
+        i12++
+      })()
+      let i12
+  })()
+} catch (e) {
+  assertEq(e instanceof ReferenceError, true);
+  assertEq(e.message.indexOf("i12") > 0, true);
+}
diff --git a/js/src/jit/IonMacroAssembler.cpp b/js/src/jit/IonMacroAssembler.cpp
index 397bd044f7e..11b8701b38f 100644
--- a/js/src/jit/IonMacroAssembler.cpp
+++ b/js/src/jit/IonMacroAssembler.cpp
@@ -27,6 +27,7 @@
 #endif
 #include "jsinferinlines.h"
 #include "jsobjinlines.h"
+#include "vm/Interpreter-inl.h"
 
 using namespace js;
 using namespace js::jit;
@@ -956,12 +957,18 @@ MacroAssembler::copySlotsFromTemplate(Register obj, const NativeObject *template
 }
 
 void
-MacroAssembler::fillSlotsWithUndefined(Address base, Register temp, uint32_t start, uint32_t end)
+MacroAssembler::fillSlotsWithConstantValue(Address base, Register temp,
+                                           uint32_t start, uint32_t end, const Value &v)
 {
+    MOZ_ASSERT(v.isUndefined() || IsUninitializedLexical(v));
+
+    if (start >= end)
+        return;
+
 #ifdef JS_NUNBOX32
     // We only have a single spare register, so do the initialization as two
     // strided writes of the tag and body.
-    jsval_layout jv = JSVAL_TO_IMPL(UndefinedValue());
+    jsval_layout jv = JSVAL_TO_IMPL(v);
 
     Address addr = base;
     move32(Imm32(jv.s.payload.i32), temp);
@@ -973,22 +980,43 @@ MacroAssembler::fillSlotsWithUndefined(Address base, Register temp, uint32_t sta
     for (unsigned i = start; i < end; ++i, addr.offset += sizeof(HeapValue))
         store32(temp, ToType(addr));
 #else
-    moveValue(UndefinedValue(), temp);
+    moveValue(v, temp);
     for (uint32_t i = start; i < end; ++i, base.offset += sizeof(HeapValue))
         storePtr(temp, base);
 #endif
 }
 
-static uint32_t
-FindStartOfUndefinedSlots(NativeObject *templateObj, uint32_t nslots)
+void
+MacroAssembler::fillSlotsWithUndefined(Address base, Register temp, uint32_t start, uint32_t end)
+{
+    fillSlotsWithConstantValue(base, temp, start, end, UndefinedValue());
+}
+
+void
+MacroAssembler::fillSlotsWithUninitialized(Address base, Register temp, uint32_t start, uint32_t end)
+{
+    fillSlotsWithConstantValue(base, temp, start, end, MagicValue(JS_UNINITIALIZED_LEXICAL));
+}
+
+static void
+FindStartOfUndefinedAndUninitializedSlots(NativeObject *templateObj, uint32_t nslots,
+                                          uint32_t *startOfUndefined, uint32_t *startOfUninitialized)
 {
     MOZ_ASSERT(nslots == templateObj->lastProperty()->slotSpan(templateObj->getClass()));
     MOZ_ASSERT(nslots > 0);
-    for (uint32_t first = nslots; first != 0; --first) {
-        if (templateObj->getSlot(first - 1) != UndefinedValue())
-            return first;
+    uint32_t first = nslots;
+    for (; first != 0; --first) {
+        if (!IsUninitializedLexical(templateObj->getSlot(first - 1)))
+            break;
     }
-    return 0;
+    *startOfUninitialized = first;
+    for (; first != 0; --first) {
+        if (templateObj->getSlot(first - 1) != UndefinedValue()) {
+            *startOfUndefined = first;
+            return;
+        }
+    }
+    *startOfUndefined = 0;
 }
 
 void
@@ -1011,16 +1039,28 @@ MacroAssembler::initGCSlots(Register obj, Register slots, NativeObject *template
     // logically into independent non-UndefinedValue writes to the head and
     // duplicated writes of UndefinedValue to the tail. For the majority of
     // objects, the "tail" will be the entire slot range.
-    uint32_t startOfUndefined = FindStartOfUndefinedSlots(templateObj, nslots);
+    //
+    // The template object may be a CallObject, in which case we need to
+    // account for uninitialized lexical slots as well as undefined
+    // slots. Unitialized lexical slots always appear at the very end of
+    // slots, after undefined.
+    uint32_t startOfUndefined = nslots;
+    uint32_t startOfUninitialized = nslots;
+    FindStartOfUndefinedAndUninitializedSlots(templateObj, nslots,
+                                              &startOfUndefined, &startOfUninitialized);
     MOZ_ASSERT(startOfUndefined <= nfixed); // Reserved slots must be fixed.
+    MOZ_ASSERT_IF(startOfUndefined != nfixed, startOfUndefined <= startOfUninitialized);
+    MOZ_ASSERT_IF(!templateObj->is<CallObject>(), startOfUninitialized == nslots);
 
     // Copy over any preserved reserved slots.
     copySlotsFromTemplate(obj, templateObj, 0, startOfUndefined);
 
-    // Fill the rest of the fixed slots with undefined.
+    // Fill the rest of the fixed slots with undefined and uninitialized.
     if (initFixedSlots) {
         fillSlotsWithUndefined(Address(obj, NativeObject::getFixedSlotOffset(startOfUndefined)), slots,
-                               startOfUndefined, nfixed);
+                               startOfUndefined, Min(startOfUninitialized, nfixed));
+        size_t offset = NativeObject::getFixedSlotOffset(startOfUninitialized);
+        fillSlotsWithUninitialized(Address(obj, offset), slots, startOfUninitialized, nfixed);
     }
 
     if (ndynamic) {
@@ -1028,7 +1068,14 @@ MacroAssembler::initGCSlots(Register obj, Register slots, NativeObject *template
         // register briefly for our slots base address.
         push(obj);
         loadPtr(Address(obj, NativeObject::offsetOfSlots()), obj);
+
+        // Initially fill all dynamic slots with undefined.
         fillSlotsWithUndefined(Address(obj, 0), slots, 0, ndynamic);
+
+        // Fill uninitialized slots if necessary.
+        fillSlotsWithUninitialized(Address(obj, 0), slots, startOfUninitialized - nfixed,
+                                   nslots - startOfUninitialized);
+
         pop(obj);
     }
 }
diff --git a/js/src/jit/IonMacroAssembler.h b/js/src/jit/IonMacroAssembler.h
index a303a814fd9..7c8edc77a72 100644
--- a/js/src/jit/IonMacroAssembler.h
+++ b/js/src/jit/IonMacroAssembler.h
@@ -810,7 +810,10 @@ class MacroAssembler : public MacroAssemblerSpecific
     void allocateNonObject(Register result, Register temp, gc::AllocKind allocKind, Label *fail);
     void copySlotsFromTemplate(Register obj, const NativeObject *templateObj,
                                uint32_t start, uint32_t end);
+    void fillSlotsWithConstantValue(Address addr, Register temp, uint32_t start, uint32_t end,
+                                    const Value &v);
     void fillSlotsWithUndefined(Address addr, Register temp, uint32_t start, uint32_t end);
+    void fillSlotsWithUninitialized(Address addr, Register temp, uint32_t start, uint32_t end);
     void initGCSlots(Register obj, Register temp, NativeObject *templateObj, bool initFixedSlots);
 
   public:

From 0b64cfb0e6d5b9468a7ea907f43dd88315f9e17f Mon Sep 17 00:00:00 2001
From: Nathan Froyd <froydnj@mozilla.com>
Date: Tue, 4 Nov 2014 08:57:25 -0500
Subject: [PATCH 028/153] Bug 1088043 - read and write nsTArrays more
 intelligently in IPC serialization; r=bent

---
 ipc/glue/IPCMessageUtils.h | 76 +++++++++++++++++++++++++++++++++++---
 1 file changed, 70 insertions(+), 6 deletions(-)

diff --git a/ipc/glue/IPCMessageUtils.h b/ipc/glue/IPCMessageUtils.h
index bd3c69e45ba..60336217fa0 100644
--- a/ipc/glue/IPCMessageUtils.h
+++ b/ipc/glue/IPCMessageUtils.h
@@ -11,11 +11,13 @@
 #include "chrome/common/ipc_message_utils.h"
 
 #include "mozilla/ArrayUtils.h"
+#include "mozilla/DebugOnly.h"
 #include "mozilla/TimeStamp.h"
 #ifdef XP_WIN
 #include "mozilla/TimeStamp_windows.h"
 #endif
 #include "mozilla/TypedEnum.h"
+#include "mozilla/TypeTraits.h"
 #include "mozilla/IntegerTypeTraits.h"
 
 #include <stdint.h>
@@ -464,12 +466,51 @@ struct ParamTraits<FallibleTArray<E> >
 {
   typedef FallibleTArray<E> paramType;
 
+  // We write arrays of integer or floating-point data using a single pickling
+  // call, rather than writing each element individually.  We deliberately do
+  // not use mozilla::IsPod here because it is perfectly reasonable to have
+  // a data structure T for which IsPod<T>::value is true, yet also have a
+  // ParamTraits<T> specialization.
+  static const bool sUseWriteBytes = (mozilla::IsIntegral<E>::value ||
+                                      mozilla::IsFloatingPoint<E>::value);
+
+  // Compute the byte length for |aNumElements| of type E.  If that length
+  // would overflow an int, return false.  Otherwise, return true and place
+  // the byte length in |aTotalLength|.
+  //
+  // Pickle's ReadBytes/WriteBytes interface takes lengths in ints, hence this
+  // dance.
+  static bool ByteLengthIsValid(size_t aNumElements, int* aTotalLength) {
+    static_assert(sizeof(int) == sizeof(int32_t), "int is an unexpected size!");
+
+    // nsTArray only handles sizes up to INT32_MAX.
+    if (aNumElements > size_t(INT32_MAX)) {
+      return false;
+    }
+
+    int64_t numBytes = static_cast<int64_t>(aNumElements) * sizeof(E);
+    if (numBytes > int64_t(INT32_MAX)) {
+      return false;
+    }
+
+    *aTotalLength = static_cast<int>(numBytes);
+    return true;
+  }
+
   static void Write(Message* aMsg, const paramType& aParam)
   {
     uint32_t length = aParam.Length();
     WriteParam(aMsg, length);
-    for (uint32_t index = 0; index < length; index++) {
-      WriteParam(aMsg, aParam[index]);
+
+    if (sUseWriteBytes) {
+      int pickledLength = 0;
+      mozilla::DebugOnly<bool> valid = ByteLengthIsValid(length, &pickledLength);
+      MOZ_ASSERT(valid);
+      aMsg->WriteBytes(aParam.Elements(), pickledLength);
+    } else {
+      for (uint32_t index = 0; index < length; index++) {
+        WriteParam(aMsg, aParam[index]);
+      }
     }
   }
 
@@ -480,12 +521,35 @@ struct ParamTraits<FallibleTArray<E> >
       return false;
     }
 
-    aResult->SetCapacity(length);
-    for (uint32_t index = 0; index < length; index++) {
-      E* element = aResult->AppendElement();
-      if (!(element && ReadParam(aMsg, aIter, element))) {
+    if (sUseWriteBytes) {
+      int pickledLength = 0;
+      if (!ByteLengthIsValid(length, &pickledLength)) {
         return false;
       }
+
+      const char* outdata;
+      if (!aMsg->ReadBytes(aIter, &outdata, pickledLength)) {
+        return false;
+      }
+
+      E* elements = aResult->AppendElements(length);
+      if (!elements) {
+        return false;
+      }
+
+      memcpy(elements, outdata, pickledLength);
+    } else {
+      if (!aResult->SetCapacity(length)) {
+        return false;
+      }
+
+      for (uint32_t index = 0; index < length; index++) {
+        E* element = aResult->AppendElement();
+        MOZ_ASSERT(element);
+        if (!ReadParam(aMsg, aIter, element)) {
+          return false;
+        }
+      }
     }
 
     return true;

From 60b5c327818ca7be0ab7bb008697c429bdff6b7b Mon Sep 17 00:00:00 2001
From: Nathan Froyd <froydnj@mozilla.com>
Date: Tue, 4 Nov 2014 11:33:06 -0500
Subject: [PATCH 029/153] Bug 1093809 - make Pickle reading functions
 MOZ_WARN_UNUSED_RESULT; r=bent

---
 ipc/chromium/src/base/pickle.h | 46 ++++++++++++++++++----------------
 1 file changed, 24 insertions(+), 22 deletions(-)

diff --git a/ipc/chromium/src/base/pickle.h b/ipc/chromium/src/base/pickle.h
index 3c9061dbba9..55c88a03152 100644
--- a/ipc/chromium/src/base/pickle.h
+++ b/ipc/chromium/src/base/pickle.h
@@ -11,6 +11,8 @@
 #include "base/logging.h"
 #include "base/string16.h"
 
+#include "mozilla/Attributes.h"
+
 // This class provides facilities for basic binary value packing and unpacking.
 //
 // The Pickle class supports appending primitive values (ints, strings, etc.)
@@ -67,31 +69,31 @@ class Pickle {
   // the Pickle, initialize *iter to NULL.  If successful, these methods return
   // true.  Otherwise, false is returned to indicate that the result could not
   // be extracted.
-  bool ReadBool(void** iter, bool* result) const;
-  bool ReadInt16(void** iter, int16_t* result) const;
-  bool ReadUInt16(void** iter, uint16_t* result) const;
-  bool ReadShort(void** iter, short* result) const;
-  bool ReadInt(void** iter, int* result) const;
-  bool ReadLong(void** iter, long* result) const;
-  bool ReadULong(void** iter, unsigned long* result) const;
-  bool ReadSize(void** iter, size_t* result) const;
-  bool ReadInt32(void** iter, int32_t* result) const;
-  bool ReadUInt32(void** iter, uint32_t* result) const;
-  bool ReadInt64(void** iter, int64_t* result) const;
-  bool ReadUInt64(void** iter, uint64_t* result) const;
-  bool ReadDouble(void** iter, double* result) const;
-  bool ReadIntPtr(void** iter, intptr_t* result) const;
-  bool ReadUnsignedChar(void** iter, unsigned char* result) const;
-  bool ReadString(void** iter, std::string* result) const;
-  bool ReadWString(void** iter, std::wstring* result) const;
-  bool ReadString16(void** iter, string16* result) const;
-  bool ReadData(void** iter, const char** data, int* length) const;
-  bool ReadBytes(void** iter, const char** data, int length,
-                 uint32_t alignment = sizeof(memberAlignmentType)) const;
+  MOZ_WARN_UNUSED_RESULT bool ReadBool(void** iter, bool* result) const;
+  MOZ_WARN_UNUSED_RESULT bool ReadInt16(void** iter, int16_t* result) const;
+  MOZ_WARN_UNUSED_RESULT bool ReadUInt16(void** iter, uint16_t* result) const;
+  MOZ_WARN_UNUSED_RESULT bool ReadShort(void** iter, short* result) const;
+  MOZ_WARN_UNUSED_RESULT bool ReadInt(void** iter, int* result) const;
+  MOZ_WARN_UNUSED_RESULT bool ReadLong(void** iter, long* result) const;
+  MOZ_WARN_UNUSED_RESULT bool ReadULong(void** iter, unsigned long* result) const;
+  MOZ_WARN_UNUSED_RESULT bool ReadSize(void** iter, size_t* result) const;
+  MOZ_WARN_UNUSED_RESULT bool ReadInt32(void** iter, int32_t* result) const;
+  MOZ_WARN_UNUSED_RESULT bool ReadUInt32(void** iter, uint32_t* result) const;
+  MOZ_WARN_UNUSED_RESULT bool ReadInt64(void** iter, int64_t* result) const;
+  MOZ_WARN_UNUSED_RESULT bool ReadUInt64(void** iter, uint64_t* result) const;
+  MOZ_WARN_UNUSED_RESULT bool ReadDouble(void** iter, double* result) const;
+  MOZ_WARN_UNUSED_RESULT bool ReadIntPtr(void** iter, intptr_t* result) const;
+  MOZ_WARN_UNUSED_RESULT bool ReadUnsignedChar(void** iter, unsigned char* result) const;
+  MOZ_WARN_UNUSED_RESULT bool ReadString(void** iter, std::string* result) const;
+  MOZ_WARN_UNUSED_RESULT bool ReadWString(void** iter, std::wstring* result) const;
+  MOZ_WARN_UNUSED_RESULT bool ReadString16(void** iter, string16* result) const;
+  MOZ_WARN_UNUSED_RESULT bool ReadData(void** iter, const char** data, int* length) const;
+  MOZ_WARN_UNUSED_RESULT bool ReadBytes(void** iter, const char** data, int length,
+					uint32_t alignment = sizeof(memberAlignmentType)) const;
 
   // Safer version of ReadInt() checks for the result not being negative.
   // Use it for reading the object sizes.
-  bool ReadLength(void** iter, int* result) const;
+  MOZ_WARN_UNUSED_RESULT bool ReadLength(void** iter, int* result) const;
 
   // Methods for adding to the payload of the Pickle.  These values are
   // appended to the end of the Pickle's payload.  When reading values from a

From 997000fd405a414d646c3b8e93467ee6aa15187c Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Tue, 21 Oct 2014 10:32:09 +1300
Subject: [PATCH 030/153] Bug 1083635. Part 1: Remove nsDisplayZoom::Paint
 since it's dead code. r=mattwoodrow

--HG--
extra : rebase_source : bb053e5abb7f5a8ae17ab59af542db292ba35543
---
 layout/base/nsDisplayList.cpp | 6 ------
 layout/base/nsDisplayList.h   | 1 -
 2 files changed, 7 deletions(-)

diff --git a/layout/base/nsDisplayList.cpp b/layout/base/nsDisplayList.cpp
index b7187729641..e27dab52f17 100644
--- a/layout/base/nsDisplayList.cpp
+++ b/layout/base/nsDisplayList.cpp
@@ -4418,12 +4418,6 @@ void nsDisplayZoom::HitTest(nsDisplayListBuilder *aBuilder,
   mList.HitTest(aBuilder, rect, aState, aOutFrames);
 }
 
-void nsDisplayZoom::Paint(nsDisplayListBuilder* aBuilder,
-                          nsRenderingContext* aCtx)
-{
-  mList.PaintForFrame(aBuilder, aCtx, mFrame, nsDisplayList::PAINT_DEFAULT);
-}
-
 bool nsDisplayZoom::ComputeVisibility(nsDisplayListBuilder *aBuilder,
                                       nsRegion *aVisibleRegion)
 {
diff --git a/layout/base/nsDisplayList.h b/layout/base/nsDisplayList.h
index de38c608e2f..4439d06fe9a 100644
--- a/layout/base/nsDisplayList.h
+++ b/layout/base/nsDisplayList.h
@@ -3180,7 +3180,6 @@ public:
 #endif
   
   virtual nsRect GetBounds(nsDisplayListBuilder* aBuilder, bool* aSnap) MOZ_OVERRIDE;
-  virtual void Paint(nsDisplayListBuilder* aBuilder, nsRenderingContext* aCtx) MOZ_OVERRIDE;
   virtual void HitTest(nsDisplayListBuilder* aBuilder, const nsRect& aRect,
                        HitTestState* aState, nsTArray<nsIFrame*> *aOutFrames) MOZ_OVERRIDE;
   virtual bool ComputeVisibility(nsDisplayListBuilder* aBuilder,

From 50bd448572f55dd7947a6ede19e21b04284a667e Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Tue, 21 Oct 2014 10:32:09 +1300
Subject: [PATCH 031/153] Bug 1083635. Part 2: Inline
 nsDisplayList::PaintForFrame into PaintRoot. r=mattwoodrow

--HG--
extra : rebase_source : 1d313b18a2b0cc5894924299f421966a1f428799
---
 layout/base/nsDisplayList.cpp | 31 +++++++++++++------------------
 layout/base/nsDisplayList.h   |  6 ------
 2 files changed, 13 insertions(+), 24 deletions(-)

diff --git a/layout/base/nsDisplayList.cpp b/layout/base/nsDisplayList.cpp
index e27dab52f17..5335a760f0c 100644
--- a/layout/base/nsDisplayList.cpp
+++ b/layout/base/nsDisplayList.cpp
@@ -1278,23 +1278,17 @@ nsDisplayList::ComputeVisibilityForSublist(nsDisplayListBuilder* aBuilder,
   return anyVisible;
 }
 
-void nsDisplayList::PaintRoot(nsDisplayListBuilder* aBuilder,
-                              nsRenderingContext* aCtx,
-                              uint32_t aFlags) {
-  PROFILER_LABEL("nsDisplayList", "PaintRoot",
-    js::ProfileEntry::Category::GRAPHICS);
-  PaintForFrame(aBuilder, aCtx, aBuilder->RootReferenceFrame(), aFlags);
-}
-
 /**
  * We paint by executing a layer manager transaction, constructing a
  * single layer representing the display list, and then making it the
  * root of the layer manager, drawing into the PaintedLayers.
  */
-void nsDisplayList::PaintForFrame(nsDisplayListBuilder* aBuilder,
-                                  nsRenderingContext* aCtx,
-                                  nsIFrame* aForFrame,
-                                  uint32_t aFlags) {
+void nsDisplayList::PaintRoot(nsDisplayListBuilder* aBuilder,
+                              nsRenderingContext* aCtx,
+                              uint32_t aFlags) {
+  PROFILER_LABEL("nsDisplayList", "PaintRoot",
+    js::ProfileEntry::Category::GRAPHICS);
+
   nsRefPtr<LayerManager> layerManager;
   bool widgetTransaction = false;
   bool allowRetaining = false;
@@ -1347,7 +1341,8 @@ void nsDisplayList::PaintForFrame(nsDisplayListBuilder* aBuilder,
     layerBuilder->DidBeginRetainedLayerTransaction(layerManager);
   }
 
-  nsPresContext* presContext = aForFrame->PresContext();
+  nsIFrame* frame = aBuilder->RootReferenceFrame();
+  nsPresContext* presContext = frame->PresContext();
   nsIPresShell* presShell = presContext->GetPresShell();
 
   NotifySubDocInvalidationFunc computeInvalidFunc =
@@ -1364,7 +1359,7 @@ void nsDisplayList::PaintForFrame(nsDisplayListBuilder* aBuilder,
   ContainerLayerParameters containerParameters
     (presShell->GetXResolution(), presShell->GetYResolution());
   nsRefPtr<ContainerLayer> root = layerBuilder->
-    BuildContainerLayerFor(aBuilder, layerManager, aForFrame, nullptr, this,
+    BuildContainerLayerFor(aBuilder, layerManager, frame, nullptr, this,
                            containerParameters, nullptr);
 
   nsIDocument* document = nullptr;
@@ -1384,11 +1379,11 @@ void nsDisplayList::PaintForFrame(nsDisplayListBuilder* aBuilder,
 
   nsIFrame* rootScrollFrame = presShell->GetRootScrollFrame();
 
-  nsRect viewport(aBuilder->ToReferenceFrame(aForFrame), aForFrame->GetSize());
+  nsRect viewport(aBuilder->ToReferenceFrame(frame), frame->GetSize());
 
   root->SetFrameMetrics(
-    nsDisplayScrollLayer::ComputeFrameMetrics(aForFrame, rootScrollFrame,
-                       aBuilder->FindReferenceFrameFor(aForFrame),
+    nsDisplayScrollLayer::ComputeFrameMetrics(frame, rootScrollFrame,
+                       aBuilder->FindReferenceFrameFor(frame),
                        root, FrameMetrics::NULL_SCROLL_ID, viewport,
                        !isRoot, isRoot, containerParameters));
 
@@ -1418,7 +1413,7 @@ void nsDisplayList::PaintForFrame(nsDisplayListBuilder* aBuilder,
       // but they still need the invalidation state bits cleared in order for
       // invalidation for CSS/SMIL animation to work properly.
       (document && document->IsBeingUsedAsImage())) {
-    aForFrame->ClearInvalidationStateBits();
+    frame->ClearInvalidationStateBits();
   }
 
   bool temp = aBuilder->SetIsCompositingCheap(layerManager->IsCompositingCheap());
diff --git a/layout/base/nsDisplayList.h b/layout/base/nsDisplayList.h
index 4439d06fe9a..e6496da4d64 100644
--- a/layout/base/nsDisplayList.h
+++ b/layout/base/nsDisplayList.h
@@ -1672,12 +1672,6 @@ public:
   };
   void PaintRoot(nsDisplayListBuilder* aBuilder, nsRenderingContext* aCtx,
                  uint32_t aFlags);
-  /**
-   * Like PaintRoot, but used for internal display sublists.
-   * aForFrame is the frame that the list is associated with.
-   */
-  void PaintForFrame(nsDisplayListBuilder* aBuilder, nsRenderingContext* aCtx,
-                     nsIFrame* aForFrame, uint32_t aFlags);
   /**
    * Get the bounds. Takes the union of the bounds of all children.
    * The result is not cached.

From 7d45b99ff888d6794709bf72f557acc250f745be Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Tue, 21 Oct 2014 10:32:10 +1300
Subject: [PATCH 032/153] Bug 1083635. Part 3: Flush displaylist dump before
 calling PaintRoot. r=mattwoodrow

--HG--
extra : rebase_source : 6da7f168218036a13be7dcd73ed8b3c552dcace1
---
 layout/base/nsLayoutUtils.cpp | 29 +++++++++++++++++------------
 1 file changed, 17 insertions(+), 12 deletions(-)

diff --git a/layout/base/nsLayoutUtils.cpp b/layout/base/nsLayoutUtils.cpp
index bc44caebe81..9a83a19ee5b 100644
--- a/layout/base/nsLayoutUtils.cpp
+++ b/layout/base/nsLayoutUtils.cpp
@@ -3066,7 +3066,7 @@ nsLayoutUtils::PaintFrame(nsRenderingContext* aRenderingContext, nsIFrame* aFram
 #ifdef MOZ_DUMP_PAINTING
   FILE* savedDumpFile = gfxUtils::sDumpPaintFile;
 
-  std::stringstream ss;
+  UniquePtr<std::stringstream> ss = MakeUnique<std::stringstream>();
   if (gfxUtils::DumpPaintList() || gfxUtils::sDumpPainting) {
     if (gfxUtils::sDumpPaintingToFile) {
       nsCString string("dump-");
@@ -3077,13 +3077,18 @@ nsLayoutUtils::PaintFrame(nsRenderingContext* aRenderingContext, nsIFrame* aFram
       gfxUtils::sDumpPaintFile = stderr;
     }
     if (gfxUtils::sDumpPaintingToFile) {
-      ss << "<html><head><script>var array = {}; function ViewImage(index) { window.location = array[index]; }</script></head><body>";
+      *ss << "<html><head><script>var array = {}; function ViewImage(index) { window.location = array[index]; }</script></head><body>";
     }
-    ss << nsPrintfCString("Painting --- before optimization (dirty %d,%d,%d,%d):\n",
+    *ss << nsPrintfCString("Painting --- before optimization (dirty %d,%d,%d,%d):\n",
             dirtyRect.x, dirtyRect.y, dirtyRect.width, dirtyRect.height).get();
-    nsFrame::PrintDisplayList(&builder, list, ss, gfxUtils::sDumpPaintingToFile);
+    nsFrame::PrintDisplayList(&builder, list, *ss, gfxUtils::sDumpPaintingToFile);
     if (gfxUtils::sDumpPaintingToFile) {
-      ss << "<script>";
+      *ss << "<script>";
+    } else {
+      // Flush stream now to avoid reordering dump output relative to
+      // messages dumped by PaintRoot below.
+      fprint_stderr(gfxUtils::sDumpPaintFile, *ss);
+      ss = MakeUnique<std::stringstream>();
     }
   }
 #endif
@@ -3124,25 +3129,25 @@ nsLayoutUtils::PaintFrame(nsRenderingContext* aRenderingContext, nsIFrame* aFram
 #ifdef MOZ_DUMP_PAINTING
   if (gfxUtils::DumpPaintList() || gfxUtils::sDumpPainting) {
     if (gfxUtils::sDumpPaintingToFile) {
-      ss << "</script>";
+      *ss << "</script>";
     }
-    ss << "Painting --- after optimization:\n";
-    nsFrame::PrintDisplayList(&builder, list, ss, gfxUtils::sDumpPaintingToFile);
+    *ss << "Painting --- after optimization:\n";
+    nsFrame::PrintDisplayList(&builder, list, *ss, gfxUtils::sDumpPaintingToFile);
 
-    ss << "Painting --- retained layer tree:\n";
+    *ss << "Painting --- retained layer tree:\n";
     nsIWidget* widget = aFrame->GetNearestWidget();
     if (widget) {
       nsRefPtr<LayerManager> layerManager = widget->GetLayerManager();
       if (layerManager) {
-        FrameLayerBuilder::DumpRetainedLayerTree(layerManager, ss,
+        FrameLayerBuilder::DumpRetainedLayerTree(layerManager, *ss,
                                                  gfxUtils::sDumpPaintingToFile);
       }
     }
     if (gfxUtils::sDumpPaintingToFile) {
-      ss << "</body></html>";
+      *ss << "</body></html>";
     }
 
-    fprint_stderr(gfxUtils::sDumpPaintFile, ss);
+    fprint_stderr(gfxUtils::sDumpPaintFile, *ss);
 
     if (gfxUtils::sDumpPaintingToFile) {
       fclose(gfxUtils::sDumpPaintFile);

From c72141ba760d739a4a3e94fc681bb6ce4fb5d80e Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Tue, 21 Oct 2014 10:32:10 +1300
Subject: [PATCH 033/153] Bug 1083635. Part 4: Return LayerManager from
 nsDisplayList::PaintRoot, and dump its contents in nsLayoutUtils::PaintFrame.
 r=mattwoodrow

--HG--
extra : rebase_source : 8c39aebedb275b56eda4a740b63ae4e00523c206
---
 layout/base/nsDisplayList.cpp | 11 ++++++-----
 layout/base/nsDisplayList.h   | 10 ++++++----
 layout/base/nsLayoutUtils.cpp | 21 ++++++---------------
 layout/base/nsPresShell.cpp   |  4 +++-
 4 files changed, 21 insertions(+), 25 deletions(-)

diff --git a/layout/base/nsDisplayList.cpp b/layout/base/nsDisplayList.cpp
index 5335a760f0c..7d95861d45f 100644
--- a/layout/base/nsDisplayList.cpp
+++ b/layout/base/nsDisplayList.cpp
@@ -1283,9 +1283,9 @@ nsDisplayList::ComputeVisibilityForSublist(nsDisplayListBuilder* aBuilder,
  * single layer representing the display list, and then making it the
  * root of the layer manager, drawing into the PaintedLayers.
  */
-void nsDisplayList::PaintRoot(nsDisplayListBuilder* aBuilder,
-                              nsRenderingContext* aCtx,
-                              uint32_t aFlags) {
+already_AddRefed<LayerManager> nsDisplayList::PaintRoot(nsDisplayListBuilder* aBuilder,
+                                                        nsRenderingContext* aCtx,
+                                                        uint32_t aFlags) {
   PROFILER_LABEL("nsDisplayList", "PaintRoot",
     js::ProfileEntry::Category::GRAPHICS);
 
@@ -1311,7 +1311,7 @@ void nsDisplayList::PaintRoot(nsDisplayListBuilder* aBuilder,
   if (!layerManager) {
     if (!aCtx) {
       NS_WARNING("Nowhere to paint into");
-      return;
+      return nullptr;
     }
     layerManager = new BasicLayerManager(BasicLayerManager::BLM_OFFSCREEN);
   }
@@ -1369,7 +1369,7 @@ void nsDisplayList::PaintRoot(nsDisplayListBuilder* aBuilder,
 
   if (!root) {
     layerManager->SetUserData(&gLayerManagerLayerBuilder, oldBuilder);
-    return;
+    return nullptr;
   }
   // Root is being scaled up by the X/Y resolution. Scale it back down.
   root->SetPostScale(1.0f/containerParameters.mXScale,
@@ -1468,6 +1468,7 @@ void nsDisplayList::PaintRoot(nsDisplayListBuilder* aBuilder,
   }
 
   layerManager->SetUserData(&gLayerManagerLayerBuilder, oldBuilder);
+  return layerManager.forget();
 }
 
 uint32_t nsDisplayList::Count() const {
diff --git a/layout/base/nsDisplayList.h b/layout/base/nsDisplayList.h
index e6496da4d64..10f35a8228d 100644
--- a/layout/base/nsDisplayList.h
+++ b/layout/base/nsDisplayList.h
@@ -1657,10 +1657,11 @@ public:
    * If PAINT_COMPRESSED is set, the FrameLayerBuilder should be set to compressed mode
    * to avoid short cut optimizations.
    *
-   * ComputeVisibility must be called before Paint.
-   * 
    * This must only be called on the root display list of the display list
    * tree.
+   *
+   * We return the layer manager used for painting --- mainly so that
+   * callers can dump its layer tree if necessary.
    */
   enum {
     PAINT_DEFAULT = 0,
@@ -1670,8 +1671,9 @@ public:
     PAINT_NO_COMPOSITE = 0x08,
     PAINT_COMPRESSED = 0x10
   };
-  void PaintRoot(nsDisplayListBuilder* aBuilder, nsRenderingContext* aCtx,
-                 uint32_t aFlags);
+  already_AddRefed<LayerManager> PaintRoot(nsDisplayListBuilder* aBuilder,
+                                           nsRenderingContext* aCtx,
+                                           uint32_t aFlags);
   /**
    * Get the bounds. Takes the union of the bounds of all children.
    * The result is not cached.
diff --git a/layout/base/nsLayoutUtils.cpp b/layout/base/nsLayoutUtils.cpp
index 9a83a19ee5b..04975014559 100644
--- a/layout/base/nsLayoutUtils.cpp
+++ b/layout/base/nsLayoutUtils.cpp
@@ -3124,7 +3124,8 @@ nsLayoutUtils::PaintFrame(nsRenderingContext* aRenderingContext, nsIFrame* aFram
     flags |= nsDisplayList::PAINT_COMPRESSED;
   }
 
-  list.PaintRoot(&builder, aRenderingContext, flags);
+  nsRefPtr<LayerManager> layerManager =
+    list.PaintRoot(&builder, aRenderingContext, flags);
 
 #ifdef MOZ_DUMP_PAINTING
   if (gfxUtils::DumpPaintList() || gfxUtils::sDumpPainting) {
@@ -3134,14 +3135,10 @@ nsLayoutUtils::PaintFrame(nsRenderingContext* aRenderingContext, nsIFrame* aFram
     *ss << "Painting --- after optimization:\n";
     nsFrame::PrintDisplayList(&builder, list, *ss, gfxUtils::sDumpPaintingToFile);
 
-    *ss << "Painting --- retained layer tree:\n";
-    nsIWidget* widget = aFrame->GetNearestWidget();
-    if (widget) {
-      nsRefPtr<LayerManager> layerManager = widget->GetLayerManager();
-      if (layerManager) {
-        FrameLayerBuilder::DumpRetainedLayerTree(layerManager, *ss,
-                                                 gfxUtils::sDumpPaintingToFile);
-      }
+    *ss << "Painting --- layer tree:\n";
+    if (layerManager) {
+      FrameLayerBuilder::DumpRetainedLayerTree(layerManager, *ss,
+                                               gfxUtils::sDumpPaintingToFile);
     }
     if (gfxUtils::sDumpPaintingToFile) {
       *ss << "</body></html>";
@@ -3177,12 +3174,6 @@ nsLayoutUtils::PaintFrame(nsRenderingContext* aRenderingContext, nsIFrame* aFram
   }
 
   if (builder.WillComputePluginGeometry()) {
-    nsRefPtr<LayerManager> layerManager;
-    nsIWidget* widget = aFrame->GetNearestWidget();
-    if (widget) {
-      layerManager = widget->GetLayerManager();
-    }
-
     rootPresContext->ComputePluginGeometryUpdates(aFrame, &builder, &list);
 
     // We're not going to get a WillPaintWindow event here if we didn't do
diff --git a/layout/base/nsPresShell.cpp b/layout/base/nsPresShell.cpp
index 1154e465533..377320e7712 100644
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -5255,7 +5255,9 @@ PresShell::PaintRangePaintInfo(nsTArray<nsAutoPtr<RangePaintInfo> >* aItems,
     ctx->SetMatrix(initialTM.Translate(rootOffset));
     aArea.MoveBy(-rangeInfo->mRootOffset.x, -rangeInfo->mRootOffset.y);
     nsRegion visible(aArea);
-    rangeInfo->mList.PaintRoot(&rangeInfo->mBuilder, &rc, nsDisplayList::PAINT_DEFAULT);
+    nsRefPtr<LayerManager> layerManager =
+        rangeInfo->mList.PaintRoot(&rangeInfo->mBuilder, &rc,
+                                   nsDisplayList::PAINT_DEFAULT);
     aArea.MoveBy(rangeInfo->mRootOffset.x, rangeInfo->mRootOffset.y);
   }
 

From d0f1ae646ea1e490e3693e6ae05f7a2cd2a10d3c Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Tue, 4 Nov 2014 17:05:44 +1300
Subject: [PATCH 034/153] Bug 1083635. Part 4.2: Create
 nsDOMWindowUtils::UpdateLayerTree and use it to flush layers in reftest
 content processes instead of doing a DRAW_WIDGET_LAYERS drawWindow.
 r=mattwoodrow

--HG--
extra : rebase_source : b1db1f0171180ed0a7ca36f92653cb702124fc95
---
 dom/base/nsDOMWindowUtils.cpp             | 10 ++++++++++
 dom/interfaces/base/nsIDOMWindowUtils.idl |  7 ++++++-
 layout/base/nsIPresShell.h                |  4 ++--
 layout/tools/reftest/reftest-content.js   |  8 +-------
 4 files changed, 19 insertions(+), 10 deletions(-)

diff --git a/dom/base/nsDOMWindowUtils.cpp b/dom/base/nsDOMWindowUtils.cpp
index 165f3794efa..71172e71993 100644
--- a/dom/base/nsDOMWindowUtils.cpp
+++ b/dom/base/nsDOMWindowUtils.cpp
@@ -271,6 +271,16 @@ nsDOMWindowUtils::Redraw(uint32_t aCount, uint32_t *aDurationOut)
   return NS_ERROR_FAILURE;
 }
 
+NS_IMETHODIMP
+nsDOMWindowUtils::UpdateLayerTree()
+{
+  if (nsIPresShell* presShell = GetPresShell()) {
+    nsRefPtr<nsViewManager> vm = presShell->GetViewManager();
+    vm->ProcessPendingUpdates();
+  }
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsDOMWindowUtils::SetCSSViewport(float aWidthPx, float aHeightPx)
 {
diff --git a/dom/interfaces/base/nsIDOMWindowUtils.idl b/dom/interfaces/base/nsIDOMWindowUtils.idl
index ecbb125b787..63d3165acbc 100644
--- a/dom/interfaces/base/nsIDOMWindowUtils.idl
+++ b/dom/interfaces/base/nsIDOMWindowUtils.idl
@@ -51,7 +51,7 @@ interface nsITranslationNodeList;
 interface nsIJSRAIIHelper;
 interface nsIContentPermissionRequest;
 
-[scriptable, uuid(f7e4d5da-4dd0-455a-b448-d0224c17fd10)]
+[scriptable, uuid(01e0c3ca-37e7-4ab4-bd22-3e99d8d23336)]
 interface nsIDOMWindowUtils : nsISupports {
 
   /**
@@ -103,6 +103,11 @@ interface nsIDOMWindowUtils : nsISupports {
    */
   unsigned long redraw([optional] in unsigned long aCount);
 
+  /**
+   * Force a synchronous layer transaction for this window if necessary.
+   */
+  void updateLayerTree();
+
   /**
    * Set the CSS viewport to be |widthPx| x |heightPx| in units of CSS
    * pixels, regardless of the size of the enclosing widget/view.
diff --git a/layout/base/nsIPresShell.h b/layout/base/nsIPresShell.h
index aa573cf2320..eb48f3b9afa 100644
--- a/layout/base/nsIPresShell.h
+++ b/layout/base/nsIPresShell.h
@@ -1102,8 +1102,8 @@ public:
     RENDER_DRAWWINDOW_NOT_FLUSHING = 0x40
   };
   virtual nsresult RenderDocument(const nsRect& aRect, uint32_t aFlags,
-                                              nscolor aBackgroundColor,
-                                              gfxContext* aRenderedContext) = 0;
+                                  nscolor aBackgroundColor,
+                                  gfxContext* aRenderedContext) = 0;
 
   /**
    * Renders a node aNode to a surface and returns it. The aRegion may be used
diff --git a/layout/tools/reftest/reftest-content.js b/layout/tools/reftest/reftest-content.js
index 2c307e1bafc..5895fe89066 100644
--- a/layout/tools/reftest/reftest-content.js
+++ b/layout/tools/reftest/reftest-content.js
@@ -784,13 +784,7 @@ function SynchronizeForSnapshot(flags)
         }
     }
 
-    var dummyCanvas = content.document.createElementNS(XHTML_NS, "canvas");
-    dummyCanvas.setAttribute("width", 1);
-    dummyCanvas.setAttribute("height", 1);
-
-    var ctx = dummyCanvas.getContext("2d");
-    var flags = ctx.DRAWWINDOW_DRAW_CARET | ctx.DRAWWINDOW_DRAW_VIEW | ctx.DRAWWINDOW_USE_WIDGET_LAYERS;
-    ctx.drawWindow(content, 0, 0, 1, 1, "rgb(255,255,255)", flags);
+    windowUtils().updateLayerTree();
 
     // Setup async scroll offsets now, because any scrollable layers should
     // have had their AsyncPanZoomControllers created.

From c2d5639aae76844ddf15f04ecc01d7030820d329 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Fri, 24 Oct 2014 12:20:01 +1300
Subject: [PATCH 035/153] Bug 1083635. Part 4.5: Avoid requesting
 PAINT_WIDGET_LAYERS if we're in a content process. r=mattwoodrow

--HG--
extra : rebase_source : 2559a0f44319264fe6395ef833269fb412f18502
---
 layout/base/nsPresShell.cpp | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/layout/base/nsPresShell.cpp b/layout/base/nsPresShell.cpp
index 377320e7712..0f592b7752a 100644
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -4915,7 +4915,14 @@ PresShell::RenderDocument(const nsRect& aRect, uint32_t aFlags,
     nsView* view = rootFrame->GetView();
     if (view && view->GetWidget() &&
         nsLayoutUtils::GetDisplayRootFrame(rootFrame) == rootFrame) {
-      flags |= nsLayoutUtils::PAINT_WIDGET_LAYERS;
+      LayerManager* layerManager = view->GetWidget()->GetLayerManager();
+      // ClientLayerManagers in content processes don't support
+      // taking snapshots.
+      if (layerManager &&
+          (!layerManager->AsClientLayerManager() ||
+           XRE_GetProcessType() == GeckoProcessType_Default)) {
+        flags |= nsLayoutUtils::PAINT_WIDGET_LAYERS;
+      }
     }
   }
   if (!(aFlags & RENDER_CARET)) {

From bd30ce7c71ef08728ac850dc69cc080b92c946fa Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Tue, 21 Oct 2014 10:32:10 +1300
Subject: [PATCH 036/153] Bug 1083635. Part 5:
 ClientLayerManager::BeginTransactionWithTarget should assert if we're not
 going to take a snapshot. r=mattwoodrow

--HG--
extra : rebase_source : 07cea353735743670cc82031bcbe738932f56829
---
 gfx/layers/client/ClientLayerManager.cpp | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/gfx/layers/client/ClientLayerManager.cpp b/gfx/layers/client/ClientLayerManager.cpp
index d2c8e5dacf8..f38e5ef6b47 100644
--- a/gfx/layers/client/ClientLayerManager.cpp
+++ b/gfx/layers/client/ClientLayerManager.cpp
@@ -217,6 +217,9 @@ ClientLayerManager::BeginTransactionWithTarget(gfxContext* aTarget)
   // to it. This will happen at the end of the transaction.
   if (aTarget && XRE_GetProcessType() == GeckoProcessType_Default) {
     mShadowTarget = aTarget;
+  } else {
+    NS_ASSERTION(!aTarget,
+                 "Content-process ClientLayerManager::BeginTransactionWithTarget not supported");
   }
 
   // If this is a new paint, increment the paint sequence number.

From e2ca2f25988cab3ed0ea29f4180badbcab031614 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Tue, 21 Oct 2014 10:32:11 +1300
Subject: [PATCH 037/153] Bug 1083635. Part 6: Rename viewport to scrollport in
 ScrollFrameHelper::ComputeFrameMetrics. r=mattwoodrow

--HG--
extra : rebase_source : 188a2ddd979eacdcfee18b700d6c4f0c2ced48a0
---
 layout/generic/nsGfxScrollFrame.cpp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/layout/generic/nsGfxScrollFrame.cpp b/layout/generic/nsGfxScrollFrame.cpp
index f927b5f352d..6b51be74c97 100644
--- a/layout/generic/nsGfxScrollFrame.cpp
+++ b/layout/generic/nsGfxScrollFrame.cpp
@@ -3047,10 +3047,10 @@ ScrollFrameHelper::ComputeFrameMetrics(Layer* aLayer,
                                        nsRect* aClipRect,
                                        nsTArray<FrameMetrics>* aOutput) const
 {
-  nsRect viewport = mScrollPort +
+  nsRect scrollport = mScrollPort +
     mOuter->GetOffsetToCrossDoc(aContainerReferenceFrame);
   if (!(mIsRoot && mOuter->PresContext()->PresShell()->GetIsViewportOverridden())) {
-    *aClipRect = viewport;
+    *aClipRect = scrollport;
   }
 
   if (!mShouldBuildScrollableLayer || BuildScrollContainerLayers()) {
@@ -3062,7 +3062,7 @@ ScrollFrameHelper::ComputeFrameMetrics(Layer* aLayer,
   *aOutput->AppendElement() =
       nsDisplayScrollLayer::ComputeFrameMetrics(mScrolledFrame, mOuter,
         aContainerReferenceFrame, aLayer, mScrollParentID,
-        viewport, false, false, aParameters);
+        scrollport, false, false, aParameters);
 }
 
 bool

From cdb7a37f1ab13e68aa5315a749423583e950e73f Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Tue, 28 Oct 2014 17:34:58 +1300
Subject: [PATCH 038/153] Bug 1080205. Part 1: Don't add clip rects to
 async-scrolled layers for root scrollframes, since the FrameMetrics to scroll
 those layers will be set on a ContainerLayer parent. r=tn

--HG--
extra : rebase_source : b8fc0e3c97d5be50443734ed80caafabd37cf1a3
---
 layout/generic/nsGfxScrollFrame.cpp | 8 +++++++-
 layout/generic/nsGfxScrollFrame.h   | 2 ++
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/layout/generic/nsGfxScrollFrame.cpp b/layout/generic/nsGfxScrollFrame.cpp
index 6b51be74c97..6ef75c4e747 100644
--- a/layout/generic/nsGfxScrollFrame.cpp
+++ b/layout/generic/nsGfxScrollFrame.cpp
@@ -2800,6 +2800,7 @@ ScrollFrameHelper::BuildDisplayList(nsDisplayListBuilder*   aBuilder,
     mOuter->PresContext()->IsRootContentDocument();
 
   if (aBuilder->GetIgnoreScrollFrame() == mOuter || IsIgnoringViewportClipping()) {
+    mAddClipRectToLayer = false;
 
     // If we are a root scroll frame that has a display port we want to add
     // scrollbars, they will be children of the scrollable layer, but they get
@@ -2829,6 +2830,9 @@ ScrollFrameHelper::BuildDisplayList(nsDisplayListBuilder*   aBuilder,
     return;
   }
 
+  mAddClipRectToLayer =
+    !(mIsRoot && mOuter->PresContext()->PresShell()->GetIsViewportOverridden());
+
   // Overflow clipping can never clip frames outside our subtree, so there
   // is no need to worry about whether we are a moving frame that might clip
   // non-moving frames.
@@ -3049,7 +3053,9 @@ ScrollFrameHelper::ComputeFrameMetrics(Layer* aLayer,
 {
   nsRect scrollport = mScrollPort +
     mOuter->GetOffsetToCrossDoc(aContainerReferenceFrame);
-  if (!(mIsRoot && mOuter->PresContext()->PresShell()->GetIsViewportOverridden())) {
+  // Root scrollframes have FrameMetrics and clipping on their container layers,
+  // so don't also apply clipping here.
+  if (mAddClipRectToLayer) {
     *aClipRect = scrollport;
   }
 
diff --git a/layout/generic/nsGfxScrollFrame.h b/layout/generic/nsGfxScrollFrame.h
index 447828b94e8..8c27379c761 100644
--- a/layout/generic/nsGfxScrollFrame.h
+++ b/layout/generic/nsGfxScrollFrame.h
@@ -450,6 +450,8 @@ public:
   // If true, the layer should always be active because we always build a
   // scrollable layer. Used for asynchronous scrolling.
   bool mShouldBuildScrollableLayer:1;
+  // If true, add clipping in ScrollFrameHelper::ComputeFrameMetrics.
+  bool mAddClipRectToLayer:1;
 
   // True if this frame has been scrolled at least once
   bool mHasBeenScrolled:1;

From 628c45fc975b51618215cbc54f2128024b4425c0 Mon Sep 17 00:00:00 2001
From: Robert O'Callahan <robert@ocallahan.org>
Date: Thu, 30 Oct 2014 16:33:55 +1300
Subject: [PATCH 039/153] Bug 1080205. Part 2: Add test. r=tn

--HG--
extra : rebase_source : 9f8a41ae255e132e572fdb5012f851554fde69d9
---
 gfx/layers/ipc/PLayerTransaction.ipdl         |  2 +-
 .../async-scrolling/iframe-1-ref.html         | 10 +++++
 layout/reftests/async-scrolling/iframe-1.html | 12 +++++
 layout/reftests/async-scrolling/reftest.list  |  1 +
 layout/tools/reftest/reftest-content.js       | 44 ++++++++++++-------
 5 files changed, 53 insertions(+), 16 deletions(-)
 create mode 100644 layout/reftests/async-scrolling/iframe-1-ref.html
 create mode 100644 layout/reftests/async-scrolling/iframe-1.html

diff --git a/gfx/layers/ipc/PLayerTransaction.ipdl b/gfx/layers/ipc/PLayerTransaction.ipdl
index ded6f6ce48d..1360d48e987 100644
--- a/gfx/layers/ipc/PLayerTransaction.ipdl
+++ b/gfx/layers/ipc/PLayerTransaction.ipdl
@@ -84,7 +84,7 @@ parent:
   // The next time the layer tree is composited, add this async scroll offset in
   // CSS pixels for the given ViewID.
   // Useful for testing rendering of async scrolling.
-  async SetAsyncScrollOffset(ViewID id, int32_t x, int32_t y);
+  sync SetAsyncScrollOffset(ViewID id, int32_t x, int32_t y);
 
   // Drop any front buffers that might be retained on the compositor
   // side.
diff --git a/layout/reftests/async-scrolling/iframe-1-ref.html b/layout/reftests/async-scrolling/iframe-1-ref.html
new file mode 100644
index 00000000000..76537c52c10
--- /dev/null
+++ b/layout/reftests/async-scrolling/iframe-1-ref.html
@@ -0,0 +1,10 @@
+<!DOCTYPE HTML>
+<html>
+<body>
+<iframe style="width:300px; height:600px; border:2px solid blue"
+        srcdoc="<!DOCTYPE HTML>
+                <html style='overflow:hidden'>
+                <div style='height:450px'></div>
+                <div style='height:200px; background:purple'>
+                  <div style='display:inline-block; width:20px; height:20px; background:yellow;'></div>
+                </div>"></iframe>
diff --git a/layout/reftests/async-scrolling/iframe-1.html b/layout/reftests/async-scrolling/iframe-1.html
new file mode 100644
index 00000000000..fbd89d661ba
--- /dev/null
+++ b/layout/reftests/async-scrolling/iframe-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE HTML>
+<html reftest-async-scroll>
+<body>
+<iframe style="width:300px; height:600px; border:2px solid blue"
+        srcdoc="<!DOCTYPE HTML>
+                <html reftest-displayport-x='0' reftest-displayport-y='0'
+                      reftest-displayport-w='800' reftest-displayport-h='2000'
+                      reftest-async-scroll-x='0' reftest-async-scroll-y='50' style='overflow:hidden'>
+                <div style='height:500px'></div>
+                <div style='height:200px; background:purple'>
+                  <div style='display:inline-block; width:20px; height:20px; background:yellow;'></div>
+                </div>"></iframe>
diff --git a/layout/reftests/async-scrolling/reftest.list b/layout/reftests/async-scrolling/reftest.list
index f85725e7c7c..cdde191e288 100644
--- a/layout/reftests/async-scrolling/reftest.list
+++ b/layout/reftests/async-scrolling/reftest.list
@@ -3,6 +3,7 @@ pref(layout.async-containerless-scrolling.enabled,true) pref(apz.subframe.enable
 pref(layout.async-containerless-scrolling.enabled,true) pref(apz.subframe.enabled,true) skip-if(!asyncPanZoom) == bg-fixed-cover-2.html bg-fixed-cover-2-ref.html
 pref(layout.async-containerless-scrolling.enabled,true) pref(apz.subframe.enabled,true) skip-if(!asyncPanZoom) == bg-fixed-cover-3.html bg-fixed-cover-3-ref.html
 pref(layout.async-containerless-scrolling.enabled,true) pref(apz.subframe.enabled,true) skip-if(!asyncPanZoom) == element-1.html element-1-ref.html
+pref(layout.async-containerless-scrolling.enabled,true) pref(apz.subframe.enabled,true) pref(layers.force-active,true) skip-if(!asyncPanZoom) == iframe-1.html iframe-1-ref.html
 pref(layout.async-containerless-scrolling.enabled,true) pref(apz.subframe.enabled,true) skip-if(!asyncPanZoom) == nested-1.html nested-1-ref.html
 pref(layout.async-containerless-scrolling.enabled,true) pref(apz.subframe.enabled,true) skip-if(!asyncPanZoom) == position-fixed-1.html position-fixed-1-ref.html
 pref(layout.async-containerless-scrolling.enabled,true) pref(apz.subframe.enabled,true) skip-if(!asyncPanZoom) == position-fixed-2.html position-fixed-2-ref.html
diff --git a/layout/tools/reftest/reftest-content.js b/layout/tools/reftest/reftest-content.js
index 5895fe89066..c49d2e24235 100644
--- a/layout/tools/reftest/reftest-content.js
+++ b/layout/tools/reftest/reftest-content.js
@@ -57,9 +57,13 @@ function webNavigation() {
     return docShell.QueryInterface(CI.nsIWebNavigation);
 }
 
+function windowUtilsForWindow(w) {
+    return w.QueryInterface(CI.nsIInterfaceRequestor)
+            .getInterface(CI.nsIDOMWindowUtils);
+}
+
 function windowUtils() {
-    return content.QueryInterface(CI.nsIInterfaceRequestor)
-                  .getInterface(CI.nsIDOMWindowUtils);
+    return windowUtilsForWindow(content);
 }
 
 function IDForEventTarget(event)
@@ -208,28 +212,33 @@ function setupDisplayport(contentRootElement) {
         return;
     }
 
-    function setupDisplayportForElement(element) {
+    function setupDisplayportForElement(element, winUtils) {
         var dpw = attrOrDefault(element, "reftest-displayport-w", 0);
         var dph = attrOrDefault(element, "reftest-displayport-h", 0);
         var dpx = attrOrDefault(element, "reftest-displayport-x", 0);
         var dpy = attrOrDefault(element, "reftest-displayport-y", 0);
         if (dpw !== 0 || dph !== 0 || dpx != 0 || dpy != 0) {
             LogInfo("Setting displayport to <x="+ dpx +", y="+ dpy +", w="+ dpw +", h="+ dph +">");
-            windowUtils().setDisplayPortForElement(dpx, dpy, dpw, dph, element, 1);
+            winUtils.setDisplayPortForElement(dpx, dpy, dpw, dph, element, 1);
         }
     }
 
-    function setupDisplayportForElementSubtree(element) {
-        setupDisplayportForElement(element);
+    function setupDisplayportForElementSubtree(element, winUtils) {
+        setupDisplayportForElement(element, winUtils);
         for (var c = element.firstElementChild; c; c = c.nextElementSibling) {
-            setupDisplayportForElementSubtree(c);
+            setupDisplayportForElementSubtree(c, winUtils);
+        }
+        if (element.contentDocument) {
+            LogInfo("Descending into subdocument");
+            setupDisplayportForElementSubtree(element.contentDocument.documentElement,
+                                              windowUtilsForWindow(element.contentWindow));
         }
     }
 
     if (contentRootElement.hasAttribute("reftest-async-scroll")) {
-        setupDisplayportForElementSubtree(contentRootElement);
+        setupDisplayportForElementSubtree(contentRootElement, windowUtils());
     } else {
-        setupDisplayportForElement(contentRootElement);
+        setupDisplayportForElement(contentRootElement, windowUtils());
     }
 }
 
@@ -241,14 +250,14 @@ function setupAsyncScrollOffsets(options) {
         return;
     }
 
-    function setupAsyncScrollOffsetsForElement(element) {
+    function setupAsyncScrollOffsetsForElement(element, winUtils) {
         var sx = attrOrDefault(element, "reftest-async-scroll-x", 0);
         var sy = attrOrDefault(element, "reftest-async-scroll-y", 0);
         if (sx != 0 || sy != 0) {
             try {
                 // This might fail when called from RecordResult since layers
                 // may not have been constructed yet
-                windowUtils().setAsyncScrollOffset(element, sx, sy);
+                winUtils.setAsyncScrollOffset(element, sx, sy);
             } catch (e) {
                 if (!options.allowFailure) {
                     throw e;
@@ -257,16 +266,21 @@ function setupAsyncScrollOffsets(options) {
         }
     }
 
-    function setupAsyncScrollOffsetsForElementSubtree(element) {
-        setupAsyncScrollOffsetsForElement(element);
+    function setupAsyncScrollOffsetsForElementSubtree(element, winUtils) {
+        setupAsyncScrollOffsetsForElement(element, winUtils);
         for (var c = element.firstElementChild; c; c = c.nextElementSibling) {
-            setupAsyncScrollOffsetsForElementSubtree(c);
+            setupAsyncScrollOffsetsForElementSubtree(c, winUtils);
+        }
+        if (element.contentDocument) {
+            LogInfo("Descending into subdocument (async offsets)");
+            setupAsyncScrollOffsetsForElementSubtree(element.contentDocument.documentElement,
+                                                     windowUtilsForWindow(element.contentWindow));
         }
     }
 
     var asyncScroll = contentRootElement.hasAttribute("reftest-async-scroll");
     if (asyncScroll) {
-        setupAsyncScrollOffsetsForElementSubtree(contentRootElement);
+        setupAsyncScrollOffsetsForElementSubtree(contentRootElement, windowUtils());
     }
 }
 

From d146c5b08bf5ee11b988b676cbbd283e14911ea7 Mon Sep 17 00:00:00 2001
From: "Pankaj Malhotra(:bitgeeky)" <mozpankaj1994@gmail.com>
Date: Tue, 4 Nov 2014 16:59:40 -0800
Subject: [PATCH 040/153] Bug 1091270 - Move isURL out of automationutils;
 r=jgriffin

---
 build/automationutils.py               | 7 -------
 layout/tools/reftest/runreftest.py     | 4 ++--
 testing/mochitest/mochitest_options.py | 5 +++--
 testing/mochitest/runtests.py          | 4 ++--
 4 files changed, 7 insertions(+), 13 deletions(-)

diff --git a/build/automationutils.py b/build/automationutils.py
index 73fcf2782fb..5973342bed2 100644
--- a/build/automationutils.py
+++ b/build/automationutils.py
@@ -13,7 +13,6 @@ import signal
 import subprocess
 import sys
 import tempfile
-from urlparse import urlparse
 import zipfile
 import mozinfo
 
@@ -21,7 +20,6 @@ __all__ = [
   "ZipFileReader",
   "addCommonOptions",
   "dumpLeakLog",
-  "isURL",
   "processLeakLog",
   'KeyValueParseError',
   'parseKeyValue',
@@ -107,11 +105,6 @@ class ZipFileReader(object):
     for name in self._zipfile.namelist():
       self._extractname(name, path)
 
-def isURL(thing):
-  """Return True if |thing| looks like a URL."""
-  # We want to download URLs like http://... but not Windows paths like c:\...
-  return len(urlparse(thing).scheme) >= 2
-
 # Python does not provide strsignal() even in the very latest 3.x.
 # This is a reasonable fake.
 def strsig(n):
diff --git a/layout/tools/reftest/runreftest.py b/layout/tools/reftest/runreftest.py
index 272edbf58c7..ac2bf771e72 100644
--- a/layout/tools/reftest/runreftest.py
+++ b/layout/tools/reftest/runreftest.py
@@ -7,6 +7,7 @@ Runs the reftest test harness.
 """
 
 from optparse import OptionParser
+from urlparse import urlparse
 import collections
 import multiprocessing
 import os
@@ -24,7 +25,6 @@ from automationutils import (
     addCommonOptions,
     dumpScreen,
     environment,
-    isURL,
     processLeakLog
 )
 import mozcrash
@@ -786,7 +786,7 @@ Are you executing $objdir/_tests/reftest/runreftest.py?""" \
   if options.xrePath is None:
     options.xrePath = os.path.dirname(options.app)
 
-  if options.symbolsPath and not isURL(options.symbolsPath):
+  if options.symbolsPath and len(urlparse(options.symbolsPath).scheme) < 2:
     options.symbolsPath = reftest.getFullPath(options.symbolsPath)
   options.utilityPath = reftest.getFullPath(options.utilityPath)
 
diff --git a/testing/mochitest/mochitest_options.py b/testing/mochitest/mochitest_options.py
index 2e4a03c0bf4..0e92cabad46 100644
--- a/testing/mochitest/mochitest_options.py
+++ b/testing/mochitest/mochitest_options.py
@@ -2,13 +2,14 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
+from urlparse import urlparse
 import mozinfo
 import moznetwork
 import optparse
 import os
 import tempfile
 
-from automationutils import addCommonOptions, isURL
+from automationutils import addCommonOptions
 from mozprofile import DEFAULT_PORTS
 
 here = os.path.abspath(os.path.dirname(__file__))
@@ -504,7 +505,7 @@ class MochitestOptions(optparse.OptionParser):
         if options.certPath:
             options.certPath = mochitest.getFullPath(options.certPath)
 
-        if options.symbolsPath and not isURL(options.symbolsPath):
+        if options.symbolsPath and len(urlparse(options.symbolsPath).scheme) < 2:
             options.symbolsPath = mochitest.getFullPath(options.symbolsPath)
 
         # Set server information on the options object
diff --git a/testing/mochitest/runtests.py b/testing/mochitest/runtests.py
index 54e6c047a4a..e6f89d9e699 100644
--- a/testing/mochitest/runtests.py
+++ b/testing/mochitest/runtests.py
@@ -12,6 +12,7 @@ import sys
 SCRIPT_DIR = os.path.abspath(os.path.realpath(os.path.dirname(__file__)))
 sys.path.insert(0, SCRIPT_DIR);
 
+from urlparse import urlparse
 import ctypes
 import glob
 import json
@@ -35,7 +36,6 @@ import bisection
 
 from automationutils import (
     environment,
-    isURL,
     KeyValueParseError,
     parseKeyValue,
     processLeakLog,
@@ -2125,7 +2125,7 @@ def main():
 
   options.utilityPath = mochitest.getFullPath(options.utilityPath)
   options.certPath = mochitest.getFullPath(options.certPath)
-  if options.symbolsPath and not isURL(options.symbolsPath):
+  if options.symbolsPath and len(urlparse(options.symbolsPath).scheme) < 2:
     options.symbolsPath = mochitest.getFullPath(options.symbolsPath)
 
   return_code = mochitest.runTests(options)

From 7e118c77aa4377426502cbcecb8c30f2cc8e7cfd Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Tue, 4 Nov 2014 18:21:47 -0700
Subject: [PATCH 041/153] Bug 1091329 - Optimize writes to reference members of
 TypedObjects, r=nmatsakis,jandem.

---
 .../tests/TypedObject/jit-write-references.js |  83 +++++++++++++
 js/src/jit/CodeGenerator.cpp                  |  94 ++++++++++++++-
 js/src/jit/CodeGenerator.h                    |   2 +
 js/src/jit/Ion.cpp                            |   5 +
 js/src/jit/IonBuilder.cpp                     | 102 ++++++++++++++--
 js/src/jit/IonBuilder.h                       |  15 +++
 js/src/jit/IonTypes.h                         |   1 +
 js/src/jit/JitCompartment.h                   |   2 +
 js/src/jit/LIR-Common.h                       |  43 +++++++
 js/src/jit/LIR.h                              |   1 +
 js/src/jit/LOpcodes.h                         |   2 +
 js/src/jit/Lowering.cpp                       |  43 +++++++
 js/src/jit/Lowering.h                         |   3 +
 js/src/jit/MIR.h                              | 112 +++++++++++++++++-
 js/src/jit/MOpcodes.h                         |   3 +
 js/src/jit/ParallelSafetyAnalysis.cpp         |   3 +
 js/src/jit/TypePolicy.cpp                     |  28 +++++
 js/src/jit/TypePolicy.h                       |  13 ++
 js/src/jit/VMFunctions.cpp                    |  14 +++
 js/src/jit/VMFunctions.h                      |   4 +
 js/src/jit/arm/MacroAssembler-arm.cpp         |  18 ++-
 js/src/jit/arm/MacroAssembler-arm.h           |   6 +-
 js/src/jit/mips/MacroAssembler-mips.cpp       |  18 ++-
 js/src/jit/mips/MacroAssembler-mips.h         |   6 +-
 js/src/jit/x64/MacroAssembler-x64.h           |   9 +-
 js/src/jit/x86/MacroAssembler-x86.h           |   9 +-
 26 files changed, 603 insertions(+), 36 deletions(-)
 create mode 100644 js/src/jit-test/tests/TypedObject/jit-write-references.js

diff --git a/js/src/jit-test/tests/TypedObject/jit-write-references.js b/js/src/jit-test/tests/TypedObject/jit-write-references.js
new file mode 100644
index 00000000000..2ea25004ca7
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/jit-write-references.js
@@ -0,0 +1,83 @@
+if (typeof TypedObject === "undefined")
+    quit();
+
+var T = TypedObject;
+
+var ObjectStruct = new T.StructType({f: T.Object});
+var StringStruct = new T.StructType({f: T.string});
+var ValueStruct = new T.StructType({f: T.Any});
+
+// Suppress ion compilation of the global script.
+with({}){}
+
+var o = new ObjectStruct();
+var s = new StringStruct();
+var v = new ValueStruct();
+
+// Make sure that unboxed null pointers on the stack are marked correctly.
+whatever = new Array();
+function testGC(o, p) {
+    for (var i = 0; i < 5; i++) {
+        minorgc();
+        o.f = p;
+        whatever.push(new Array()); // minorgc needs garbage before it scans the stack.
+    }
+}
+testGC(o, {});
+testGC(o, null);
+
+// Test writing various things to an object field.
+function writeObject(o, v, expected) {
+    o.f = v;
+    assertEq(typeof o.f, "object");
+    assertEq("" + o.f, expected);
+}
+for (var i = 0; i < 5; i++)
+    writeObject(o, {toString: function() { return "helo"} }, "helo");
+for (var i = 0; i < 5; i++)
+    writeObject(o, null, "null");
+for (var i = 0; i < 5; i++)
+    writeObject(o, "three", "three");
+for (var i = 0; i < 5; i++)
+    writeObject(o, 4.5, "4.5");
+for (var i = 0; i < 5; i++) {
+    try {
+        writeObject(o, undefined, "");
+    } catch (e) {
+        assertEq(e instanceof TypeError, true);
+    }
+}
+
+// Test writing various things to a string field.
+function writeString(o, v, expected) {
+    o.f = v;
+    assertEq(typeof o.f, "string");
+    assertEq("" + o.f, expected);
+}
+for (var i = 0; i < 5; i++)
+    writeString(s, {toString: function() { return "helo"} }, "helo");
+for (var i = 0; i < 5; i++)
+    writeString(s, null, "null");
+for (var i = 0; i < 5; i++)
+    writeString(s, "three", "three");
+for (var i = 0; i < 5; i++)
+    writeString(s, 4.5, "4.5");
+for (var i = 0; i < 5; i++)
+    writeString(s, undefined, "undefined");
+
+// Test writing various things to a value field.
+function writeValue(o, v, expectedType, expected) {
+    o.f = v;
+    assertEq(typeof o.f, expectedType);
+    assertEq("" + o.f, expected);
+}
+for (var i = 0; i < 5; i++)
+    writeValue(v, {toString: function() { return "helo"} }, "object", "helo");
+for (var i = 0; i < 5; i++)
+    writeValue(v, null, "object", "null");
+for (var i = 0; i < 5; i++)
+    writeValue(v, "three", "string", "three");
+for (var i = 0; i < 5; i++)
+    writeValue(v, 4.5, "number", "4.5");
+for (var i = 0; i < 5; i++)
+    writeValue(v, undefined, "undefined", "undefined");
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index 13f076f0e11..0b67a45152a 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -1004,6 +1004,31 @@ CodeGenerator::visitValueToString(LValueToString *lir)
     return true;
 }
 
+typedef JSObject *(*ToObjectFn)(JSContext *, HandleValue, bool);
+static const VMFunction ToObjectInfo = FunctionInfo<ToObjectFn>(ToObjectSlow);
+
+bool
+CodeGenerator::visitValueToObjectOrNull(LValueToObjectOrNull *lir)
+{
+    ValueOperand input = ToValue(lir, LValueToObjectOrNull::Input);
+    Register output = ToRegister(lir->output());
+
+    OutOfLineCode *ool = oolCallVM(ToObjectInfo, lir, (ArgList(), input, Imm32(0)),
+                                   StoreRegisterTo(output));
+    if (!ool)
+        return false;
+
+    Label done;
+    masm.branchTestObject(Assembler::Equal, input, &done);
+    masm.branchTestNull(Assembler::NotEqual, input, ool->entry());
+
+    masm.bind(&done);
+    masm.unboxNonDouble(input, output);
+
+    masm.bind(ool->rejoin());
+    return true;
+}
+
 typedef JSObject *(*CloneRegExpObjectFn)(JSContext *, JSObject *);
 static const VMFunction CloneRegExpObjectInfo =
     FunctionInfo<CloneRegExpObjectFn>(CloneRegExpObject);
@@ -3919,12 +3944,14 @@ CodeGenerator::emitObjectOrStringResultChecks(LInstruction *lir, MDefinition *mi
     if (!branchIfInvalidated(temp, &done))
         return false;
 
-    if (mir->type() == MIRType_Object &&
+    if ((mir->type() == MIRType_Object || mir->type() == MIRType_ObjectOrNull) &&
         mir->resultTypeSet() &&
         !mir->resultTypeSet()->unknownObject())
     {
         // We have a result TypeSet, assert this object is in it.
         Label miss, ok;
+        if (mir->type() == MIRType_ObjectOrNull)
+            masm.branchPtr(Assembler::NotEqual, output, ImmWord(0), &ok);
         if (mir->resultTypeSet()->getObjectCount() > 0)
             masm.guardObjectType(output, mir->resultTypeSet(), temp, &miss);
         else
@@ -3944,11 +3971,26 @@ CodeGenerator::emitObjectOrStringResultChecks(LInstruction *lir, MDefinition *mi
         masm.loadJSContext(temp);
         masm.passABIArg(temp);
         masm.passABIArg(output);
-        masm.callWithABINoProfiling(mir->type() == MIRType_Object
-                                    ? JS_FUNC_TO_DATA_PTR(void *, AssertValidObjectPtr)
-                                    : mir->type() == MIRType_String
-                                      ? JS_FUNC_TO_DATA_PTR(void *, AssertValidStringPtr)
-                                      : JS_FUNC_TO_DATA_PTR(void *, AssertValidSymbolPtr));
+
+        void *callee;
+        switch (mir->type()) {
+          case MIRType_Object:
+            callee = JS_FUNC_TO_DATA_PTR(void *, AssertValidObjectPtr);
+            break;
+          case MIRType_ObjectOrNull:
+            callee = JS_FUNC_TO_DATA_PTR(void *, AssertValidObjectOrNullPtr);
+            break;
+          case MIRType_String:
+            callee = JS_FUNC_TO_DATA_PTR(void *, AssertValidStringPtr);
+            break;
+          case MIRType_Symbol:
+            callee = JS_FUNC_TO_DATA_PTR(void *, AssertValidSymbolPtr);
+            break;
+          default:
+            MOZ_CRASH();
+        }
+
+        masm.callWithABINoProfiling(callee);
         restoreVolatile();
     }
 
@@ -4028,6 +4070,7 @@ CodeGenerator::emitDebugResultChecks(LInstruction *ins)
 
     switch (mir->type()) {
       case MIRType_Object:
+      case MIRType_ObjectOrNull:
       case MIRType_String:
       case MIRType_Symbol:
         return emitObjectOrStringResultChecks(ins, mir);
@@ -6789,6 +6832,45 @@ CodeGenerator::visitOutOfLineStoreElementHole(OutOfLineStoreElementHole *ool)
     return true;
 }
 
+template <typename T>
+static void
+StoreUnboxedPointer(MacroAssembler &masm, T address, MIRType type, const LAllocation *value)
+{
+    masm.patchableCallPreBarrier(address, type);
+    if (value->isConstant()) {
+        Value v = *value->toConstant();
+        if (v.isMarkable()) {
+            masm.storePtr(ImmGCPtr(v.toGCThing()), address);
+        } else {
+            MOZ_ASSERT(v.isNull());
+            masm.storePtr(ImmWord(0), address);
+        }
+    } else {
+        masm.storePtr(ToRegister(value), address);
+    }
+}
+
+bool
+CodeGenerator::visitStoreUnboxedPointer(LStoreUnboxedPointer *lir)
+{
+    MOZ_ASSERT(lir->mir()->isStoreUnboxedObjectOrNull() || lir->mir()->isStoreUnboxedString());
+    MIRType type = lir->mir()->isStoreUnboxedObjectOrNull() ? MIRType_Object : MIRType_String;
+
+    Register elements = ToRegister(lir->elements());
+    const LAllocation *index = lir->index();
+    const LAllocation *value = lir->value();
+
+    if (index->isConstant()) {
+        Address address(elements, ToInt32(index) * sizeof(uintptr_t));
+        StoreUnboxedPointer(masm, address, type, value);
+    } else {
+        BaseIndex address(elements, ToRegister(index), ScalePointer);
+        StoreUnboxedPointer(masm, address, type, value);
+    }
+
+    return true;
+}
+
 typedef bool (*ArrayPopShiftFn)(JSContext *, HandleObject, MutableHandleValue);
 static const VMFunction ArrayPopDenseInfo = FunctionInfo<ArrayPopShiftFn>(jit::ArrayPopDense);
 static const VMFunction ArrayShiftDenseInfo = FunctionInfo<ArrayPopShiftFn>(jit::ArrayShiftDense);
diff --git a/js/src/jit/CodeGenerator.h b/js/src/jit/CodeGenerator.h
index ce3db386734..feaab4cd889 100644
--- a/js/src/jit/CodeGenerator.h
+++ b/js/src/jit/CodeGenerator.h
@@ -100,6 +100,7 @@ class CodeGenerator : public CodeGeneratorSpecific
     bool visitIntToString(LIntToString *lir);
     bool visitDoubleToString(LDoubleToString *lir);
     bool visitValueToString(LValueToString *lir);
+    bool visitValueToObjectOrNull(LValueToObjectOrNull *lir);
     bool visitInteger(LInteger *lir);
     bool visitRegExp(LRegExp *lir);
     bool visitRegExpExec(LRegExpExec *lir);
@@ -252,6 +253,7 @@ class CodeGenerator : public CodeGeneratorSpecific
     bool visitStoreElementV(LStoreElementV *lir);
     bool visitStoreElementHoleT(LStoreElementHoleT *lir);
     bool visitStoreElementHoleV(LStoreElementHoleV *lir);
+    bool visitStoreUnboxedPointer(LStoreUnboxedPointer *lir);
     bool emitArrayPopShift(LInstruction *lir, const MArrayPopShift *mir, Register obj,
                            Register elementsTemp, Register lengthTemp, TypedOrValueRegister out);
     bool visitArrayPopShiftV(LArrayPopShiftV *lir);
diff --git a/js/src/jit/Ion.cpp b/js/src/jit/Ion.cpp
index 5b388c0e2da..a7b73bf76fa 100644
--- a/js/src/jit/Ion.cpp
+++ b/js/src/jit/Ion.cpp
@@ -281,6 +281,11 @@ JitRuntime::initialize(JSContext *cx)
     if (!stringPreBarrier_)
         return false;
 
+    JitSpew(JitSpew_Codegen, "# Emitting Pre Barrier for Object");
+    objectPreBarrier_ = generatePreBarrier(cx, MIRType_Object);
+    if (!objectPreBarrier_)
+        return false;
+
     JitSpew(JitSpew_Codegen, "# Emitting Pre Barrier for Shape");
     shapePreBarrier_ = generatePreBarrier(cx, MIRType_Shape);
     if (!shapePreBarrier_)
diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index b31a236c3f0..10199a45682 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -8152,11 +8152,8 @@ IonBuilder::setElemTryTypedObject(bool *emitted, MDefinition *obj,
         return true;
 
       case type::Reference:
-      case type::Struct:
-      case type::SizedArray:
-      case type::UnsizedArray:
-        // For now, only optimize storing scalars.
-        return true;
+        return setElemTryReferenceElemOfTypedObject(emitted, obj, index,
+                                                    objPrediction, value, elemPrediction);
 
       case type::Scalar:
         return setElemTryScalarElemOfTypedObject(emitted,
@@ -8166,11 +8163,41 @@ IonBuilder::setElemTryTypedObject(bool *emitted, MDefinition *obj,
                                                  value,
                                                  elemPrediction,
                                                  elemSize);
+
+      case type::Struct:
+      case type::SizedArray:
+      case type::UnsizedArray:
+        // Not yet optimized.
+        return true;
     }
 
     MOZ_CRASH("Bad kind");
 }
 
+bool
+IonBuilder::setElemTryReferenceElemOfTypedObject(bool *emitted,
+                                                 MDefinition *obj,
+                                                 MDefinition *index,
+                                                 TypedObjectPrediction objPrediction,
+                                                 MDefinition *value,
+                                                 TypedObjectPrediction elemPrediction)
+{
+    ReferenceTypeDescr::Type elemType = elemPrediction.referenceType();
+    size_t elemSize = ReferenceTypeDescr::size(elemType);
+
+    MDefinition *indexAsByteOffset;
+    if (!checkTypedObjectIndexInBounds(elemSize, obj, index, objPrediction, &indexAsByteOffset))
+        return true;
+
+    if (!storeReferenceTypedObjectValue(obj, indexAsByteOffset, elemType, value))
+        return false;
+
+    current->push(value);
+
+    *emitted = true;
+    return true;
+}
+
 bool
 IonBuilder::setElemTryScalarElemOfTypedObject(bool *emitted,
                                               MDefinition *obj,
@@ -10047,20 +10074,44 @@ IonBuilder::setPropTryTypedObject(bool *emitted, MDefinition *obj,
         return true;
 
       case type::Reference:
-      case type::Struct:
-      case type::SizedArray:
-      case type::UnsizedArray:
-        // For now, only optimize storing scalars.
-        return true;
+        return setPropTryReferencePropOfTypedObject(emitted, obj, fieldOffset,
+                                                    value, fieldPrediction);
 
       case type::Scalar:
         return setPropTryScalarPropOfTypedObject(emitted, obj, fieldOffset,
                                                  value, fieldPrediction);
+
+      case type::Struct:
+      case type::SizedArray:
+      case type::UnsizedArray:
+        return true;
     }
 
     MOZ_CRASH("Unknown kind");
 }
 
+bool
+IonBuilder::setPropTryReferencePropOfTypedObject(bool *emitted,
+                                                 MDefinition *obj,
+                                                 int32_t fieldOffset,
+                                                 MDefinition *value,
+                                                 TypedObjectPrediction fieldPrediction)
+{
+    ReferenceTypeDescr::Type fieldType = fieldPrediction.referenceType();
+
+    types::TypeObjectKey *globalType = types::TypeObjectKey::get(&script()->global());
+    if (globalType->hasFlags(constraints(), types::OBJECT_FLAG_TYPED_OBJECT_NEUTERED))
+        return true;
+
+    if (!storeReferenceTypedObjectValue(obj, constantInt(fieldOffset), fieldType, value))
+        return false;
+
+    current->push(value);
+
+    *emitted = true;
+    return true;
+}
+
 bool
 IonBuilder::setPropTryScalarPropOfTypedObject(bool *emitted,
                                               MDefinition *obj,
@@ -11197,6 +11248,37 @@ IonBuilder::storeScalarTypedObjectValue(MDefinition *typedObj,
     return true;
 }
 
+bool
+IonBuilder::storeReferenceTypedObjectValue(MDefinition *typedObj,
+                                           MDefinition *byteOffset,
+                                           ReferenceTypeDescr::Type type,
+                                           MDefinition *value)
+{
+    if (NeedsPostBarrier(info(), value))
+        current->add(MPostWriteBarrier::New(alloc(), typedObj, value));
+
+    // Find location within the owner object.
+    MDefinition *elements, *scaledOffset;
+    size_t alignment = ReferenceTypeDescr::alignment(type);
+    loadTypedObjectElements(typedObj, byteOffset, alignment, &elements, &scaledOffset);
+
+    MInstruction *store;
+    switch (type) {
+      case ReferenceTypeDescr::TYPE_ANY:
+        store = MStoreElement::New(alloc(), elements, scaledOffset, value, false);
+        break;
+      case ReferenceTypeDescr::TYPE_OBJECT:
+        store = MStoreUnboxedObjectOrNull::New(alloc(), elements, scaledOffset, value);
+        break;
+      case ReferenceTypeDescr::TYPE_STRING:
+        store = MStoreUnboxedString::New(alloc(), elements, scaledOffset, value);
+        break;
+    }
+
+    current->add(store);
+    return true;
+}
+
 MConstant *
 IonBuilder::constant(const Value &v)
 {
diff --git a/js/src/jit/IonBuilder.h b/js/src/jit/IonBuilder.h
index 277e780b8db..287684ddb98 100644
--- a/js/src/jit/IonBuilder.h
+++ b/js/src/jit/IonBuilder.h
@@ -451,6 +451,11 @@ class IonBuilder
                                 types::TemporaryTypeSet *objTypes);
     bool setPropTryTypedObject(bool *emitted, MDefinition *obj,
                                PropertyName *name, MDefinition *value);
+    bool setPropTryReferencePropOfTypedObject(bool *emitted,
+                                              MDefinition *obj,
+                                              int32_t fieldOffset,
+                                              MDefinition *value,
+                                              TypedObjectPrediction fieldPrediction);
     bool setPropTryScalarPropOfTypedObject(bool *emitted,
                                            MDefinition *obj,
                                            int32_t fieldOffset,
@@ -481,6 +486,10 @@ class IonBuilder
     MDefinition *typeObjectForElementFromArrayStructType(MDefinition *typedObj);
     MDefinition *typeObjectForFieldFromStructType(MDefinition *type,
                                                   size_t fieldIndex);
+    bool storeReferenceTypedObjectValue(MDefinition *typedObj,
+                                        MDefinition *byteOffset,
+                                        ReferenceTypeDescr::Type type,
+                                        MDefinition *value);
     bool storeScalarTypedObjectValue(MDefinition *typedObj,
                                      MDefinition *offset,
                                      ScalarTypeDescr::Type type,
@@ -515,6 +524,12 @@ class IonBuilder
                              MDefinition *index, MDefinition *value);
     bool setElemTryCache(bool *emitted, MDefinition *object,
                          MDefinition *index, MDefinition *value);
+    bool setElemTryReferenceElemOfTypedObject(bool *emitted,
+                                              MDefinition *obj,
+                                              MDefinition *index,
+                                              TypedObjectPrediction objPrediction,
+                                              MDefinition *value,
+                                              TypedObjectPrediction elemPrediction);
     bool setElemTryScalarElemOfTypedObject(bool *emitted,
                                            MDefinition *obj,
                                            MDefinition *index,
diff --git a/js/src/jit/IonTypes.h b/js/src/jit/IonTypes.h
index 6b8e15061cc..eb58be78d17 100644
--- a/js/src/jit/IonTypes.h
+++ b/js/src/jit/IonTypes.h
@@ -369,6 +369,7 @@ enum MIRType
     MIRType_MagicIsConstructing,       // JS_IS_CONSTRUCTING magic value.
     MIRType_MagicUninitializedLexical, // JS_UNINITIALIZED_LEXICAL magic value.
     MIRType_Value,
+    MIRType_ObjectOrNull,
     MIRType_None,                      // Invalid, used as a placeholder.
     MIRType_Slots,                     // A slots vector
     MIRType_Elements,                  // An elements vector
diff --git a/js/src/jit/JitCompartment.h b/js/src/jit/JitCompartment.h
index 3024bc21d5c..71837389688 100644
--- a/js/src/jit/JitCompartment.h
+++ b/js/src/jit/JitCompartment.h
@@ -187,6 +187,7 @@ class JitRuntime
     // Thunk that calls the GC pre barrier.
     JitCode *valuePreBarrier_;
     JitCode *stringPreBarrier_;
+    JitCode *objectPreBarrier_;
     JitCode *shapePreBarrier_;
     JitCode *typeObjectPreBarrier_;
 
@@ -361,6 +362,7 @@ class JitRuntime
         switch (type) {
           case MIRType_Value: return valuePreBarrier_;
           case MIRType_String: return stringPreBarrier_;
+          case MIRType_Object: return objectPreBarrier_;
           case MIRType_Shape: return shapePreBarrier_;
           case MIRType_TypeObject: return typeObjectPreBarrier_;
           default: MOZ_CRASH();
diff --git a/js/src/jit/LIR-Common.h b/js/src/jit/LIR-Common.h
index 10bf998cfdc..42286a11f27 100644
--- a/js/src/jit/LIR-Common.h
+++ b/js/src/jit/LIR-Common.h
@@ -3715,6 +3715,22 @@ class LValueToString : public LInstructionHelper<1, BOX_PIECES, 1>
     }
 };
 
+// Convert a value to an object or null pointer.
+class LValueToObjectOrNull : public LInstructionHelper<1, BOX_PIECES, 0>
+{
+  public:
+    LIR_HEADER(ValueToObjectOrNull)
+
+    explicit LValueToObjectOrNull()
+    {}
+
+    static const size_t Input = 0;
+
+    const MToObjectOrNull *mir() {
+        return mir_->toToObjectOrNull();
+    }
+};
+
 class LInt32x4ToFloat32x4 : public LInstructionHelper<1, 1, 0>
 {
   public:
@@ -4608,6 +4624,33 @@ class LStoreElementHoleT : public LInstructionHelper<0, 4, 0>
     }
 };
 
+class LStoreUnboxedPointer : public LInstructionHelper<0, 3, 0>
+{
+  public:
+    LIR_HEADER(StoreUnboxedPointer)
+
+    LStoreUnboxedPointer(LAllocation elements, LAllocation index, LAllocation value) {
+        setOperand(0, elements);
+        setOperand(1, index);
+        setOperand(2, value);
+    }
+
+    MDefinition *mir() {
+        MOZ_ASSERT(mir_->isStoreUnboxedObjectOrNull() || mir_->isStoreUnboxedString());
+        return mir_;
+    }
+
+    const LAllocation *elements() {
+        return getOperand(0);
+    }
+    const LAllocation *index() {
+        return getOperand(1);
+    }
+    const LAllocation *value() {
+        return getOperand(2);
+    }
+};
+
 class LArrayPopShiftV : public LInstructionHelper<BOX_PIECES, 1, 2>
 {
   public:
diff --git a/js/src/jit/LIR.h b/js/src/jit/LIR.h
index 4b78a33b468..e83dd4e24c7 100644
--- a/js/src/jit/LIR.h
+++ b/js/src/jit/LIR.h
@@ -554,6 +554,7 @@ class LDefinition
           case MIRType_String:
           case MIRType_Symbol:
           case MIRType_Object:
+          case MIRType_ObjectOrNull:
             return LDefinition::OBJECT;
           case MIRType_Double:
             return LDefinition::DOUBLE;
diff --git a/js/src/jit/LOpcodes.h b/js/src/jit/LOpcodes.h
index 34ce62630ea..787ed80b215 100644
--- a/js/src/jit/LOpcodes.h
+++ b/js/src/jit/LOpcodes.h
@@ -173,6 +173,7 @@
     _(IntToString)                  \
     _(DoubleToString)               \
     _(ValueToString)                \
+    _(ValueToObjectOrNull)          \
     _(Int32x4ToFloat32x4)           \
     _(Float32x4ToInt32x4)           \
     _(Start)                        \
@@ -221,6 +222,7 @@
     _(LoadElementHole)              \
     _(StoreElementV)                \
     _(StoreElementT)                \
+    _(StoreUnboxedPointer)          \
     _(ArrayPopShiftV)               \
     _(ArrayPopShiftT)               \
     _(ArrayPushV)                   \
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index 9c5fa6d7b1e..6787bfb23f0 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -2038,6 +2038,17 @@ LIRGenerator::visitToString(MToString *ins)
     }
 }
 
+bool
+LIRGenerator::visitToObjectOrNull(MToObjectOrNull *ins)
+{
+    MOZ_ASSERT(ins->input()->type() == MIRType_Value);
+
+    LValueToObjectOrNull *lir = new(alloc()) LValueToObjectOrNull();
+    if (!useBox(lir, LValueToString::Input, ins->input()))
+        return false;
+    return define(lir, ins) && assignSafepoint(lir, ins);
+}
+
 static bool
 MustCloneRegExpForCall(MCall *call, uint32_t useIndex)
 {
@@ -2774,6 +2785,38 @@ LIRGenerator::visitStoreElementHole(MStoreElementHole *ins)
     return add(lir, ins) && assignSafepoint(lir, ins);
 }
 
+bool
+LIRGenerator::visitStoreUnboxedObjectOrNull(MStoreUnboxedObjectOrNull *ins)
+{
+    MOZ_ASSERT(ins->elements()->type() == MIRType_Elements);
+    MOZ_ASSERT(ins->index()->type() == MIRType_Int32);
+    MOZ_ASSERT(ins->value()->type() == MIRType_Object ||
+               ins->value()->type() == MIRType_Null ||
+               ins->value()->type() == MIRType_ObjectOrNull);
+
+    const LUse elements = useRegister(ins->elements());
+    const LAllocation index = useRegisterOrNonDoubleConstant(ins->index());
+    const LAllocation value = useRegisterOrNonDoubleConstant(ins->value());
+
+    LInstruction *lir = new(alloc()) LStoreUnboxedPointer(elements, index, value);
+    return add(lir, ins);
+}
+
+bool
+LIRGenerator::visitStoreUnboxedString(MStoreUnboxedString *ins)
+{
+    MOZ_ASSERT(ins->elements()->type() == MIRType_Elements);
+    MOZ_ASSERT(ins->index()->type() == MIRType_Int32);
+    MOZ_ASSERT(ins->value()->type() == MIRType_String);
+
+    const LUse elements = useRegister(ins->elements());
+    const LAllocation index = useRegisterOrConstant(ins->index());
+    const LAllocation value = useRegisterOrNonDoubleConstant(ins->value());
+
+    LInstruction *lir = new(alloc()) LStoreUnboxedPointer(elements, index, value);
+    return add(lir, ins);
+}
+
 bool
 LIRGenerator::visitEffectiveAddress(MEffectiveAddress *ins)
 {
diff --git a/js/src/jit/Lowering.h b/js/src/jit/Lowering.h
index dd3667210e8..aefc37e503d 100644
--- a/js/src/jit/Lowering.h
+++ b/js/src/jit/Lowering.h
@@ -159,6 +159,7 @@ class LIRGenerator : public LIRGeneratorSpecific
     bool visitToInt32(MToInt32 *convert);
     bool visitTruncateToInt32(MTruncateToInt32 *truncate);
     bool visitToString(MToString *convert);
+    bool visitToObjectOrNull(MToObjectOrNull *convert);
     bool visitRegExp(MRegExp *ins);
     bool visitRegExpExec(MRegExpExec *ins);
     bool visitRegExpTest(MRegExpTest *ins);
@@ -202,6 +203,8 @@ class LIRGenerator : public LIRGeneratorSpecific
     bool visitLoadElementHole(MLoadElementHole *ins);
     bool visitStoreElement(MStoreElement *ins);
     bool visitStoreElementHole(MStoreElementHole *ins);
+    bool visitStoreUnboxedObjectOrNull(MStoreUnboxedObjectOrNull *ins);
+    bool visitStoreUnboxedString(MStoreUnboxedString *ins);
     bool visitEffectiveAddress(MEffectiveAddress *ins);
     bool visitArrayPopShift(MArrayPopShift *ins);
     bool visitArrayPush(MArrayPush *ins);
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index e19cce4249c..2f6dec55d70 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -268,10 +268,12 @@ class AliasSet {
     enum Flag {
         None_             = 0,
         ObjectFields      = 1 << 0, // shape, class, slots, length etc.
-        Element           = 1 << 1, // A member of obj->elements.
+        Element           = 1 << 1, // A member of obj->elements, or reference
+                                    // typed object field.
         DynamicSlot       = 1 << 2, // A member of obj->slots.
         FixedSlot         = 1 << 3, // A member of obj->fixedSlots().
-        TypedArrayElement = 1 << 4, // A typed array element.
+        TypedArrayElement = 1 << 4, // A typed array element, or scalar typed
+                                    // object field.
         DOMProperty       = 1 << 5, // A DOM property
         FrameArgument     = 1 << 6, // An argument kept on the stack frame
         AsmJSGlobalVar    = 1 << 7, // An asm.js global var
@@ -4642,6 +4644,36 @@ class MToString :
     ALLOW_CLONE(MToString)
 };
 
+// Converts any type to an object or null value, throwing on undefined.
+class MToObjectOrNull :
+  public MUnaryInstruction,
+  public BoxInputsPolicy::Data
+{
+    explicit MToObjectOrNull(MDefinition *def)
+      : MUnaryInstruction(def)
+    {
+        setResultType(MIRType_ObjectOrNull);
+        setMovable();
+    }
+
+  public:
+    INSTRUCTION_HEADER(ToObjectOrNull)
+    static MToObjectOrNull *New(TempAllocator &alloc, MDefinition *def)
+    {
+        return new(alloc) MToObjectOrNull(def);
+    }
+
+    bool congruentTo(const MDefinition *ins) const {
+        return congruentIfOperandsEqual(ins);
+    }
+
+    AliasSet getAliasSet() const {
+        return AliasSet::None();
+    }
+
+    ALLOW_CLONE(MToObjectOrNull)
+};
+
 class MBitNot
   : public MUnaryInstruction,
     public BitwisePolicy::Data
@@ -7966,6 +7998,82 @@ class MStoreElementHole
     ALLOW_CLONE(MStoreElementHole)
 };
 
+// Store an unboxed object or null pointer to a vector.
+class MStoreUnboxedObjectOrNull
+  : public MAryInstruction<3>,
+    public ConvertToObjectOrNullPolicy<2>::Data
+{
+    MStoreUnboxedObjectOrNull(MDefinition *elements, MDefinition *index, MDefinition *value) {
+        initOperand(0, elements);
+        initOperand(1, index);
+        initOperand(2, value);
+        MOZ_ASSERT(elements->type() == MIRType_Elements);
+        MOZ_ASSERT(index->type() == MIRType_Int32);
+    }
+
+  public:
+    INSTRUCTION_HEADER(StoreUnboxedObjectOrNull)
+
+    static MStoreUnboxedObjectOrNull *New(TempAllocator &alloc,
+                                          MDefinition *elements, MDefinition *index,
+                                          MDefinition *value) {
+        return new(alloc) MStoreUnboxedObjectOrNull(elements, index, value);
+    }
+    MDefinition *elements() const {
+        return getOperand(0);
+    }
+    MDefinition *index() const {
+        return getOperand(1);
+    }
+    MDefinition *value() const {
+        return getOperand(2);
+    }
+    AliasSet getAliasSet() const {
+        // Use AliasSet::Element for reference typed object fields.
+        return AliasSet::Store(AliasSet::Element);
+    }
+
+    ALLOW_CLONE(MStoreUnboxedObjectOrNull)
+};
+
+// Store an unboxed object or null pointer to a vector.
+class MStoreUnboxedString
+  : public MAryInstruction<3>,
+    public ConvertToStringPolicy<2>::Data
+{
+    MStoreUnboxedString(MDefinition *elements, MDefinition *index, MDefinition *value) {
+        initOperand(0, elements);
+        initOperand(1, index);
+        initOperand(2, value);
+        MOZ_ASSERT(elements->type() == MIRType_Elements);
+        MOZ_ASSERT(index->type() == MIRType_Int32);
+    }
+
+  public:
+    INSTRUCTION_HEADER(StoreUnboxedString)
+
+    static MStoreUnboxedString *New(TempAllocator &alloc,
+                                    MDefinition *elements, MDefinition *index,
+                                    MDefinition *value) {
+        return new(alloc) MStoreUnboxedString(elements, index, value);
+    }
+    MDefinition *elements() const {
+        return getOperand(0);
+    }
+    MDefinition *index() const {
+        return getOperand(1);
+    }
+    MDefinition *value() const {
+        return getOperand(2);
+    }
+    AliasSet getAliasSet() const {
+        // Use AliasSet::Element for reference typed object fields.
+        return AliasSet::Store(AliasSet::Element);
+    }
+
+    ALLOW_CLONE(MStoreUnboxedString)
+};
+
 // Array.prototype.pop or Array.prototype.shift on a dense array.
 class MArrayPopShift
   : public MUnaryInstruction,
diff --git a/js/src/jit/MOpcodes.h b/js/src/jit/MOpcodes.h
index 3d5ea4cad87..5d645ac6deb 100644
--- a/js/src/jit/MOpcodes.h
+++ b/js/src/jit/MOpcodes.h
@@ -108,6 +108,7 @@ namespace jit {
     _(ToInt32)                                                              \
     _(TruncateToInt32)                                                      \
     _(ToString)                                                             \
+    _(ToObjectOrNull)                                                       \
     _(NewArray)                                                             \
     _(NewArrayCopyOnWrite)                                                  \
     _(NewObject)                                                            \
@@ -176,6 +177,8 @@ namespace jit {
     _(LoadElementHole)                                                      \
     _(StoreElement)                                                         \
     _(StoreElementHole)                                                     \
+    _(StoreUnboxedObjectOrNull)                                             \
+    _(StoreUnboxedString)                                                   \
     _(ArrayPopShift)                                                        \
     _(ArrayPush)                                                            \
     _(ArrayConcat)                                                          \
diff --git a/js/src/jit/ParallelSafetyAnalysis.cpp b/js/src/jit/ParallelSafetyAnalysis.cpp
index 96d335dbb35..ed9f265575c 100644
--- a/js/src/jit/ParallelSafetyAnalysis.cpp
+++ b/js/src/jit/ParallelSafetyAnalysis.cpp
@@ -200,6 +200,7 @@ class ParallelSafetyVisitor : public MDefinitionVisitor
     SAFE_OP(TruncateToInt32)
     SAFE_OP(MaybeToDoubleElement)
     CUSTOM_OP(ToString)
+    UNSAFE_OP(ToObjectOrNull)
     CUSTOM_OP(NewArray)
     UNSAFE_OP(NewArrayCopyOnWrite)
     UNSAFE_OP(NewTypedObject)
@@ -260,6 +261,8 @@ class ParallelSafetyVisitor : public MDefinitionVisitor
     SAFE_OP(LoadElementHole)
     MAYBE_WRITE_GUARDED_OP(StoreElement, elements)
     WRITE_GUARDED_OP(StoreElementHole, elements)
+    UNSAFE_OP(StoreUnboxedObjectOrNull)
+    UNSAFE_OP(StoreUnboxedString)
     UNSAFE_OP(ArrayPopShift)
     UNSAFE_OP(ArrayPush)
     SAFE_OP(LoadTypedArrayElement)
diff --git a/js/src/jit/TypePolicy.cpp b/js/src/jit/TypePolicy.cpp
index a704087e4aa..bd7648959d6 100644
--- a/js/src/jit/TypePolicy.cpp
+++ b/js/src/jit/TypePolicy.cpp
@@ -405,6 +405,32 @@ ConvertToStringPolicy<Op>::staticAdjustInputs(TempAllocator &alloc, MInstruction
 
 template bool ConvertToStringPolicy<0>::staticAdjustInputs(TempAllocator &alloc, MInstruction *ins);
 template bool ConvertToStringPolicy<1>::staticAdjustInputs(TempAllocator &alloc, MInstruction *ins);
+template bool ConvertToStringPolicy<2>::staticAdjustInputs(TempAllocator &alloc, MInstruction *ins);
+
+template <unsigned Op>
+bool
+ConvertToObjectOrNullPolicy<Op>::staticAdjustInputs(TempAllocator &alloc, MInstruction *ins)
+{
+    MDefinition *in = ins->getOperand(Op);
+    if (in->type() == MIRType_Object ||
+        in->type() == MIRType_Null ||
+        in->type() == MIRType_ObjectOrNull)
+    {
+        return true;
+    }
+
+    MToObjectOrNull *replace = MToObjectOrNull::New(alloc, in);
+    ins->block()->insertBefore(ins, replace);
+    ins->replaceOperand(Op, replace);
+
+    if (!BoxPolicy<0>::staticAdjustInputs(alloc, replace))
+        return false;
+
+    return true;
+}
+
+template bool ConvertToObjectOrNullPolicy<2>::staticAdjustInputs(TempAllocator &alloc,
+                                                                 MInstruction *ins);
 
 template <unsigned Op>
 bool
@@ -941,6 +967,8 @@ FilterTypeSetPolicy::adjustInputs(TempAllocator &alloc, MInstruction *ins)
     _(BoxPolicy<0>)                                                     \
     _(ConvertToInt32Policy<0>)                                          \
     _(ConvertToStringPolicy<0>)                                         \
+    _(ConvertToStringPolicy<2>)                                         \
+    _(ConvertToObjectOrNullPolicy<2>)                                   \
     _(DoublePolicy<0>)                                                  \
     _(FloatingPointPolicy<0>)                                           \
     _(IntPolicy<0>)                                                     \
diff --git a/js/src/jit/TypePolicy.h b/js/src/jit/TypePolicy.h
index 2c8ce6a947a..d04ea5f40a0 100644
--- a/js/src/jit/TypePolicy.h
+++ b/js/src/jit/TypePolicy.h
@@ -148,6 +148,19 @@ class ConvertToStringPolicy : public TypePolicy
     }
 };
 
+// Expect an object or null value for operand Op. Else a ToObjectOrNull
+// instruction is inserted.
+template <unsigned Op>
+class ConvertToObjectOrNullPolicy : public TypePolicy
+{
+  public:
+    EMPTY_DATA_;
+    static bool staticAdjustInputs(TempAllocator &alloc, MInstruction *def);
+    bool adjustInputs(TempAllocator &alloc, MInstruction *def) {
+        return staticAdjustInputs(alloc, def);
+    }
+};
+
 // Expect an Int for operand Op. If the input is a Value, it is unboxed.
 template <unsigned Op>
 class IntPolicy : public BoxInputsPolicy
diff --git a/js/src/jit/VMFunctions.cpp b/js/src/jit/VMFunctions.cpp
index 8536916d1e5..f599bbe3a51 100644
--- a/js/src/jit/VMFunctions.cpp
+++ b/js/src/jit/VMFunctions.cpp
@@ -1147,6 +1147,13 @@ AssertValidObjectPtr(JSContext *cx, JSObject *obj)
     }
 }
 
+void
+AssertValidObjectOrNullPtr(JSContext *cx, JSObject *obj)
+{
+    if (obj)
+        AssertValidObjectPtr(cx, obj);
+}
+
 void
 AssertValidStringPtr(JSContext *cx, JSString *str)
 {
@@ -1235,6 +1242,13 @@ MarkStringFromIon(JSRuntime *rt, JSString **stringp)
         gc::MarkStringUnbarriered(&rt->gc.marker, stringp, "write barrier");
 }
 
+void
+MarkObjectFromIon(JSRuntime *rt, JSObject **objp)
+{
+    if (*objp)
+        gc::MarkObjectUnbarriered(&rt->gc.marker, objp, "write barrier");
+}
+
 void
 MarkShapeFromIon(JSRuntime *rt, Shape **shapep)
 {
diff --git a/js/src/jit/VMFunctions.h b/js/src/jit/VMFunctions.h
index 5ed78b34c1d..6523e07cf57 100644
--- a/js/src/jit/VMFunctions.h
+++ b/js/src/jit/VMFunctions.h
@@ -745,6 +745,7 @@ bool SetDenseElement(JSContext *cx, HandleNativeObject obj, int32_t index, Handl
 
 #ifdef DEBUG
 void AssertValidObjectPtr(JSContext *cx, JSObject *obj);
+void AssertValidObjectOrNullPtr(JSContext *cx, JSObject *obj);
 void AssertValidStringPtr(JSContext *cx, JSString *str);
 void AssertValidSymbolPtr(JSContext *cx, JS::Symbol *sym);
 void AssertValidValue(JSContext *cx, Value *v);
@@ -754,6 +755,7 @@ JSObject *TypedObjectProto(JSObject *obj);
 
 void MarkValueFromIon(JSRuntime *rt, Value *vp);
 void MarkStringFromIon(JSRuntime *rt, JSString **stringp);
+void MarkObjectFromIon(JSRuntime *rt, JSObject **objp);
 void MarkShapeFromIon(JSRuntime *rt, Shape **shapep);
 void MarkTypeObjectFromIon(JSRuntime *rt, types::TypeObject **typep);
 
@@ -766,6 +768,8 @@ IonMarkFunction(MIRType type)
         return JS_FUNC_TO_DATA_PTR(void *, MarkValueFromIon);
       case MIRType_String:
         return JS_FUNC_TO_DATA_PTR(void *, MarkStringFromIon);
+      case MIRType_Object:
+        return JS_FUNC_TO_DATA_PTR(void *, MarkObjectFromIon);
       case MIRType_Shape:
         return JS_FUNC_TO_DATA_PTR(void *, MarkShapeFromIon);
       case MIRType_TypeObject:
diff --git a/js/src/jit/arm/MacroAssembler-arm.cpp b/js/src/jit/arm/MacroAssembler-arm.cpp
index c17c3c01452..d53fe8f49eb 100644
--- a/js/src/jit/arm/MacroAssembler-arm.cpp
+++ b/js/src/jit/arm/MacroAssembler-arm.cpp
@@ -2503,26 +2503,38 @@ MacroAssemblerARMCompat::store32_NoSecondScratch(Imm32 src, const Address &addre
     storePtr(ScratchRegister, address);
 }
 
+template <typename T>
 void
-MacroAssemblerARMCompat::storePtr(ImmWord imm, const Address &address)
+MacroAssemblerARMCompat::storePtr(ImmWord imm, T address)
 {
     movePtr(imm, ScratchRegister);
     storePtr(ScratchRegister, address);
 }
 
+template void MacroAssemblerARMCompat::storePtr<Address>(ImmWord imm, Address address);
+template void MacroAssemblerARMCompat::storePtr<BaseIndex>(ImmWord imm, BaseIndex address);
+
+template <typename T>
 void
-MacroAssemblerARMCompat::storePtr(ImmPtr imm, const Address &address)
+MacroAssemblerARMCompat::storePtr(ImmPtr imm, T address)
 {
     storePtr(ImmWord(uintptr_t(imm.value)), address);
 }
 
+template void MacroAssemblerARMCompat::storePtr<Address>(ImmPtr imm, Address address);
+template void MacroAssemblerARMCompat::storePtr<BaseIndex>(ImmPtr imm, BaseIndex address);
+
+template <typename T>
 void
-MacroAssemblerARMCompat::storePtr(ImmGCPtr imm, const Address &address)
+MacroAssemblerARMCompat::storePtr(ImmGCPtr imm, T address)
 {
     movePtr(imm, ScratchRegister);
     storePtr(ScratchRegister, address);
 }
 
+template void MacroAssemblerARMCompat::storePtr<Address>(ImmGCPtr imm, Address address);
+template void MacroAssemblerARMCompat::storePtr<BaseIndex>(ImmGCPtr imm, BaseIndex address);
+
 void
 MacroAssemblerARMCompat::storePtr(Register src, const Address &address)
 {
diff --git a/js/src/jit/arm/MacroAssembler-arm.h b/js/src/jit/arm/MacroAssembler-arm.h
index 242f0ad92a0..7fbf7b115c6 100644
--- a/js/src/jit/arm/MacroAssembler-arm.h
+++ b/js/src/jit/arm/MacroAssembler-arm.h
@@ -1396,9 +1396,9 @@ class MacroAssemblerARMCompat : public MacroAssemblerARM
 
     void store32_NoSecondScratch(Imm32 src, const Address &address);
 
-    void storePtr(ImmWord imm, const Address &address);
-    void storePtr(ImmPtr imm, const Address &address);
-    void storePtr(ImmGCPtr imm, const Address &address);
+    template <typename T> void storePtr(ImmWord imm, T address);
+    template <typename T> void storePtr(ImmPtr imm, T address);
+    template <typename T> void storePtr(ImmGCPtr imm, T address);
     void storePtr(Register src, const Address &address);
     void storePtr(Register src, const BaseIndex &address);
     void storePtr(Register src, AbsoluteAddress dest);
diff --git a/js/src/jit/mips/MacroAssembler-mips.cpp b/js/src/jit/mips/MacroAssembler-mips.cpp
index 4a441503aed..121b028f4ab 100644
--- a/js/src/jit/mips/MacroAssembler-mips.cpp
+++ b/js/src/jit/mips/MacroAssembler-mips.cpp
@@ -2043,26 +2043,38 @@ MacroAssemblerMIPSCompat::store32(Register src, const BaseIndex &dest)
     ma_store(src, dest, SizeWord);
 }
 
+template <typename T>
 void
-MacroAssemblerMIPSCompat::storePtr(ImmWord imm, const Address &address)
+MacroAssemblerMIPSCompat::storePtr(ImmWord imm, T address)
 {
     ma_li(ScratchRegister, Imm32(imm.value));
     ma_sw(ScratchRegister, address);
 }
 
+template void MacroAssemblerMIPSCompat::storePtr<Address>(ImmWord imm, Address address);
+template void MacroAssemblerMIPSCompat::storePtr<BaseIndex>(ImmWord imm, BaseIndex address);
+
+template <typename T>
 void
-MacroAssemblerMIPSCompat::storePtr(ImmPtr imm, const Address &address)
+MacroAssemblerMIPSCompat::storePtr(ImmPtr imm, T address)
 {
     storePtr(ImmWord(uintptr_t(imm.value)), address);
 }
 
+template void MacroAssemblerMIPSCompat::storePtr<Address>(ImmPtr imm, Address address);
+template void MacroAssemblerMIPSCompat::storePtr<BaseIndex>(ImmPtr imm, BaseIndex address);
+
+template <typename T>
 void
-MacroAssemblerMIPSCompat::storePtr(ImmGCPtr imm, const Address &address)
+MacroAssemblerMIPSCompat::storePtr(ImmGCPtr imm, T address)
 {
     ma_li(ScratchRegister, imm);
     ma_sw(ScratchRegister, address);
 }
 
+template void MacroAssemblerMIPSCompat::storePtr<Address>(ImmGCPtr imm, Address address);
+template void MacroAssemblerMIPSCompat::storePtr<BaseIndex>(ImmGCPtr imm, BaseIndex address);
+
 void
 MacroAssemblerMIPSCompat::storePtr(Register src, const Address &address)
 {
diff --git a/js/src/jit/mips/MacroAssembler-mips.h b/js/src/jit/mips/MacroAssembler-mips.h
index 3748a5a1a8e..07f1785f286 100644
--- a/js/src/jit/mips/MacroAssembler-mips.h
+++ b/js/src/jit/mips/MacroAssembler-mips.h
@@ -1263,9 +1263,9 @@ public:
         store32(src, address);
     }
 
-    void storePtr(ImmWord imm, const Address &address);
-    void storePtr(ImmPtr imm, const Address &address);
-    void storePtr(ImmGCPtr imm, const Address &address);
+    template <typename T> void storePtr(ImmWord imm, T address);
+    template <typename T> void storePtr(ImmPtr imm, T address);
+    template <typename T> void storePtr(ImmGCPtr imm, T address);
     void storePtr(Register src, const Address &address);
     void storePtr(Register src, const BaseIndex &address);
     void storePtr(Register src, AbsoluteAddress dest);
diff --git a/js/src/jit/x64/MacroAssembler-x64.h b/js/src/jit/x64/MacroAssembler-x64.h
index 215930edb7e..10791bfb5cb 100644
--- a/js/src/jit/x64/MacroAssembler-x64.h
+++ b/js/src/jit/x64/MacroAssembler-x64.h
@@ -766,7 +766,8 @@ class MacroAssemblerX64 : public MacroAssemblerX86Shared
             load32(Address(ScratchReg, 0x0), dest);
         }
     }
-    void storePtr(ImmWord imm, const Address &address) {
+    template <typename T>
+    void storePtr(ImmWord imm, T address) {
         if ((intptr_t)imm.value <= INT32_MAX && (intptr_t)imm.value >= INT32_MIN) {
             movq(Imm32((int32_t)imm.value), Operand(address));
         } else {
@@ -774,10 +775,12 @@ class MacroAssemblerX64 : public MacroAssemblerX86Shared
             movq(ScratchReg, Operand(address));
         }
     }
-    void storePtr(ImmPtr imm, const Address &address) {
+    template <typename T>
+    void storePtr(ImmPtr imm, T address) {
         storePtr(ImmWord(uintptr_t(imm.value)), address);
     }
-    void storePtr(ImmGCPtr imm, const Address &address) {
+    template <typename T>
+    void storePtr(ImmGCPtr imm, T address) {
         movq(imm, ScratchReg);
         movq(ScratchReg, Operand(address));
     }
diff --git a/js/src/jit/x86/MacroAssembler-x86.h b/js/src/jit/x86/MacroAssembler-x86.h
index 515c8696087..aa225b7629d 100644
--- a/js/src/jit/x86/MacroAssembler-x86.h
+++ b/js/src/jit/x86/MacroAssembler-x86.h
@@ -725,13 +725,16 @@ class MacroAssemblerX86 : public MacroAssemblerX86Shared
     void load32(AbsoluteAddress address, Register dest) {
         movl(Operand(address), dest);
     }
-    void storePtr(ImmWord imm, const Address &address) {
+    template <typename T>
+    void storePtr(ImmWord imm, T address) {
         movl(Imm32(imm.value), Operand(address));
     }
-    void storePtr(ImmPtr imm, const Address &address) {
+    template <typename T>
+    void storePtr(ImmPtr imm, T address) {
         storePtr(ImmWord(uintptr_t(imm.value)), address);
     }
-    void storePtr(ImmGCPtr imm, const Address &address) {
+    template <typename T>
+    void storePtr(ImmGCPtr imm, T address) {
         movl(imm, Operand(address));
     }
     void storePtr(Register src, const Address &address) {

From 1c6b557ffb171f9640ccb4621d38a48aa3570bd7 Mon Sep 17 00:00:00 2001
From: Masayuki Nakano <masayuki@d-toybox.com>
Date: Wed, 5 Nov 2014 10:36:37 +0900
Subject: [PATCH 042/153] Bug 1047588 IMEContentObserver::Init() should take
 nsIEditor because nsDocShell sometimes hasn't been initialized and
 nsContentEditor::GetHTMLEditor() fails r=smaug

---
 dom/events/IMEContentObserver.cpp          | 29 +++++----------------
 dom/events/IMEContentObserver.h            |  2 +-
 dom/events/IMEStateManager.cpp             | 30 ++++++++++++----------
 dom/events/IMEStateManager.h               |  9 ++++---
 editor/libeditor/nsEditor.cpp              |  4 +--
 editor/libeditor/nsEditorEventListener.cpp |  3 ++-
 6 files changed, 34 insertions(+), 43 deletions(-)

diff --git a/dom/events/IMEContentObserver.cpp b/dom/events/IMEContentObserver.cpp
index 5620004d9fe..836c6882abc 100644
--- a/dom/events/IMEContentObserver.cpp
+++ b/dom/events/IMEContentObserver.cpp
@@ -28,7 +28,6 @@
 #include "nsISelectionController.h"
 #include "nsISelectionPrivate.h"
 #include "nsISupports.h"
-#include "nsITextControlElement.h"
 #include "nsIWidget.h"
 #include "nsPresContext.h"
 #include "nsThreadUtils.h"
@@ -99,8 +98,11 @@ IMEContentObserver::IMEContentObserver()
 void
 IMEContentObserver::Init(nsIWidget* aWidget,
                          nsPresContext* aPresContext,
-                         nsIContent* aContent)
+                         nsIContent* aContent,
+                         nsIEditor* aEditor)
 {
+  MOZ_ASSERT(aEditor, "aEditor must not be null");
+
   mESM = aPresContext->EventStateManager();
   mESM->OnStartToObserveContent(this);
 
@@ -110,27 +112,8 @@ IMEContentObserver::Init(nsIWidget* aWidget,
     return;
   }
 
-  nsCOMPtr<nsITextControlElement> textControlElement =
-    do_QueryInterface(mEditableNode);
-  if (textControlElement) {
-    // This may fail. For example, <input type="button" contenteditable>
-    mEditor = textControlElement->GetTextEditor();
-    if (!mEditor && mEditableNode->IsContent()) {
-      // The element must be an editing host.
-      nsIContent* editingHost = mEditableNode->AsContent()->GetEditingHost();
-      MOZ_ASSERT(editingHost == mEditableNode,
-                 "found editing host should be mEditableNode");
-      if (editingHost == mEditableNode) {
-        mEditor = nsContentUtils::GetHTMLEditor(aPresContext);
-      }
-    }
-  } else {
-    mEditor = nsContentUtils::GetHTMLEditor(aPresContext);
-  }
-  MOZ_ASSERT(mEditor, "Failed to get editor");
-  if (mEditor) {
-    mEditor->AddEditorObserver(this);
-  }
+  mEditor = aEditor;
+  mEditor->AddEditorObserver(this);
 
   nsIPresShell* presShell = aPresContext->PresShell();
 
diff --git a/dom/events/IMEContentObserver.h b/dom/events/IMEContentObserver.h
index f8dba04917f..43a67f5a022 100644
--- a/dom/events/IMEContentObserver.h
+++ b/dom/events/IMEContentObserver.h
@@ -64,7 +64,7 @@ public:
                           WidgetMouseEvent* aMouseEvent);
 
   void Init(nsIWidget* aWidget, nsPresContext* aPresContext,
-            nsIContent* aContent);
+            nsIContent* aContent, nsIEditor* aEditor);
   void Destroy();
   /**
    * IMEContentObserver is stored by EventStateManager during observing.
diff --git a/dom/events/IMEStateManager.cpp b/dom/events/IMEStateManager.cpp
index 663dd8baa2b..5e3722613f6 100644
--- a/dom/events/IMEStateManager.cpp
+++ b/dom/events/IMEStateManager.cpp
@@ -25,6 +25,7 @@
 #include "nsIContent.h"
 #include "nsIDocument.h"
 #include "nsIDOMMouseEvent.h"
+#include "nsIEditor.h"
 #include "nsIForm.h"
 #include "nsIFormControl.h"
 #include "nsINode.h"
@@ -559,12 +560,14 @@ IMEStateManager::OnClickInEditor(nsPresContext* aPresContext,
 // static
 void
 IMEStateManager::OnFocusInEditor(nsPresContext* aPresContext,
-                                 nsIContent* aContent)
+                                 nsIContent* aContent,
+                                 nsIEditor* aEditor)
 {
   PR_LOG(sISMLog, PR_LOG_ALWAYS,
-    ("ISM: IMEStateManager::OnFocusInEditor(aPresContext=0x%p, aContent=0x%p), "
-     "sPresContext=0x%p, sContent=0x%p, sActiveIMEContentObserver=0x%p",
-     aPresContext, aContent, sPresContext, sContent,
+    ("ISM: IMEStateManager::OnFocusInEditor(aPresContext=0x%p, aContent=0x%p, "
+     "aEditor=0x%p), sPresContext=0x%p, sContent=0x%p, "
+     "sActiveIMEContentObserver=0x%p",
+     aPresContext, aContent, aEditor, sPresContext, sContent,
      sActiveIMEContentObserver));
 
   if (sPresContext != aPresContext || sContent != aContent) {
@@ -586,21 +589,22 @@ IMEStateManager::OnFocusInEditor(nsPresContext* aPresContext,
     DestroyIMEContentObserver();
   }
 
-  CreateIMEContentObserver();
+  CreateIMEContentObserver(aEditor);
 }
 
 // static
 void
 IMEStateManager::UpdateIMEState(const IMEState& aNewIMEState,
-                                nsIContent* aContent)
+                                nsIContent* aContent,
+                                nsIEditor* aEditor)
 {
   PR_LOG(sISMLog, PR_LOG_ALWAYS,
     ("ISM: IMEStateManager::UpdateIMEState(aNewIMEState={ mEnabled=%s, "
-     "mOpen=%s }, aContent=0x%p), "
+     "mOpen=%s }, aContent=0x%p, aEditor=0x%p), "
      "sPresContext=0x%p, sContent=0x%p, sActiveIMEContentObserver=0x%p, "
      "sIsGettingNewIMEState=%s",
      GetIMEStateEnabledName(aNewIMEState.mEnabled),
-     GetIMEStateSetOpenName(aNewIMEState.mOpen), aContent,
+     GetIMEStateSetOpenName(aNewIMEState.mOpen), aContent, aEditor,
      sPresContext, sContent, sActiveIMEContentObserver,
      GetBoolName(sIsGettingNewIMEState)));
 
@@ -651,7 +655,7 @@ IMEStateManager::UpdateIMEState(const IMEState& aNewIMEState,
   }
 
   if (createTextStateManager) {
-    CreateIMEContentObserver();
+    CreateIMEContentObserver(aEditor);
   }
 }
 
@@ -1145,13 +1149,13 @@ IMEStateManager::DestroyIMEContentObserver()
 
 // static
 void
-IMEStateManager::CreateIMEContentObserver()
+IMEStateManager::CreateIMEContentObserver(nsIEditor* aEditor)
 {
   PR_LOG(sISMLog, PR_LOG_ALWAYS,
-    ("ISM: IMEStateManager::CreateIMEContentObserver(), "
+    ("ISM: IMEStateManager::CreateIMEContentObserver(aEditor=0x%p), "
      "sPresContext=0x%p, sContent=0x%p, sActiveIMEContentObserver=0x%p, "
      "sActiveIMEContentObserver->IsManaging(sPresContext, sContent)=%s",
-     sPresContext, sContent, sActiveIMEContentObserver,
+     aEditor, sPresContext, sContent, sActiveIMEContentObserver,
      GetBoolName(sActiveIMEContentObserver ?
        sActiveIMEContentObserver->IsManaging(sPresContext, sContent) : false)));
 
@@ -1195,7 +1199,7 @@ IMEStateManager::CreateIMEContentObserver()
   // instance.  So, sActiveIMEContentObserver would be replaced with new one.
   // We should hold the current instance here.
   nsRefPtr<IMEContentObserver> kungFuDeathGrip(sActiveIMEContentObserver);
-  sActiveIMEContentObserver->Init(widget, sPresContext, sContent);
+  sActiveIMEContentObserver->Init(widget, sPresContext, sContent, aEditor);
 }
 
 // static
diff --git a/dom/events/IMEStateManager.h b/dom/events/IMEStateManager.h
index 665edcc2d0f..01ad078ac38 100644
--- a/dom/events/IMEStateManager.h
+++ b/dom/events/IMEStateManager.h
@@ -11,6 +11,7 @@
 
 class nsIContent;
 class nsIDOMMouseEvent;
+class nsIEditor;
 class nsINode;
 class nsPIDOMWindow;
 class nsPresContext;
@@ -65,7 +66,8 @@ public:
   // Note that this method changes the IME state of the active element in the
   // widget.  So, the caller must have focus.
   static void UpdateIMEState(const IMEState &aNewIMEState,
-                             nsIContent* aContent);
+                             nsIContent* aContent,
+                             nsIEditor* aEditor);
 
   // This method is called when user operates mouse button in focused editor
   // and before the editor handles it.
@@ -89,7 +91,8 @@ public:
   //   If the editor is for contenteditable, the active editinghost.
   //   If the editor is for designMode, nullptr.
   static void OnFocusInEditor(nsPresContext* aPresContext,
-                              nsIContent* aContent);
+                              nsIContent* aContent,
+                              nsIEditor* aEditor);
 
   /**
    * All composition events must be dispatched via DispatchCompositionEvent()
@@ -149,7 +152,7 @@ protected:
                                  nsIContent* aContent);
 
   static void EnsureTextCompositionArray();
-  static void CreateIMEContentObserver();
+  static void CreateIMEContentObserver(nsIEditor* aEditor);
   static void DestroyIMEContentObserver();
 
   static bool IsEditable(nsINode* node);
diff --git a/editor/libeditor/nsEditor.cpp b/editor/libeditor/nsEditor.cpp
index d4e7e5a77b3..75b8797c819 100644
--- a/editor/libeditor/nsEditor.cpp
+++ b/editor/libeditor/nsEditor.cpp
@@ -315,7 +315,7 @@ nsEditor::PostCreate()
     rv = GetPreferredIMEState(&newState);
     NS_ENSURE_SUCCESS(rv, NS_OK);
     nsCOMPtr<nsIContent> content = GetFocusedContentForIME();
-    IMEStateManager::UpdateIMEState(newState, content);
+    IMEStateManager::UpdateIMEState(newState, content, this);
   }
   return NS_OK;
 }
@@ -496,7 +496,7 @@ nsEditor::SetFlags(uint32_t aFlags)
       // NOTE: When the enabled state isn't going to be modified, this method
       // is going to do nothing.
       nsCOMPtr<nsIContent> content = GetFocusedContentForIME();
-      IMEStateManager::UpdateIMEState(newState, content);
+      IMEStateManager::UpdateIMEState(newState, content, this);
     }
   }
 
diff --git a/editor/libeditor/nsEditorEventListener.cpp b/editor/libeditor/nsEditorEventListener.cpp
index 702a61862fb..01f6a4af7f8 100644
--- a/editor/libeditor/nsEditorEventListener.cpp
+++ b/editor/libeditor/nsEditorEventListener.cpp
@@ -1097,7 +1097,8 @@ nsEditorEventListener::Focus(nsIDOMEvent* aEvent)
   nsCOMPtr<nsIPresShell> ps = GetPresShell();
   NS_ENSURE_TRUE(ps, NS_OK);
   nsCOMPtr<nsIContent> focusedContent = mEditor->GetFocusedContentForIME();
-  IMEStateManager::OnFocusInEditor(ps->GetPresContext(), focusedContent);
+  IMEStateManager::OnFocusInEditor(ps->GetPresContext(), focusedContent,
+                                   mEditor);
 
   return NS_OK;
 }

From edd6c20e5ba44a251b11423c39d5578ab971d7cc Mon Sep 17 00:00:00 2001
From: Bill McCloskey <wmccloskey@mozilla.com>
Date: Tue, 4 Nov 2014 17:38:19 -0800
Subject: [PATCH 043/153] Bug 1092446 - [e10s] Allow unprivileged scopes to
 call content-to-chrome CPOWs (r=bholley)

---
 dom/base/test/chrome/cpows_child.js      | 9 +++++++++
 dom/base/test/chrome/cpows_parent.xul    | 5 ++++-
 js/xpconnect/wrappers/WrapperFactory.cpp | 9 +++++++--
 3 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/dom/base/test/chrome/cpows_child.js b/dom/base/test/chrome/cpows_child.js
index 95bdfb9e1f5..b81a24a6d66 100644
--- a/dom/base/test/chrome/cpows_child.js
+++ b/dom/base/test/chrome/cpows_child.js
@@ -87,6 +87,15 @@ function parent_test()
   addMessageListener("cpows:from_parent", (msg) => {
     let obj = msg.objects.obj;
     ok(obj.a == 1, "correct value from parent");
+
+    // Test that a CPOW reference to a function in the chrome process
+    // is callable from unprivileged content. Greasemonkey uses this
+    // functionality.
+    let func = msg.objects.func;
+    let sb = Cu.Sandbox('http://www.example.com', {});
+    sb.func = func;
+    ok(sb.eval('func()') == 101, "can call parent's function in child");
+
     done_count++;
     if (done_count == 2)
       sendSyncMessage("cpows:done", {});
diff --git a/dom/base/test/chrome/cpows_parent.xul b/dom/base/test/chrome/cpows_parent.xul
index 78ed01d80bb..bc69541219f 100644
--- a/dom/base/test/chrome/cpows_parent.xul
+++ b/dom/base/test/chrome/cpows_parent.xul
@@ -181,8 +181,11 @@
       let func = message.objects.func;
       let result = func(n => 2*n);
       ok(result == 20, "result == 20");
+      function f() {
+        return 101;
+      }
       let obj = {a:1, __exposedProps__: {"a": "r"}};
-      savedMM.sendAsyncMessage("cpows:from_parent", {}, {obj: obj});
+      savedMM.sendAsyncMessage("cpows:from_parent", {}, {obj: obj, func: f});
     }
 
     // Make sure errors in this file actually hit window.onerror.
diff --git a/js/xpconnect/wrappers/WrapperFactory.cpp b/js/xpconnect/wrappers/WrapperFactory.cpp
index 0792b9a343a..0d8eee539c7 100644
--- a/js/xpconnect/wrappers/WrapperFactory.cpp
+++ b/js/xpconnect/wrappers/WrapperFactory.cpp
@@ -16,9 +16,11 @@
 #include "xpcprivate.h"
 #include "XPCMaps.h"
 #include "mozilla/dom/BindingUtils.h"
+#include "JavaScriptParent.h"
 #include "jsfriendapi.h"
 #include "mozilla/Likely.h"
 #include "nsContentUtils.h"
+#include "nsXULAppAPI.h"
 
 using namespace JS;
 using namespace js;
@@ -423,9 +425,12 @@ WrapperFactory::Rewrap(JSContext *cx, HandleObject existing, HandleObject obj,
     }
 
     // If this is a chrome function being exposed to content, we need to allow
-    // call (but nothing else).
+    // call (but nothing else). We allow CPOWs that purport to be function's
+    // here, but only in the content process.
     else if (originIsChrome && !targetIsChrome &&
-             IdentifyStandardInstance(obj) == JSProto_Function)
+             (IdentifyStandardInstance(obj) == JSProto_Function ||
+              (jsipc::IsCPOW(obj) && JS::IsCallable(obj) &&
+               XRE_GetProcessType() == GeckoProcessType_Content)))
     {
         wrapper = &FilteringWrapper<CrossCompartmentSecurityWrapper, OpaqueWithCall>::singleton;
     }

From 7260811c539268b1f1f3c1d686a10dbbecbeaa17 Mon Sep 17 00:00:00 2001
From: Bill McCloskey <wmccloskey@mozilla.com>
Date: Tue, 4 Nov 2014 17:39:34 -0800
Subject: [PATCH 044/153] Bug 1091964 - [e10s] Cache isCallable and
 isConstructor for CPOWs (r=mrbkap)

---
 js/ipc/JavaScriptBase.h      | 16 -------
 js/ipc/JavaScriptTypes.ipdlh |  2 +
 js/ipc/PJavaScript.ipdl      |  3 --
 js/ipc/WrapperAnswer.cpp     | 41 -----------------
 js/ipc/WrapperAnswer.h       |  3 --
 js/ipc/WrapperOwner.cpp      | 88 +++++++++++++++++-------------------
 js/ipc/WrapperOwner.h        |  5 --
 7 files changed, 44 insertions(+), 114 deletions(-)

diff --git a/js/ipc/JavaScriptBase.h b/js/ipc/JavaScriptBase.h
index a80e784f3af..2ae230bb0f7 100644
--- a/js/ipc/JavaScriptBase.h
+++ b/js/ipc/JavaScriptBase.h
@@ -116,14 +116,6 @@ class JavaScriptBase : public WrapperOwner, public WrapperAnswer, public Base
         return Answer::RecvDOMInstanceOf(ObjectId::deserialize(objId), prototypeID, depth, rs, instanceof);
     }
 
-    bool RecvIsCallable(const uint64_t &objId, bool *result) {
-        return Answer::RecvIsCallable(ObjectId::deserialize(objId), result);
-    }
-
-    bool RecvIsConstructor(const uint64_t &objId, bool *result) {
-        return Answer::RecvIsConstructor(ObjectId::deserialize(objId), result);
-    }
-
     bool RecvDropObject(const uint64_t &objId) {
         return Answer::RecvDropObject(ObjectId::deserialize(objId));
     }
@@ -215,14 +207,6 @@ class JavaScriptBase : public WrapperOwner, public WrapperAnswer, public Base
         return Base::SendDOMInstanceOf(objId.serialize(), prototypeID, depth, rs, instanceof);
     }
 
-    bool SendIsCallable(const ObjectId &objId, bool *result) {
-        return Base::SendIsCallable(objId.serialize(), result);
-    }
-
-    bool SendIsConstructor(const ObjectId &objId, bool *result) {
-        return Base::SendIsConstructor(objId.serialize(), result);
-    }
-
     /* The following code is needed to suppress a bogus MSVC warning (C4250). */
 
     virtual bool toObjectVariant(JSContext *cx, JSObject *obj, ObjectVariant *objVarp) {
diff --git a/js/ipc/JavaScriptTypes.ipdlh b/js/ipc/JavaScriptTypes.ipdlh
index a5c57792b7b..975e3aa39e1 100644
--- a/js/ipc/JavaScriptTypes.ipdlh
+++ b/js/ipc/JavaScriptTypes.ipdlh
@@ -35,6 +35,8 @@ struct LocalObject
 struct RemoteObject
 {
     uint64_t serializedId;
+    bool isCallable;
+    bool isConstructor;
 };
 
 union ObjectVariant
diff --git a/js/ipc/PJavaScript.ipdl b/js/ipc/PJavaScript.ipdl
index 6638ce19f3b..8f89fd139ca 100644
--- a/js/ipc/PJavaScript.ipdl
+++ b/js/ipc/PJavaScript.ipdl
@@ -46,9 +46,6 @@ both:
     prio(high) sync InstanceOf(uint64_t objId, JSIID iid) returns (ReturnStatus rs, bool instanceof);
     prio(high) sync DOMInstanceOf(uint64_t objId, int prototypeID, int depth) returns (ReturnStatus rs, bool instanceof);
 
-    prio(high) sync IsCallable(uint64_t objId) returns (bool result);
-    prio(high) sync IsConstructor(uint64_t objId) returns (bool result);
-
 parent:
     async __delete__();
 };
diff --git a/js/ipc/WrapperAnswer.cpp b/js/ipc/WrapperAnswer.cpp
index e2ef50b309b..fa8a6a9f2f3 100644
--- a/js/ipc/WrapperAnswer.cpp
+++ b/js/ipc/WrapperAnswer.cpp
@@ -662,47 +662,6 @@ WrapperAnswer::RecvDOMInstanceOf(const ObjectId &objId, const int &prototypeID,
     return ok(rs);
 }
 
-bool
-WrapperAnswer::RecvIsCallable(const ObjectId &objId, bool *result)
-{
-    AutoSafeJSContext cx;
-    JSAutoRequest request(cx);
-
-    RootedObject obj(cx, findObjectById(cx, objId));
-    if (!obj) {
-        // This is very unfortunate, but we have no choice.
-        *result = false;
-        return true;
-    }
-    JSAutoCompartment ac(cx, obj); // Not really necessary here, but be safe.
-
-    LOG("%s.isCallable()", ReceiverObj(objId));
-
-    *result = JS::IsCallable(obj);
-    return true;
-}
-
-bool
-WrapperAnswer::RecvIsConstructor(const ObjectId &objId, bool *result)
-{
-    AutoSafeJSContext cx;
-    JSAutoRequest request(cx);
-
-    RootedObject obj(cx, findObjectById(cx, objId));
-    if (!obj) {
-        // This is very unfortunate, but we have no choice.
-        *result = false;
-        return true;
-    }
-    JSAutoCompartment ac(cx, obj); // Not really necessary here, but be safe.
-
-    LOG("%s.isConstructor()", ReceiverObj(objId));
-
-    *result = JS::IsConstructor(obj);
-    return true;
-}
-
-
 bool
 WrapperAnswer::RecvDropObject(const ObjectId &objId)
 {
diff --git a/js/ipc/WrapperAnswer.h b/js/ipc/WrapperAnswer.h
index 180bad5abaa..772416abb2b 100644
--- a/js/ipc/WrapperAnswer.h
+++ b/js/ipc/WrapperAnswer.h
@@ -62,9 +62,6 @@ class WrapperAnswer : public virtual JavaScriptShared
     bool RecvDOMInstanceOf(const ObjectId &objId, const int &prototypeID, const int &depth,
                            ReturnStatus *rs, bool *instanceof);
 
-    bool RecvIsCallable(const ObjectId &objId, bool *result);
-    bool RecvIsConstructor(const ObjectId &objId, bool *result);
-
     bool RecvDropObject(const ObjectId &objId);
 
   private:
diff --git a/js/ipc/WrapperOwner.cpp b/js/ipc/WrapperOwner.cpp
index 3bbb1414fd3..8eb6b30ae2a 100644
--- a/js/ipc/WrapperOwner.cpp
+++ b/js/ipc/WrapperOwner.cpp
@@ -18,12 +18,32 @@ using namespace JS;
 using namespace mozilla;
 using namespace mozilla::jsipc;
 
+struct AuxCPOWData
+{
+    ObjectId id;
+    bool isCallable;
+    bool isConstructor;
+
+    AuxCPOWData(ObjectId id, bool isCallable, bool isConstructor)
+      : id(id),
+        isCallable(isCallable),
+        isConstructor(isConstructor)
+    {}
+};
+
 WrapperOwner::WrapperOwner(JSRuntime *rt)
   : JavaScriptShared(rt),
     inactive_(false)
 {
 }
 
+static inline AuxCPOWData *
+AuxCPOWDataOf(JSObject *obj)
+{
+    MOZ_ASSERT(IsCPOW(obj));
+    return static_cast<AuxCPOWData *>(GetProxyExtra(obj, 1).toPrivate());
+}
+
 static inline WrapperOwner *
 OwnerOf(JSObject *obj)
 {
@@ -36,13 +56,9 @@ WrapperOwner::idOfUnchecked(JSObject *obj)
 {
     MOZ_ASSERT(IsCPOW(obj));
 
-    Value v = GetProxyExtra(obj, 1);
-    MOZ_ASSERT(v.isDouble());
-
-    ObjectId objId = ObjectId::deserialize(BitwiseCast<uint64_t>(v.toDouble()));
-    MOZ_ASSERT(!objId.isNull());
-
-    return objId;
+    AuxCPOWData *aux = AuxCPOWDataOf(obj);
+    MOZ_ASSERT(!aux->id.isNull());
+    return aux->id;
 }
 
 ObjectId
@@ -689,6 +705,10 @@ void
 CPOWProxyHandler::finalize(JSFreeOp *fop, JSObject *proxy) const
 {
     OwnerOf(proxy)->drop(proxy);
+
+    AuxCPOWData *aux = AuxCPOWDataOf(proxy);
+    if (aux)
+        delete aux;
 }
 
 void
@@ -700,47 +720,15 @@ CPOWProxyHandler::objectMoved(JSObject *proxy, const JSObject *old) const
 bool
 CPOWProxyHandler::isCallable(JSObject *proxy) const
 {
-    WrapperOwner *parent = OwnerOf(proxy);
-    if (!parent->active())
-        return false;
-    return parent->isCallable(proxy);
-}
-
-bool
-WrapperOwner::isCallable(JSObject *obj)
-{
-    ObjectId objId = idOf(obj);
-
-    bool callable = false;
-    if (!SendIsCallable(objId, &callable)) {
-        NS_WARNING("IPC isCallable() failed");
-        return false;
-    }
-
-    return callable;
+    AuxCPOWData *aux = AuxCPOWDataOf(proxy);
+    return aux->isCallable;
 }
 
 bool
 CPOWProxyHandler::isConstructor(JSObject *proxy) const
 {
-    WrapperOwner *parent = OwnerOf(proxy);
-    if (!parent->active())
-        return false;
-    return parent->isConstructor(proxy);
-}
-
-bool
-WrapperOwner::isConstructor(JSObject *obj)
-{
-    ObjectId objId = idOf(obj);
-
-    bool constructor = false;
-    if (!SendIsConstructor(objId, &constructor)) {
-        NS_WARNING("IPC isConstructor() failed");
-        return false;
-    }
-
-    return constructor;
+    AuxCPOWData *aux = AuxCPOWDataOf(proxy);
+    return aux->isConstructor;
 }
 
 void
@@ -895,6 +883,12 @@ WrapperOwner::ok(JSContext *cx, const ReturnStatus &status)
     return false;
 }
 
+static RemoteObject
+MakeRemoteObject(ObjectId id, JSObject *obj)
+{
+    return RemoteObject(id.serialize(), JS::IsCallable(obj), JS::IsConstructor(obj));
+}
+
 bool
 WrapperOwner::toObjectVariant(JSContext *cx, JSObject *objArg, ObjectVariant *objVarp)
 {
@@ -916,7 +910,7 @@ WrapperOwner::toObjectVariant(JSContext *cx, JSObject *objArg, ObjectVariant *ob
     ObjectId id = objectIdMap(waiveXray).find(obj);
     if (!id.isNull()) {
         MOZ_ASSERT(id.hasXrayWaiver() == waiveXray);
-        *objVarp = RemoteObject(id.serialize());
+        *objVarp = MakeRemoteObject(id, obj);
         return true;
     }
 
@@ -931,7 +925,7 @@ WrapperOwner::toObjectVariant(JSContext *cx, JSObject *objArg, ObjectVariant *ob
     if (!objectIdMap(waiveXray).add(cx, obj, id))
         return false;
 
-    *objVarp = RemoteObject(id.serialize());
+    *objVarp = MakeRemoteObject(id, obj);
     return true;
 }
 
@@ -970,8 +964,10 @@ WrapperOwner::fromRemoteObjectVariant(JSContext *cx, RemoteObject objVar)
         // Incref once we know the decref will be called.
         incref();
 
+        AuxCPOWData *aux = new AuxCPOWData(objId, objVar.isCallable(), objVar.isConstructor());
+
         SetProxyExtra(obj, 0, PrivateValue(this));
-        SetProxyExtra(obj, 1, DoubleValue(BitwiseCast<double>(objId.serialize())));
+        SetProxyExtra(obj, 1, PrivateValue(aux));
     }
 
     if (!JS_WrapObject(cx, &obj))
diff --git a/js/ipc/WrapperOwner.h b/js/ipc/WrapperOwner.h
index 47bad3ccfd4..5ff469dc233 100644
--- a/js/ipc/WrapperOwner.h
+++ b/js/ipc/WrapperOwner.h
@@ -61,8 +61,6 @@ class WrapperOwner : public virtual JavaScriptShared
     bool objectClassIs(JSContext *cx, JS::HandleObject obj, js::ESClassValue classValue);
     const char* className(JSContext *cx, JS::HandleObject proxy);
     bool regexp_toShared(JSContext *cx, JS::HandleObject proxy, js::RegExpGuard *g);
-    bool isCallable(JSObject *obj);
-    bool isConstructor(JSObject *obj);
 
     nsresult instanceOf(JSObject *obj, const nsID *id, bool *bp);
 
@@ -151,9 +149,6 @@ class WrapperOwner : public virtual JavaScriptShared
                                 ReturnStatus *rs, bool *instanceof) = 0;
     virtual bool SendDOMInstanceOf(const ObjectId &objId, const int &prototypeID, const int &depth,
                                    ReturnStatus *rs, bool *instanceof) = 0;
-
-    virtual bool SendIsCallable(const ObjectId &objId, bool *result) = 0;
-    virtual bool SendIsConstructor(const ObjectId &objId, bool *result) = 0;
 };
 
 bool

From d673d4c30d39a9152de997b98f04a874b6eff536 Mon Sep 17 00:00:00 2001
From: Bill McCloskey <wmccloskey@mozilla.com>
Date: Tue, 4 Nov 2014 17:40:08 -0800
Subject: [PATCH 045/153] Bug 1091970 - [e10s] Cache object tag in add-on shims
 for remote objects (r=mrbkap)

---
 browser/installer/package-manifest.in         |  1 +
 js/ipc/JavaScriptTypes.ipdlh                  |  1 +
 js/ipc/WrapperOwner.cpp                       | 47 ++++++++++++++++---
 js/ipc/WrapperOwner.h                         |  3 ++
 js/xpconnect/idl/moz.build                    |  1 +
 js/xpconnect/idl/nsIRemoteTagService.idl      | 13 +++++
 js/xpconnect/idl/xpccomponents.idl            | 11 ++++-
 js/xpconnect/src/XPCComponents.cpp            | 10 ++++
 .../addoncompat/addoncompat.manifest          |  2 +
 toolkit/components/addoncompat/moz.build      |  1 +
 .../addoncompat/multiprocessShims.js          |  8 +---
 .../addoncompat/remoteTagService.js           | 39 +++++++++++++++
 12 files changed, 122 insertions(+), 15 deletions(-)
 create mode 100644 js/xpconnect/idl/nsIRemoteTagService.idl
 create mode 100644 toolkit/components/addoncompat/remoteTagService.js

diff --git a/browser/installer/package-manifest.in b/browser/installer/package-manifest.in
index 125354ff90a..7f81993c60e 100644
--- a/browser/installer/package-manifest.in
+++ b/browser/installer/package-manifest.in
@@ -441,6 +441,7 @@
 @BINPATH@/components/nsUpdateTimerManager.js
 @BINPATH@/components/addoncompat.manifest
 @BINPATH@/components/multiprocessShims.js
+@BINPATH@/components/remoteTagService.js
 @BINPATH@/components/pluginGlue.manifest
 @BINPATH@/components/ProcessSingleton.manifest
 @BINPATH@/components/MainProcessSingleton.js
diff --git a/js/ipc/JavaScriptTypes.ipdlh b/js/ipc/JavaScriptTypes.ipdlh
index 975e3aa39e1..2d19ccff82a 100644
--- a/js/ipc/JavaScriptTypes.ipdlh
+++ b/js/ipc/JavaScriptTypes.ipdlh
@@ -37,6 +37,7 @@ struct RemoteObject
     uint64_t serializedId;
     bool isCallable;
     bool isConstructor;
+    nsCString objectTag;
 };
 
 union ObjectVariant
diff --git a/js/ipc/WrapperOwner.cpp b/js/ipc/WrapperOwner.cpp
index 8eb6b30ae2a..bb377fea64f 100644
--- a/js/ipc/WrapperOwner.cpp
+++ b/js/ipc/WrapperOwner.cpp
@@ -13,6 +13,8 @@
 #include "xpcprivate.h"
 #include "WrapperFactory.h"
 
+#include "nsIRemoteTagService.h"
+
 using namespace js;
 using namespace JS;
 using namespace mozilla;
@@ -24,10 +26,15 @@ struct AuxCPOWData
     bool isCallable;
     bool isConstructor;
 
-    AuxCPOWData(ObjectId id, bool isCallable, bool isConstructor)
+    // The object tag is just some auxilliary information that clients can use
+    // however they see fit.
+    nsCString objectTag;
+
+    AuxCPOWData(ObjectId id, bool isCallable, bool isConstructor, const nsACString &objectTag)
       : id(id),
         isCallable(isCallable),
-        isConstructor(isConstructor)
+        isConstructor(isConstructor),
+        objectTag(objectTag)
     {}
 };
 
@@ -803,6 +810,17 @@ IsWrappedCPOW(JSObject *obj)
     return IsCPOW(unwrapped);
 }
 
+void
+GetWrappedCPOWTag(JSObject *obj, nsACString &out)
+{
+    JSObject *unwrapped = js::UncheckedUnwrap(obj, true);
+    MOZ_ASSERT(IsCPOW(unwrapped));
+
+    AuxCPOWData *aux = AuxCPOWDataOf(unwrapped);
+    if (aux)
+        out = aux->objectTag;
+}
+
 nsresult
 InstanceOf(JSObject *proxy, const nsID *id, bool *bp)
 {
@@ -884,9 +902,21 @@ WrapperOwner::ok(JSContext *cx, const ReturnStatus &status)
 }
 
 static RemoteObject
-MakeRemoteObject(ObjectId id, JSObject *obj)
+MakeRemoteObject(JSContext *cx, ObjectId id, HandleObject obj)
 {
-    return RemoteObject(id.serialize(), JS::IsCallable(obj), JS::IsConstructor(obj));
+    nsCString objectTag;
+
+    nsCOMPtr<nsIRemoteTagService> service =
+        do_GetService("@mozilla.org/addons/remote-tag-service;1");
+    if (service) {
+        RootedValue objVal(cx, ObjectValue(*obj));
+        service->GetRemoteObjectTag(objVal, objectTag);
+    }
+
+    return RemoteObject(id.serialize(),
+                        JS::IsCallable(obj),
+                        JS::IsConstructor(obj),
+                        objectTag);
 }
 
 bool
@@ -910,7 +940,7 @@ WrapperOwner::toObjectVariant(JSContext *cx, JSObject *objArg, ObjectVariant *ob
     ObjectId id = objectIdMap(waiveXray).find(obj);
     if (!id.isNull()) {
         MOZ_ASSERT(id.hasXrayWaiver() == waiveXray);
-        *objVarp = MakeRemoteObject(id, obj);
+        *objVarp = MakeRemoteObject(cx, id, obj);
         return true;
     }
 
@@ -925,7 +955,7 @@ WrapperOwner::toObjectVariant(JSContext *cx, JSObject *objArg, ObjectVariant *ob
     if (!objectIdMap(waiveXray).add(cx, obj, id))
         return false;
 
-    *objVarp = MakeRemoteObject(id, obj);
+    *objVarp = MakeRemoteObject(cx, id, obj);
     return true;
 }
 
@@ -964,7 +994,10 @@ WrapperOwner::fromRemoteObjectVariant(JSContext *cx, RemoteObject objVar)
         // Incref once we know the decref will be called.
         incref();
 
-        AuxCPOWData *aux = new AuxCPOWData(objId, objVar.isCallable(), objVar.isConstructor());
+        AuxCPOWData *aux = new AuxCPOWData(objId,
+                                           objVar.isCallable(),
+                                           objVar.isConstructor(),
+                                           objVar.objectTag());
 
         SetProxyExtra(obj, 0, PrivateValue(this));
         SetProxyExtra(obj, 1, PrivateValue(aux));
diff --git a/js/ipc/WrapperOwner.h b/js/ipc/WrapperOwner.h
index 5ff469dc233..8c51f218c93 100644
--- a/js/ipc/WrapperOwner.h
+++ b/js/ipc/WrapperOwner.h
@@ -163,6 +163,9 @@ InstanceOf(JSObject *obj, const nsID *id, bool *bp);
 bool
 DOMInstanceOf(JSContext *cx, JSObject *obj, int prototypeID, int depth, bool *bp);
 
+void
+GetWrappedCPOWTag(JSObject *obj, nsACString &out);
+
 } // jsipc
 } // mozilla
 
diff --git a/js/xpconnect/idl/moz.build b/js/xpconnect/idl/moz.build
index 8dffa158e46..c1ed1e21c1b 100644
--- a/js/xpconnect/idl/moz.build
+++ b/js/xpconnect/idl/moz.build
@@ -8,6 +8,7 @@ XPIDL_SOURCES += [
     'mozIJSSubScriptLoader.idl',
     'nsIAddonInterposition.idl',
     'nsIJSRuntimeService.idl',
+    'nsIRemoteTagService.idl',
     'nsIScriptError.idl',
     'nsIXPConnect.idl',
     'nsIXPCScriptable.idl',
diff --git a/js/xpconnect/idl/nsIRemoteTagService.idl b/js/xpconnect/idl/nsIRemoteTagService.idl
new file mode 100644
index 00000000000..4602dfdb99f
--- /dev/null
+++ b/js/xpconnect/idl/nsIRemoteTagService.idl
@@ -0,0 +1,13 @@
+/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsISupports.idl"
+
+[scriptable,uuid(59dbe3d0-6084-11e4-9803-0800200c9a66)]
+interface nsIRemoteTagService : nsISupports
+{
+    ACString getRemoteObjectTag(in jsval target);
+};
diff --git a/js/xpconnect/idl/xpccomponents.idl b/js/xpconnect/idl/xpccomponents.idl
index fca4ffc9372..7cde41bf36a 100644
--- a/js/xpconnect/idl/xpccomponents.idl
+++ b/js/xpconnect/idl/xpccomponents.idl
@@ -122,7 +122,7 @@ interface ScheduledGCCallback : nsISupports
 /**
 * interface of Components.utils
 */
-[scriptable, uuid(ad41689c-ed0e-4a92-8f19-a53c2dba5711)]
+[scriptable, uuid(2617a800-63c1-11e4-9803-0800200c9a66)]
 interface nsIXPCComponents_Utils : nsISupports
 {
 
@@ -435,6 +435,15 @@ interface nsIXPCComponents_Utils : nsISupports
      */
     bool isCrossProcessWrapper(in jsval obj);
 
+    /**
+     * CPOWs can have user data attached to them. This data originates
+     * in the local process via the
+     * nsIRemoteTagService.getRemoteObjectTag method. It's sent along
+     * with the CPOW to the remote process, where it can be fetched
+     * with this function, getCrossProcessWrapperTag.
+     */
+    ACString getCrossProcessWrapperTag(in jsval obj);
+
     /*
      * To be called from JS only. This is for Gecko internal use only, and may
      * disappear at any moment.
diff --git a/js/xpconnect/src/XPCComponents.cpp b/js/xpconnect/src/XPCComponents.cpp
index 3b2c716f034..25a7f0bc8d6 100644
--- a/js/xpconnect/src/XPCComponents.cpp
+++ b/js/xpconnect/src/XPCComponents.cpp
@@ -3106,6 +3106,16 @@ nsXPCComponents_Utils::IsCrossProcessWrapper(HandleValue obj, bool *out)
     return NS_OK;
 }
 
+NS_IMETHODIMP
+nsXPCComponents_Utils::GetCrossProcessWrapperTag(HandleValue obj, nsACString &out)
+{
+    if (obj.isPrimitive() || !jsipc::IsWrappedCPOW(&obj.toObject()))
+        return NS_ERROR_INVALID_ARG;
+
+    jsipc::GetWrappedCPOWTag(&obj.toObject(), out);
+    return NS_OK;
+}
+
 /* void recomputerWrappers(jsval vobj); */
 NS_IMETHODIMP
 nsXPCComponents_Utils::RecomputeWrappers(HandleValue vobj, JSContext *cx)
diff --git a/toolkit/components/addoncompat/addoncompat.manifest b/toolkit/components/addoncompat/addoncompat.manifest
index 962562bfcb6..4273bf246c3 100644
--- a/toolkit/components/addoncompat/addoncompat.manifest
+++ b/toolkit/components/addoncompat/addoncompat.manifest
@@ -1,2 +1,4 @@
 component {1363d5f0-d95e-11e3-9c1a-0800200c9a66} multiprocessShims.js
 contract @mozilla.org/addons/multiprocess-shims;1 {1363d5f0-d95e-11e3-9c1a-0800200c9a66}
+component {dfd07380-6083-11e4-9803-0800200c9a66} remoteTagService.js
+contract @mozilla.org/addons/remote-tag-service;1 {dfd07380-6083-11e4-9803-0800200c9a66}
diff --git a/toolkit/components/addoncompat/moz.build b/toolkit/components/addoncompat/moz.build
index f915e7370e4..56e8d050a72 100644
--- a/toolkit/components/addoncompat/moz.build
+++ b/toolkit/components/addoncompat/moz.build
@@ -9,6 +9,7 @@ TEST_DIRS += ['tests']
 EXTRA_COMPONENTS += [
     'addoncompat.manifest',
     'multiprocessShims.js',
+    'remoteTagService.js',
 ]
 
 EXTRA_JS_MODULES += [
diff --git a/toolkit/components/addoncompat/multiprocessShims.js b/toolkit/components/addoncompat/multiprocessShims.js
index 637685571be..9cbcce8afc0 100644
--- a/toolkit/components/addoncompat/multiprocessShims.js
+++ b/toolkit/components/addoncompat/multiprocessShims.js
@@ -77,13 +77,7 @@ AddonInterpositionService.prototype = {
   // determines the type of the target object.
   getObjectTag: function(target) {
     if (Cu.isCrossProcessWrapper(target)) {
-      if (target instanceof Ci.nsIDocShellTreeItem) {
-        return "ContentDocShellTreeItem";
-      }
-
-      if (target instanceof Ci.nsIDOMDocument) {
-        return "ContentDocument";
-      }
+      return Cu.getCrossProcessWrapperTag(target);
     }
 
     const XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
diff --git a/toolkit/components/addoncompat/remoteTagService.js b/toolkit/components/addoncompat/remoteTagService.js
new file mode 100644
index 00000000000..9c1a443baa1
--- /dev/null
+++ b/toolkit/components/addoncompat/remoteTagService.js
@@ -0,0 +1,39 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+const Cu = Components.utils;
+const Ci = Components.interfaces;
+
+Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+
+function RemoteTagServiceService()
+{
+}
+
+RemoteTagServiceService.prototype = {
+  classID: Components.ID("{dfd07380-6083-11e4-9803-0800200c9a66}"),
+  QueryInterface: XPCOMUtils.generateQI([Ci.nsIRemoteTagService, Ci.nsISupportsWeakReference]),
+
+  /**
+   * CPOWs can have user data attached to them. This data originates
+   * in the local process from this function, getRemoteObjectTag. It's
+   * sent along with the CPOW to the remote process, where it can be
+   * fetched with Components.utils.getCrossProcessWrapperTag.
+   */
+  getRemoteObjectTag: function(target) {
+    if (target instanceof Ci.nsIDocShellTreeItem) {
+      return "ContentDocShellTreeItem";
+    }
+
+    if (target instanceof Ci.nsIDOMDocument) {
+      return "ContentDocument";
+    }
+
+    return "generic";
+  }
+};
+
+this.NSGetFactory = XPCOMUtils.generateNSGetFactory([RemoteTagServiceService]);

From d08dfee91d92bbed7f1fcaa3b6dceb15fefc052e Mon Sep 17 00:00:00 2001
From: Brian Hackett <bhackett1024@gmail.com>
Date: Tue, 4 Nov 2014 18:44:03 -0700
Subject: [PATCH 046/153] Bug 1089665 - Fixup dictionary objects earlier after
 swapping them, r=billm.

---
 js/src/jsobj.cpp | 22 +++++++++++++++-------
 js/src/jsobj.h   |  4 ++++
 2 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/js/src/jsobj.cpp b/js/src/jsobj.cpp
index 6749db2d6d8..5264c306631 100644
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@@ -2387,6 +2387,15 @@ NativeObject::fillInAfterSwap(JSContext *cx, const Vector<Value> &values, void *
     initSlotRange(0, values.begin(), values.length());
 }
 
+void
+JSObject::fixDictionaryShapeAfterSwap()
+{
+    // Dictionary shapes can point back to their containing objects, so after
+    // swapping the guts of those objects fix the pointers up.
+    if (isNative() && as<NativeObject>().inDictionaryMode())
+        shape_->listp = &shape_;
+}
+
 /* Use this method with extreme caution. It trades the guts of two objects. */
 bool
 JSObject::swap(JSContext *cx, HandleObject a, HandleObject b)
@@ -2441,6 +2450,9 @@ JSObject::swap(JSContext *cx, HandleObject a, HandleObject b)
         js_memcpy(tmp, a, size);
         js_memcpy(a, b, size);
         js_memcpy(b, tmp, size);
+
+        a->fixDictionaryShapeAfterSwap();
+        b->fixDictionaryShapeAfterSwap();
     } else {
         // Avoid GC in here to avoid confusing the tracing code with our
         // intermediate state.
@@ -2478,19 +2490,15 @@ JSObject::swap(JSContext *cx, HandleObject a, HandleObject b)
         js_memcpy(a, b, sizeof tmp);
         js_memcpy(b, &tmp, sizeof tmp);
 
+        a->fixDictionaryShapeAfterSwap();
+        b->fixDictionaryShapeAfterSwap();
+
         if (na)
             b->as<NativeObject>().fillInAfterSwap(cx, avals, apriv);
         if (nb)
             a->as<NativeObject>().fillInAfterSwap(cx, bvals, bpriv);
     }
 
-    // Dictionary shapes can point back to their containing objects, so fix
-    // those pointers up.
-    if (a->isNative() && a->as<NativeObject>().inDictionaryMode())
-        a->lastProperty()->listp = &a->shape_;
-    if (b->isNative() && b->as<NativeObject>().inDictionaryMode())
-        b->lastProperty()->listp = &b->shape_;
-
     // Swapping the contents of two objects invalidates type sets which contain
     // either of the objects, so mark all such sets as unknown.
     MarkTypeObjectUnknownProperties(cx, a->type(), !a->hasSingletonType());
diff --git a/js/src/jsobj.h b/js/src/jsobj.h
index eacceebb516..c02d857f903 100644
--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@@ -705,6 +705,10 @@ class JSObject : public js::gc::Cell
 
     static bool swap(JSContext *cx, JS::HandleObject a, JS::HandleObject b);
 
+  private:
+    void fixDictionaryShapeAfterSwap();
+
+  public:
     inline void initArrayClass();
 
     /*

From 16d46a1e8fa543ca11f8c4afb0c0c70a2880b3a6 Mon Sep 17 00:00:00 2001
From: Chris Pearce <cpearce@mozilla.com>
Date: Wed, 5 Nov 2014 15:11:44 +1300
Subject: [PATCH 047/153] Bug 1090523 - Add more logging to help debug
 infrequent EME/MSE failure. r=edwin

---
 dom/media/test/eme.js                         | 64 +++++++++++++------
 dom/media/test/test_eme_canvas_blocked.html   |  4 +-
 dom/media/test/test_eme_playback.html         | 24 +++----
 .../test/test_eme_stream_capture_blocked.html | 14 ++--
 4 files changed, 65 insertions(+), 41 deletions(-)

diff --git a/dom/media/test/eme.js b/dom/media/test/eme.js
index f01455b9f35..c166b78c31c 100644
--- a/dom/media/test/eme.js
+++ b/dom/media/test/eme.js
@@ -50,14 +50,34 @@ function HexToBase64(hex)
   return window.btoa(bin).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
 }
 
+function TimeStamp(token) {
+  function pad(x) {
+    return (x < 10) ? "0" + x : x;
+  }
+  var now = new Date();
+  var ms = now.getMilliseconds();
+  var time = "[" +
+             pad(now.getHours()) + ":" +
+             pad(now.getMinutes()) + ":" +
+             pad(now.getSeconds()) + "." +
+             ms +
+             "]" +
+             (ms < 10 ? "  " : (ms < 100 ? " " : ""));
+  return token ? (time + " " + token) : time;
+}
+
+function Log(token, msg) {
+  info(TimeStamp(token) + " " + msg);
+}
+
 function UpdateSessionFunc(test, token) {
   return function(ev) {
     var msgStr = ArrayBufferToString(ev.message);
     var msg = JSON.parse(msgStr);
 
-    info(token + " got message from CDM: " + msgStr);
-    is(msg.type, test.sessionType, token + " key session type should match");
-    ok(msg.kids, token + " message event should contain key ID array");
+    Log(token, "got message from CDM: " + msgStr);
+    is(msg.type, test.sessionType, TimeStamp(token) + " key session type should match");
+    ok(msg.kids, TimeStamp(token) + " message event should contain key ID array");
 
     var outKeys = [];
 
@@ -67,7 +87,7 @@ function UpdateSessionFunc(test, token) {
       var key = test.keys[idHex];
 
       if (key) {
-        info(token + " found key " + key + " for key id " + idHex);
+        Log(token, "found key " + key + " for key id " + idHex);
         outKeys.push({
           "kty":"oct",
           "alg":"A128KW",
@@ -75,7 +95,7 @@ function UpdateSessionFunc(test, token) {
           "k":HexToBase64(key)
         });
       } else {
-        bail(token + " Couldn't find key for key id " + idHex);
+        bail(token + " couldn't find key for key id " + idHex);
       }
     }
 
@@ -83,15 +103,15 @@ function UpdateSessionFunc(test, token) {
       "keys" : outKeys,
       "type" : msg.type
     });
-    info(token + " sending update message to CDM: " + update);
+    Log(token, "sending update message to CDM: " + update);
 
     ev.target.update(StringToArrayBuffer(update)).then(function() {
-      info(token + " MediaKeySession update ok!");
+      Log(token, "MediaKeySession update ok!");
     }, bail(token + " MediaKeySession update failed"));
   }
 }
 
-function PlayFragmented(test, elem)
+function PlayFragmented(test, elem, token)
 {
   return new Promise(function(resolve, reject) {
     var ms = new MediaSource();
@@ -102,6 +122,7 @@ function PlayFragmented(test, elem)
 
     function addNextFragment() {
       if (curFragment >= test.fragments.length) {
+        Log(token, "addNextFragment() end of stream");
         ms.endOfStream();
         resolve();
         return;
@@ -114,18 +135,19 @@ function PlayFragmented(test, elem)
       req.responseType = "arraybuffer";
 
       req.addEventListener("load", function() {
-        info("fetch of " + fragmentFile + " complete");
+        Log(token, "fetch of " + fragmentFile + " complete, appending");
         sb.appendBuffer(new Uint8Array(req.response));
       });
 
-      req.addEventListener("error", bail("Error fetching " + fragmentFile));
-      req.addEventListener("abort", bail("Aborted fetching " + fragmentFile));
+      req.addEventListener("error", bail(token + " error fetching " + fragmentFile));
+      req.addEventListener("abort", bail(token + " aborted fetching " + fragmentFile));
 
-      info("fetching resource " + fragmentFile);
+      Log(token, "addNextFragment() fetching next fragment " + fragmentFile);
       req.send(null);
     }
 
     ms.addEventListener("sourceopen", function () {
+      Log(token, "sourceopen");
       sb = ms.addSourceBuffer(test.type);
       sb.addEventListener("updateend", addNextFragment);
 
@@ -137,10 +159,10 @@ function PlayFragmented(test, elem)
 // Returns a promise that is resovled when the media element is ready to have
 // its play() function called; when it's loaded MSE fragments, or once the load
 // has started for non-MSE video.
-function LoadTest(test, elem)
+function LoadTest(test, elem, token)
 {
   if (test.fragments) {
-    return PlayFragmented(test, elem);
+    return PlayFragmented(test, elem, token);
   }
 
   // This file isn't fragmented; set the media source normally.
@@ -155,10 +177,12 @@ function SetupEME(test, token, params)
   var v = document.createElement("video");
 
   // Log events dispatched to make debugging easier...
-  ["loadstart", "loadedmetadata", "loadeddata", "ended",
-    "play", "canplay", "playing", "canplaythrough"].forEach(function (e) {
+  [ "canplay", "canplaythrough", "ended", "error", "loadeddata",
+    "loadedmetadata", "loadstart", "pause", "play", "playing", "progress",
+    "stalled", "suspend", "waiting",
+  ].forEach(function (e) {
     v.addEventListener(e, function(event) {
-      info(token + " " + e);
+      Log(token, "" + e);
     }, false);
   });
 
@@ -167,13 +191,13 @@ function SetupEME(test, token, params)
     : bail(token + " Failed to set MediaKeys on <video> element");
 
   v.addEventListener("encrypted", function(ev) {
-    info(token + " got encrypted event");
+    Log(token, "got encrypted event");
     MediaKeys.create(KEYSYSTEM_TYPE).then(function(mediaKeys) {
-      info(token + " created MediaKeys object ok");
+      Log(token, "created MediaKeys object ok");
       mediaKeys.sessions = [];
       return v.setMediaKeys(mediaKeys);
     }, bail("failed to create MediaKeys object")).then(function() {
-      info(token + " set MediaKeys on <video> element ok");
+      Log(token, "set MediaKeys on <video> element ok");
 
       var session = v.mediaKeys.createSession(test.sessionType);
       if (params && params.onsessioncreated) {
diff --git a/dom/media/test/test_eme_canvas_blocked.html b/dom/media/test/test_eme_canvas_blocked.html
index a9945b7037a..abbe310a420 100644
--- a/dom/media/test/test_eme_canvas_blocked.html
+++ b/dom/media/test/test_eme_canvas_blocked.html
@@ -34,13 +34,13 @@ function startTest(test, token)
     } catch (ex) {
       threwError = true;
     }
-    ok(threwError, token + " - Should throw an error when trying to draw EME video to canvas.");
+    ok(threwError, TimeStamp(token) + " - Should throw an error when trying to draw EME video to canvas.");
     manager.finished(token);
   });
 
   v.addEventListener("error", bail(token + " got error event"));
 
-  LoadTest(test, v);
+  LoadTest(test, v, token);
 }
 
 function beginTest() {
diff --git a/dom/media/test/test_eme_playback.html b/dom/media/test/test_eme_playback.html
index 3e04a2db697..89110c471cc 100644
--- a/dom/media/test/test_eme_playback.html
+++ b/dom/media/test/test_eme_playback.html
@@ -16,7 +16,7 @@ var manager = new MediaTestManager;
 function KeysChangeFunc(session, keys, token) {
   session.keyIdsReceived = [];
   for (var keyid in keys) {
-    info("Set " + keyid + " to false in session.keyIdsReceived");
+    Log(token, "Set " + keyid + " to false in session.keyIdsReceived");
     session.keyIdsReceived[keyid] = false;
   }
   return function(ev) {
@@ -25,7 +25,7 @@ function KeysChangeFunc(session, keys, token) {
     session.getUsableKeyIds().then(function(keyIds) {
       for (var k = 0; k < keyIds.length; k++) {
         var kid = Base64ToHex(window.btoa(ArrayBufferToString(keyIds[k])));
-        ok(kid in session.keyIdsReceived, token + " session.keyIdsReceived contained " + kid + " as expected.");
+        ok(kid in session.keyIdsReceived, TimeStamp(token) + " session.keyIdsReceived contained " + kid + " as expected.");
         session.keyIdsReceived[kid] = true;
       }
     }, bail("Failed to get keyIds"));
@@ -52,31 +52,31 @@ function startTest(test, token)
 
   v.addEventListener("encrypted", function(ev) {
     ok(MediaKeys.isTypeSupported(KEYSYSTEM_TYPE, ev.initDataType, test.type),
-       token + " MediaKeys should support this keysystem");
+       TimeStamp(token) + " MediaKeys should support this keysystem");
     gotEncrypted = true;
   });
 
   v.addEventListener("playing", function () { gotPlaying = true; });
 
   v.addEventListener("ended", function(ev) {
-    ok(true, token + " got ended event");
+    ok(true, TimeStamp(token) + " got ended event");
 
-    ok(gotEncrypted, token + " encrypted event should have fired");
-    ok(gotPlaying, token + " playing event should have fired");
+    ok(gotEncrypted, TimeStamp(token) + " encrypted event should have fired");
+    ok(gotPlaying, TimeStamp(token) + " playing event should have fired");
 
     ok(Math.abs(test.duration - v.duration) < 0.1,
-       token + " Duration of video should be corrrect");
+       TimeStamp(token) + " Duration of video should be corrrect");
     ok(Math.abs(test.duration - v.currentTime) < 0.1,
-       token + " Current time should be same as duration");
+       TimeStamp(token) + " Current time should be same as duration");
 
     // Verify all sessions had all keys went sent the to the CDM usable, and thus
     // that we received keyschange event(s).
-    is(sessions.length, 1, token + " should have 1 session");
+    is(sessions.length, 1, TimeStamp(token) + " should have 1 session");
     for (var i = 0; i < sessions.length; i++) {
       var session = sessions[i];
-      ok(session.gotKeysChanged, token + " should have received at least one keychange event");
+      ok(session.gotKeysChanged, TimeStamp(token) + " should have received at least one keychange event");
       for (var kid in session.keyIdsReceived) {
-        ok(session.keyIdsReceived[kid], token + " key with id " + kid + " was usable as expected");
+        ok(session.keyIdsReceived[kid], TimeStamp(token) + " key with id " + kid + " was usable as expected");
       }
     }
 
@@ -85,7 +85,7 @@ function startTest(test, token)
 
   v.addEventListener("error", bail(token + " got error event"));
 
-  LoadTest(test, v).then(function(){v.play();}, bail(token + " failed to load"));
+  LoadTest(test, v, token).then(function(){v.play();}, bail(token + " failed to load"));
 }
 
 function testIsTypeSupported()
diff --git a/dom/media/test/test_eme_stream_capture_blocked.html b/dom/media/test/test_eme_stream_capture_blocked.html
index 6e6620c898f..38dded3da57 100644
--- a/dom/media/test/test_eme_stream_capture_blocked.html
+++ b/dom/media/test/test_eme_stream_capture_blocked.html
@@ -22,7 +22,7 @@ function startTest(test, token)
   // Case 1. setting MediaKeys on an element captured by MediaElementSource should fail.
   var case1token = token + "_case1";
   var setKeysFailed = function() {
-    ok(true, case1token + " setMediaKeys failed as expected.");
+    ok(true, TimeStamp(case1token) + " setMediaKeys failed as expected.");
     manager.finished(case1token);
   };
   var v1 = SetupEME(test, case1token,  { onSetKeysFail: setKeysFailed });
@@ -31,10 +31,10 @@ function startTest(test, token)
   v1.preload = "auto"; // Required due to "canplay" not firing for MSE unless we do this.
   v1.addEventListener("error", bail(case1token + " got error event"));
   v1.addEventListener("canplay", function(ev) {
-    ok(false, case1token + " should never reach canplay, as setMediaKeys should fail");
+    ok(false, TimeStamp(case1token) + " should never reach canplay, as setMediaKeys should fail");
   });
   manager.started(case1token);
-  LoadTest(test, v1);
+  LoadTest(test, v1, case1token);
 
 
   // Case 2. creating a MediaElementSource on a media element with a MediaKeys should fail.
@@ -55,7 +55,7 @@ function startTest(test, token)
     manager.finished(case2token);
   });
   manager.started(case2token);
-  LoadTest(test, v2);
+  LoadTest(test, v2, case2token);
 
 
   // Case 3. capturing a media element with mozCaptureStream that has a MediaKeys should fail.
@@ -64,18 +64,18 @@ function startTest(test, token)
   v3.preload = "auto"; // Required due to "canplay" not firing for MSE unless we do this.
   v3.addEventListener("error", bail(case3token + " got error event"));
   v3.addEventListener("canplay", function(ev) {
-    ok(true, case3token + " should reach canplay");
+    ok(true, TimeStamp(case3token) + " should reach canplay");
     var threw = false;
     try {
       var stream = v3.mozCaptureStreamUntilEnded();
     } catch (e) {
       threw = true;
     }
-    ok(threw, "Should throw an error calling mozCaptureStreamUntilEnded an EME video.");
+    ok(threw, TimeStamp(case3token) + " Should throw an error calling mozCaptureStreamUntilEnded an EME video.");
     manager.finished(case3token);
   });
   manager.started(case3token);
-  LoadTest(test, v3);
+  LoadTest(test, v3, case3token);
 }
 
 function beginTest() {

From 4a1f58b330e66333c53adc35fdc06e78eb5fd2ea Mon Sep 17 00:00:00 2001
From: Wes Kocher <wkocher@mozilla.com>
Date: Tue, 4 Nov 2014 20:24:50 -0800
Subject: [PATCH 048/153] Backed out changeset 5e6d8b6023e3 (bug 1092833) under
 suspicion of ggc bustage on a CLOSED TREE

---
 js/src/jit-test/tests/ion/bug1092833.js | 49 -----------------
 js/src/jit/IonMacroAssembler.cpp        | 71 +++++--------------------
 js/src/jit/IonMacroAssembler.h          |  3 --
 3 files changed, 12 insertions(+), 111 deletions(-)
 delete mode 100644 js/src/jit-test/tests/ion/bug1092833.js

diff --git a/js/src/jit-test/tests/ion/bug1092833.js b/js/src/jit-test/tests/ion/bug1092833.js
deleted file mode 100644
index 64a74fb28fd..00000000000
--- a/js/src/jit-test/tests/ion/bug1092833.js
+++ /dev/null
@@ -1,49 +0,0 @@
-// Test that lexicals work with functions with many bindings.
-
-(function() {
-    var a01
-    var b02
-    var c03
-    var d04
-    var e05
-    var f06
-    var g07
-    var h08
-    let i09
-    var j10
-    var k11
-    var l12
-    var m13
-    var n14
-    var o15
-    (function n14() {
-      assertEq(i09, undefined);
-    })()
-})();
-
-try {
-  (function() {
-      var a01
-      var b02
-      var c03
-      var d04
-      var e05
-      var f06
-      var g07
-      var h08
-      let i09
-      var j10
-      var k11
-      var l12
-      var m13
-      var n14
-      var o15
-      (function n14() {
-        i12++
-      })()
-      let i12
-  })()
-} catch (e) {
-  assertEq(e instanceof ReferenceError, true);
-  assertEq(e.message.indexOf("i12") > 0, true);
-}
diff --git a/js/src/jit/IonMacroAssembler.cpp b/js/src/jit/IonMacroAssembler.cpp
index 11b8701b38f..397bd044f7e 100644
--- a/js/src/jit/IonMacroAssembler.cpp
+++ b/js/src/jit/IonMacroAssembler.cpp
@@ -27,7 +27,6 @@
 #endif
 #include "jsinferinlines.h"
 #include "jsobjinlines.h"
-#include "vm/Interpreter-inl.h"
 
 using namespace js;
 using namespace js::jit;
@@ -957,18 +956,12 @@ MacroAssembler::copySlotsFromTemplate(Register obj, const NativeObject *template
 }
 
 void
-MacroAssembler::fillSlotsWithConstantValue(Address base, Register temp,
-                                           uint32_t start, uint32_t end, const Value &v)
+MacroAssembler::fillSlotsWithUndefined(Address base, Register temp, uint32_t start, uint32_t end)
 {
-    MOZ_ASSERT(v.isUndefined() || IsUninitializedLexical(v));
-
-    if (start >= end)
-        return;
-
 #ifdef JS_NUNBOX32
     // We only have a single spare register, so do the initialization as two
     // strided writes of the tag and body.
-    jsval_layout jv = JSVAL_TO_IMPL(v);
+    jsval_layout jv = JSVAL_TO_IMPL(UndefinedValue());
 
     Address addr = base;
     move32(Imm32(jv.s.payload.i32), temp);
@@ -980,43 +973,22 @@ MacroAssembler::fillSlotsWithConstantValue(Address base, Register temp,
     for (unsigned i = start; i < end; ++i, addr.offset += sizeof(HeapValue))
         store32(temp, ToType(addr));
 #else
-    moveValue(v, temp);
+    moveValue(UndefinedValue(), temp);
     for (uint32_t i = start; i < end; ++i, base.offset += sizeof(HeapValue))
         storePtr(temp, base);
 #endif
 }
 
-void
-MacroAssembler::fillSlotsWithUndefined(Address base, Register temp, uint32_t start, uint32_t end)
-{
-    fillSlotsWithConstantValue(base, temp, start, end, UndefinedValue());
-}
-
-void
-MacroAssembler::fillSlotsWithUninitialized(Address base, Register temp, uint32_t start, uint32_t end)
-{
-    fillSlotsWithConstantValue(base, temp, start, end, MagicValue(JS_UNINITIALIZED_LEXICAL));
-}
-
-static void
-FindStartOfUndefinedAndUninitializedSlots(NativeObject *templateObj, uint32_t nslots,
-                                          uint32_t *startOfUndefined, uint32_t *startOfUninitialized)
+static uint32_t
+FindStartOfUndefinedSlots(NativeObject *templateObj, uint32_t nslots)
 {
     MOZ_ASSERT(nslots == templateObj->lastProperty()->slotSpan(templateObj->getClass()));
     MOZ_ASSERT(nslots > 0);
-    uint32_t first = nslots;
-    for (; first != 0; --first) {
-        if (!IsUninitializedLexical(templateObj->getSlot(first - 1)))
-            break;
+    for (uint32_t first = nslots; first != 0; --first) {
+        if (templateObj->getSlot(first - 1) != UndefinedValue())
+            return first;
     }
-    *startOfUninitialized = first;
-    for (; first != 0; --first) {
-        if (templateObj->getSlot(first - 1) != UndefinedValue()) {
-            *startOfUndefined = first;
-            return;
-        }
-    }
-    *startOfUndefined = 0;
+    return 0;
 }
 
 void
@@ -1039,28 +1011,16 @@ MacroAssembler::initGCSlots(Register obj, Register slots, NativeObject *template
     // logically into independent non-UndefinedValue writes to the head and
     // duplicated writes of UndefinedValue to the tail. For the majority of
     // objects, the "tail" will be the entire slot range.
-    //
-    // The template object may be a CallObject, in which case we need to
-    // account for uninitialized lexical slots as well as undefined
-    // slots. Unitialized lexical slots always appear at the very end of
-    // slots, after undefined.
-    uint32_t startOfUndefined = nslots;
-    uint32_t startOfUninitialized = nslots;
-    FindStartOfUndefinedAndUninitializedSlots(templateObj, nslots,
-                                              &startOfUndefined, &startOfUninitialized);
+    uint32_t startOfUndefined = FindStartOfUndefinedSlots(templateObj, nslots);
     MOZ_ASSERT(startOfUndefined <= nfixed); // Reserved slots must be fixed.
-    MOZ_ASSERT_IF(startOfUndefined != nfixed, startOfUndefined <= startOfUninitialized);
-    MOZ_ASSERT_IF(!templateObj->is<CallObject>(), startOfUninitialized == nslots);
 
     // Copy over any preserved reserved slots.
     copySlotsFromTemplate(obj, templateObj, 0, startOfUndefined);
 
-    // Fill the rest of the fixed slots with undefined and uninitialized.
+    // Fill the rest of the fixed slots with undefined.
     if (initFixedSlots) {
         fillSlotsWithUndefined(Address(obj, NativeObject::getFixedSlotOffset(startOfUndefined)), slots,
-                               startOfUndefined, Min(startOfUninitialized, nfixed));
-        size_t offset = NativeObject::getFixedSlotOffset(startOfUninitialized);
-        fillSlotsWithUninitialized(Address(obj, offset), slots, startOfUninitialized, nfixed);
+                               startOfUndefined, nfixed);
     }
 
     if (ndynamic) {
@@ -1068,14 +1028,7 @@ MacroAssembler::initGCSlots(Register obj, Register slots, NativeObject *template
         // register briefly for our slots base address.
         push(obj);
         loadPtr(Address(obj, NativeObject::offsetOfSlots()), obj);
-
-        // Initially fill all dynamic slots with undefined.
         fillSlotsWithUndefined(Address(obj, 0), slots, 0, ndynamic);
-
-        // Fill uninitialized slots if necessary.
-        fillSlotsWithUninitialized(Address(obj, 0), slots, startOfUninitialized - nfixed,
-                                   nslots - startOfUninitialized);
-
         pop(obj);
     }
 }
diff --git a/js/src/jit/IonMacroAssembler.h b/js/src/jit/IonMacroAssembler.h
index 7c8edc77a72..a303a814fd9 100644
--- a/js/src/jit/IonMacroAssembler.h
+++ b/js/src/jit/IonMacroAssembler.h
@@ -810,10 +810,7 @@ class MacroAssembler : public MacroAssemblerSpecific
     void allocateNonObject(Register result, Register temp, gc::AllocKind allocKind, Label *fail);
     void copySlotsFromTemplate(Register obj, const NativeObject *templateObj,
                                uint32_t start, uint32_t end);
-    void fillSlotsWithConstantValue(Address addr, Register temp, uint32_t start, uint32_t end,
-                                    const Value &v);
     void fillSlotsWithUndefined(Address addr, Register temp, uint32_t start, uint32_t end);
-    void fillSlotsWithUninitialized(Address addr, Register temp, uint32_t start, uint32_t end);
     void initGCSlots(Register obj, Register temp, NativeObject *templateObj, bool initFixedSlots);
 
   public:

From aa88290d8dedb28026f6036bd7200ac1a120f3c9 Mon Sep 17 00:00:00 2001
From: Wes Kocher <wkocher@mozilla.com>
Date: Tue, 4 Nov 2014 20:25:47 -0800
Subject: [PATCH 049/153] Backed out changeset f86dbba73d43 (bug 1047588) under
 suspicion of adding a hazard on a CLOSED TREE

---
 dom/events/IMEContentObserver.cpp          | 29 ++++++++++++++++-----
 dom/events/IMEContentObserver.h            |  2 +-
 dom/events/IMEStateManager.cpp             | 30 ++++++++++------------
 dom/events/IMEStateManager.h               |  9 +++----
 editor/libeditor/nsEditor.cpp              |  4 +--
 editor/libeditor/nsEditorEventListener.cpp |  3 +--
 6 files changed, 43 insertions(+), 34 deletions(-)

diff --git a/dom/events/IMEContentObserver.cpp b/dom/events/IMEContentObserver.cpp
index 836c6882abc..5620004d9fe 100644
--- a/dom/events/IMEContentObserver.cpp
+++ b/dom/events/IMEContentObserver.cpp
@@ -28,6 +28,7 @@
 #include "nsISelectionController.h"
 #include "nsISelectionPrivate.h"
 #include "nsISupports.h"
+#include "nsITextControlElement.h"
 #include "nsIWidget.h"
 #include "nsPresContext.h"
 #include "nsThreadUtils.h"
@@ -98,11 +99,8 @@ IMEContentObserver::IMEContentObserver()
 void
 IMEContentObserver::Init(nsIWidget* aWidget,
                          nsPresContext* aPresContext,
-                         nsIContent* aContent,
-                         nsIEditor* aEditor)
+                         nsIContent* aContent)
 {
-  MOZ_ASSERT(aEditor, "aEditor must not be null");
-
   mESM = aPresContext->EventStateManager();
   mESM->OnStartToObserveContent(this);
 
@@ -112,8 +110,27 @@ IMEContentObserver::Init(nsIWidget* aWidget,
     return;
   }
 
-  mEditor = aEditor;
-  mEditor->AddEditorObserver(this);
+  nsCOMPtr<nsITextControlElement> textControlElement =
+    do_QueryInterface(mEditableNode);
+  if (textControlElement) {
+    // This may fail. For example, <input type="button" contenteditable>
+    mEditor = textControlElement->GetTextEditor();
+    if (!mEditor && mEditableNode->IsContent()) {
+      // The element must be an editing host.
+      nsIContent* editingHost = mEditableNode->AsContent()->GetEditingHost();
+      MOZ_ASSERT(editingHost == mEditableNode,
+                 "found editing host should be mEditableNode");
+      if (editingHost == mEditableNode) {
+        mEditor = nsContentUtils::GetHTMLEditor(aPresContext);
+      }
+    }
+  } else {
+    mEditor = nsContentUtils::GetHTMLEditor(aPresContext);
+  }
+  MOZ_ASSERT(mEditor, "Failed to get editor");
+  if (mEditor) {
+    mEditor->AddEditorObserver(this);
+  }
 
   nsIPresShell* presShell = aPresContext->PresShell();
 
diff --git a/dom/events/IMEContentObserver.h b/dom/events/IMEContentObserver.h
index 43a67f5a022..f8dba04917f 100644
--- a/dom/events/IMEContentObserver.h
+++ b/dom/events/IMEContentObserver.h
@@ -64,7 +64,7 @@ public:
                           WidgetMouseEvent* aMouseEvent);
 
   void Init(nsIWidget* aWidget, nsPresContext* aPresContext,
-            nsIContent* aContent, nsIEditor* aEditor);
+            nsIContent* aContent);
   void Destroy();
   /**
    * IMEContentObserver is stored by EventStateManager during observing.
diff --git a/dom/events/IMEStateManager.cpp b/dom/events/IMEStateManager.cpp
index 5e3722613f6..663dd8baa2b 100644
--- a/dom/events/IMEStateManager.cpp
+++ b/dom/events/IMEStateManager.cpp
@@ -25,7 +25,6 @@
 #include "nsIContent.h"
 #include "nsIDocument.h"
 #include "nsIDOMMouseEvent.h"
-#include "nsIEditor.h"
 #include "nsIForm.h"
 #include "nsIFormControl.h"
 #include "nsINode.h"
@@ -560,14 +559,12 @@ IMEStateManager::OnClickInEditor(nsPresContext* aPresContext,
 // static
 void
 IMEStateManager::OnFocusInEditor(nsPresContext* aPresContext,
-                                 nsIContent* aContent,
-                                 nsIEditor* aEditor)
+                                 nsIContent* aContent)
 {
   PR_LOG(sISMLog, PR_LOG_ALWAYS,
-    ("ISM: IMEStateManager::OnFocusInEditor(aPresContext=0x%p, aContent=0x%p, "
-     "aEditor=0x%p), sPresContext=0x%p, sContent=0x%p, "
-     "sActiveIMEContentObserver=0x%p",
-     aPresContext, aContent, aEditor, sPresContext, sContent,
+    ("ISM: IMEStateManager::OnFocusInEditor(aPresContext=0x%p, aContent=0x%p), "
+     "sPresContext=0x%p, sContent=0x%p, sActiveIMEContentObserver=0x%p",
+     aPresContext, aContent, sPresContext, sContent,
      sActiveIMEContentObserver));
 
   if (sPresContext != aPresContext || sContent != aContent) {
@@ -589,22 +586,21 @@ IMEStateManager::OnFocusInEditor(nsPresContext* aPresContext,
     DestroyIMEContentObserver();
   }
 
-  CreateIMEContentObserver(aEditor);
+  CreateIMEContentObserver();
 }
 
 // static
 void
 IMEStateManager::UpdateIMEState(const IMEState& aNewIMEState,
-                                nsIContent* aContent,
-                                nsIEditor* aEditor)
+                                nsIContent* aContent)
 {
   PR_LOG(sISMLog, PR_LOG_ALWAYS,
     ("ISM: IMEStateManager::UpdateIMEState(aNewIMEState={ mEnabled=%s, "
-     "mOpen=%s }, aContent=0x%p, aEditor=0x%p), "
+     "mOpen=%s }, aContent=0x%p), "
      "sPresContext=0x%p, sContent=0x%p, sActiveIMEContentObserver=0x%p, "
      "sIsGettingNewIMEState=%s",
      GetIMEStateEnabledName(aNewIMEState.mEnabled),
-     GetIMEStateSetOpenName(aNewIMEState.mOpen), aContent, aEditor,
+     GetIMEStateSetOpenName(aNewIMEState.mOpen), aContent,
      sPresContext, sContent, sActiveIMEContentObserver,
      GetBoolName(sIsGettingNewIMEState)));
 
@@ -655,7 +651,7 @@ IMEStateManager::UpdateIMEState(const IMEState& aNewIMEState,
   }
 
   if (createTextStateManager) {
-    CreateIMEContentObserver(aEditor);
+    CreateIMEContentObserver();
   }
 }
 
@@ -1149,13 +1145,13 @@ IMEStateManager::DestroyIMEContentObserver()
 
 // static
 void
-IMEStateManager::CreateIMEContentObserver(nsIEditor* aEditor)
+IMEStateManager::CreateIMEContentObserver()
 {
   PR_LOG(sISMLog, PR_LOG_ALWAYS,
-    ("ISM: IMEStateManager::CreateIMEContentObserver(aEditor=0x%p), "
+    ("ISM: IMEStateManager::CreateIMEContentObserver(), "
      "sPresContext=0x%p, sContent=0x%p, sActiveIMEContentObserver=0x%p, "
      "sActiveIMEContentObserver->IsManaging(sPresContext, sContent)=%s",
-     aEditor, sPresContext, sContent, sActiveIMEContentObserver,
+     sPresContext, sContent, sActiveIMEContentObserver,
      GetBoolName(sActiveIMEContentObserver ?
        sActiveIMEContentObserver->IsManaging(sPresContext, sContent) : false)));
 
@@ -1199,7 +1195,7 @@ IMEStateManager::CreateIMEContentObserver(nsIEditor* aEditor)
   // instance.  So, sActiveIMEContentObserver would be replaced with new one.
   // We should hold the current instance here.
   nsRefPtr<IMEContentObserver> kungFuDeathGrip(sActiveIMEContentObserver);
-  sActiveIMEContentObserver->Init(widget, sPresContext, sContent, aEditor);
+  sActiveIMEContentObserver->Init(widget, sPresContext, sContent);
 }
 
 // static
diff --git a/dom/events/IMEStateManager.h b/dom/events/IMEStateManager.h
index 01ad078ac38..665edcc2d0f 100644
--- a/dom/events/IMEStateManager.h
+++ b/dom/events/IMEStateManager.h
@@ -11,7 +11,6 @@
 
 class nsIContent;
 class nsIDOMMouseEvent;
-class nsIEditor;
 class nsINode;
 class nsPIDOMWindow;
 class nsPresContext;
@@ -66,8 +65,7 @@ public:
   // Note that this method changes the IME state of the active element in the
   // widget.  So, the caller must have focus.
   static void UpdateIMEState(const IMEState &aNewIMEState,
-                             nsIContent* aContent,
-                             nsIEditor* aEditor);
+                             nsIContent* aContent);
 
   // This method is called when user operates mouse button in focused editor
   // and before the editor handles it.
@@ -91,8 +89,7 @@ public:
   //   If the editor is for contenteditable, the active editinghost.
   //   If the editor is for designMode, nullptr.
   static void OnFocusInEditor(nsPresContext* aPresContext,
-                              nsIContent* aContent,
-                              nsIEditor* aEditor);
+                              nsIContent* aContent);
 
   /**
    * All composition events must be dispatched via DispatchCompositionEvent()
@@ -152,7 +149,7 @@ protected:
                                  nsIContent* aContent);
 
   static void EnsureTextCompositionArray();
-  static void CreateIMEContentObserver(nsIEditor* aEditor);
+  static void CreateIMEContentObserver();
   static void DestroyIMEContentObserver();
 
   static bool IsEditable(nsINode* node);
diff --git a/editor/libeditor/nsEditor.cpp b/editor/libeditor/nsEditor.cpp
index 75b8797c819..d4e7e5a77b3 100644
--- a/editor/libeditor/nsEditor.cpp
+++ b/editor/libeditor/nsEditor.cpp
@@ -315,7 +315,7 @@ nsEditor::PostCreate()
     rv = GetPreferredIMEState(&newState);
     NS_ENSURE_SUCCESS(rv, NS_OK);
     nsCOMPtr<nsIContent> content = GetFocusedContentForIME();
-    IMEStateManager::UpdateIMEState(newState, content, this);
+    IMEStateManager::UpdateIMEState(newState, content);
   }
   return NS_OK;
 }
@@ -496,7 +496,7 @@ nsEditor::SetFlags(uint32_t aFlags)
       // NOTE: When the enabled state isn't going to be modified, this method
       // is going to do nothing.
       nsCOMPtr<nsIContent> content = GetFocusedContentForIME();
-      IMEStateManager::UpdateIMEState(newState, content, this);
+      IMEStateManager::UpdateIMEState(newState, content);
     }
   }
 
diff --git a/editor/libeditor/nsEditorEventListener.cpp b/editor/libeditor/nsEditorEventListener.cpp
index 01f6a4af7f8..702a61862fb 100644
--- a/editor/libeditor/nsEditorEventListener.cpp
+++ b/editor/libeditor/nsEditorEventListener.cpp
@@ -1097,8 +1097,7 @@ nsEditorEventListener::Focus(nsIDOMEvent* aEvent)
   nsCOMPtr<nsIPresShell> ps = GetPresShell();
   NS_ENSURE_TRUE(ps, NS_OK);
   nsCOMPtr<nsIContent> focusedContent = mEditor->GetFocusedContentForIME();
-  IMEStateManager::OnFocusInEditor(ps->GetPresContext(), focusedContent,
-                                   mEditor);
+  IMEStateManager::OnFocusInEditor(ps->GetPresContext(), focusedContent);
 
   return NS_OK;
 }

From f6a0eb205f2e0c28bd3187f3ed051cd839570177 Mon Sep 17 00:00:00 2001
From: Wes Kocher <wkocher@mozilla.com>
Date: Tue, 4 Nov 2014 20:56:45 -0800
Subject: [PATCH 050/153] no bug - Fix merge conflict to help open this CLOSED
 TREE

---
 dom/interfaces/base/nsIDOMWindowUtils.idl | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/dom/interfaces/base/nsIDOMWindowUtils.idl b/dom/interfaces/base/nsIDOMWindowUtils.idl
index ae322ed1b77..c42881bfe93 100644
--- a/dom/interfaces/base/nsIDOMWindowUtils.idl
+++ b/dom/interfaces/base/nsIDOMWindowUtils.idl
@@ -51,11 +51,7 @@ interface nsITranslationNodeList;
 interface nsIJSRAIIHelper;
 interface nsIContentPermissionRequest;
 
-<<<<<<< local
-[scriptable, uuid(01e0c3ca-37e7-4ab4-bd22-3e99d8d23336)]
-=======
 [scriptable, uuid(e293355b-ae7f-4ef7-9237-452bcf3e9e6b)]
->>>>>>> other
 interface nsIDOMWindowUtils : nsISupports {
 
   /**

From 24b6f1a80dfa0a065fee7b04c6abde86bd3a67f4 Mon Sep 17 00:00:00 2001
From: Johnny Stenback <jst@mozilla.com>
Date: Tue, 4 Nov 2014 23:21:05 -0800
Subject: [PATCH 051/153] Bug 1093865. Fix regression from bug 1080030, make
 select with optgroup w/o lable element show up again. r=felipe

---
 toolkit/modules/SelectContentHelper.jsm | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)
---
 toolkit/modules/SelectContentHelper.jsm | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/toolkit/modules/SelectContentHelper.jsm b/toolkit/modules/SelectContentHelper.jsm
index c3e86e53f4e..516e51f74c7 100644
--- a/toolkit/modules/SelectContentHelper.jsm
+++ b/toolkit/modules/SelectContentHelper.jsm
@@ -90,10 +90,19 @@ function buildOptionListForChildren(node) {
   let result = [];
   for (let child = node.firstChild; child; child = child.nextSibling) {
     if (child.tagName == 'OPTION' || child.tagName == 'OPTGROUP') {
+      let textContent =
+        child.tagName == 'OPTGROUP' ? child.getAttribute("label")
+                                    : child.textContent;
+
+      if (textContent != null) {
+        textContent = textContent.trim();
+      } else {
+        textContent = ""
+      }
+
       let info = {
         tagName: child.tagName,
-        textContent: child.tagName == 'OPTGROUP' ? child.getAttribute("label").trim()
-                                                 : child.textContent.trim(),
+        textContent: textContent,
         // XXX this uses a highlight color when this is the selected element.
         // We need to suppress such highlighting in the content process to get
         // the option's correct unhighlighted color here.

From 4d373d5e32a7dac5fc953904965d83bb2539d394 Mon Sep 17 00:00:00 2001
From: Jan Varga <jan.varga@gmail.com>
Date: Wed, 5 Nov 2014 08:30:21 +0100
Subject: [PATCH 052/153] Bug 1067568 - Intermittent
 test_filehandle_readonly_exceptions.html | Assertion count 4 is greater than
 expected (ASSERTION: We don't know anyting about this file handle?!: 'Error',
 file dom/filehandle/FileService.cpp, line 234); r=bent

---
 dom/indexedDB/IDBMutableFile.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/dom/indexedDB/IDBMutableFile.cpp b/dom/indexedDB/IDBMutableFile.cpp
index 75445cf3852..1754716b023 100644
--- a/dom/indexedDB/IDBMutableFile.cpp
+++ b/dom/indexedDB/IDBMutableFile.cpp
@@ -321,6 +321,11 @@ IDBMutableFile::Open(FileMode aMode, ErrorResult& aError)
     return nullptr;
   }
 
+  if (mInvalidated) {
+    aError.Throw(NS_ERROR_DOM_FILEHANDLE_NOT_ALLOWED_ERR);
+    return nullptr;
+  }
+
   nsRefPtr<IDBFileHandle> fileHandle =
     IDBFileHandle::Create(aMode, FileHandleBase::NORMAL, this);
   if (!fileHandle) {

From f841511972e409194e0488064493879b0dd7c597 Mon Sep 17 00:00:00 2001
From: Catalin Badea <cbadea@mozilla.com>
Date: Mon, 27 Oct 2014 12:03:00 +0100
Subject: [PATCH 053/153] Bug 982726 - Patch 1.1 - Service Worker:
 ServiceWorkerClients and Client interfaces with getServiced(). r=baku

---
 dom/bindings/Bindings.conf                    |  10 +
 dom/webidl/ServiceWorkerClient.webidl         |  14 ++
 dom/webidl/ServiceWorkerClients.webidl        |  19 ++
 dom/webidl/ServiceWorkerGlobalScope.webidl    |   5 +-
 dom/webidl/moz.build                          |   2 +
 dom/workers/ServiceWorkerClient.cpp           |  29 +++
 dom/workers/ServiceWorkerClient.h             |  58 +++++
 dom/workers/ServiceWorkerClients.cpp          | 228 ++++++++++++++++++
 dom/workers/ServiceWorkerClients.h            |  56 +++++
 dom/workers/ServiceWorkerManager.cpp          |  55 ++++-
 dom/workers/ServiceWorkerManager.h            |   4 +
 dom/workers/WorkerScope.cpp                   |   8 +
 dom/workers/WorkerScope.h                     |  17 ++
 dom/workers/moz.build                         |   4 +
 .../serviceworkers/get_serviced_worker.js     |  16 ++
 dom/workers/test/serviceworkers/mochitest.ini |   3 +
 .../serviceworkers/sw_clients/simple.html     |  25 ++
 .../serviceworkers/test_get_serviced.html     |  57 +++++
 .../test/serviceworkers/test_unregister.html  |  18 ++
 .../test/serviceworkers/unregister/index.html |   4 +
 20 files changed, 626 insertions(+), 6 deletions(-)
 create mode 100644 dom/webidl/ServiceWorkerClient.webidl
 create mode 100644 dom/webidl/ServiceWorkerClients.webidl
 create mode 100644 dom/workers/ServiceWorkerClient.cpp
 create mode 100644 dom/workers/ServiceWorkerClient.h
 create mode 100644 dom/workers/ServiceWorkerClients.cpp
 create mode 100644 dom/workers/ServiceWorkerClients.h
 create mode 100644 dom/workers/test/serviceworkers/get_serviced_worker.js
 create mode 100644 dom/workers/test/serviceworkers/sw_clients/simple.html
 create mode 100644 dom/workers/test/serviceworkers/test_get_serviced.html

diff --git a/dom/bindings/Bindings.conf b/dom/bindings/Bindings.conf
index dbe8f8f0c2f..33b4ea85d9e 100644
--- a/dom/bindings/Bindings.conf
+++ b/dom/bindings/Bindings.conf
@@ -951,6 +951,16 @@ DOMInterfaces = {
     'headerFile': 'mozilla/dom/workers/bindings/ServiceWorker.h',
 },
 
+'ServiceWorkerClient': {
+    'nativeType': 'mozilla::dom::workers::ServiceWorkerClient',
+    'headerFile': 'mozilla/dom/workers/bindings/ServiceWorkerClient.h',
+},
+
+'ServiceWorkerClients': {
+    'nativeType': 'mozilla::dom::workers::ServiceWorkerClients',
+    'headerFile': 'mozilla/dom/workers/bindings/ServiceWorkerClients.h',
+},
+
 'ServiceWorkerGlobalScope': {
     'headerFile': 'mozilla/dom/WorkerScope.h',
     'workers': True,
diff --git a/dom/webidl/ServiceWorkerClient.webidl b/dom/webidl/ServiceWorkerClient.webidl
new file mode 100644
index 00000000000..2473fb572fe
--- /dev/null
+++ b/dom/webidl/ServiceWorkerClient.webidl
@@ -0,0 +1,14 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * The origin of this IDL file is
+ * http://slightlyoff.github.io/ServiceWorker/spec/service_worker/index.html
+ *
+ */
+
+[Exposed=ServiceWorker]
+interface ServiceWorkerClient {
+  readonly attribute unsigned long id;
+};
diff --git a/dom/webidl/ServiceWorkerClients.webidl b/dom/webidl/ServiceWorkerClients.webidl
new file mode 100644
index 00000000000..8d88181ddc0
--- /dev/null
+++ b/dom/webidl/ServiceWorkerClients.webidl
@@ -0,0 +1,19 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * The origin of this IDL file is
+ * http://slightlyoff.github.io/ServiceWorker/spec/service_worker/index.html
+ *
+ */
+
+[Exposed=ServiceWorker]
+interface ServiceWorkerClients {
+  // A list of client objects, identifiable by ID, that correspond to windows
+  // (or workers) that are "controlled" by this SW
+  [Throws]
+  Promise<sequence<ServiceWorkerClient>?> getServiced();
+  [Throws]
+  Promise<any> reloadAll();
+};
diff --git a/dom/webidl/ServiceWorkerGlobalScope.webidl b/dom/webidl/ServiceWorkerGlobalScope.webidl
index 228ce25ead5..c731e6a02d8 100644
--- a/dom/webidl/ServiceWorkerGlobalScope.webidl
+++ b/dom/webidl/ServiceWorkerGlobalScope.webidl
@@ -16,10 +16,7 @@ interface ServiceWorkerGlobalScope : WorkerGlobalScope {
   // FIXME(nsm): Bug 982725
   // readonly attribute CacheList caches;
 
-  // FIXME(nsm): Bug 982726
-  // A container for a list of window objects, identifiable by ID, that
-  // correspond to windows (or workers) that are "controlled" by this SW
-  // readonly attribute ServiceWorkerClients clients;
+  readonly attribute ServiceWorkerClients clients;
 
   [Unforgeable] readonly attribute DOMString scope;
 
diff --git a/dom/webidl/moz.build b/dom/webidl/moz.build
index 2cf524ac228..0d829b00d05 100644
--- a/dom/webidl/moz.build
+++ b/dom/webidl/moz.build
@@ -358,6 +358,8 @@ WEBIDL_FILES = [
     'ScrollBoxObject.webidl',
     'Selection.webidl',
     'ServiceWorker.webidl',
+    'ServiceWorkerClient.webidl',
+    'ServiceWorkerClients.webidl',
     'ServiceWorkerContainer.webidl',
     'ServiceWorkerGlobalScope.webidl',
     'ServiceWorkerRegistration.webidl',
diff --git a/dom/workers/ServiceWorkerClient.cpp b/dom/workers/ServiceWorkerClient.cpp
new file mode 100644
index 00000000000..2a2e1c28b3e
--- /dev/null
+++ b/dom/workers/ServiceWorkerClient.cpp
@@ -0,0 +1,29 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+#include "ServiceWorkerClient.h"
+
+#include "mozilla/dom/ServiceWorkerClientBinding.h"
+
+using namespace mozilla::dom;
+using namespace mozilla::dom::workers;
+
+NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE(ServiceWorkerClient, mOwner)
+
+NS_IMPL_CYCLE_COLLECTING_ADDREF(ServiceWorkerClient)
+NS_IMPL_CYCLE_COLLECTING_RELEASE(ServiceWorkerClient)
+
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(ServiceWorkerClient)
+  NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
+  NS_INTERFACE_MAP_ENTRY(nsISupports)
+NS_INTERFACE_MAP_END
+
+JSObject*
+ServiceWorkerClient::WrapObject(JSContext* aCx)
+{
+  return ServiceWorkerClientBinding::Wrap(aCx, this);
+}
+
diff --git a/dom/workers/ServiceWorkerClient.h b/dom/workers/ServiceWorkerClient.h
new file mode 100644
index 00000000000..1cfdb634d52
--- /dev/null
+++ b/dom/workers/ServiceWorkerClient.h
@@ -0,0 +1,58 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+#ifndef mozilla_dom_workers_serviceworkerclient_h
+#define mozilla_dom_workers_serviceworkerclient_h
+
+#include "nsCOMPtr.h"
+#include "nsWrapperCache.h"
+
+namespace mozilla {
+namespace dom {
+
+class Promise;
+
+namespace workers {
+
+class ServiceWorkerClient MOZ_FINAL : public nsISupports,
+                                      public nsWrapperCache
+{
+public:
+  NS_DECL_CYCLE_COLLECTING_ISUPPORTS
+  NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(ServiceWorkerClient)
+
+  ServiceWorkerClient(nsISupports* aOwner, uint64_t aId)
+    : mOwner(aOwner),
+      mId(aId)
+  {
+  }
+
+  uint32_t Id() const
+  {
+    return mId;
+  }
+
+  nsISupports* GetParentObject() const
+  {
+    return mOwner;
+  }
+
+  JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
+
+private:
+  ~ServiceWorkerClient()
+  {
+  }
+
+  nsCOMPtr<nsISupports> mOwner;
+  uint64_t mId;
+};
+
+} // namespace workers
+} // namespace dom
+} // namespace mozilla
+
+#endif // mozilla_dom_workers_serviceworkerclient_h
diff --git a/dom/workers/ServiceWorkerClients.cpp b/dom/workers/ServiceWorkerClients.cpp
new file mode 100644
index 00000000000..c4e3f77271e
--- /dev/null
+++ b/dom/workers/ServiceWorkerClients.cpp
@@ -0,0 +1,228 @@
+/* -*- Mode: c++; c-basic-offset: 2; indent-tabs-mode: nil; tab-width: 40 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ServiceWorkerClient.h"
+#include "ServiceWorkerClients.h"
+#include "ServiceWorkerManager.h"
+
+#include "WorkerPrivate.h"
+#include "WorkerRunnable.h"
+#include "WorkerScope.h"
+
+#include "mozilla/dom/Promise.h"
+#include "mozilla/dom/ServiceWorkerClientsBinding.h"
+
+using namespace mozilla;
+using namespace mozilla::dom;
+using namespace mozilla::dom::workers;
+
+NS_IMPL_CYCLE_COLLECTING_ADDREF(ServiceWorkerClients)
+NS_IMPL_CYCLE_COLLECTING_RELEASE(ServiceWorkerClients)
+NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE(ServiceWorkerClients, mWorkerScope)
+
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(ServiceWorkerClients)
+  NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
+  NS_INTERFACE_MAP_ENTRY(nsISupports)
+NS_INTERFACE_MAP_END
+
+ServiceWorkerClients::ServiceWorkerClients(ServiceWorkerGlobalScope* aWorkerScope)
+  : mWorkerScope(aWorkerScope)
+{
+  MOZ_ASSERT(mWorkerScope);
+}
+
+JSObject*
+ServiceWorkerClients::WrapObject(JSContext* aCx)
+{
+  return ServiceWorkerClientsBinding::Wrap(aCx, this);
+}
+
+namespace {
+
+// Helper class used for passing the promise between threads while
+// keeping the worker alive.
+class PromiseHolder MOZ_FINAL : public WorkerFeature
+{
+  NS_INLINE_DECL_THREADSAFE_REFCOUNTING(PromiseHolder)
+
+public:
+  PromiseHolder(WorkerPrivate* aWorkerPrivate,
+                Promise* aPromise)
+    : mWorkerPrivate(aWorkerPrivate),
+      mPromise(aPromise),
+      mClean(false)
+  {
+    MOZ_ASSERT(mWorkerPrivate);
+    mWorkerPrivate->AssertIsOnWorkerThread();
+    MOZ_ASSERT(mPromise);
+
+    if (NS_WARN_IF(!mWorkerPrivate->AddFeature(mWorkerPrivate->GetJSContext(), this))) {
+      // Worker has been canceled and will go away.
+      // The ResolvePromiseWorkerRunnable won't run, so we can set mPromise to
+      // nullptr.
+      mPromise = nullptr;
+      mClean = true;
+    }
+  }
+
+  Promise*
+  Get() const
+  {
+    return mPromise;
+  }
+
+  void
+  Clean()
+  {
+    mWorkerPrivate->AssertIsOnWorkerThread();
+
+    if (mClean) {
+      return;
+    }
+
+    mPromise = nullptr;
+    mWorkerPrivate->RemoveFeature(mWorkerPrivate->GetJSContext(), this);
+    mClean = true;
+  }
+
+  bool
+  Notify(JSContext* aCx, Status aStatus)
+  {
+    mWorkerPrivate->AssertIsOnWorkerThread();
+
+    if (aStatus > Running) {
+      Clean();
+    }
+
+    return true;
+  }
+
+private:
+  ~PromiseHolder()
+  {
+    MOZ_ASSERT(mClean);
+  }
+
+  WorkerPrivate* mWorkerPrivate;
+  nsRefPtr<Promise> mPromise;
+
+  bool mClean;
+};
+
+class ResolvePromiseWorkerRunnable MOZ_FINAL : public WorkerRunnable
+{
+  nsRefPtr<PromiseHolder> mPromiseHolder;
+  nsAutoPtr<nsTArray<uint64_t>> mValue;
+
+public:
+  ResolvePromiseWorkerRunnable(WorkerPrivate* aWorkerPrivate,
+                               PromiseHolder* aPromiseHolder,
+                               nsAutoPtr<nsTArray<uint64_t>>& aValue)
+    : WorkerRunnable(aWorkerPrivate, WorkerThreadModifyBusyCount),
+      mPromiseHolder(aPromiseHolder),
+      mValue(aValue)
+  {
+    AssertIsOnMainThread();
+  }
+
+  bool
+  WorkerRun(JSContext* aCx, WorkerPrivate* aWorkerPrivate)
+  {
+    MOZ_ASSERT(aWorkerPrivate);
+    aWorkerPrivate->AssertIsOnWorkerThread();
+
+    Promise* promise = mPromiseHolder->Get();
+    MOZ_ASSERT(promise);
+
+    nsTArray<nsRefPtr<ServiceWorkerClient>> ret;
+    for (size_t i = 0; i < mValue->Length(); i++) {
+      ret.AppendElement(nsRefPtr<ServiceWorkerClient>(
+            new ServiceWorkerClient(promise->GetParentObject(),
+                                    mValue->ElementAt(i))));
+    }
+    promise->MaybeResolve(ret);
+
+    // release the reference on the worker thread.
+    mPromiseHolder->Clean();
+
+    return true;
+  }
+};
+
+class GetServicedRunnable MOZ_FINAL : public nsRunnable
+{
+  WorkerPrivate* mWorkerPrivate;
+  nsCString mScope;
+  nsRefPtr<PromiseHolder> mPromiseHolder;
+public:
+  GetServicedRunnable(WorkerPrivate* aWorkerPrivate,
+                      Promise* aPromise,
+                      const nsCString& aScope)
+    : mWorkerPrivate(aWorkerPrivate),
+      mScope(aScope)
+  {
+    MOZ_ASSERT(aWorkerPrivate);
+    aWorkerPrivate->AssertIsOnWorkerThread();
+    mPromiseHolder = new PromiseHolder(aWorkerPrivate, aPromise);
+  }
+
+  NS_IMETHOD
+  Run() MOZ_OVERRIDE
+  {
+    AssertIsOnMainThread();
+
+    nsRefPtr<ServiceWorkerManager> swm = ServiceWorkerManager::GetInstance();
+    nsAutoPtr<nsTArray<uint64_t>> result(new nsTArray<uint64_t>());
+
+    swm->GetServicedClients(mScope, result);
+    nsRefPtr<ResolvePromiseWorkerRunnable> r =
+      new ResolvePromiseWorkerRunnable(mWorkerPrivate, mPromiseHolder, result);
+
+    AutoSafeJSContext cx;
+    r->Dispatch(cx);
+    return NS_OK;
+  }
+};
+
+} // anonymous namespace
+
+already_AddRefed<Promise>
+ServiceWorkerClients::GetServiced(ErrorResult& aRv)
+{
+  WorkerPrivate* workerPrivate = GetCurrentThreadWorkerPrivate();
+  MOZ_ASSERT(workerPrivate);
+  workerPrivate->AssertIsOnWorkerThread();
+
+  DOMString scope;
+  mWorkerScope->GetScope(scope);
+
+  nsRefPtr<Promise> promise = Promise::Create(mWorkerScope, aRv);
+  if (NS_WARN_IF(aRv.Failed())) {
+    return nullptr;
+  }
+
+  nsRefPtr<GetServicedRunnable> r =
+    new GetServicedRunnable(workerPrivate, promise, NS_ConvertUTF16toUTF8(scope));
+  nsresult rv = NS_DispatchToMainThread(r);
+
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    promise->MaybeReject(NS_ERROR_NOT_AVAILABLE);
+  }
+
+  return promise.forget();
+}
+
+// FIXME(catalinb): Bug 1045257 - Implement ReloadAll
+already_AddRefed<Promise>
+ServiceWorkerClients::ReloadAll(ErrorResult& aRv)
+{
+  nsRefPtr<Promise> promise = Promise::Create(mWorkerScope, aRv);
+  if (NS_WARN_IF(aRv.Failed())) {
+    return nullptr;
+  }
+  promise->MaybeReject(NS_ERROR_NOT_AVAILABLE);
+  return promise.forget();
+}
+
diff --git a/dom/workers/ServiceWorkerClients.h b/dom/workers/ServiceWorkerClients.h
new file mode 100644
index 00000000000..39cf03a6dab
--- /dev/null
+++ b/dom/workers/ServiceWorkerClients.h
@@ -0,0 +1,56 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+#ifndef mozilla_dom_workers_serviceworkerclients_h
+#define mozilla_dom_workers_serviceworkerclients_h
+
+#include "nsAutoPtr.h"
+#include "nsWrapperCache.h"
+
+namespace mozilla {
+
+class ErrorResult;
+
+namespace dom {
+
+class Promise;
+
+namespace workers {
+
+class ServiceWorkerGlobalScope;
+
+class ServiceWorkerClients MOZ_FINAL : public nsISupports,
+                                       public nsWrapperCache
+{
+public:
+  NS_DECL_CYCLE_COLLECTING_ISUPPORTS
+  NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(ServiceWorkerClients)
+
+  ServiceWorkerClients(ServiceWorkerGlobalScope* aWorkerScope);
+
+  already_AddRefed<Promise> GetServiced(ErrorResult& aRv);
+  already_AddRefed<Promise> ReloadAll(ErrorResult& aRv);
+
+  JSObject* WrapObject(JSContext* aCx) MOZ_OVERRIDE;
+
+  ServiceWorkerGlobalScope* GetParentObject() const
+  {
+    return mWorkerScope;
+  }
+
+private:
+  ~ServiceWorkerClients()
+  {
+  }
+
+  nsRefPtr<ServiceWorkerGlobalScope> mWorkerScope;
+};
+
+} // namespace workers
+} // namespace dom
+} // namespace mozilla
+
+#endif // mozilla_dom_workers_serviceworkerclients_h
diff --git a/dom/workers/ServiceWorkerManager.cpp b/dom/workers/ServiceWorkerManager.cpp
index a6ef1872ca3..03546c004be 100644
--- a/dom/workers/ServiceWorkerManager.cpp
+++ b/dom/workers/ServiceWorkerManager.cpp
@@ -24,6 +24,7 @@
 
 #include "RuntimeService.h"
 #include "ServiceWorker.h"
+#include "ServiceWorkerClient.h"
 #include "ServiceWorkerRegistration.h"
 #include "ServiceWorkerEvents.h"
 #include "WorkerInlines.h"
@@ -70,6 +71,7 @@ UpdatePromise::ResolveAllPromises(const nsACString& aScriptSpec, const nsACStrin
   for (uint32_t i = 0; i < array.Length(); ++i) {
     WeakPtr<Promise>& pendingPromise = array.ElementAt(i);
     if (pendingPromise) {
+      nsRefPtr<Promise> kungfuDeathGrip = pendingPromise.get();
       nsCOMPtr<nsIGlobalObject> go =
         do_QueryInterface(pendingPromise->GetParentObject());
       MOZ_ASSERT(go);
@@ -93,8 +95,7 @@ UpdatePromise::ResolveAllPromises(const nsACString& aScriptSpec, const nsACStrin
 
       // Since ServiceWorkerRegistration is only exposed to windows we can be
       // certain about this cast.
-      nsCOMPtr<nsPIDOMWindow> window =
-        do_QueryInterface(pendingPromise->GetParentObject());
+      nsCOMPtr<nsPIDOMWindow> window = do_QueryInterface(go);
       nsRefPtr<ServiceWorkerRegistration> swr =
         new ServiceWorkerRegistration(window, NS_ConvertUTF8toUTF16(aScope));
 
@@ -2141,4 +2142,54 @@ ServiceWorkerManager::InvalidateServiceWorkerRegistrationWorker(ServiceWorkerReg
   }
 }
 
+namespace {
+
+class MOZ_STACK_CLASS FilterRegistrationData
+{
+public:
+  FilterRegistrationData(nsTArray<uint64_t>* aDocuments,
+                     ServiceWorkerRegistrationInfo* aRegistration)
+  : mDocuments(aDocuments),
+    mRegistration(aRegistration)
+  {
+  }
+
+  nsTArray<uint64_t>* mDocuments;
+  nsRefPtr<ServiceWorkerRegistrationInfo> mRegistration;
+};
+
+static PLDHashOperator
+EnumControlledDocuments(nsISupports* aKey,
+                        ServiceWorkerRegistrationInfo* aRegistration,
+                        void* aData)
+{
+  FilterRegistrationData* data = static_cast<FilterRegistrationData*>(aData);
+  if (data->mRegistration != aRegistration) {
+    return PL_DHASH_NEXT;
+  }
+  nsCOMPtr<nsIDocument> document = do_QueryInterface(aKey);
+  if (!document || !document->GetInnerWindow()) {
+      return PL_DHASH_NEXT;
+  }
+
+  data->mDocuments->AppendElement(document->GetInnerWindow()->WindowID());
+  return PL_DHASH_NEXT;
+}
+
+} // anonymous namespace
+
+void
+ServiceWorkerManager::GetServicedClients(const nsCString& aScope,
+                                     nsTArray<uint64_t>* aControlledDocuments)
+{
+  nsRefPtr<ServiceWorkerDomainInfo> domainInfo = GetDomainInfo(aScope);
+  nsRefPtr<ServiceWorkerRegistrationInfo> registration =
+    domainInfo->GetRegistration(aScope);
+  MOZ_ASSERT(registration);
+  FilterRegistrationData data(aControlledDocuments, registration);
+
+  domainInfo->mControlledDocuments.EnumerateRead(EnumControlledDocuments,
+                                                 &data);
+}
+
 END_WORKERS_NAMESPACE
diff --git a/dom/workers/ServiceWorkerManager.h b/dom/workers/ServiceWorkerManager.h
index df70849e6e1..f58b24ecdec 100644
--- a/dom/workers/ServiceWorkerManager.h
+++ b/dom/workers/ServiceWorkerManager.h
@@ -317,6 +317,10 @@ public:
               uint32_t aColumnNumber,
               uint32_t aFlags);
 
+  void
+  GetServicedClients(const nsCString& aScope,
+                     nsTArray<uint64_t>* aControlledDocuments);
+
   static already_AddRefed<ServiceWorkerManager>
   GetInstance();
 
diff --git a/dom/workers/WorkerScope.cpp b/dom/workers/WorkerScope.cpp
index 9facb89dcb0..015fd2ce304 100644
--- a/dom/workers/WorkerScope.cpp
+++ b/dom/workers/WorkerScope.cpp
@@ -359,6 +359,14 @@ SharedWorkerGlobalScope::WrapGlobalObject(JSContext* aCx)
                                                       true);
 }
 
+NS_IMPL_CYCLE_COLLECTION_INHERITED(ServiceWorkerGlobalScope, WorkerGlobalScope,
+                                   mClients)
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_INHERITED(ServiceWorkerGlobalScope)
+NS_INTERFACE_MAP_END_INHERITING(WorkerGlobalScope)
+
+NS_IMPL_ADDREF_INHERITED(ServiceWorkerGlobalScope, WorkerGlobalScope)
+NS_IMPL_RELEASE_INHERITED(ServiceWorkerGlobalScope, WorkerGlobalScope)
+
 ServiceWorkerGlobalScope::ServiceWorkerGlobalScope(WorkerPrivate* aWorkerPrivate,
                                                    const nsACString& aScope)
   : WorkerGlobalScope(aWorkerPrivate),
diff --git a/dom/workers/WorkerScope.h b/dom/workers/WorkerScope.h
index de6142212b8..f969fae0e85 100644
--- a/dom/workers/WorkerScope.h
+++ b/dom/workers/WorkerScope.h
@@ -11,6 +11,8 @@
 #include "mozilla/dom/Headers.h"
 #include "mozilla/dom/RequestBinding.h"
 
+#include "ServiceWorkerClients.h"
+
 namespace mozilla {
 namespace dom {
 
@@ -170,9 +172,15 @@ public:
 class ServiceWorkerGlobalScope MOZ_FINAL : public WorkerGlobalScope
 {
   const nsString mScope;
+  nsRefPtr<ServiceWorkerClients> mClients;
+
   ~ServiceWorkerGlobalScope() { }
 
 public:
+  NS_DECL_ISUPPORTS_INHERITED
+  NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(ServiceWorkerGlobalScope,
+                                           WorkerGlobalScope)
+
   ServiceWorkerGlobalScope(WorkerPrivate* aWorkerPrivate, const nsACString& aScope);
 
   virtual JSObject*
@@ -199,6 +207,15 @@ public:
   already_AddRefed<Promise>
   Unregister(ErrorResult& aRv);
 
+  ServiceWorkerClients*
+  Clients() {
+    if (!mClients) {
+      mClients = new ServiceWorkerClients(this);
+    }
+
+    return mClients;
+  }
+
   IMPL_EVENT_HANDLER(activate)
   IMPL_EVENT_HANDLER(beforeevicted)
   IMPL_EVENT_HANDLER(evicted)
diff --git a/dom/workers/moz.build b/dom/workers/moz.build
index 7c667ffa5f5..47f3ba43365 100644
--- a/dom/workers/moz.build
+++ b/dom/workers/moz.build
@@ -30,6 +30,8 @@ EXPORTS.mozilla.dom.workers.bindings += [
     'Navigator.h',
     'Performance.h',
     'ServiceWorker.h',
+    'ServiceWorkerClient.h',
+    'ServiceWorkerClients.h',
     'SharedWorker.h',
     'URL.h',
     'WorkerFeature.h',
@@ -58,6 +60,8 @@ UNIFIED_SOURCES += [
     'RuntimeService.cpp',
     'ScriptLoader.cpp',
     'ServiceWorker.cpp',
+    'ServiceWorkerClient.cpp',
+    'ServiceWorkerClients.cpp',
     'ServiceWorkerContainer.cpp',
     'ServiceWorkerEvents.cpp',
     'ServiceWorkerManager.cpp',
diff --git a/dom/workers/test/serviceworkers/get_serviced_worker.js b/dom/workers/test/serviceworkers/get_serviced_worker.js
new file mode 100644
index 00000000000..b97e4145034
--- /dev/null
+++ b/dom/workers/test/serviceworkers/get_serviced_worker.js
@@ -0,0 +1,16 @@
+function loop() {
+  self.clients.getServiced().then(function(result) {
+    setTimeout(loop, 0);
+  });
+}
+
+onactivate = function(e) {
+  // spam getServiced until the worker is closed.
+  loop();
+}
+
+onclose = function(e) {
+  for (var i = 0; i < 100; ++i) {
+    self.clients.getServiced();
+  }
+}
diff --git a/dom/workers/test/serviceworkers/mochitest.ini b/dom/workers/test/serviceworkers/mochitest.ini
index 20da13ab8a9..c8e7660cc5b 100644
--- a/dom/workers/test/serviceworkers/mochitest.ini
+++ b/dom/workers/test/serviceworkers/mochitest.ini
@@ -10,7 +10,10 @@ support-files =
   simpleregister/ready.html
   controller/index.html
   unregister/index.html
+  sw_clients/simple.html
+  get_serviced_worker.js
 
+[test_get_serviced.html]
 [test_installation_simple.html]
 [test_install_event.html]
 [test_navigator.html]
diff --git a/dom/workers/test/serviceworkers/sw_clients/simple.html b/dom/workers/test/serviceworkers/sw_clients/simple.html
new file mode 100644
index 00000000000..6b1551928d3
--- /dev/null
+++ b/dom/workers/test/serviceworkers/sw_clients/simple.html
@@ -0,0 +1,25 @@
+<!--
+  Any copyright is dedicated to the Public Domain.
+  http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Bug 982726 - test get_serviced not crashing</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<p id="display"></p>
+<div id="content" style="display: none"></div>
+<pre id="test"></pre>
+<script class="testbody" type="text/javascript">
+
+  window.onload = function() {
+    opener.postMessage("READY", "*");
+  }
+</script>
+</pre>
+</body>
+</html>
+
diff --git a/dom/workers/test/serviceworkers/test_get_serviced.html b/dom/workers/test/serviceworkers/test_get_serviced.html
new file mode 100644
index 00000000000..8c47401a079
--- /dev/null
+++ b/dom/workers/test/serviceworkers/test_get_serviced.html
@@ -0,0 +1,57 @@
+<!--
+  Any copyright is dedicated to the Public Domain.
+  http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Bug 982726 - test get_serviced not crashing</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<p id="display"></p>
+<div id="content" style="display: none"></div>
+<pre id="test"></pre>
+<script class="testbody" type="text/javascript">
+  // get_serviced_worker will call getServiced until the worker shuts down.
+  // Test passes if the browser doesn't crash on leaked promise objects.
+  var controlled_window;
+  function simpleRegister() {
+    return navigator.serviceWorker.register("get_serviced_worker.js", { scope: "./sw_clients/" });
+  }
+
+  function openWindow() {
+    var p = new Promise(function(resolve, reject) {
+      window.onmessage = function(e) {
+        if (e.data === "READY") {
+          resolve();
+        }
+      }
+    });
+
+    controlled_window = window.open("sw_clients/simple.html");
+    return p;
+  }
+
+  function runTest() {
+    simpleRegister()
+      .then(openWindow).catch(function(e) {
+        ok(false, "Some test failed with error " + e);
+      }).then(function() {
+        ok(true, "Didn't crash on resolving getServiced promises while worker shuts down.");
+        SimpleTest.finish();
+        controlled_window.close();
+      });
+  }
+
+  SimpleTest.waitForExplicitFinish();
+  SpecialPowers.pushPrefEnv({"set": [
+    ["dom.serviceWorkers.enabled", true],
+    ["dom.serviceWorkers.testing.enabled", true]
+  ]}, runTest);
+</script>
+</pre>
+</body>
+</html>
+
diff --git a/dom/workers/test/serviceworkers/test_unregister.html b/dom/workers/test/serviceworkers/test_unregister.html
index 46870ed57ac..88752d8eadc 100644
--- a/dom/workers/test/serviceworkers/test_unregister.html
+++ b/dom/workers/test/serviceworkers/test_unregister.html
@@ -16,6 +16,7 @@
 <script class="testbody" type="text/javascript">
 
   function simpleRegister() {
+        info("simpleRegister() just before calling register");
     return navigator.serviceWorker.register("worker.js", { scope: "unregister/" });
   }
 
@@ -48,6 +49,7 @@
   function unregister() {
     return navigator.serviceWorker.getRegistration("unregister/")
            .then(function(reg) {
+             info("getRegistration() succeeded " + reg.scope);
              return reg.unregister().then(function(v) {
                ok(v, "Unregister should resolve to true");
              }, function(e) {
@@ -84,9 +86,25 @@
 
   function runTest() {
     simpleRegister()
+      .then(function(v) {
+        info("simpleRegister() promise resolved");
+      })
       .then(testControlled)
+      .then(function(v) {
+        info("testControlled() promise resolved");
+      }, function(e) {
+        info("testControlled() promise rejected " + e);
+      })
       .then(unregister)
+      .then(function(v) {
+        info("unregister() promise resolved");
+      })
       .then(testUncontrolled)
+      .then(function(v) {
+        info("testUncontrolled() promise resolved");
+      }, function(e) {
+        info("testUncontrolled() promise rejected " + e);
+      })
       .then(function() {
         SimpleTest.finish();
       }).catch(function(e) {
diff --git a/dom/workers/test/serviceworkers/unregister/index.html b/dom/workers/test/serviceworkers/unregister/index.html
index d6d87f359ca..73d8d4a8a2d 100644
--- a/dom/workers/test/serviceworkers/unregister/index.html
+++ b/dom/workers/test/serviceworkers/unregister/index.html
@@ -20,17 +20,21 @@
   }
 
   var tId = setTimeout(function() {
+    info("tId timeout!");
     parent.postMessage({ controlled: false }, "*");
     tId = null;
   }, 2000);
 
   navigator.serviceWorker.ready.then(function() {
+  info("Got ready");
     if (tId == null) {
+    info("tId was null");
       parent.postMessage("FAIL!!!", "*");
       return;
     }
 
     clearTimeout(tId);
+    info("tId was non-null");
     parent.postMessage({ controlled: true }, "*");
   });
 

From f2167d59743d17d9cdd4859a4ebdcb5d1e6826b4 Mon Sep 17 00:00:00 2001
From: Ehsan Akhgari <ehsan@mozilla.com>
Date: Mon, 27 Oct 2014 12:03:00 +0100
Subject: [PATCH 054/153] Bug 982726 - Part 1.2: Break the cyclic dependency
 between WorkerScope.h and ServiceWorkerClients.h, and introduce a ToSupports
 overload for WorkerGlobalScope in order to fix the b2g builds. r=baku

---
 dom/workers/ServiceWorkerClients.h |  3 +--
 dom/workers/WorkerScope.cpp        | 15 +++++++++++++++
 dom/workers/WorkerScope.h          | 19 +++++++++----------
 3 files changed, 25 insertions(+), 12 deletions(-)

diff --git a/dom/workers/ServiceWorkerClients.h b/dom/workers/ServiceWorkerClients.h
index 39cf03a6dab..a1ea870d294 100644
--- a/dom/workers/ServiceWorkerClients.h
+++ b/dom/workers/ServiceWorkerClients.h
@@ -9,6 +9,7 @@
 
 #include "nsAutoPtr.h"
 #include "nsWrapperCache.h"
+#include "mozilla/dom/WorkerScope.h"
 
 namespace mozilla {
 
@@ -20,8 +21,6 @@ class Promise;
 
 namespace workers {
 
-class ServiceWorkerGlobalScope;
-
 class ServiceWorkerClients MOZ_FINAL : public nsISupports,
                                        public nsWrapperCache
 {
diff --git a/dom/workers/WorkerScope.cpp b/dom/workers/WorkerScope.cpp
index 015fd2ce304..9a41031ab11 100644
--- a/dom/workers/WorkerScope.cpp
+++ b/dom/workers/WorkerScope.cpp
@@ -33,6 +33,7 @@
 #include "WorkerPrivate.h"
 #include "WorkerRunnable.h"
 #include "Performance.h"
+#include "ServiceWorkerClients.h"
 
 #define UNWRAP_WORKER_OBJECT(Interface, obj, value)                           \
   UnwrapObject<prototypes::id::Interface##_workers,                           \
@@ -374,6 +375,10 @@ ServiceWorkerGlobalScope::ServiceWorkerGlobalScope(WorkerPrivate* aWorkerPrivate
 {
 }
 
+ServiceWorkerGlobalScope::~ServiceWorkerGlobalScope()
+{
+}
+
 JSObject*
 ServiceWorkerGlobalScope::WrapGlobalObject(JSContext* aCx)
 {
@@ -388,6 +393,16 @@ ServiceWorkerGlobalScope::WrapGlobalObject(JSContext* aCx)
                                                        true);
 }
 
+ServiceWorkerClients*
+ServiceWorkerGlobalScope::Clients()
+{
+  if (!mClients) {
+    mClients = new ServiceWorkerClients(this);
+  }
+
+  return mClients;
+}
+
 bool
 GetterOnlyJSNative(JSContext* aCx, unsigned aArgc, JS::Value* aVp)
 {
diff --git a/dom/workers/WorkerScope.h b/dom/workers/WorkerScope.h
index f969fae0e85..8f2ef1b29c4 100644
--- a/dom/workers/WorkerScope.h
+++ b/dom/workers/WorkerScope.h
@@ -11,8 +11,6 @@
 #include "mozilla/dom/Headers.h"
 #include "mozilla/dom/RequestBinding.h"
 
-#include "ServiceWorkerClients.h"
-
 namespace mozilla {
 namespace dom {
 
@@ -26,6 +24,7 @@ class RequestOrScalarValueString;
 
 BEGIN_WORKERS_NAMESPACE
 
+class ServiceWorkerClients;
 class WorkerPrivate;
 class WorkerLocation;
 class WorkerNavigator;
@@ -174,7 +173,7 @@ class ServiceWorkerGlobalScope MOZ_FINAL : public WorkerGlobalScope
   const nsString mScope;
   nsRefPtr<ServiceWorkerClients> mClients;
 
-  ~ServiceWorkerGlobalScope() { }
+  ~ServiceWorkerGlobalScope();
 
 public:
   NS_DECL_ISUPPORTS_INHERITED
@@ -208,13 +207,7 @@ public:
   Unregister(ErrorResult& aRv);
 
   ServiceWorkerClients*
-  Clients() {
-    if (!mClients) {
-      mClients = new ServiceWorkerClients(this);
-    }
-
-    return mClients;
-  }
+  Clients();
 
   IMPL_EVENT_HANDLER(activate)
   IMPL_EVENT_HANDLER(beforeevicted)
@@ -229,4 +222,10 @@ CreateGlobalScope(JSContext* aCx);
 
 END_WORKERS_NAMESPACE
 
+inline nsISupports*
+ToSupports(mozilla::dom::workers::WorkerGlobalScope* aScope)
+{
+  return static_cast<nsIDOMEventTarget*>(aScope);
+}
+
 #endif /* mozilla_dom_workerscope_h__ */

From 1a08ad874364b14c7b5ed8921eb3530c8f158e91 Mon Sep 17 00:00:00 2001
From: Catalin Badea <catalin.badea392@gmail.com>
Date: Tue, 28 Oct 2014 10:29:00 +0100
Subject: [PATCH 055/153] Bug 982726 - Patch 1.3 - Fix crash caused by a race
 condition in PromiseHolder. r=baku

---
 dom/workers/ServiceWorkerClients.cpp          | 36 +++++++++++++++----
 .../serviceworkers/get_serviced_worker.js     |  6 ----
 2 files changed, 30 insertions(+), 12 deletions(-)

diff --git a/dom/workers/ServiceWorkerClients.cpp b/dom/workers/ServiceWorkerClients.cpp
index c4e3f77271e..20f01d5f695 100644
--- a/dom/workers/ServiceWorkerClients.cpp
+++ b/dom/workers/ServiceWorkerClients.cpp
@@ -45,6 +45,8 @@ namespace {
 // keeping the worker alive.
 class PromiseHolder MOZ_FINAL : public WorkerFeature
 {
+  friend class GetServicedRunnable;
+
   NS_INLINE_DECL_THREADSAFE_REFCOUNTING(PromiseHolder)
 
 public:
@@ -52,6 +54,7 @@ public:
                 Promise* aPromise)
     : mWorkerPrivate(aWorkerPrivate),
       mPromise(aPromise),
+      mCleanUpLock("promiseHolderCleanUpLock"),
       mClean(false)
   {
     MOZ_ASSERT(mWorkerPrivate);
@@ -68,7 +71,7 @@ public:
   }
 
   Promise*
-  Get() const
+  GetPromise() const
   {
     return mPromise;
   }
@@ -78,6 +81,7 @@ public:
   {
     mWorkerPrivate->AssertIsOnWorkerThread();
 
+    MutexAutoLock lock(mCleanUpLock);
     if (mClean) {
       return;
     }
@@ -108,6 +112,11 @@ private:
   WorkerPrivate* mWorkerPrivate;
   nsRefPtr<Promise> mPromise;
 
+  // Used to prevent race conditions on |mClean| and to ensure that either a
+  // Notify() call or a dispatch back to the worker thread occurs before
+  // this object is released.
+  Mutex mCleanUpLock;
+
   bool mClean;
 };
 
@@ -133,7 +142,7 @@ public:
     MOZ_ASSERT(aWorkerPrivate);
     aWorkerPrivate->AssertIsOnWorkerThread();
 
-    Promise* promise = mPromiseHolder->Get();
+    Promise* promise = mPromiseHolder->GetPromise();
     MOZ_ASSERT(promise);
 
     nsTArray<nsRefPtr<ServiceWorkerClient>> ret;
@@ -154,18 +163,18 @@ public:
 class GetServicedRunnable MOZ_FINAL : public nsRunnable
 {
   WorkerPrivate* mWorkerPrivate;
-  nsCString mScope;
   nsRefPtr<PromiseHolder> mPromiseHolder;
+  nsCString mScope;
 public:
   GetServicedRunnable(WorkerPrivate* aWorkerPrivate,
-                      Promise* aPromise,
+                      PromiseHolder* aPromiseHolder,
                       const nsCString& aScope)
     : mWorkerPrivate(aWorkerPrivate),
+      mPromiseHolder(aPromiseHolder),
       mScope(aScope)
   {
     MOZ_ASSERT(aWorkerPrivate);
     aWorkerPrivate->AssertIsOnWorkerThread();
-    mPromiseHolder = new PromiseHolder(aWorkerPrivate, aPromise);
   }
 
   NS_IMETHOD
@@ -173,6 +182,12 @@ public:
   {
     AssertIsOnMainThread();
 
+    MutexAutoLock lock(mPromiseHolder->mCleanUpLock);
+    if (mPromiseHolder->mClean) {
+      // Don't resolve the promise if it was already released.
+      return NS_OK;
+    }
+
     nsRefPtr<ServiceWorkerManager> swm = ServiceWorkerManager::GetInstance();
     nsAutoPtr<nsTArray<uint64_t>> result(new nsTArray<uint64_t>());
 
@@ -203,8 +218,17 @@ ServiceWorkerClients::GetServiced(ErrorResult& aRv)
     return nullptr;
   }
 
+  nsRefPtr<PromiseHolder> promiseHolder = new PromiseHolder(workerPrivate,
+                                                            promise);
+  if (!promiseHolder->GetPromise()) {
+    // Don't dispatch if adding the worker feature failed.
+    return promise.forget();
+  }
+
   nsRefPtr<GetServicedRunnable> r =
-    new GetServicedRunnable(workerPrivate, promise, NS_ConvertUTF16toUTF8(scope));
+    new GetServicedRunnable(workerPrivate,
+                            promiseHolder,
+                            NS_ConvertUTF16toUTF8(scope));
   nsresult rv = NS_DispatchToMainThread(r);
 
   if (NS_WARN_IF(NS_FAILED(rv))) {
diff --git a/dom/workers/test/serviceworkers/get_serviced_worker.js b/dom/workers/test/serviceworkers/get_serviced_worker.js
index b97e4145034..5719fb22703 100644
--- a/dom/workers/test/serviceworkers/get_serviced_worker.js
+++ b/dom/workers/test/serviceworkers/get_serviced_worker.js
@@ -8,9 +8,3 @@ onactivate = function(e) {
   // spam getServiced until the worker is closed.
   loop();
 }
-
-onclose = function(e) {
-  for (var i = 0; i < 100; ++i) {
-    self.clients.getServiced();
-  }
-}

From ee13876c13deb415e72ea16caf3af2d816f86dc8 Mon Sep 17 00:00:00 2001
From: Catalin Badea <catalin.badea392@gmail.com>
Date: Thu, 30 Oct 2014 16:13:00 +0100
Subject: [PATCH 056/153] Bug 982726 - Patch 1.4 - Fix second crash scenario
 caused by a race in PromiseHolder. r=baku

---
 dom/workers/ServiceWorkerClients.cpp | 42 +++++++++++++++++++++++++++-
 1 file changed, 41 insertions(+), 1 deletion(-)

diff --git a/dom/workers/ServiceWorkerClients.cpp b/dom/workers/ServiceWorkerClients.cpp
index 20f01d5f695..0515075a7be 100644
--- a/dom/workers/ServiceWorkerClients.cpp
+++ b/dom/workers/ServiceWorkerClients.cpp
@@ -160,6 +160,34 @@ public:
   }
 };
 
+class ReleasePromiseRunnable MOZ_FINAL : public MainThreadWorkerControlRunnable
+{
+  nsRefPtr<PromiseHolder> mPromiseHolder;
+
+public:
+  ReleasePromiseRunnable(WorkerPrivate* aWorkerPrivate,
+                         PromiseHolder* aPromiseHolder)
+    : MainThreadWorkerControlRunnable(aWorkerPrivate),
+      mPromiseHolder(aPromiseHolder)
+  { }
+
+private:
+  ~ReleasePromiseRunnable()
+  { }
+
+  bool
+  WorkerRun(JSContext* aCx, WorkerPrivate* aWorkerPrivate)
+  {
+    MOZ_ASSERT(aWorkerPrivate);
+    aWorkerPrivate->AssertIsOnWorkerThread();
+
+    mPromiseHolder->Clean();
+
+    return true;
+  }
+
+};
+
 class GetServicedRunnable MOZ_FINAL : public nsRunnable
 {
   WorkerPrivate* mWorkerPrivate;
@@ -196,7 +224,19 @@ public:
       new ResolvePromiseWorkerRunnable(mWorkerPrivate, mPromiseHolder, result);
 
     AutoSafeJSContext cx;
-    r->Dispatch(cx);
+    if (r->Dispatch(cx)) {
+      return NS_OK;
+    }
+
+    // Dispatch to worker thread failed because the worker is shutting down.
+    // Use a control runnable to release the runnable on the worker thread.
+    nsRefPtr<ReleasePromiseRunnable> releaseRunnable =
+      new ReleasePromiseRunnable(mWorkerPrivate, mPromiseHolder);
+
+    if (!releaseRunnable->Dispatch(cx)) {
+      NS_RUNTIMEABORT("Failed to dispatch PromiseHolder control runnable.");
+    }
+
     return NS_OK;
   }
 };

From 769651290f6126586ed82fce8fbd8aba1405b91b Mon Sep 17 00:00:00 2001
From: Catalin Badea <catalin.badea392@gmail.com>
Date: Tue, 4 Nov 2014 13:04:00 +0100
Subject: [PATCH 057/153] Bug 982726 - Patch 1.5 - Update getServiced test and
 fix an assert when the registration has been removed. r=baku

---
 dom/workers/ServiceWorkerManager.cpp          |  7 +++-
 .../serviceworkers/sw_clients/simple.html     |  9 ++++--
 .../serviceworkers/test_get_serviced.html     | 32 +++++++++++++++----
 3 files changed, 39 insertions(+), 9 deletions(-)

diff --git a/dom/workers/ServiceWorkerManager.cpp b/dom/workers/ServiceWorkerManager.cpp
index 03546c004be..dcd16209a65 100644
--- a/dom/workers/ServiceWorkerManager.cpp
+++ b/dom/workers/ServiceWorkerManager.cpp
@@ -2185,7 +2185,12 @@ ServiceWorkerManager::GetServicedClients(const nsCString& aScope,
   nsRefPtr<ServiceWorkerDomainInfo> domainInfo = GetDomainInfo(aScope);
   nsRefPtr<ServiceWorkerRegistrationInfo> registration =
     domainInfo->GetRegistration(aScope);
-  MOZ_ASSERT(registration);
+
+  if (!registration) {
+    // The registration was removed, leave the array empty.
+    return;
+  }
+
   FilterRegistrationData data(aControlledDocuments, registration);
 
   domainInfo->mControlledDocuments.EnumerateRead(EnumControlledDocuments,
diff --git a/dom/workers/test/serviceworkers/sw_clients/simple.html b/dom/workers/test/serviceworkers/sw_clients/simple.html
index 6b1551928d3..0267b9200ad 100644
--- a/dom/workers/test/serviceworkers/sw_clients/simple.html
+++ b/dom/workers/test/serviceworkers/sw_clients/simple.html
@@ -15,9 +15,14 @@
 <pre id="test"></pre>
 <script class="testbody" type="text/javascript">
 
-  window.onload = function() {
-    opener.postMessage("READY", "*");
+  if (!parent) {
+    info("sw_clients/simple.html shouldn't be launched directly!");
   }
+
+  navigator.serviceWorker.ready.then(function() {
+    parent.postMessage("READY", "*");
+  });
+
 </script>
 </pre>
 </body>
diff --git a/dom/workers/test/serviceworkers/test_get_serviced.html b/dom/workers/test/serviceworkers/test_get_serviced.html
index 8c47401a079..18c0bed426a 100644
--- a/dom/workers/test/serviceworkers/test_get_serviced.html
+++ b/dom/workers/test/serviceworkers/test_get_serviced.html
@@ -16,12 +16,25 @@
 <script class="testbody" type="text/javascript">
   // get_serviced_worker will call getServiced until the worker shuts down.
   // Test passes if the browser doesn't crash on leaked promise objects.
-  var controlled_window;
+  var registration;
+  var content;
+  var iframe;
+
   function simpleRegister() {
-    return navigator.serviceWorker.register("get_serviced_worker.js", { scope: "./sw_clients/" });
+    return navigator.serviceWorker.register("get_serviced_worker.js",
+                                            { scope: "./sw_clients/" })
+      .then((swr) => registration = swr);
   }
 
-  function openWindow() {
+  function closeAndUnregister() {
+    content.removeChild(iframe);
+
+    return registration.unregister().then(function(result) {
+      ok(result, "Unregister should return true.");
+    });
+  }
+
+  function openClient() {
     var p = new Promise(function(resolve, reject) {
       window.onmessage = function(e) {
         if (e.data === "READY") {
@@ -30,18 +43,25 @@
       }
     });
 
-    controlled_window = window.open("sw_clients/simple.html");
+    content = document.getElementById("content");
+    ok(content, "Parent exists.");
+
+    iframe = document.createElement("iframe");
+    iframe.setAttribute('src', "sw_clients/simple.html");
+    content.appendChild(iframe);
+
     return p;
   }
 
   function runTest() {
     simpleRegister()
-      .then(openWindow).catch(function(e) {
+      .then(openClient)
+      .then(closeAndUnregister)
+      .catch(function(e) {
         ok(false, "Some test failed with error " + e);
       }).then(function() {
         ok(true, "Didn't crash on resolving getServiced promises while worker shuts down.");
         SimpleTest.finish();
-        controlled_window.close();
       });
   }
 

From c47ea57634c9306076a9a05c8dc5fc4c66928748 Mon Sep 17 00:00:00 2001
From: Jan Beich <jbeich@vfemail.net>
Date: Tue, 4 Nov 2014 02:01:00 +0100
Subject: [PATCH 058/153] Bug 1041795 - Disable system libs when generating
 DTrace probes. f=sfink f=ginn.chen

---
 config/rules.mk    | 4 ++--
 js/src/Makefile.in | 2 +-
 probes/Makefile.in | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/config/rules.mk b/config/rules.mk
index 05429b25822..eb453d34737 100644
--- a/config/rules.mk
+++ b/config/rules.mk
@@ -806,7 +806,7 @@ ifdef DTRACE_PROBE_OBJ
 ifndef DTRACE_LIB_DEPENDENT
 NON_DTRACE_OBJS := $(filter-out $(DTRACE_PROBE_OBJ),$(OBJS))
 $(DTRACE_PROBE_OBJ): $(NON_DTRACE_OBJS)
-	dtrace -G -C -s $(MOZILLA_DTRACE_SRC) -o $(DTRACE_PROBE_OBJ) $(NON_DTRACE_OBJS)
+	dtrace -x nolibs -G -C -s $(MOZILLA_DTRACE_SRC) -o $(DTRACE_PROBE_OBJ) $(NON_DTRACE_OBJS)
 endif
 endif
 endif
@@ -824,7 +824,7 @@ ifndef INCREMENTAL_LINKER
 endif
 ifdef DTRACE_LIB_DEPENDENT
 ifndef XP_MACOSX
-	dtrace -G -C -s $(MOZILLA_DTRACE_SRC) -o  $(DTRACE_PROBE_OBJ) $(shell $(EXPAND_LIBS) $(MOZILLA_PROBE_LIBS))
+	dtrace -x nolibs -G -C -s $(MOZILLA_DTRACE_SRC) -o  $(DTRACE_PROBE_OBJ) $(shell $(EXPAND_LIBS) $(MOZILLA_PROBE_LIBS))
 endif
 	$(EXPAND_MKSHLIB) $(SHLIB_LDSTARTFILE) $(OBJS) $(SUB_SHLOBJS) $(DTRACE_PROBE_OBJ) $(MOZILLA_PROBE_LIBS) $(RESFILE) $(LDFLAGS) $(WRAP_LDFLAGS) $(STATIC_LIBS) $(SHARED_LIBS) $(EXTRA_DSO_LDOPTS) $(MOZ_GLUE_LDFLAGS) $(EXTRA_LIBS) $(OS_LIBS) $(SHLIB_LDENDFILE)
 	@$(RM) $(DTRACE_PROBE_OBJ)
diff --git a/js/src/Makefile.in b/js/src/Makefile.in
index 0ad2a170d55..84b7e6cdb7a 100644
--- a/js/src/Makefile.in
+++ b/js/src/Makefile.in
@@ -297,7 +297,7 @@ endif
 
 ifdef HAVE_DTRACE
 $(CURDIR)/javascript-trace.h: $(srcdir)/devtools/javascript-trace.d
-	dtrace -h -s $(srcdir)/devtools/javascript-trace.d -o javascript-trace.h.in
+	dtrace -x nolibs -h -s $(srcdir)/devtools/javascript-trace.d -o javascript-trace.h.in
 	sed -e 's/if _DTRACE_VERSION/ifdef INCLUDE_MOZILLA_DTRACE/' \
 	    -e '/const/!s/char \*/const char */g' \
 	    javascript-trace.h.in > javascript-trace.h
diff --git a/probes/Makefile.in b/probes/Makefile.in
index 6d18f342545..deec83f654a 100644
--- a/probes/Makefile.in
+++ b/probes/Makefile.in
@@ -7,7 +7,7 @@ export:: $(DIST)/include/mozilla-trace.h
 
 # Replace _DTRACE_VERSION with INCLUDE_MOZILLA_DTRACE
 $(DIST)/include/mozilla-trace.h: mozilla-trace.d Makefile
-	dtrace -h -s $(srcdir)/mozilla-trace.d -o mozilla-trace.h.tmp
+	dtrace -x nolibs -h -s $(srcdir)/mozilla-trace.d -o mozilla-trace.h.tmp
 	sed -e 's/if _DTRACE_VERSION/ifdef INCLUDE_MOZILLA_DTRACE/' \
 	    mozilla-trace.h.tmp > $(DIST)/include/mozilla-trace.h
 	rm mozilla-trace.h.tmp

From 0c437e69357de161c462334e4a0c04fd6cbeb322 Mon Sep 17 00:00:00 2001
From: Nicholas Hurley <hurley@todesschaf.org>
Date: Mon, 3 Nov 2014 16:19:00 +0100
Subject: [PATCH 059/153] Bug 1055306 - Make h2 push origin check more correct.
 r=mcmanus

---
 netwerk/protocol/http/Http2Session.cpp | 20 +++++++++++-
 netwerk/protocol/http/Http2Stream.cpp  | 42 ++++++++++++++++++++++++--
 netwerk/protocol/http/Http2Stream.h    |  9 ++++++
 3 files changed, 67 insertions(+), 4 deletions(-)

diff --git a/netwerk/protocol/http/Http2Session.cpp b/netwerk/protocol/http/Http2Session.cpp
index dbba57b12ce..eda32a37862 100644
--- a/netwerk/protocol/http/Http2Session.cpp
+++ b/netwerk/protocol/http/Http2Session.cpp
@@ -29,6 +29,8 @@
 #include "nsISSLStatus.h"
 #include "nsISSLStatusProvider.h"
 #include "nsISupportsPriority.h"
+#include "nsStandardURL.h"
+#include "nsURLHelper.h"
 #include "prprf.h"
 #include "prnetdb.h"
 #include "sslt.h"
@@ -1629,7 +1631,23 @@ Http2Session::RecvPushPromise(Http2Session *self)
     return NS_OK;
   }
 
-  if (!associatedStream->Origin().Equals(pushedStream->Origin())) {
+  nsRefPtr<nsStandardURL> associatedURL, pushedURL;
+  rv = Http2Stream::MakeOriginURL(associatedStream->Origin(), associatedURL);
+  if (NS_SUCCEEDED(rv)) {
+    rv = Http2Stream::MakeOriginURL(pushedStream->Origin(), pushedURL);
+  }
+  LOG3(("Http2Session::RecvPushPromise %p checking %s == %s",
+        associatedStream->Origin().get(), pushedStream->Origin().get()));
+  bool match = false;
+  if (NS_SUCCEEDED(rv)) {
+    rv = associatedURL->Equals(pushedURL, &match);
+  }
+  if (NS_FAILED(rv)) {
+    // Fallback to string equality of origins. This won't be guaranteed to be as
+    // liberal as we want it to be, but it will at least be safe
+    match = associatedStream->Origin().Equals(pushedStream->Origin());
+  }
+  if (!match) {
     LOG3(("Http2Session::RecvPushPromise %p pushed stream mismatched origin "
           "associated origin %s .. pushed origin %s\n", self,
           associatedStream->Origin().get(), pushedStream->Origin().get()));
diff --git a/netwerk/protocol/http/Http2Stream.cpp b/netwerk/protocol/http/Http2Stream.cpp
index da846238952..b4864b358a1 100644
--- a/netwerk/protocol/http/Http2Stream.cpp
+++ b/netwerk/protocol/http/Http2Stream.cpp
@@ -27,6 +27,7 @@
 #include "nsHttpHandler.h"
 #include "nsHttpRequestHead.h"
 #include "nsISocketTransport.h"
+#include "nsStandardURL.h"
 #include "prnetdb.h"
 
 #ifdef DEBUG
@@ -241,6 +242,28 @@ Http2Stream::WriteSegments(nsAHttpSegmentWriter *writer,
   return rv;
 }
 
+nsresult
+Http2Stream::MakeOriginURL(const nsACString &origin, nsRefPtr<nsStandardURL> &url)
+{
+  nsAutoCString scheme;
+  nsresult rv = net_ExtractURLScheme(origin, nullptr, nullptr, &scheme);
+  NS_ENSURE_SUCCESS(rv, rv);
+  return MakeOriginURL(scheme, origin, url);
+}
+
+nsresult
+Http2Stream::MakeOriginURL(const nsACString &scheme, const nsACString &origin,
+                           nsRefPtr<nsStandardURL> &url)
+{
+  url = new nsStandardURL();
+  nsresult rv = url->Init(nsIStandardURL::URLTYPE_AUTHORITY,
+                          scheme.EqualsLiteral("http") ?
+                              NS_HTTP_DEFAULT_PORT :
+                              NS_HTTPS_DEFAULT_PORT,
+                          origin, nullptr, nullptr);
+  return rv;
+}
+
 void
 Http2Stream::CreatePushHashKey(const nsCString &scheme,
                                const nsCString &hostHeader,
@@ -249,9 +272,22 @@ Http2Stream::CreatePushHashKey(const nsCString &scheme,
                                nsCString &outOrigin,
                                nsCString &outKey)
 {
-  outOrigin = scheme;
-  outOrigin.AppendLiteral("://");
-  outOrigin.Append(hostHeader);
+  nsCString fullOrigin = scheme;
+  fullOrigin.AppendLiteral("://");
+  fullOrigin.Append(hostHeader);
+
+  nsRefPtr<nsStandardURL> origin;
+  nsresult rv = Http2Stream::MakeOriginURL(scheme, fullOrigin, origin);
+
+  if (NS_SUCCEEDED(rv)) {
+    rv = origin->GetAsciiSpec(outOrigin);
+    outOrigin.Trim("/", false, true, false);
+  }
+
+  if (NS_FAILED(rv)) {
+    // Fallback to plain text copy - this may end up behaving poorly
+    outOrigin = fullOrigin;
+  }
 
   outKey = outOrigin;
   outKey.AppendLiteral("/[http2.");
diff --git a/netwerk/protocol/http/Http2Stream.h b/netwerk/protocol/http/Http2Stream.h
index f13ecb35b8d..18734d63a21 100644
--- a/netwerk/protocol/http/Http2Stream.h
+++ b/netwerk/protocol/http/Http2Stream.h
@@ -10,6 +10,8 @@
 #include "nsAHttpTransaction.h"
 #include "nsISupportsPriority.h"
 
+class nsStandardURL;
+
 namespace mozilla {
 namespace net {
 
@@ -133,6 +135,13 @@ public:
 
   Http2Session *Session() { return mSession; }
 
+  static nsresult MakeOriginURL(const nsACString &origin,
+                                nsRefPtr<nsStandardURL> &url);
+
+  static nsresult MakeOriginURL(const nsACString &scheme,
+                                const nsACString &origin,
+                                nsRefPtr<nsStandardURL> &url);
+
 protected:
   static void CreatePushHashKey(const nsCString &scheme,
                                 const nsCString &hostHeader,

From fd0b5f37e429157042a3813db4032a92aee963e5 Mon Sep 17 00:00:00 2001
From: Patrick McManus <mcmanus@ducksong.com>
Date: Sat, 1 Nov 2014 17:27:53 -0400
Subject: [PATCH 060/153] Bug 1092613 - reason phrases for http 207 and 208.
 r=hurley

---
 netwerk/protocol/http/nsHttpResponseHead.cpp | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/netwerk/protocol/http/nsHttpResponseHead.cpp b/netwerk/protocol/http/nsHttpResponseHead.cpp
index a8b11bd09fa..8d848d84545 100644
--- a/netwerk/protocol/http/nsHttpResponseHead.cpp
+++ b/netwerk/protocol/http/nsHttpResponseHead.cpp
@@ -192,6 +192,12 @@ nsHttpResponseHead::AssignDefaultStatusText()
     case 206:
         mStatusText.AssignLiteral("Partial Content");
         break;
+    case 207:
+        mStatusText.AssignLiteral("Multi-Status");
+        break;
+    case 208:
+        mStatusText.AssignLiteral("Already Reported");
+        break;
     case 300:
         mStatusText.AssignLiteral("Multiple Choices");
         break;

From c93298c79afc9c8b5df153091e116acae5aac3f5 Mon Sep 17 00:00:00 2001
From: "Pankaj Malhotra(:bitgeeky)" <mozpankaj1994@gmail.com>
Date: Tue, 4 Nov 2014 04:16:00 +0100
Subject: [PATCH 061/153] Bug 1087682 - Add a manifestparser test for the case
 where there is no manifest. r=jgriffin

---
 .../manifestparser/tests/test_testmanifest.py     | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/testing/mozbase/manifestparser/tests/test_testmanifest.py b/testing/mozbase/manifestparser/tests/test_testmanifest.py
index 434990f0fb6..f1dbb28452a 100644
--- a/testing/mozbase/manifestparser/tests/test_testmanifest.py
+++ b/testing/mozbase/manifestparser/tests/test_testmanifest.py
@@ -8,6 +8,7 @@ from manifestparser import TestManifest, ParseError
 
 here = os.path.dirname(os.path.abspath(__file__))
 
+
 class TestTestManifest(unittest.TestCase):
     """Test the Test Manifest"""
 
@@ -45,7 +46,6 @@ class TestTestManifest(unittest.TestCase):
 
         shutil.rmtree(tempdir)
 
-
     def test_comments(self):
         """
         ensure comments work, see
@@ -103,5 +103,18 @@ class TestTestManifest(unittest.TestCase):
         self.assertRaises(ParseError, manifest.active_tests, exists=False,
                           options=AttributeDict(options), **info)
 
+    def test_none_and_empty_manifest(self):
+        """
+        Test TestManifest for None and empty manifest, see
+        https://bugzilla.mozilla.org/show_bug.cgi?id=1087682
+        """
+        none_manifest = TestManifest(manifests=None, strict=False)
+        self.assertEqual(len(none_manifest.test_paths()), 0)
+        self.assertEqual(len(none_manifest.active_tests()), 0)
+
+        empty_manifest = TestManifest(manifests=[], strict=False)
+        self.assertEqual(len(empty_manifest.test_paths()), 0)
+        self.assertEqual(len(empty_manifest.active_tests()), 0)
+
 if __name__ == '__main__':
     unittest.main()

From 6eab6796070e8db5e39258e243d8ab99cc797c97 Mon Sep 17 00:00:00 2001
From: Anthony Jones <ajones@mozilla.com>
Date: Wed, 5 Nov 2014 16:18:32 +0800
Subject: [PATCH 062/153] Bug 1094049 - Make GonkDecoderModule use currect
 display height; r=bwu

---
 dom/media/fmp4/gonk/GonkVideoDecoderManager.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dom/media/fmp4/gonk/GonkVideoDecoderManager.cpp b/dom/media/fmp4/gonk/GonkVideoDecoderManager.cpp
index 6975f562ec1..7a83f4f2183 100644
--- a/dom/media/fmp4/gonk/GonkVideoDecoderManager.cpp
+++ b/dom/media/fmp4/gonk/GonkVideoDecoderManager.cpp
@@ -59,7 +59,7 @@ GonkVideoDecoderManager::GonkVideoDecoderManager(
   mVideoWidth  = aConfig.display_width;
   mVideoHeight = aConfig.display_height;
   mDisplayWidth = aConfig.display_width;
-  mDisplayHeight = aConfig.display_width;
+  mDisplayHeight = aConfig.display_height;
   mInfo.mVideo.mHasVideo = true;
   nsIntSize displaySize(mDisplayWidth, mDisplayHeight);
   mInfo.mVideo.mDisplay = displaySize;

From dbe7dbf0fe3bc1dd7f0c6e166477e2beca689db0 Mon Sep 17 00:00:00 2001
From: "Carsten \"Tomcat\" Book" <cbook@mozilla.com>
Date: Wed, 5 Nov 2014 10:02:59 +0100
Subject: [PATCH 063/153] Backed out changeset 38ca6211d1d4 (bug 1091970)

---
 browser/installer/package-manifest.in         |  1 -
 js/ipc/JavaScriptTypes.ipdlh                  |  1 -
 js/ipc/WrapperOwner.cpp                       | 47 +++----------------
 js/ipc/WrapperOwner.h                         |  3 --
 js/xpconnect/idl/moz.build                    |  1 -
 js/xpconnect/idl/nsIRemoteTagService.idl      | 13 -----
 js/xpconnect/idl/xpccomponents.idl            | 11 +----
 js/xpconnect/src/XPCComponents.cpp            | 10 ----
 .../addoncompat/addoncompat.manifest          |  2 -
 toolkit/components/addoncompat/moz.build      |  1 -
 .../addoncompat/multiprocessShims.js          |  8 +++-
 .../addoncompat/remoteTagService.js           | 39 ---------------
 12 files changed, 15 insertions(+), 122 deletions(-)
 delete mode 100644 js/xpconnect/idl/nsIRemoteTagService.idl
 delete mode 100644 toolkit/components/addoncompat/remoteTagService.js

diff --git a/browser/installer/package-manifest.in b/browser/installer/package-manifest.in
index 7f81993c60e..125354ff90a 100644
--- a/browser/installer/package-manifest.in
+++ b/browser/installer/package-manifest.in
@@ -441,7 +441,6 @@
 @BINPATH@/components/nsUpdateTimerManager.js
 @BINPATH@/components/addoncompat.manifest
 @BINPATH@/components/multiprocessShims.js
-@BINPATH@/components/remoteTagService.js
 @BINPATH@/components/pluginGlue.manifest
 @BINPATH@/components/ProcessSingleton.manifest
 @BINPATH@/components/MainProcessSingleton.js
diff --git a/js/ipc/JavaScriptTypes.ipdlh b/js/ipc/JavaScriptTypes.ipdlh
index 2d19ccff82a..975e3aa39e1 100644
--- a/js/ipc/JavaScriptTypes.ipdlh
+++ b/js/ipc/JavaScriptTypes.ipdlh
@@ -37,7 +37,6 @@ struct RemoteObject
     uint64_t serializedId;
     bool isCallable;
     bool isConstructor;
-    nsCString objectTag;
 };
 
 union ObjectVariant
diff --git a/js/ipc/WrapperOwner.cpp b/js/ipc/WrapperOwner.cpp
index bb377fea64f..8eb6b30ae2a 100644
--- a/js/ipc/WrapperOwner.cpp
+++ b/js/ipc/WrapperOwner.cpp
@@ -13,8 +13,6 @@
 #include "xpcprivate.h"
 #include "WrapperFactory.h"
 
-#include "nsIRemoteTagService.h"
-
 using namespace js;
 using namespace JS;
 using namespace mozilla;
@@ -26,15 +24,10 @@ struct AuxCPOWData
     bool isCallable;
     bool isConstructor;
 
-    // The object tag is just some auxilliary information that clients can use
-    // however they see fit.
-    nsCString objectTag;
-
-    AuxCPOWData(ObjectId id, bool isCallable, bool isConstructor, const nsACString &objectTag)
+    AuxCPOWData(ObjectId id, bool isCallable, bool isConstructor)
       : id(id),
         isCallable(isCallable),
-        isConstructor(isConstructor),
-        objectTag(objectTag)
+        isConstructor(isConstructor)
     {}
 };
 
@@ -810,17 +803,6 @@ IsWrappedCPOW(JSObject *obj)
     return IsCPOW(unwrapped);
 }
 
-void
-GetWrappedCPOWTag(JSObject *obj, nsACString &out)
-{
-    JSObject *unwrapped = js::UncheckedUnwrap(obj, true);
-    MOZ_ASSERT(IsCPOW(unwrapped));
-
-    AuxCPOWData *aux = AuxCPOWDataOf(unwrapped);
-    if (aux)
-        out = aux->objectTag;
-}
-
 nsresult
 InstanceOf(JSObject *proxy, const nsID *id, bool *bp)
 {
@@ -902,21 +884,9 @@ WrapperOwner::ok(JSContext *cx, const ReturnStatus &status)
 }
 
 static RemoteObject
-MakeRemoteObject(JSContext *cx, ObjectId id, HandleObject obj)
+MakeRemoteObject(ObjectId id, JSObject *obj)
 {
-    nsCString objectTag;
-
-    nsCOMPtr<nsIRemoteTagService> service =
-        do_GetService("@mozilla.org/addons/remote-tag-service;1");
-    if (service) {
-        RootedValue objVal(cx, ObjectValue(*obj));
-        service->GetRemoteObjectTag(objVal, objectTag);
-    }
-
-    return RemoteObject(id.serialize(),
-                        JS::IsCallable(obj),
-                        JS::IsConstructor(obj),
-                        objectTag);
+    return RemoteObject(id.serialize(), JS::IsCallable(obj), JS::IsConstructor(obj));
 }
 
 bool
@@ -940,7 +910,7 @@ WrapperOwner::toObjectVariant(JSContext *cx, JSObject *objArg, ObjectVariant *ob
     ObjectId id = objectIdMap(waiveXray).find(obj);
     if (!id.isNull()) {
         MOZ_ASSERT(id.hasXrayWaiver() == waiveXray);
-        *objVarp = MakeRemoteObject(cx, id, obj);
+        *objVarp = MakeRemoteObject(id, obj);
         return true;
     }
 
@@ -955,7 +925,7 @@ WrapperOwner::toObjectVariant(JSContext *cx, JSObject *objArg, ObjectVariant *ob
     if (!objectIdMap(waiveXray).add(cx, obj, id))
         return false;
 
-    *objVarp = MakeRemoteObject(cx, id, obj);
+    *objVarp = MakeRemoteObject(id, obj);
     return true;
 }
 
@@ -994,10 +964,7 @@ WrapperOwner::fromRemoteObjectVariant(JSContext *cx, RemoteObject objVar)
         // Incref once we know the decref will be called.
         incref();
 
-        AuxCPOWData *aux = new AuxCPOWData(objId,
-                                           objVar.isCallable(),
-                                           objVar.isConstructor(),
-                                           objVar.objectTag());
+        AuxCPOWData *aux = new AuxCPOWData(objId, objVar.isCallable(), objVar.isConstructor());
 
         SetProxyExtra(obj, 0, PrivateValue(this));
         SetProxyExtra(obj, 1, PrivateValue(aux));
diff --git a/js/ipc/WrapperOwner.h b/js/ipc/WrapperOwner.h
index 8c51f218c93..5ff469dc233 100644
--- a/js/ipc/WrapperOwner.h
+++ b/js/ipc/WrapperOwner.h
@@ -163,9 +163,6 @@ InstanceOf(JSObject *obj, const nsID *id, bool *bp);
 bool
 DOMInstanceOf(JSContext *cx, JSObject *obj, int prototypeID, int depth, bool *bp);
 
-void
-GetWrappedCPOWTag(JSObject *obj, nsACString &out);
-
 } // jsipc
 } // mozilla
 
diff --git a/js/xpconnect/idl/moz.build b/js/xpconnect/idl/moz.build
index c1ed1e21c1b..8dffa158e46 100644
--- a/js/xpconnect/idl/moz.build
+++ b/js/xpconnect/idl/moz.build
@@ -8,7 +8,6 @@ XPIDL_SOURCES += [
     'mozIJSSubScriptLoader.idl',
     'nsIAddonInterposition.idl',
     'nsIJSRuntimeService.idl',
-    'nsIRemoteTagService.idl',
     'nsIScriptError.idl',
     'nsIXPConnect.idl',
     'nsIXPCScriptable.idl',
diff --git a/js/xpconnect/idl/nsIRemoteTagService.idl b/js/xpconnect/idl/nsIRemoteTagService.idl
deleted file mode 100644
index 4602dfdb99f..00000000000
--- a/js/xpconnect/idl/nsIRemoteTagService.idl
+++ /dev/null
@@ -1,13 +0,0 @@
-/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "nsISupports.idl"
-
-[scriptable,uuid(59dbe3d0-6084-11e4-9803-0800200c9a66)]
-interface nsIRemoteTagService : nsISupports
-{
-    ACString getRemoteObjectTag(in jsval target);
-};
diff --git a/js/xpconnect/idl/xpccomponents.idl b/js/xpconnect/idl/xpccomponents.idl
index 7cde41bf36a..fca4ffc9372 100644
--- a/js/xpconnect/idl/xpccomponents.idl
+++ b/js/xpconnect/idl/xpccomponents.idl
@@ -122,7 +122,7 @@ interface ScheduledGCCallback : nsISupports
 /**
 * interface of Components.utils
 */
-[scriptable, uuid(2617a800-63c1-11e4-9803-0800200c9a66)]
+[scriptable, uuid(ad41689c-ed0e-4a92-8f19-a53c2dba5711)]
 interface nsIXPCComponents_Utils : nsISupports
 {
 
@@ -435,15 +435,6 @@ interface nsIXPCComponents_Utils : nsISupports
      */
     bool isCrossProcessWrapper(in jsval obj);
 
-    /**
-     * CPOWs can have user data attached to them. This data originates
-     * in the local process via the
-     * nsIRemoteTagService.getRemoteObjectTag method. It's sent along
-     * with the CPOW to the remote process, where it can be fetched
-     * with this function, getCrossProcessWrapperTag.
-     */
-    ACString getCrossProcessWrapperTag(in jsval obj);
-
     /*
      * To be called from JS only. This is for Gecko internal use only, and may
      * disappear at any moment.
diff --git a/js/xpconnect/src/XPCComponents.cpp b/js/xpconnect/src/XPCComponents.cpp
index 25a7f0bc8d6..3b2c716f034 100644
--- a/js/xpconnect/src/XPCComponents.cpp
+++ b/js/xpconnect/src/XPCComponents.cpp
@@ -3106,16 +3106,6 @@ nsXPCComponents_Utils::IsCrossProcessWrapper(HandleValue obj, bool *out)
     return NS_OK;
 }
 
-NS_IMETHODIMP
-nsXPCComponents_Utils::GetCrossProcessWrapperTag(HandleValue obj, nsACString &out)
-{
-    if (obj.isPrimitive() || !jsipc::IsWrappedCPOW(&obj.toObject()))
-        return NS_ERROR_INVALID_ARG;
-
-    jsipc::GetWrappedCPOWTag(&obj.toObject(), out);
-    return NS_OK;
-}
-
 /* void recomputerWrappers(jsval vobj); */
 NS_IMETHODIMP
 nsXPCComponents_Utils::RecomputeWrappers(HandleValue vobj, JSContext *cx)
diff --git a/toolkit/components/addoncompat/addoncompat.manifest b/toolkit/components/addoncompat/addoncompat.manifest
index 4273bf246c3..962562bfcb6 100644
--- a/toolkit/components/addoncompat/addoncompat.manifest
+++ b/toolkit/components/addoncompat/addoncompat.manifest
@@ -1,4 +1,2 @@
 component {1363d5f0-d95e-11e3-9c1a-0800200c9a66} multiprocessShims.js
 contract @mozilla.org/addons/multiprocess-shims;1 {1363d5f0-d95e-11e3-9c1a-0800200c9a66}
-component {dfd07380-6083-11e4-9803-0800200c9a66} remoteTagService.js
-contract @mozilla.org/addons/remote-tag-service;1 {dfd07380-6083-11e4-9803-0800200c9a66}
diff --git a/toolkit/components/addoncompat/moz.build b/toolkit/components/addoncompat/moz.build
index 56e8d050a72..f915e7370e4 100644
--- a/toolkit/components/addoncompat/moz.build
+++ b/toolkit/components/addoncompat/moz.build
@@ -9,7 +9,6 @@ TEST_DIRS += ['tests']
 EXTRA_COMPONENTS += [
     'addoncompat.manifest',
     'multiprocessShims.js',
-    'remoteTagService.js',
 ]
 
 EXTRA_JS_MODULES += [
diff --git a/toolkit/components/addoncompat/multiprocessShims.js b/toolkit/components/addoncompat/multiprocessShims.js
index 9cbcce8afc0..637685571be 100644
--- a/toolkit/components/addoncompat/multiprocessShims.js
+++ b/toolkit/components/addoncompat/multiprocessShims.js
@@ -77,7 +77,13 @@ AddonInterpositionService.prototype = {
   // determines the type of the target object.
   getObjectTag: function(target) {
     if (Cu.isCrossProcessWrapper(target)) {
-      return Cu.getCrossProcessWrapperTag(target);
+      if (target instanceof Ci.nsIDocShellTreeItem) {
+        return "ContentDocShellTreeItem";
+      }
+
+      if (target instanceof Ci.nsIDOMDocument) {
+        return "ContentDocument";
+      }
     }
 
     const XUL_NS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
diff --git a/toolkit/components/addoncompat/remoteTagService.js b/toolkit/components/addoncompat/remoteTagService.js
deleted file mode 100644
index 9c1a443baa1..00000000000
--- a/toolkit/components/addoncompat/remoteTagService.js
+++ /dev/null
@@ -1,39 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-"use strict";
-
-const Cu = Components.utils;
-const Ci = Components.interfaces;
-
-Cu.import("resource://gre/modules/XPCOMUtils.jsm");
-
-function RemoteTagServiceService()
-{
-}
-
-RemoteTagServiceService.prototype = {
-  classID: Components.ID("{dfd07380-6083-11e4-9803-0800200c9a66}"),
-  QueryInterface: XPCOMUtils.generateQI([Ci.nsIRemoteTagService, Ci.nsISupportsWeakReference]),
-
-  /**
-   * CPOWs can have user data attached to them. This data originates
-   * in the local process from this function, getRemoteObjectTag. It's
-   * sent along with the CPOW to the remote process, where it can be
-   * fetched with Components.utils.getCrossProcessWrapperTag.
-   */
-  getRemoteObjectTag: function(target) {
-    if (target instanceof Ci.nsIDocShellTreeItem) {
-      return "ContentDocShellTreeItem";
-    }
-
-    if (target instanceof Ci.nsIDOMDocument) {
-      return "ContentDocument";
-    }
-
-    return "generic";
-  }
-};
-
-this.NSGetFactory = XPCOMUtils.generateNSGetFactory([RemoteTagServiceService]);

From efe4af0c064e78bb5137ff202bb16e4c05dddc54 Mon Sep 17 00:00:00 2001
From: "Carsten \"Tomcat\" Book" <cbook@mozilla.com>
Date: Wed, 5 Nov 2014 10:03:06 +0100
Subject: [PATCH 064/153] Backed out changeset 5992aea01aff (bug 1091964)

---
 js/ipc/JavaScriptBase.h      | 16 +++++++
 js/ipc/JavaScriptTypes.ipdlh |  2 -
 js/ipc/PJavaScript.ipdl      |  3 ++
 js/ipc/WrapperAnswer.cpp     | 41 +++++++++++++++++
 js/ipc/WrapperAnswer.h       |  3 ++
 js/ipc/WrapperOwner.cpp      | 88 +++++++++++++++++++-----------------
 js/ipc/WrapperOwner.h        |  5 ++
 7 files changed, 114 insertions(+), 44 deletions(-)

diff --git a/js/ipc/JavaScriptBase.h b/js/ipc/JavaScriptBase.h
index 2ae230bb0f7..a80e784f3af 100644
--- a/js/ipc/JavaScriptBase.h
+++ b/js/ipc/JavaScriptBase.h
@@ -116,6 +116,14 @@ class JavaScriptBase : public WrapperOwner, public WrapperAnswer, public Base
         return Answer::RecvDOMInstanceOf(ObjectId::deserialize(objId), prototypeID, depth, rs, instanceof);
     }
 
+    bool RecvIsCallable(const uint64_t &objId, bool *result) {
+        return Answer::RecvIsCallable(ObjectId::deserialize(objId), result);
+    }
+
+    bool RecvIsConstructor(const uint64_t &objId, bool *result) {
+        return Answer::RecvIsConstructor(ObjectId::deserialize(objId), result);
+    }
+
     bool RecvDropObject(const uint64_t &objId) {
         return Answer::RecvDropObject(ObjectId::deserialize(objId));
     }
@@ -207,6 +215,14 @@ class JavaScriptBase : public WrapperOwner, public WrapperAnswer, public Base
         return Base::SendDOMInstanceOf(objId.serialize(), prototypeID, depth, rs, instanceof);
     }
 
+    bool SendIsCallable(const ObjectId &objId, bool *result) {
+        return Base::SendIsCallable(objId.serialize(), result);
+    }
+
+    bool SendIsConstructor(const ObjectId &objId, bool *result) {
+        return Base::SendIsConstructor(objId.serialize(), result);
+    }
+
     /* The following code is needed to suppress a bogus MSVC warning (C4250). */
 
     virtual bool toObjectVariant(JSContext *cx, JSObject *obj, ObjectVariant *objVarp) {
diff --git a/js/ipc/JavaScriptTypes.ipdlh b/js/ipc/JavaScriptTypes.ipdlh
index 975e3aa39e1..a5c57792b7b 100644
--- a/js/ipc/JavaScriptTypes.ipdlh
+++ b/js/ipc/JavaScriptTypes.ipdlh
@@ -35,8 +35,6 @@ struct LocalObject
 struct RemoteObject
 {
     uint64_t serializedId;
-    bool isCallable;
-    bool isConstructor;
 };
 
 union ObjectVariant
diff --git a/js/ipc/PJavaScript.ipdl b/js/ipc/PJavaScript.ipdl
index 8f89fd139ca..6638ce19f3b 100644
--- a/js/ipc/PJavaScript.ipdl
+++ b/js/ipc/PJavaScript.ipdl
@@ -46,6 +46,9 @@ both:
     prio(high) sync InstanceOf(uint64_t objId, JSIID iid) returns (ReturnStatus rs, bool instanceof);
     prio(high) sync DOMInstanceOf(uint64_t objId, int prototypeID, int depth) returns (ReturnStatus rs, bool instanceof);
 
+    prio(high) sync IsCallable(uint64_t objId) returns (bool result);
+    prio(high) sync IsConstructor(uint64_t objId) returns (bool result);
+
 parent:
     async __delete__();
 };
diff --git a/js/ipc/WrapperAnswer.cpp b/js/ipc/WrapperAnswer.cpp
index fa8a6a9f2f3..e2ef50b309b 100644
--- a/js/ipc/WrapperAnswer.cpp
+++ b/js/ipc/WrapperAnswer.cpp
@@ -662,6 +662,47 @@ WrapperAnswer::RecvDOMInstanceOf(const ObjectId &objId, const int &prototypeID,
     return ok(rs);
 }
 
+bool
+WrapperAnswer::RecvIsCallable(const ObjectId &objId, bool *result)
+{
+    AutoSafeJSContext cx;
+    JSAutoRequest request(cx);
+
+    RootedObject obj(cx, findObjectById(cx, objId));
+    if (!obj) {
+        // This is very unfortunate, but we have no choice.
+        *result = false;
+        return true;
+    }
+    JSAutoCompartment ac(cx, obj); // Not really necessary here, but be safe.
+
+    LOG("%s.isCallable()", ReceiverObj(objId));
+
+    *result = JS::IsCallable(obj);
+    return true;
+}
+
+bool
+WrapperAnswer::RecvIsConstructor(const ObjectId &objId, bool *result)
+{
+    AutoSafeJSContext cx;
+    JSAutoRequest request(cx);
+
+    RootedObject obj(cx, findObjectById(cx, objId));
+    if (!obj) {
+        // This is very unfortunate, but we have no choice.
+        *result = false;
+        return true;
+    }
+    JSAutoCompartment ac(cx, obj); // Not really necessary here, but be safe.
+
+    LOG("%s.isConstructor()", ReceiverObj(objId));
+
+    *result = JS::IsConstructor(obj);
+    return true;
+}
+
+
 bool
 WrapperAnswer::RecvDropObject(const ObjectId &objId)
 {
diff --git a/js/ipc/WrapperAnswer.h b/js/ipc/WrapperAnswer.h
index 772416abb2b..180bad5abaa 100644
--- a/js/ipc/WrapperAnswer.h
+++ b/js/ipc/WrapperAnswer.h
@@ -62,6 +62,9 @@ class WrapperAnswer : public virtual JavaScriptShared
     bool RecvDOMInstanceOf(const ObjectId &objId, const int &prototypeID, const int &depth,
                            ReturnStatus *rs, bool *instanceof);
 
+    bool RecvIsCallable(const ObjectId &objId, bool *result);
+    bool RecvIsConstructor(const ObjectId &objId, bool *result);
+
     bool RecvDropObject(const ObjectId &objId);
 
   private:
diff --git a/js/ipc/WrapperOwner.cpp b/js/ipc/WrapperOwner.cpp
index 8eb6b30ae2a..3bbb1414fd3 100644
--- a/js/ipc/WrapperOwner.cpp
+++ b/js/ipc/WrapperOwner.cpp
@@ -18,32 +18,12 @@ using namespace JS;
 using namespace mozilla;
 using namespace mozilla::jsipc;
 
-struct AuxCPOWData
-{
-    ObjectId id;
-    bool isCallable;
-    bool isConstructor;
-
-    AuxCPOWData(ObjectId id, bool isCallable, bool isConstructor)
-      : id(id),
-        isCallable(isCallable),
-        isConstructor(isConstructor)
-    {}
-};
-
 WrapperOwner::WrapperOwner(JSRuntime *rt)
   : JavaScriptShared(rt),
     inactive_(false)
 {
 }
 
-static inline AuxCPOWData *
-AuxCPOWDataOf(JSObject *obj)
-{
-    MOZ_ASSERT(IsCPOW(obj));
-    return static_cast<AuxCPOWData *>(GetProxyExtra(obj, 1).toPrivate());
-}
-
 static inline WrapperOwner *
 OwnerOf(JSObject *obj)
 {
@@ -56,9 +36,13 @@ WrapperOwner::idOfUnchecked(JSObject *obj)
 {
     MOZ_ASSERT(IsCPOW(obj));
 
-    AuxCPOWData *aux = AuxCPOWDataOf(obj);
-    MOZ_ASSERT(!aux->id.isNull());
-    return aux->id;
+    Value v = GetProxyExtra(obj, 1);
+    MOZ_ASSERT(v.isDouble());
+
+    ObjectId objId = ObjectId::deserialize(BitwiseCast<uint64_t>(v.toDouble()));
+    MOZ_ASSERT(!objId.isNull());
+
+    return objId;
 }
 
 ObjectId
@@ -705,10 +689,6 @@ void
 CPOWProxyHandler::finalize(JSFreeOp *fop, JSObject *proxy) const
 {
     OwnerOf(proxy)->drop(proxy);
-
-    AuxCPOWData *aux = AuxCPOWDataOf(proxy);
-    if (aux)
-        delete aux;
 }
 
 void
@@ -720,15 +700,47 @@ CPOWProxyHandler::objectMoved(JSObject *proxy, const JSObject *old) const
 bool
 CPOWProxyHandler::isCallable(JSObject *proxy) const
 {
-    AuxCPOWData *aux = AuxCPOWDataOf(proxy);
-    return aux->isCallable;
+    WrapperOwner *parent = OwnerOf(proxy);
+    if (!parent->active())
+        return false;
+    return parent->isCallable(proxy);
+}
+
+bool
+WrapperOwner::isCallable(JSObject *obj)
+{
+    ObjectId objId = idOf(obj);
+
+    bool callable = false;
+    if (!SendIsCallable(objId, &callable)) {
+        NS_WARNING("IPC isCallable() failed");
+        return false;
+    }
+
+    return callable;
 }
 
 bool
 CPOWProxyHandler::isConstructor(JSObject *proxy) const
 {
-    AuxCPOWData *aux = AuxCPOWDataOf(proxy);
-    return aux->isConstructor;
+    WrapperOwner *parent = OwnerOf(proxy);
+    if (!parent->active())
+        return false;
+    return parent->isConstructor(proxy);
+}
+
+bool
+WrapperOwner::isConstructor(JSObject *obj)
+{
+    ObjectId objId = idOf(obj);
+
+    bool constructor = false;
+    if (!SendIsConstructor(objId, &constructor)) {
+        NS_WARNING("IPC isConstructor() failed");
+        return false;
+    }
+
+    return constructor;
 }
 
 void
@@ -883,12 +895,6 @@ WrapperOwner::ok(JSContext *cx, const ReturnStatus &status)
     return false;
 }
 
-static RemoteObject
-MakeRemoteObject(ObjectId id, JSObject *obj)
-{
-    return RemoteObject(id.serialize(), JS::IsCallable(obj), JS::IsConstructor(obj));
-}
-
 bool
 WrapperOwner::toObjectVariant(JSContext *cx, JSObject *objArg, ObjectVariant *objVarp)
 {
@@ -910,7 +916,7 @@ WrapperOwner::toObjectVariant(JSContext *cx, JSObject *objArg, ObjectVariant *ob
     ObjectId id = objectIdMap(waiveXray).find(obj);
     if (!id.isNull()) {
         MOZ_ASSERT(id.hasXrayWaiver() == waiveXray);
-        *objVarp = MakeRemoteObject(id, obj);
+        *objVarp = RemoteObject(id.serialize());
         return true;
     }
 
@@ -925,7 +931,7 @@ WrapperOwner::toObjectVariant(JSContext *cx, JSObject *objArg, ObjectVariant *ob
     if (!objectIdMap(waiveXray).add(cx, obj, id))
         return false;
 
-    *objVarp = MakeRemoteObject(id, obj);
+    *objVarp = RemoteObject(id.serialize());
     return true;
 }
 
@@ -964,10 +970,8 @@ WrapperOwner::fromRemoteObjectVariant(JSContext *cx, RemoteObject objVar)
         // Incref once we know the decref will be called.
         incref();
 
-        AuxCPOWData *aux = new AuxCPOWData(objId, objVar.isCallable(), objVar.isConstructor());
-
         SetProxyExtra(obj, 0, PrivateValue(this));
-        SetProxyExtra(obj, 1, PrivateValue(aux));
+        SetProxyExtra(obj, 1, DoubleValue(BitwiseCast<double>(objId.serialize())));
     }
 
     if (!JS_WrapObject(cx, &obj))
diff --git a/js/ipc/WrapperOwner.h b/js/ipc/WrapperOwner.h
index 5ff469dc233..47bad3ccfd4 100644
--- a/js/ipc/WrapperOwner.h
+++ b/js/ipc/WrapperOwner.h
@@ -61,6 +61,8 @@ class WrapperOwner : public virtual JavaScriptShared
     bool objectClassIs(JSContext *cx, JS::HandleObject obj, js::ESClassValue classValue);
     const char* className(JSContext *cx, JS::HandleObject proxy);
     bool regexp_toShared(JSContext *cx, JS::HandleObject proxy, js::RegExpGuard *g);
+    bool isCallable(JSObject *obj);
+    bool isConstructor(JSObject *obj);
 
     nsresult instanceOf(JSObject *obj, const nsID *id, bool *bp);
 
@@ -149,6 +151,9 @@ class WrapperOwner : public virtual JavaScriptShared
                                 ReturnStatus *rs, bool *instanceof) = 0;
     virtual bool SendDOMInstanceOf(const ObjectId &objId, const int &prototypeID, const int &depth,
                                    ReturnStatus *rs, bool *instanceof) = 0;
+
+    virtual bool SendIsCallable(const ObjectId &objId, bool *result) = 0;
+    virtual bool SendIsConstructor(const ObjectId &objId, bool *result) = 0;
 };
 
 bool

From f94c96cce1294f2b1c56ab889537e1603413dcf4 Mon Sep 17 00:00:00 2001
From: "Carsten \"Tomcat\" Book" <cbook@mozilla.com>
Date: Wed, 5 Nov 2014 10:04:08 +0100
Subject: [PATCH 065/153] Backed out changeset 2dbf8f6bd2aa (bug 1092446) for
 suspicion of adding a hazard

---
 dom/base/test/chrome/cpows_child.js      | 9 ---------
 dom/base/test/chrome/cpows_parent.xul    | 5 +----
 js/xpconnect/wrappers/WrapperFactory.cpp | 9 ++-------
 3 files changed, 3 insertions(+), 20 deletions(-)

diff --git a/dom/base/test/chrome/cpows_child.js b/dom/base/test/chrome/cpows_child.js
index b81a24a6d66..95bdfb9e1f5 100644
--- a/dom/base/test/chrome/cpows_child.js
+++ b/dom/base/test/chrome/cpows_child.js
@@ -87,15 +87,6 @@ function parent_test()
   addMessageListener("cpows:from_parent", (msg) => {
     let obj = msg.objects.obj;
     ok(obj.a == 1, "correct value from parent");
-
-    // Test that a CPOW reference to a function in the chrome process
-    // is callable from unprivileged content. Greasemonkey uses this
-    // functionality.
-    let func = msg.objects.func;
-    let sb = Cu.Sandbox('http://www.example.com', {});
-    sb.func = func;
-    ok(sb.eval('func()') == 101, "can call parent's function in child");
-
     done_count++;
     if (done_count == 2)
       sendSyncMessage("cpows:done", {});
diff --git a/dom/base/test/chrome/cpows_parent.xul b/dom/base/test/chrome/cpows_parent.xul
index bc69541219f..78ed01d80bb 100644
--- a/dom/base/test/chrome/cpows_parent.xul
+++ b/dom/base/test/chrome/cpows_parent.xul
@@ -181,11 +181,8 @@
       let func = message.objects.func;
       let result = func(n => 2*n);
       ok(result == 20, "result == 20");
-      function f() {
-        return 101;
-      }
       let obj = {a:1, __exposedProps__: {"a": "r"}};
-      savedMM.sendAsyncMessage("cpows:from_parent", {}, {obj: obj, func: f});
+      savedMM.sendAsyncMessage("cpows:from_parent", {}, {obj: obj});
     }
 
     // Make sure errors in this file actually hit window.onerror.
diff --git a/js/xpconnect/wrappers/WrapperFactory.cpp b/js/xpconnect/wrappers/WrapperFactory.cpp
index 0d8eee539c7..0792b9a343a 100644
--- a/js/xpconnect/wrappers/WrapperFactory.cpp
+++ b/js/xpconnect/wrappers/WrapperFactory.cpp
@@ -16,11 +16,9 @@
 #include "xpcprivate.h"
 #include "XPCMaps.h"
 #include "mozilla/dom/BindingUtils.h"
-#include "JavaScriptParent.h"
 #include "jsfriendapi.h"
 #include "mozilla/Likely.h"
 #include "nsContentUtils.h"
-#include "nsXULAppAPI.h"
 
 using namespace JS;
 using namespace js;
@@ -425,12 +423,9 @@ WrapperFactory::Rewrap(JSContext *cx, HandleObject existing, HandleObject obj,
     }
 
     // If this is a chrome function being exposed to content, we need to allow
-    // call (but nothing else). We allow CPOWs that purport to be function's
-    // here, but only in the content process.
+    // call (but nothing else).
     else if (originIsChrome && !targetIsChrome &&
-             (IdentifyStandardInstance(obj) == JSProto_Function ||
-              (jsipc::IsCPOW(obj) && JS::IsCallable(obj) &&
-               XRE_GetProcessType() == GeckoProcessType_Content)))
+             IdentifyStandardInstance(obj) == JSProto_Function)
     {
         wrapper = &FilteringWrapper<CrossCompartmentSecurityWrapper, OpaqueWithCall>::singleton;
     }

From 93eb6d095d2e92da9ce0c384a32f497ba1e0d280 Mon Sep 17 00:00:00 2001
From: Bobby Holley <bobbyholley@gmail.com>
Date: Wed, 5 Nov 2014 10:08:57 +0100
Subject: [PATCH 066/153] Bug 1091008 - Factor out
 IsDataCachedToEndOfResource() into a higher-level question and answer it
 sensibly for MSE. r=cpearce

---
 dom/media/MediaDecoder.cpp                   | 17 ++++++++++++++---
 dom/media/MediaDecoder.h                     |  9 ++++++---
 dom/media/MediaDecoderStateMachine.cpp       |  9 +++------
 dom/media/mediasource/MediaSourceDecoder.cpp |  7 +++++++
 dom/media/mediasource/MediaSourceDecoder.h   |  1 +
 5 files changed, 31 insertions(+), 12 deletions(-)

diff --git a/dom/media/MediaDecoder.cpp b/dom/media/MediaDecoder.cpp
index bdb28990768..c386459968f 100644
--- a/dom/media/MediaDecoder.cpp
+++ b/dom/media/MediaDecoder.cpp
@@ -679,11 +679,22 @@ void MediaDecoder::QueueMetadata(int64_t aPublishTime,
 }
 
 bool
-MediaDecoder::IsDataCachedToEndOfResource()
+MediaDecoder::IsExpectingMoreData()
 {
   ReentrantMonitorAutoEnter mon(GetReentrantMonitor());
-  return (mResource &&
-          mResource->IsDataCachedToEndOfResource(mDecoderPosition));
+
+  // If there's no resource, we're probably just getting set up.
+  if (!mResource) {
+    return true;
+  }
+
+  // If we've downloaded anything, we're not waiting for anything.
+  if (mResource->IsDataCachedToEndOfResource(mDecoderPosition)) {
+    return false;
+  }
+
+  // Otherwise, we should be getting data unless the stream is suspended.
+  return !mResource->IsSuspended();
 }
 
 void MediaDecoder::MetadataLoaded(MediaInfo* aInfo, MetadataTags* aTags)
diff --git a/dom/media/MediaDecoder.h b/dom/media/MediaDecoder.h
index d0026a907f6..cf602de2f73 100644
--- a/dom/media/MediaDecoder.h
+++ b/dom/media/MediaDecoder.h
@@ -798,9 +798,12 @@ public:
   // Call on the main thread only.
   void FirstFrameLoaded();
 
-  // Returns true if the resource has been loaded. Acquires the monitor.
-  // Call from any thread.
-  virtual bool IsDataCachedToEndOfResource();
+  // Returns true if the this decoder is expecting any more data to arrive
+  // sometime in the not-too-distant future, either from the network or from
+  // an appendBuffer call on a MediaSource element.
+  //
+  // Acquires the monitor. Call from any thread.
+  virtual bool IsExpectingMoreData();
 
   // Called when the video has completed playing.
   // Call on the main thread only.
diff --git a/dom/media/MediaDecoderStateMachine.cpp b/dom/media/MediaDecoderStateMachine.cpp
index 86549e7b15d..1b32438f737 100644
--- a/dom/media/MediaDecoderStateMachine.cpp
+++ b/dom/media/MediaDecoderStateMachine.cpp
@@ -2421,9 +2421,8 @@ nsresult MediaDecoderStateMachine::RunStateMachine()
       if ((isLiveStream || !mDecoder->CanPlayThrough()) &&
             elapsed < TimeDuration::FromSeconds(mBufferingWait * mPlaybackRate) &&
             (mQuickBuffering ? HasLowDecodedData(QUICK_BUFFERING_LOW_DATA_USECS)
-                            : HasLowUndecodedData(mBufferingWait * USECS_PER_S)) &&
-            !mDecoder->IsDataCachedToEndOfResource() &&
-            !resource->IsSuspended())
+                             : HasLowUndecodedData(mBufferingWait * USECS_PER_S)) &&
+            mDecoder->IsExpectingMoreData())
       {
         DECODER_LOG("Buffering: wait %ds, timeout in %.3lfs %s",
                     mBufferingWait, mBufferingWait - elapsed.ToSeconds(),
@@ -2682,12 +2681,10 @@ void MediaDecoderStateMachine::AdvanceFrame()
 
   // Check to see if we don't have enough data to play up to the next frame.
   // If we don't, switch to buffering mode.
-  MediaResource* resource = mDecoder->GetResource();
   if (mState == DECODER_STATE_DECODING &&
       mDecoder->GetState() == MediaDecoder::PLAY_STATE_PLAYING &&
       HasLowDecodedData(remainingTime + EXHAUSTED_DATA_MARGIN_USECS) &&
-      !mDecoder->IsDataCachedToEndOfResource() &&
-      !resource->IsSuspended()) {
+      mDecoder->IsExpectingMoreData()) {
     if (JustExitedQuickBuffering() || HasLowUndecodedData()) {
       if (currentFrame) {
         VideoQueue().PushFront(currentFrame.forget());
diff --git a/dom/media/mediasource/MediaSourceDecoder.cpp b/dom/media/mediasource/MediaSourceDecoder.cpp
index 607c074353b..bd9827413d6 100644
--- a/dom/media/mediasource/MediaSourceDecoder.cpp
+++ b/dom/media/mediasource/MediaSourceDecoder.cpp
@@ -164,6 +164,13 @@ MediaSourceDecoder::Ended()
   mon.NotifyAll();
 }
 
+bool
+MediaSourceDecoder::IsExpectingMoreData()
+{
+  ReentrantMonitorAutoEnter mon(GetReentrantMonitor());
+  return !mReader->IsEnded();
+}
+
 void
 MediaSourceDecoder::SetMediaSourceDuration(double aDuration)
 {
diff --git a/dom/media/mediasource/MediaSourceDecoder.h b/dom/media/mediasource/MediaSourceDecoder.h
index 20aeb0d67cd..22fabfec900 100644
--- a/dom/media/mediasource/MediaSourceDecoder.h
+++ b/dom/media/mediasource/MediaSourceDecoder.h
@@ -52,6 +52,7 @@ public:
   void OnTrackBufferConfigured(TrackBuffer* aTrackBuffer, const MediaInfo& aInfo);
 
   void Ended();
+  bool IsExpectingMoreData() MOZ_OVERRIDE;
 
   void SetMediaSourceDuration(double aDuration);
 

From 04865cf14a4104e4e80e9036c3e8551da54ec043 Mon Sep 17 00:00:00 2001
From: Bobby Holley <bobbyholley@gmail.com>
Date: Wed, 5 Nov 2014 10:08:58 +0100
Subject: [PATCH 067/153] Bug 1091008 - Teach MediaDecoderReader about its
 start time. r=cpearce

Duplicating state is never great, but this lets the reader make calculations
using this immutable state variable without involving the state machine. We
could alternatively punch a hole from MediaDecoderReader to
MediaDecoderStateMachine and access it there, but that would create tighter
coupling, and weird relationships for MSE.
---
 dom/media/MediaDecoderReader.cpp            | 8 ++++++++
 dom/media/MediaDecoderReader.h              | 6 ++++++
 dom/media/MediaDecoderStateMachine.cpp      | 5 +++++
 dom/media/mediasource/MediaSourceReader.cpp | 9 +++++++++
 4 files changed, 28 insertions(+)

diff --git a/dom/media/MediaDecoderReader.cpp b/dom/media/MediaDecoderReader.cpp
index 0ba1c1091d4..b2af0803958 100644
--- a/dom/media/MediaDecoderReader.cpp
+++ b/dom/media/MediaDecoderReader.cpp
@@ -61,6 +61,7 @@ MediaDecoderReader::MediaDecoderReader(AbstractMediaDecoder* aDecoder)
   : mAudioCompactor(mAudioQueue)
   , mDecoder(aDecoder)
   , mIgnoreAudioOutputFormat(false)
+  , mStartTime(-1)
   , mAudioDiscontinuity(false)
   , mVideoDiscontinuity(false)
 {
@@ -120,6 +121,13 @@ VideoData* MediaDecoderReader::DecodeToFirstVideoData()
   return (d = VideoQueue().PeekFront()) ? d : nullptr;
 }
 
+void
+MediaDecoderReader::SetStartTime(int64_t aStartTime)
+{
+  mDecoder->GetReentrantMonitor().AssertCurrentThreadIn();
+  mStartTime = aStartTime;
+}
+
 nsresult
 MediaDecoderReader::GetBuffered(mozilla::dom::TimeRanges* aBuffered,
                                 int64_t aStartTime)
diff --git a/dom/media/MediaDecoderReader.h b/dom/media/MediaDecoderReader.h
index 576539680d9..9431f275eb3 100644
--- a/dom/media/MediaDecoderReader.h
+++ b/dom/media/MediaDecoderReader.h
@@ -179,6 +179,7 @@ public:
   // Indicates if the media is seekable.
   // ReadMetada should be called before calling this method.
   virtual bool IsMediaSeekable() = 0;
+  void SetStartTime(int64_t aStartTime);
 
 protected:
   virtual ~MediaDecoderReader();
@@ -235,6 +236,11 @@ protected:
   // what we support.
   bool mIgnoreAudioOutputFormat;
 
+  // The start time of the media, in microseconds. This is the presentation
+  // time of the first frame decoded from the media. This is initialized to -1,
+  // and then set to a value >= by MediaDecoderStateMachine::SetStartTime(),
+  // after which point it never changes.
+  int64_t mStartTime;
 private:
 
   nsRefPtr<RequestSampleCallback> mSampleDecodedCallback;
diff --git a/dom/media/MediaDecoderStateMachine.cpp b/dom/media/MediaDecoderStateMachine.cpp
index 1b32438f737..6233b576557 100644
--- a/dom/media/MediaDecoderStateMachine.cpp
+++ b/dom/media/MediaDecoderStateMachine.cpp
@@ -2890,6 +2890,11 @@ void MediaDecoderStateMachine::SetStartTime(int64_t aStartTimeUsecs)
       mEndTime = mStartTime + mEndTime;
     }
   }
+
+  // Pass along this immutable value to the reader so that it can make
+  // calculations independently of the state machine.
+  mReader->SetStartTime(mStartTime);
+
   // Set the audio start time to be start of media. If this lies before the
   // first actual audio frame we have, we'll inject silence during playback
   // to ensure the audio starts at the correct time.
diff --git a/dom/media/mediasource/MediaSourceReader.cpp b/dom/media/mediasource/MediaSourceReader.cpp
index c34413d8493..3ed3e4bf47e 100644
--- a/dom/media/mediasource/MediaSourceReader.cpp
+++ b/dom/media/mediasource/MediaSourceReader.cpp
@@ -309,6 +309,15 @@ MediaSourceReader::CreateSubDecoder(const nsACString& aType)
   if (!reader) {
     return nullptr;
   }
+
+  // MSE uses a start time of 0 everywhere. Set that immediately on the
+  // subreader to make sure that it's always in a state where we can invoke
+  // GetBuffered on it.
+  {
+    ReentrantMonitorAutoEnter mon(decoder->GetReentrantMonitor());
+    reader->SetStartTime(0);
+  }
+
   // Set a callback on the subreader that forwards calls to this reader.
   // This reader will then forward them onto the state machine via this
   // reader's callback.

From f48f67daffde2019b92e094f69d9d7d5fcf7e6f2 Mon Sep 17 00:00:00 2001
From: Bobby Holley <bobbyholley@gmail.com>
Date: Wed, 5 Nov 2014 10:08:58 +0100
Subject: [PATCH 068/153] Bug 1091008 - Remove the aStartTime argument from
 MediaDecoderReader::GetBuffered. r=cpearce

We now have this stashed on the superclass.
---
 dom/media/MediaDecoderReader.cpp              |  3 +--
 dom/media/MediaDecoderReader.h                |  7 ++-----
 dom/media/MediaDecoderStateMachine.cpp        |  7 +++++--
 dom/media/fmp4/MP4Reader.cpp                  |  7 ++++---
 dom/media/fmp4/MP4Reader.h                    |  3 +--
 dom/media/gstreamer/GStreamerReader.cpp       |  3 +--
 dom/media/gstreamer/GStreamerReader.h         |  2 +-
 dom/media/gtest/TestMP4Reader.cpp             | 16 +++++++++++-----
 dom/media/mediasource/SourceBufferDecoder.cpp |  3 +--
 dom/media/ogg/OggReader.cpp                   | 11 ++++++-----
 dom/media/ogg/OggReader.h                     |  2 +-
 dom/media/omx/RtspMediaCodecReader.h          |  3 +--
 dom/media/omx/RtspOmxReader.h                 |  3 +--
 dom/media/raw/RawReader.cpp                   |  2 +-
 dom/media/raw/RawReader.h                     |  2 +-
 dom/media/wave/WaveReader.cpp                 |  2 +-
 dom/media/wave/WaveReader.h                   |  2 +-
 dom/media/webm/WebMReader.cpp                 |  5 +++--
 dom/media/webm/WebMReader.h                   |  2 +-
 19 files changed, 44 insertions(+), 41 deletions(-)

diff --git a/dom/media/MediaDecoderReader.cpp b/dom/media/MediaDecoderReader.cpp
index b2af0803958..b6ebf8b5b1e 100644
--- a/dom/media/MediaDecoderReader.cpp
+++ b/dom/media/MediaDecoderReader.cpp
@@ -129,8 +129,7 @@ MediaDecoderReader::SetStartTime(int64_t aStartTime)
 }
 
 nsresult
-MediaDecoderReader::GetBuffered(mozilla::dom::TimeRanges* aBuffered,
-                                int64_t aStartTime)
+MediaDecoderReader::GetBuffered(mozilla::dom::TimeRanges* aBuffered)
 {
   MediaResource* stream = mDecoder->GetResource();
   int64_t durationUs = 0;
diff --git a/dom/media/MediaDecoderReader.h b/dom/media/MediaDecoderReader.h
index 9431f275eb3..f64f016b061 100644
--- a/dom/media/MediaDecoderReader.h
+++ b/dom/media/MediaDecoderReader.h
@@ -129,9 +129,7 @@ public:
     mIgnoreAudioOutputFormat = true;
   }
 
-  // Populates aBuffered with the time ranges which are buffered. aStartTime
-  // must be the presentation time of the first frame in the media, e.g.
-  // the media time corresponding to playback time/position 0. This function
+  // Populates aBuffered with the time ranges which are buffered. This function
   // is called on the main, decode, and state machine threads.
   //
   // This base implementation in MediaDecoderReader estimates the time ranges
@@ -145,8 +143,7 @@ public:
   // The OggReader relies on this base implementation not performing I/O,
   // since in FirefoxOS we can't do I/O on the main thread, where this is
   // called.
-  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered,
-                               int64_t aStartTime);
+  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered);
 
   virtual int64_t ComputeStartTime(const VideoData* aVideo, const AudioData* aAudio);
 
diff --git a/dom/media/MediaDecoderStateMachine.cpp b/dom/media/MediaDecoderStateMachine.cpp
index 6233b576557..90aee648e15 100644
--- a/dom/media/MediaDecoderStateMachine.cpp
+++ b/dom/media/MediaDecoderStateMachine.cpp
@@ -1494,8 +1494,11 @@ void MediaDecoderStateMachine::NotifyDataArrived(const char* aBuffer,
   // faster than played, mEndTime won't reflect the end of playable data
   // since we haven't played the frame at the end of buffered data. So update
   // mEndTime here as new data is downloaded to prevent such a lag.
+  //
+  // Make sure to only do this if we have a start time, otherwise the reader
+  // doesn't know how to compute GetBuffered.
   nsRefPtr<dom::TimeRanges> buffered = new dom::TimeRanges();
-  if (mDecoder->IsInfinite() &&
+  if (mDecoder->IsInfinite() && (mStartTime != -1) &&
       NS_SUCCEEDED(mDecoder->GetBuffered(buffered)))
   {
     uint32_t length = 0;
@@ -2986,7 +2989,7 @@ nsresult MediaDecoderStateMachine::GetBuffered(dom::TimeRanges* aBuffered) {
   MediaResource* resource = mDecoder->GetResource();
   NS_ENSURE_TRUE(resource, NS_ERROR_FAILURE);
   resource->Pin();
-  nsresult res = mReader->GetBuffered(aBuffered, mStartTime);
+  nsresult res = mReader->GetBuffered(aBuffered);
   resource->Unpin();
   return res;
 }
diff --git a/dom/media/fmp4/MP4Reader.cpp b/dom/media/fmp4/MP4Reader.cpp
index 44231c0ed08..dc0654f4716 100644
--- a/dom/media/fmp4/MP4Reader.cpp
+++ b/dom/media/fmp4/MP4Reader.cpp
@@ -821,12 +821,13 @@ MP4Reader::GetEvictionOffset(double aTime)
 }
 
 nsresult
-MP4Reader::GetBuffered(dom::TimeRanges* aBuffered, int64_t aStartTime)
+MP4Reader::GetBuffered(dom::TimeRanges* aBuffered)
 {
   MonitorAutoLock mon(mIndexMonitor);
   if (!mIndexReady) {
     return NS_OK;
   }
+  MOZ_ASSERT(mStartTime != -1, "Need to finish metadata decode first");
 
   MediaResource* resource = mDecoder->GetResource();
   nsTArray<MediaByteRange> ranges;
@@ -838,8 +839,8 @@ MP4Reader::GetBuffered(dom::TimeRanges* aBuffered, int64_t aStartTime)
     nsTArray<Interval<Microseconds>> timeRanges;
     mDemuxer->ConvertByteRangesToTime(ranges, &timeRanges);
     for (size_t i = 0; i < timeRanges.Length(); i++) {
-      aBuffered->Add((timeRanges[i].start - aStartTime) / 1000000.0,
-                     (timeRanges[i].end - aStartTime) / 1000000.0);
+      aBuffered->Add((timeRanges[i].start - mStartTime) / 1000000.0,
+                     (timeRanges[i].end - mStartTime) / 1000000.0);
     }
   }
 
diff --git a/dom/media/fmp4/MP4Reader.h b/dom/media/fmp4/MP4Reader.h
index 43f816e5e0e..517431dd0b5 100644
--- a/dom/media/fmp4/MP4Reader.h
+++ b/dom/media/fmp4/MP4Reader.h
@@ -57,8 +57,7 @@ public:
 
   virtual int64_t GetEvictionOffset(double aTime) MOZ_OVERRIDE;
 
-  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered,
-                               int64_t aStartTime) MOZ_OVERRIDE;
+  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered) MOZ_OVERRIDE;
 
   // For Media Resource Management
   virtual bool IsWaitingMediaResources() MOZ_OVERRIDE;
diff --git a/dom/media/gstreamer/GStreamerReader.cpp b/dom/media/gstreamer/GStreamerReader.cpp
index abc95131a55..5514c0d7ee6 100644
--- a/dom/media/gstreamer/GStreamerReader.cpp
+++ b/dom/media/gstreamer/GStreamerReader.cpp
@@ -815,8 +815,7 @@ nsresult GStreamerReader::Seek(int64_t aTarget,
   return NS_OK;
 }
 
-nsresult GStreamerReader::GetBuffered(dom::TimeRanges* aBuffered,
-                                      int64_t aStartTime)
+nsresult GStreamerReader::GetBuffered(dom::TimeRanges* aBuffered)
 {
   if (!mInfo.HasValidMedia()) {
     return NS_OK;
diff --git a/dom/media/gstreamer/GStreamerReader.h b/dom/media/gstreamer/GStreamerReader.h
index c2a14dc5a9f..8c816e01d55 100644
--- a/dom/media/gstreamer/GStreamerReader.h
+++ b/dom/media/gstreamer/GStreamerReader.h
@@ -52,7 +52,7 @@ public:
                         int64_t aStartTime,
                         int64_t aEndTime,
                         int64_t aCurrentTime);
-  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered, int64_t aStartTime);
+  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered);
 
   virtual void NotifyDataArrived(const char *aBuffer,
                                  uint32_t aLength,
diff --git a/dom/media/gtest/TestMP4Reader.cpp b/dom/media/gtest/TestMP4Reader.cpp
index 6c464b12e9b..4a13b92df63 100644
--- a/dom/media/gtest/TestMP4Reader.cpp
+++ b/dom/media/gtest/TestMP4Reader.cpp
@@ -36,6 +36,12 @@ public:
     decoder->SetResource(resource);
 
     reader->Init(nullptr);
+    {
+      // This needs to be done before invoking GetBuffered. This is normally
+      // done by MediaDecoderStateMachine.
+      ReentrantMonitorAutoEnter mon(decoder->GetReentrantMonitor());
+      reader->SetStartTime(0);
+    }
   }
 
   void Init() {
@@ -72,7 +78,7 @@ TEST(MP4Reader, BufferedRange)
   b->resource->MockAddBufferedRange(248400, 327455);
 
   nsRefPtr<TimeRanges> ranges = new TimeRanges();
-  EXPECT_EQ(NS_OK, b->reader->GetBuffered(ranges, 0));
+  EXPECT_EQ(NS_OK, b->reader->GetBuffered(ranges));
   EXPECT_EQ(1U, ranges->Length());
   double start = 0;
   EXPECT_EQ(NS_OK, ranges->Start(0, &start));
@@ -93,7 +99,7 @@ TEST(MP4Reader, BufferedRangeMissingLastByte)
   b->resource->MockAddBufferedRange(324913, 327455);
 
   nsRefPtr<TimeRanges> ranges = new TimeRanges();
-  EXPECT_EQ(NS_OK, b->reader->GetBuffered(ranges, 0));
+  EXPECT_EQ(NS_OK, b->reader->GetBuffered(ranges));
   EXPECT_EQ(1U, ranges->Length());
   double start = 0;
   EXPECT_EQ(NS_OK, ranges->Start(0, &start));
@@ -114,7 +120,7 @@ TEST(MP4Reader, BufferedRangeSyncFrame)
   b->resource->MockAddBufferedRange(146336, 327455);
 
   nsRefPtr<TimeRanges> ranges = new TimeRanges();
-  EXPECT_EQ(NS_OK, b->reader->GetBuffered(ranges, 0));
+  EXPECT_EQ(NS_OK, b->reader->GetBuffered(ranges));
   EXPECT_EQ(1U, ranges->Length());
   double start = 0;
   EXPECT_EQ(NS_OK, ranges->Start(0, &start));
@@ -172,7 +178,7 @@ TEST(MP4Reader, CompositionOrder)
   b->resource->MockAddBufferedRange(13220, 13901);
 
   nsRefPtr<TimeRanges> ranges = new TimeRanges();
-  EXPECT_EQ(NS_OK, b->reader->GetBuffered(ranges, 0));
+  EXPECT_EQ(NS_OK, b->reader->GetBuffered(ranges));
   EXPECT_EQ(2U, ranges->Length());
 
   double start = 0;
@@ -222,7 +228,7 @@ TEST(MP4Reader, Normalised)
   b->resource->MockAddBufferedRange(48, 13901);
 
   nsRefPtr<TimeRanges> ranges = new TimeRanges();
-  EXPECT_EQ(NS_OK, b->reader->GetBuffered(ranges, 0));
+  EXPECT_EQ(NS_OK, b->reader->GetBuffered(ranges));
   EXPECT_EQ(1U, ranges->Length());
 
   double start = 0;
diff --git a/dom/media/mediasource/SourceBufferDecoder.cpp b/dom/media/mediasource/SourceBufferDecoder.cpp
index 24cb642c856..8a7ec995f94 100644
--- a/dom/media/mediasource/SourceBufferDecoder.cpp
+++ b/dom/media/mediasource/SourceBufferDecoder.cpp
@@ -210,8 +210,7 @@ SourceBufferDecoder::NotifyDataArrived(const char* aBuffer, uint32_t aLength, in
 nsresult
 SourceBufferDecoder::GetBuffered(dom::TimeRanges* aBuffered)
 {
-  // XXX: Need mStartTime (from StateMachine) instead of passing 0.
-  return mReader->GetBuffered(aBuffered, 0);
+  return mReader->GetBuffered(aBuffered);
 }
 
 int64_t
diff --git a/dom/media/ogg/OggReader.cpp b/dom/media/ogg/OggReader.cpp
index e0b52df3658..ee0252a4510 100644
--- a/dom/media/ogg/OggReader.cpp
+++ b/dom/media/ogg/OggReader.cpp
@@ -1881,15 +1881,16 @@ nsresult OggReader::SeekBisection(int64_t aTarget,
   return NS_OK;
 }
 
-nsresult OggReader::GetBuffered(dom::TimeRanges* aBuffered, int64_t aStartTime)
+nsresult OggReader::GetBuffered(dom::TimeRanges* aBuffered)
 {
+  MOZ_ASSERT(mStartTime != -1, "Need to finish metadata decode first");
   {
     mozilla::ReentrantMonitorAutoEnter mon(mMonitor);
     if (mIsChained)
       return NS_ERROR_FAILURE;
   }
 #ifdef OGG_ESTIMATE_BUFFERED
-  return MediaDecoderReader::GetBuffered(aBuffered, aStartTime);
+  return MediaDecoderReader::GetBuffered(aBuffered);
 #else
   // HasAudio and HasVideo are not used here as they take a lock and cause
   // a deadlock. Accessing mInfo doesn't require a lock - it doesn't change
@@ -1919,7 +1920,7 @@ nsresult OggReader::GetBuffered(dom::TimeRanges* aBuffered, int64_t aStartTime)
     // we special-case (startOffset == 0) so that the first
     // buffered range always appears to be buffered from the media start
     // time, rather than from the end-time of the first page.
-    int64_t startTime = (startOffset == 0) ? aStartTime : -1;
+    int64_t startTime = (startOffset == 0) ? mStartTime : -1;
 
     // Find the start time of the range. Read pages until we find one with a
     // granulepos which we can convert into a timestamp to use as the time of
@@ -1987,8 +1988,8 @@ nsresult OggReader::GetBuffered(dom::TimeRanges* aBuffered, int64_t aStartTime)
       // find an end time.
       int64_t endTime = RangeEndTime(startOffset, endOffset, true);
       if (endTime != -1) {
-        aBuffered->Add((startTime - aStartTime) / static_cast<double>(USECS_PER_S),
-                       (endTime - aStartTime) / static_cast<double>(USECS_PER_S));
+        aBuffered->Add((startTime - mStartTime) / static_cast<double>(USECS_PER_S),
+                       (endTime - mStartTime) / static_cast<double>(USECS_PER_S));
       }
     }
   }
diff --git a/dom/media/ogg/OggReader.h b/dom/media/ogg/OggReader.h
index 12a581b56a4..ef3b03e8237 100644
--- a/dom/media/ogg/OggReader.h
+++ b/dom/media/ogg/OggReader.h
@@ -79,7 +79,7 @@ public:
   virtual nsresult ReadMetadata(MediaInfo* aInfo,
                                 MetadataTags** aTags);
   virtual nsresult Seek(int64_t aTime, int64_t aStartTime, int64_t aEndTime, int64_t aCurrentTime);
-  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered, int64_t aStartTime);
+  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered);
 
   virtual bool IsMediaSeekable() MOZ_OVERRIDE;
 
diff --git a/dom/media/omx/RtspMediaCodecReader.h b/dom/media/omx/RtspMediaCodecReader.h
index 37d32c7d8e4..c7c0714672e 100644
--- a/dom/media/omx/RtspMediaCodecReader.h
+++ b/dom/media/omx/RtspMediaCodecReader.h
@@ -48,8 +48,7 @@ public:
   // we returned are not useful for the MediaDecodeStateMachine. Unlike the
   // ChannelMediaResource, it has a "cache" that can store the whole streaming
   // data so the |GetBuffered| function can retrieve useful time ranges.
-  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered,
-                               int64_t aStartTime) MOZ_OVERRIDE {
+  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered) MOZ_OVERRIDE {
     return NS_OK;
   }
 
diff --git a/dom/media/omx/RtspOmxReader.h b/dom/media/omx/RtspOmxReader.h
index 7ec425f3ef3..f7af4489001 100644
--- a/dom/media/omx/RtspOmxReader.h
+++ b/dom/media/omx/RtspOmxReader.h
@@ -58,8 +58,7 @@ public:
   // we returned are not useful for the MediaDecodeStateMachine. Unlike the
   // ChannelMediaResource, it has a "cache" that can store the whole streaming
   // data so the |GetBuffered| function can retrieve useful time ranges.
-  virtual nsresult GetBuffered(mozilla::dom::TimeRanges* aBuffered,
-                               int64_t aStartTime) MOZ_FINAL MOZ_OVERRIDE {
+  virtual nsresult GetBuffered(mozilla::dom::TimeRanges* aBuffered) MOZ_FINAL MOZ_OVERRIDE {
     return NS_OK;
   }
 
diff --git a/dom/media/raw/RawReader.cpp b/dom/media/raw/RawReader.cpp
index 49aab9a949c..440dce85ce1 100644
--- a/dom/media/raw/RawReader.cpp
+++ b/dom/media/raw/RawReader.cpp
@@ -284,7 +284,7 @@ nsresult RawReader::Seek(int64_t aTime, int64_t aStartTime, int64_t aEndTime, in
   return NS_OK;
 }
 
-nsresult RawReader::GetBuffered(dom::TimeRanges* aBuffered, int64_t aStartTime)
+nsresult RawReader::GetBuffered(dom::TimeRanges* aBuffered)
 {
   return NS_OK;
 }
diff --git a/dom/media/raw/RawReader.h b/dom/media/raw/RawReader.h
index b1f91932a90..de4b80793ef 100644
--- a/dom/media/raw/RawReader.h
+++ b/dom/media/raw/RawReader.h
@@ -40,7 +40,7 @@ public:
   virtual nsresult ReadMetadata(MediaInfo* aInfo,
                                 MetadataTags** aTags);
   virtual nsresult Seek(int64_t aTime, int64_t aStartTime, int64_t aEndTime, int64_t aCurrentTime);
-  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered, int64_t aStartTime);
+  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered);
 
   virtual bool IsMediaSeekable() MOZ_OVERRIDE;
 
diff --git a/dom/media/wave/WaveReader.cpp b/dom/media/wave/WaveReader.cpp
index 2476b6134cb..d2461653624 100644
--- a/dom/media/wave/WaveReader.cpp
+++ b/dom/media/wave/WaveReader.cpp
@@ -278,7 +278,7 @@ static double RoundToUsecs(double aSeconds) {
   return floor(aSeconds * USECS_PER_S) / USECS_PER_S;
 }
 
-nsresult WaveReader::GetBuffered(dom::TimeRanges* aBuffered, int64_t aStartTime)
+nsresult WaveReader::GetBuffered(dom::TimeRanges* aBuffered)
 {
   if (!mInfo.HasAudio()) {
     return NS_OK;
diff --git a/dom/media/wave/WaveReader.h b/dom/media/wave/WaveReader.h
index f9e47cb43a5..3a62231b7da 100644
--- a/dom/media/wave/WaveReader.h
+++ b/dom/media/wave/WaveReader.h
@@ -44,7 +44,7 @@ public:
   virtual nsresult ReadMetadata(MediaInfo* aInfo,
                                 MetadataTags** aTags);
   virtual nsresult Seek(int64_t aTime, int64_t aStartTime, int64_t aEndTime, int64_t aCurrentTime);
-  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered, int64_t aStartTime);
+  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered);
 
   // To seek in a buffered range, we just have to seek the stream.
   virtual bool IsSeekableInBufferedRanges() {
diff --git a/dom/media/webm/WebMReader.cpp b/dom/media/webm/WebMReader.cpp
index 7f8c993ea2d..f41b5d3cfbd 100644
--- a/dom/media/webm/WebMReader.cpp
+++ b/dom/media/webm/WebMReader.cpp
@@ -1085,8 +1085,9 @@ nsresult WebMReader::Seek(int64_t aTarget, int64_t aStartTime, int64_t aEndTime,
   return NS_OK;
 }
 
-nsresult WebMReader::GetBuffered(dom::TimeRanges* aBuffered, int64_t aStartTime)
+nsresult WebMReader::GetBuffered(dom::TimeRanges* aBuffered)
 {
+  MOZ_ASSERT(mStartTime != -1, "Need to finish metadata decode first");
   if (aBuffered->Length() != 0) {
     return NS_ERROR_FAILURE;
   }
@@ -1114,7 +1115,7 @@ nsresult WebMReader::GetBuffered(dom::TimeRanges* aBuffered, int64_t aStartTime)
                                                         ranges[index].mEnd,
                                                         &start, &end);
     if (rv) {
-      int64_t startOffset = aStartTime * NS_PER_USEC;
+      int64_t startOffset = mStartTime * NS_PER_USEC;
       NS_ASSERTION(startOffset >= 0 && uint64_t(startOffset) <= start,
                    "startOffset negative or larger than start time");
       if (!(startOffset >= 0 && uint64_t(startOffset) <= start)) {
diff --git a/dom/media/webm/WebMReader.h b/dom/media/webm/WebMReader.h
index 8fe67cf4b17..77bcbe454c1 100644
--- a/dom/media/webm/WebMReader.h
+++ b/dom/media/webm/WebMReader.h
@@ -136,7 +136,7 @@ public:
                                 MetadataTags** aTags);
   virtual nsresult Seek(int64_t aTime, int64_t aStartTime, int64_t aEndTime,
                         int64_t aCurrentTime);
-  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered, int64_t aStartTime);
+  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered);
   virtual void NotifyDataArrived(const char* aBuffer, uint32_t aLength,
                                  int64_t aOffset);
   virtual int64_t GetEvictionOffset(double aTime);

From bc7157ad5e0efb986c5e217947dc76f72d0d737e Mon Sep 17 00:00:00 2001
From: Bobby Holley <bobbyholley@gmail.com>
Date: Wed, 5 Nov 2014 10:08:58 +0100
Subject: [PATCH 069/153] Bug 1091008 - Hoist stream pinning into the
 MediaDecoderReaders and make MediaDecoderStateMachine::GetBuffered just
 forward to them. r=cpearce

Whether or not we ping a stream depends a lot on what kind of decoder we're
dealing with. In particular, it doesn't really make sense for MSE.
---
 dom/media/MediaDecoderReader.cpp        |  3 ++-
 dom/media/MediaDecoderStateMachine.cpp  |  9 ---------
 dom/media/MediaDecoderStateMachine.h    |  4 +++-
 dom/media/MediaResource.h               | 27 +++++++++++++++++++++++++
 dom/media/fmp4/MP4Reader.cpp            |  8 ++------
 dom/media/gstreamer/GStreamerReader.cpp |  2 +-
 dom/media/ogg/OggReader.cpp             |  2 +-
 dom/media/wave/WaveReader.cpp           |  7 ++++---
 dom/media/webm/WebMReader.cpp           |  2 +-
 9 files changed, 41 insertions(+), 23 deletions(-)

diff --git a/dom/media/MediaDecoderReader.cpp b/dom/media/MediaDecoderReader.cpp
index b6ebf8b5b1e..bebaf17c723 100644
--- a/dom/media/MediaDecoderReader.cpp
+++ b/dom/media/MediaDecoderReader.cpp
@@ -6,6 +6,7 @@
 
 #include "MediaDecoderReader.h"
 #include "AbstractMediaDecoder.h"
+#include "MediaResource.h"
 #include "VideoUtils.h"
 #include "ImageContainer.h"
 
@@ -131,7 +132,7 @@ MediaDecoderReader::SetStartTime(int64_t aStartTime)
 nsresult
 MediaDecoderReader::GetBuffered(mozilla::dom::TimeRanges* aBuffered)
 {
-  MediaResource* stream = mDecoder->GetResource();
+  AutoPinned<MediaResource> stream(mDecoder->GetResource());
   int64_t durationUs = 0;
   {
     ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
diff --git a/dom/media/MediaDecoderStateMachine.cpp b/dom/media/MediaDecoderStateMachine.cpp
index 90aee648e15..7762ea939ae 100644
--- a/dom/media/MediaDecoderStateMachine.cpp
+++ b/dom/media/MediaDecoderStateMachine.cpp
@@ -2985,15 +2985,6 @@ void MediaDecoderStateMachine::StartBuffering()
 #endif
 }
 
-nsresult MediaDecoderStateMachine::GetBuffered(dom::TimeRanges* aBuffered) {
-  MediaResource* resource = mDecoder->GetResource();
-  NS_ENSURE_TRUE(resource, NS_ERROR_FAILURE);
-  resource->Pin();
-  nsresult res = mReader->GetBuffered(aBuffered);
-  resource->Unpin();
-  return res;
-}
-
 void MediaDecoderStateMachine::SetPlayStartTime(const TimeStamp& aTimeStamp)
 {
   AssertCurrentThreadInMonitor();
diff --git a/dom/media/MediaDecoderStateMachine.h b/dom/media/MediaDecoderStateMachine.h
index f334a1c2962..9d6dd699c89 100644
--- a/dom/media/MediaDecoderStateMachine.h
+++ b/dom/media/MediaDecoderStateMachine.h
@@ -254,7 +254,9 @@ public:
     return mState == DECODER_STATE_SEEKING;
   }
 
-  nsresult GetBuffered(dom::TimeRanges* aBuffered);
+  nsresult GetBuffered(dom::TimeRanges* aBuffered) {
+    return mReader->GetBuffered(aBuffered);
+  }
 
   void SetPlaybackRate(double aPlaybackRate);
   void SetPreservesPitch(bool aPreservesPitch);
diff --git a/dom/media/MediaResource.h b/dom/media/MediaResource.h
index f9ff63b5ef3..1be171208c8 100644
--- a/dom/media/MediaResource.h
+++ b/dom/media/MediaResource.h
@@ -718,6 +718,33 @@ protected:
   bool mIsTransportSeekable;
 };
 
+/**
+ * RAII class that handles pinning and unpinning for MediaResource and derived.
+ * This should be used when making calculations that involve potentially-cached
+ * MediaResource data, so that the state of the world can't change out from under
+ * us.
+ */
+template<class T>
+class MOZ_STACK_CLASS AutoPinned {
+ public:
+  explicit AutoPinned(T* aResource MOZ_GUARD_OBJECT_NOTIFIER_PARAM) : mResource(aResource) {
+    MOZ_GUARD_OBJECT_NOTIFIER_INIT;
+    MOZ_ASSERT(mResource);
+    mResource->Pin();
+  }
+
+  ~AutoPinned() {
+    mResource->Unpin();
+  }
+
+  operator T*() const { return mResource; }
+  T* operator->() const { return mResource; }
+
+private:
+  T* mResource;
+  MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
+};
+
 } // namespace mozilla
 
 #endif
diff --git a/dom/media/fmp4/MP4Reader.cpp b/dom/media/fmp4/MP4Reader.cpp
index dc0654f4716..e627f2e8371 100644
--- a/dom/media/fmp4/MP4Reader.cpp
+++ b/dom/media/fmp4/MP4Reader.cpp
@@ -800,13 +800,11 @@ MP4Reader::UpdateIndex()
     return;
   }
 
-  MediaResource* resource = mDecoder->GetResource();
-  resource->Pin();
+  AutoPinned<MediaResource> resource(mDecoder->GetResource());
   nsTArray<MediaByteRange> ranges;
   if (NS_SUCCEEDED(resource->GetCachedRanges(ranges))) {
     mDemuxer->UpdateIndex(ranges);
   }
-  resource->Unpin();
 }
 
 int64_t
@@ -829,11 +827,9 @@ MP4Reader::GetBuffered(dom::TimeRanges* aBuffered)
   }
   MOZ_ASSERT(mStartTime != -1, "Need to finish metadata decode first");
 
-  MediaResource* resource = mDecoder->GetResource();
+  AutoPinned<MediaResource> resource(mDecoder->GetResource());
   nsTArray<MediaByteRange> ranges;
-  resource->Pin();
   nsresult rv = resource->GetCachedRanges(ranges);
-  resource->Unpin();
 
   if (NS_SUCCEEDED(rv)) {
     nsTArray<Interval<Microseconds>> timeRanges;
diff --git a/dom/media/gstreamer/GStreamerReader.cpp b/dom/media/gstreamer/GStreamerReader.cpp
index 5514c0d7ee6..94e5c37cb8f 100644
--- a/dom/media/gstreamer/GStreamerReader.cpp
+++ b/dom/media/gstreamer/GStreamerReader.cpp
@@ -824,7 +824,7 @@ nsresult GStreamerReader::GetBuffered(dom::TimeRanges* aBuffered)
 #if GST_VERSION_MAJOR == 0
   GstFormat format = GST_FORMAT_TIME;
 #endif
-  MediaResource* resource = mDecoder->GetResource();
+  AutoPinned<MediaResource> resource(mDecoder->GetResource());
   nsTArray<MediaByteRange> ranges;
   resource->GetCachedRanges(ranges);
 
diff --git a/dom/media/ogg/OggReader.cpp b/dom/media/ogg/OggReader.cpp
index ee0252a4510..54779f859da 100644
--- a/dom/media/ogg/OggReader.cpp
+++ b/dom/media/ogg/OggReader.cpp
@@ -1900,7 +1900,7 @@ nsresult OggReader::GetBuffered(dom::TimeRanges* aBuffered)
     return NS_OK;
   }
 
-  MediaResource* resource = mDecoder->GetResource();
+  AutoPinned<MediaResource> resource(mDecoder->GetResource());
   nsTArray<MediaByteRange> ranges;
   nsresult res = resource->GetCachedRanges(ranges);
   NS_ENSURE_SUCCESS(res, res);
diff --git a/dom/media/wave/WaveReader.cpp b/dom/media/wave/WaveReader.cpp
index d2461653624..b568dfba1e2 100644
--- a/dom/media/wave/WaveReader.cpp
+++ b/dom/media/wave/WaveReader.cpp
@@ -283,9 +283,10 @@ nsresult WaveReader::GetBuffered(dom::TimeRanges* aBuffered)
   if (!mInfo.HasAudio()) {
     return NS_OK;
   }
-  int64_t startOffset = mDecoder->GetResource()->GetNextCachedData(mWavePCMOffset);
+  AutoPinned<MediaResource> resource(mDecoder->GetResource());
+  int64_t startOffset = resource->GetNextCachedData(mWavePCMOffset);
   while (startOffset >= 0) {
-    int64_t endOffset = mDecoder->GetResource()->GetCachedDataEnd(startOffset);
+    int64_t endOffset = resource->GetCachedDataEnd(startOffset);
     // Bytes [startOffset..endOffset] are cached.
     NS_ASSERTION(startOffset >= mWavePCMOffset, "Integer underflow in GetBuffered");
     NS_ASSERTION(endOffset >= mWavePCMOffset, "Integer underflow in GetBuffered");
@@ -295,7 +296,7 @@ nsresult WaveReader::GetBuffered(dom::TimeRanges* aBuffered)
     // the media element.
     aBuffered->Add(RoundToUsecs(BytesToTime(startOffset - mWavePCMOffset)),
                    RoundToUsecs(BytesToTime(endOffset - mWavePCMOffset)));
-    startOffset = mDecoder->GetResource()->GetNextCachedData(endOffset);
+    startOffset = resource->GetNextCachedData(endOffset);
   }
   return NS_OK;
 }
diff --git a/dom/media/webm/WebMReader.cpp b/dom/media/webm/WebMReader.cpp
index f41b5d3cfbd..c59b1b15112 100644
--- a/dom/media/webm/WebMReader.cpp
+++ b/dom/media/webm/WebMReader.cpp
@@ -1092,7 +1092,7 @@ nsresult WebMReader::GetBuffered(dom::TimeRanges* aBuffered)
     return NS_ERROR_FAILURE;
   }
 
-  MediaResource* resource = mDecoder->GetResource();
+  AutoPinned<MediaResource> resource(mDecoder->GetResource());
 
   // Special case completely cached files.  This also handles local files.
   if (mContext && resource->IsDataCachedToEndOfResource(0)) {

From 0db9b673ddaae9e0f5a0c2e1c9bab92d34bd3f8e Mon Sep 17 00:00:00 2001
From: Bobby Holley <bobbyholley@gmail.com>
Date: Wed, 5 Nov 2014 10:08:59 +0100
Subject: [PATCH 070/153] Bug 1091008 - Implement a sensible GetBuffered
 override for MediaSourceReader using the existing GetBuffered on MediaSource.
 r=cajbir

---
 dom/media/mediasource/MediaSource.cpp       | 1 +
 dom/media/mediasource/MediaSourceDecoder.h  | 5 +++++
 dom/media/mediasource/MediaSourceReader.cpp | 7 +++++++
 dom/media/mediasource/MediaSourceReader.h   | 2 ++
 dom/media/mediasource/TrackBuffer.cpp       | 1 -
 dom/media/mediasource/TrackBuffer.h         | 2 +-
 6 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/dom/media/mediasource/MediaSource.cpp b/dom/media/mediasource/MediaSource.cpp
index 547b42846ed..68967e35f9f 100644
--- a/dom/media/mediasource/MediaSource.cpp
+++ b/dom/media/mediasource/MediaSource.cpp
@@ -353,6 +353,7 @@ MediaSource::Detach()
 void
 MediaSource::GetBuffered(TimeRanges* aBuffered)
 {
+  ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
   MOZ_ASSERT(aBuffered->Length() == 0);
   if (mActiveSourceBuffers->IsEmpty()) {
     return;
diff --git a/dom/media/mediasource/MediaSourceDecoder.h b/dom/media/mediasource/MediaSourceDecoder.h
index 22fabfec900..54feeb84b05 100644
--- a/dom/media/mediasource/MediaSourceDecoder.h
+++ b/dom/media/mediasource/MediaSourceDecoder.h
@@ -74,6 +74,11 @@ private:
   // mMediaSource.
   dom::MediaSource* mMediaSource;
   nsRefPtr<MediaSourceReader> mReader;
+
+  // XXXbholley - This is to allow the reader to invoke GetBuffered on
+  // mMediaSource. It goes away in a subsequent patch when that function gets
+  // hoisted into MediaSourceReader.
+  friend class MediaSourceReader;
 };
 
 } // namespace mozilla
diff --git a/dom/media/mediasource/MediaSourceReader.cpp b/dom/media/mediasource/MediaSourceReader.cpp
index 3ed3e4bf47e..8846ff72430 100644
--- a/dom/media/mediasource/MediaSourceReader.cpp
+++ b/dom/media/mediasource/MediaSourceReader.cpp
@@ -446,6 +446,13 @@ MediaSourceReader::Seek(int64_t aTime, int64_t aStartTime, int64_t aEndTime,
   return NS_OK;
 }
 
+nsresult
+MediaSourceReader::GetBuffered(dom::TimeRanges* aBuffered)
+{
+  static_cast<MediaSourceDecoder*>(mDecoder)->mMediaSource->GetBuffered(aBuffered);
+  return NS_OK;
+}
+
 nsresult
 MediaSourceReader::ReadMetadata(MediaInfo* aInfo, MetadataTags** aTags)
 {
diff --git a/dom/media/mediasource/MediaSourceReader.h b/dom/media/mediasource/MediaSourceReader.h
index 0544145deff..9b21d68e11f 100644
--- a/dom/media/mediasource/MediaSourceReader.h
+++ b/dom/media/mediasource/MediaSourceReader.h
@@ -77,6 +77,8 @@ public:
   nsresult Seek(int64_t aTime, int64_t aStartTime, int64_t aEndTime,
                 int64_t aCurrentTime) MOZ_OVERRIDE;
 
+  nsresult GetBuffered(dom::TimeRanges* aBuffered) MOZ_OVERRIDE;
+
   already_AddRefed<SourceBufferDecoder> CreateSubDecoder(const nsACString& aType);
 
   void AddTrackBuffer(TrackBuffer* aTrackBuffer);
diff --git a/dom/media/mediasource/TrackBuffer.cpp b/dom/media/mediasource/TrackBuffer.cpp
index f8e2a40fa42..185007ea446 100644
--- a/dom/media/mediasource/TrackBuffer.cpp
+++ b/dom/media/mediasource/TrackBuffer.cpp
@@ -191,7 +191,6 @@ double
 TrackBuffer::Buffered(dom::TimeRanges* aRanges)
 {
   ReentrantMonitorAutoEnter mon(mParentDecoder->GetReentrantMonitor());
-  MOZ_ASSERT(NS_IsMainThread());
 
   double highestEndTime = 0;
 
diff --git a/dom/media/mediasource/TrackBuffer.h b/dom/media/mediasource/TrackBuffer.h
index 3510afaa5ff..3d6cded3856 100644
--- a/dom/media/mediasource/TrackBuffer.h
+++ b/dom/media/mediasource/TrackBuffer.h
@@ -43,7 +43,7 @@ public:
 
   // Returns the highest end time of all of the buffered ranges in the
   // decoders managed by this TrackBuffer, and returns the union of the
-  // decoders buffered ranges in aRanges.
+  // decoders buffered ranges in aRanges. This may be called on any thread.
   double Buffered(dom::TimeRanges* aRanges);
 
   // Mark the current decoder's resource as ended, clear mCurrentDecoder and

From b63e786a99ed3c04d279e1ddbc692c60202b2afa Mon Sep 17 00:00:00 2001
From: Bobby Holley <bobbyholley@gmail.com>
Date: Wed, 5 Nov 2014 10:08:59 +0100
Subject: [PATCH 071/153] Bug 1091008 - Remove special handling for MSE in
 HTMLMediaElement::Buffered. r=cajbir

The same code will now be reached by invoking this method on the decoder.
---
 dom/html/HTMLMediaElement.cpp                |  4 +-
 dom/media/mediasource/MediaSource.cpp        | 42 --------------------
 dom/media/mediasource/MediaSource.h          |  2 -
 dom/media/mediasource/MediaSourceDecoder.cpp |  2 +-
 dom/media/mediasource/MediaSourceDecoder.h   |  5 ---
 dom/media/mediasource/MediaSourceReader.cpp  | 37 ++++++++++++++++-
 dom/media/mediasource/MediaSourceReader.h    |  1 +
 7 files changed, 39 insertions(+), 54 deletions(-)

diff --git a/dom/html/HTMLMediaElement.cpp b/dom/html/HTMLMediaElement.cpp
index 366cbcdc04c..a5e021afc8d 100644
--- a/dom/html/HTMLMediaElement.cpp
+++ b/dom/html/HTMLMediaElement.cpp
@@ -3678,9 +3678,7 @@ HTMLMediaElement::Buffered() const
 {
   nsRefPtr<TimeRanges> ranges = new TimeRanges();
   if (mReadyState > nsIDOMHTMLMediaElement::HAVE_NOTHING) {
-    if (mMediaSource) {
-      mMediaSource->GetBuffered(ranges);
-    } else if (mDecoder) {
+    if (mDecoder) {
       // If GetBuffered fails we ignore the error result and just return the
       // time ranges we found up till the error.
       mDecoder->GetBuffered(ranges);
diff --git a/dom/media/mediasource/MediaSource.cpp b/dom/media/mediasource/MediaSource.cpp
index 68967e35f9f..3f047a2bb2a 100644
--- a/dom/media/mediasource/MediaSource.cpp
+++ b/dom/media/mediasource/MediaSource.cpp
@@ -350,48 +350,6 @@ MediaSource::Detach()
   }
 }
 
-void
-MediaSource::GetBuffered(TimeRanges* aBuffered)
-{
-  ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
-  MOZ_ASSERT(aBuffered->Length() == 0);
-  if (mActiveSourceBuffers->IsEmpty()) {
-    return;
-  }
-
-  double highestEndTime = 0;
-
-  nsTArray<nsRefPtr<TimeRanges>> activeRanges;
-  for (uint32_t i = 0; i < mActiveSourceBuffers->Length(); ++i) {
-    bool found;
-    SourceBuffer* sourceBuffer = mActiveSourceBuffers->IndexedGetter(i, found);
-
-    ErrorResult dummy;
-    *activeRanges.AppendElement() = sourceBuffer->GetBuffered(dummy);
-
-    highestEndTime = std::max(highestEndTime, activeRanges.LastElement()->GetEndTime());
-  }
-
-  TimeRanges* intersectionRanges = aBuffered;
-  intersectionRanges->Add(0, highestEndTime);
-
-  for (uint32_t i = 0; i < activeRanges.Length(); ++i) {
-    TimeRanges* sourceRanges = activeRanges[i];
-
-    if (mReadyState == MediaSourceReadyState::Ended) {
-      // Set the end time on the last range to highestEndTime by adding a
-      // new range spanning the current end time to highestEndTime, which
-      // Normalize() will then merge with the old last range.
-      sourceRanges->Add(sourceRanges->GetEndTime(), highestEndTime);
-      sourceRanges->Normalize();
-    }
-
-    intersectionRanges->Intersection(sourceRanges);
-  }
-
-  MSE_DEBUG("MediaSource(%p)::GetBuffered ranges=%s", this, DumpTimeRanges(intersectionRanges).get());
-}
-
 MediaSource::MediaSource(nsPIDOMWindow* aWindow)
   : DOMEventTargetHelper(aWindow)
   , mDuration(UnspecifiedNaN<double>())
diff --git a/dom/media/mediasource/MediaSource.h b/dom/media/mediasource/MediaSource.h
index 6a4c743685a..0698799fd3b 100644
--- a/dom/media/mediasource/MediaSource.h
+++ b/dom/media/mediasource/MediaSource.h
@@ -74,8 +74,6 @@ public:
   bool Attach(MediaSourceDecoder* aDecoder);
   void Detach();
 
-  void GetBuffered(TimeRanges* aBuffered);
-
   // Set mReadyState to aState and fire the required events at the MediaSource.
   void SetReadyState(MediaSourceReadyState aState);
 
diff --git a/dom/media/mediasource/MediaSourceDecoder.cpp b/dom/media/mediasource/MediaSourceDecoder.cpp
index bd9827413d6..5105d1240c3 100644
--- a/dom/media/mediasource/MediaSourceDecoder.cpp
+++ b/dom/media/mediasource/MediaSourceDecoder.cpp
@@ -82,7 +82,7 @@ MediaSourceDecoder::GetSeekable(dom::TimeRanges* aSeekable)
     // Return empty range.
   } else if (duration > 0 && mozilla::IsInfinite(duration)) {
     nsRefPtr<dom::TimeRanges> bufferedRanges = new dom::TimeRanges();
-    mMediaSource->GetBuffered(bufferedRanges);
+    mReader->GetBuffered(bufferedRanges);
     aSeekable->Add(bufferedRanges->GetStartTime(), bufferedRanges->GetEndTime());
   } else {
     aSeekable->Add(0, duration);
diff --git a/dom/media/mediasource/MediaSourceDecoder.h b/dom/media/mediasource/MediaSourceDecoder.h
index 54feeb84b05..22fabfec900 100644
--- a/dom/media/mediasource/MediaSourceDecoder.h
+++ b/dom/media/mediasource/MediaSourceDecoder.h
@@ -74,11 +74,6 @@ private:
   // mMediaSource.
   dom::MediaSource* mMediaSource;
   nsRefPtr<MediaSourceReader> mReader;
-
-  // XXXbholley - This is to allow the reader to invoke GetBuffered on
-  // mMediaSource. It goes away in a subsequent patch when that function gets
-  // hoisted into MediaSourceReader.
-  friend class MediaSourceReader;
 };
 
 } // namespace mozilla
diff --git a/dom/media/mediasource/MediaSourceReader.cpp b/dom/media/mediasource/MediaSourceReader.cpp
index 8846ff72430..89a90cb9064 100644
--- a/dom/media/mediasource/MediaSourceReader.cpp
+++ b/dom/media/mediasource/MediaSourceReader.cpp
@@ -33,6 +33,8 @@ extern PRLogModuleInfo* GetMediaSourceAPILog();
 #define MSE_API(...)
 #endif
 
+using mozilla::dom::TimeRanges;
+
 namespace mozilla {
 
 MediaSourceReader::MediaSourceReader(MediaSourceDecoder* aDecoder)
@@ -449,7 +451,40 @@ MediaSourceReader::Seek(int64_t aTime, int64_t aStartTime, int64_t aEndTime,
 nsresult
 MediaSourceReader::GetBuffered(dom::TimeRanges* aBuffered)
 {
-  static_cast<MediaSourceDecoder*>(mDecoder)->mMediaSource->GetBuffered(aBuffered);
+  ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
+  MOZ_ASSERT(aBuffered->Length() == 0);
+  if (mTrackBuffers.IsEmpty()) {
+    return NS_OK;
+  }
+
+  double highestEndTime = 0;
+
+  nsTArray<nsRefPtr<TimeRanges>> activeRanges;
+  for (uint32_t i = 0; i < mTrackBuffers.Length(); ++i) {
+    nsRefPtr<TimeRanges> r = new TimeRanges();
+    mTrackBuffers[i]->Buffered(r);
+    activeRanges.AppendElement(r);
+    highestEndTime = std::max(highestEndTime, activeRanges.LastElement()->GetEndTime());
+  }
+
+  TimeRanges* intersectionRanges = aBuffered;
+  intersectionRanges->Add(0, highestEndTime);
+
+  for (uint32_t i = 0; i < activeRanges.Length(); ++i) {
+    TimeRanges* sourceRanges = activeRanges[i];
+
+    if (IsEnded()) {
+      // Set the end time on the last range to highestEndTime by adding a
+      // new range spanning the current end time to highestEndTime, which
+      // Normalize() will then merge with the old last range.
+      sourceRanges->Add(sourceRanges->GetEndTime(), highestEndTime);
+      sourceRanges->Normalize();
+    }
+
+    intersectionRanges->Intersection(sourceRanges);
+  }
+
+  MSE_DEBUG("MediaSourceReader(%p)::GetBuffered ranges=%s", this, DumpTimeRanges(intersectionRanges).get());
   return NS_OK;
 }
 
diff --git a/dom/media/mediasource/MediaSourceReader.h b/dom/media/mediasource/MediaSourceReader.h
index 9b21d68e11f..1c543132491 100644
--- a/dom/media/mediasource/MediaSourceReader.h
+++ b/dom/media/mediasource/MediaSourceReader.h
@@ -77,6 +77,7 @@ public:
   nsresult Seek(int64_t aTime, int64_t aStartTime, int64_t aEndTime,
                 int64_t aCurrentTime) MOZ_OVERRIDE;
 
+  // Acquires the decoder monitor, and is thus callable on any thread.
   nsresult GetBuffered(dom::TimeRanges* aBuffered) MOZ_OVERRIDE;
 
   already_AddRefed<SourceBufferDecoder> CreateSubDecoder(const nsACString& aType);

From ac5322f46900c3f1e7ddaafeedebaadca884ecee Mon Sep 17 00:00:00 2001
From: Bobby Holley <bobbyholley@gmail.com>
Date: Wed, 5 Nov 2014 10:08:59 +0100
Subject: [PATCH 072/153] Bug 1091008 - Reimplement HasLowUndecodedData in
 terms of GetBuffered. r=cpearce

Since GetBuffered now has a sane implementation for MSE, this should
make this function sane for MSE as well.
---
 dom/html/TimeRanges.h                  |  9 ++++++++
 dom/media/MediaDecoderStateMachine.cpp | 29 +++++++++++++-------------
 dom/media/MediaDecoderStateMachine.h   |  2 +-
 3 files changed, 25 insertions(+), 15 deletions(-)

diff --git a/dom/html/TimeRanges.h b/dom/html/TimeRanges.h
index 97b8b127bca..8ad3c350e35 100644
--- a/dom/html/TimeRanges.h
+++ b/dom/html/TimeRanges.h
@@ -92,6 +92,15 @@ public:
   static const index_type NoIndex = index_type(-1);
 
   index_type Find(double aTime);
+
+  bool Contains(double aStart, double aEnd) {
+    index_type target = Find(aStart);
+    if (target == NoIndex) {
+      return false;
+    }
+
+    return mRanges[target].mEnd >= aEnd;
+  }
 };
 
 } // namespace dom
diff --git a/dom/media/MediaDecoderStateMachine.cpp b/dom/media/MediaDecoderStateMachine.cpp
index 7762ea939ae..d6faf362c9a 100644
--- a/dom/media/MediaDecoderStateMachine.cpp
+++ b/dom/media/MediaDecoderStateMachine.cpp
@@ -1855,28 +1855,29 @@ bool MediaDecoderStateMachine::HasLowUndecodedData()
   return HasLowUndecodedData(mLowDataThresholdUsecs);
 }
 
-bool MediaDecoderStateMachine::HasLowUndecodedData(double aUsecs)
+bool MediaDecoderStateMachine::HasLowUndecodedData(int64_t aUsecs)
 {
   AssertCurrentThreadInMonitor();
   NS_ASSERTION(mState > DECODER_STATE_DECODING_METADATA,
                "Must have loaded metadata for GetBuffered() to work");
 
-  bool reliable;
-  double bytesPerSecond = mDecoder->ComputePlaybackRate(&reliable);
-  if (!reliable) {
-    // Default to assuming we have enough
-    return false;
-  }
+  nsRefPtr<dom::TimeRanges> buffered = new dom::TimeRanges();
+  nsresult rv = mReader->GetBuffered(buffered.get());
+  NS_ENSURE_SUCCESS(rv, false);
 
-  MediaResource* stream = mDecoder->GetResource();
-  int64_t currentPos = stream->Tell();
-  int64_t requiredPos = currentPos + int64_t((aUsecs/1000000.0)*bytesPerSecond);
-  int64_t length = stream->GetLength();
-  if (length >= 0) {
-    requiredPos = std::min(requiredPos, length);
+  int64_t endOfDecodedVideoData = INT64_MAX;
+  if (HasVideo() && !VideoQueue().AtEndOfStream()) {
+    endOfDecodedVideoData = VideoQueue().Peek() ? VideoQueue().Peek()->GetEndTime() : mVideoFrameEndTime;
   }
+  int64_t endOfDecodedAudioData = INT64_MAX;
+  if (HasAudio() && !AudioQueue().AtEndOfStream()) {
+    endOfDecodedAudioData = AudioQueue().Peek() ? AudioQueue().Peek()->GetEndTime() : GetAudioClock();
+  }
+  int64_t endOfDecodedData = std::min(endOfDecodedVideoData, endOfDecodedAudioData);
 
-  return stream->GetCachedDataEnd(currentPos) < requiredPos;
+  return endOfDecodedData != INT64_MAX &&
+         !buffered->Contains(static_cast<double>(endOfDecodedData) / USECS_PER_S,
+                             static_cast<double>(std::min(endOfDecodedData + aUsecs, GetDuration())) / USECS_PER_S);
 }
 
 void
diff --git a/dom/media/MediaDecoderStateMachine.h b/dom/media/MediaDecoderStateMachine.h
index 9d6dd699c89..a35741158ab 100644
--- a/dom/media/MediaDecoderStateMachine.h
+++ b/dom/media/MediaDecoderStateMachine.h
@@ -427,7 +427,7 @@ protected:
   bool HasLowUndecodedData();
 
   // Returns true if we have less than aUsecs of undecoded data available.
-  bool HasLowUndecodedData(double aUsecs);
+  bool HasLowUndecodedData(int64_t aUsecs);
 
   // Returns the number of unplayed usecs of audio we've got decoded and/or
   // pushed to the hardware waiting to play. This is how much audio we can

From c19b9225dd46ea5c06d1effa2431ca60b9d7caaa Mon Sep 17 00:00:00 2001
From: Bobby Holley <bobbyholley@gmail.com>
Date: Wed, 5 Nov 2014 10:08:59 +0100
Subject: [PATCH 073/153] Bug 1063323 - Tests. r=cajbir

---
 dom/media/mediasource/test/mochitest.ini      |  1 +
 .../test/test_WaitingOnMissingData.html       | 72 +++++++++++++++++++
 2 files changed, 73 insertions(+)
 create mode 100644 dom/media/mediasource/test/test_WaitingOnMissingData.html

diff --git a/dom/media/mediasource/test/mochitest.ini b/dom/media/mediasource/test/mochitest.ini
index 8ca2c7bfaf8..ec1edb5ae72 100644
--- a/dom/media/mediasource/test/mochitest.ini
+++ b/dom/media/mediasource/test/mochitest.ini
@@ -16,3 +16,4 @@ support-files =
 [test_SeekableBeforeEndOfStreamSplit.html]
 [test_SplitAppendDelay.html]
 [test_SplitAppend.html]
+[test_WaitingOnMissingData.html]
diff --git a/dom/media/mediasource/test/test_WaitingOnMissingData.html b/dom/media/mediasource/test/test_WaitingOnMissingData.html
new file mode 100644
index 00000000000..10b40b19726
--- /dev/null
+++ b/dom/media/mediasource/test/test_WaitingOnMissingData.html
@@ -0,0 +1,72 @@
+<!DOCTYPE html>
+<html><head>
+<meta http-equiv="content-type" content="text/html; charset=windows-1252">
+  <title>MSE: |waiting| event when source data is missing</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="text/javascript" src="mediasource.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<pre id="test"><script class="testbody" type="text/javascript">
+
+SimpleTest.waitForExplicitFinish();
+
+var receivedSourceOpen = false;
+runWithMSE(function(ms, v) {
+  ms.addEventListener("sourceopen", function() {
+    ok(true, "Receive a sourceopen event");
+    ok(!receivedSourceOpen, "Should only receive one sourceopen for this test");
+    receivedSourceOpen = true;
+    var sb = ms.addSourceBuffer("video/webm");
+    ok(sb, "Create a SourceBuffer");
+
+    function once(target, name, cb) {
+      target.addEventListener(name, function() {
+        target.removeEventListener(name, cb);
+        cb();
+      });
+    }
+    function loadSegment(typedArray) {
+      info(`Loading buffer: [${typedArray.byteOffset}, ${typedArray.byteOffset + typedArray.byteLength})`);
+      return new Promise(function(resolve, reject) {
+        once(sb, 'update', resolve);
+        sb.appendBuffer(typedArray);
+      });
+    }
+
+    fetchWithXHR("seek.webm", function(arrayBuffer) {
+      sb.addEventListener('error', (e) => { ok(false, "Got Error: " + e); SimpleTest.finish(); });
+      loadSegment.bind(null, new Uint8Array(arrayBuffer, 0, 318))().then(
+      loadSegment.bind(null, new Uint8Array(arrayBuffer, 318, 25223-318))).then(
+      loadSegment.bind(null, new Uint8Array(arrayBuffer, 25223, 46712-25223))).then(
+      /* Note - Missing |46712, 67833 - 46712| segment here */
+      loadSegment.bind(null, new Uint8Array(arrayBuffer, 67833, 88966 - 67833))).then(
+      loadSegment.bind(null, new Uint8Array(arrayBuffer, 88966))).then(function() {
+
+        v.addEventListener("waiting", function onwaiting() {
+          ok(true, "Got a waiting event at " + v.currentTime);
+          if (v.currentTime > 0.7 && v.currentTime < 1.2) {
+            v.removeEventListener("waiting", onwaiting);
+            todo(v.currentTime >= 0.8, "See bug 1091774");
+            gotWaiting = true;
+            ok(true, "Received waiting event at time " + v.currentTime);
+            loadSegment(new Uint8Array(arrayBuffer, 46712, 67833 - 46712)).then(() => ms.endOfStream());
+          }
+        });
+
+        info("Playing video. It should play for a bit, then fire 'waiting'");
+        v.play();
+      });
+    });
+  });
+  v.addEventListener("ended", function () {
+    ok(Math.abs(v.duration - 4) < 0.1, "Video has correct duration. This fuzz factor is due to bug 1065207");
+    is(v.currentTime, v.duration, "Video has correct current time: " + v.currentTime);
+    ok(gotWaiting, "Received waiting event and playback continued after data added");
+    SimpleTest.finish();
+  });
+});
+</script>
+</pre>
+</body>
+</html>

From 99250f7b44364d9721446639386efa0e45cc5a93 Mon Sep 17 00:00:00 2001
From: Bobby Holley <bobbyholley@gmail.com>
Date: Wed, 5 Nov 2014 10:09:00 +0100
Subject: [PATCH 074/153] Bug 1093020 - Don't use a buffering wait for MSE.
 r=cpearce

---
 dom/media/MediaDecoderReader.h            | 5 +++++
 dom/media/MediaDecoderStateMachine.cpp    | 7 +------
 dom/media/mediasource/MediaSourceReader.h | 6 ++++++
 3 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/dom/media/MediaDecoderReader.h b/dom/media/MediaDecoderReader.h
index f64f016b061..2a2fc666e85 100644
--- a/dom/media/MediaDecoderReader.h
+++ b/dom/media/MediaDecoderReader.h
@@ -147,6 +147,11 @@ public:
 
   virtual int64_t ComputeStartTime(const VideoData* aVideo, const AudioData* aAudio);
 
+  // Wait this number of seconds when buffering, then leave and play
+  // as best as we can if the required amount of data hasn't been
+  // retrieved.
+  virtual uint32_t GetBufferingWait() { return 30; }
+
   // Returns the number of bytes of memory allocated by structures/frames in
   // the video queue.
   size_t SizeOfVideoQueueInBytes() const;
diff --git a/dom/media/MediaDecoderStateMachine.cpp b/dom/media/MediaDecoderStateMachine.cpp
index d6faf362c9a..0b545de2934 100644
--- a/dom/media/MediaDecoderStateMachine.cpp
+++ b/dom/media/MediaDecoderStateMachine.cpp
@@ -84,11 +84,6 @@ extern PRLogModuleInfo* gMediaDecoderLog;
 #undef GetCurrentTime
 #endif
 
-// Wait this number of seconds when buffering, then leave and play
-// as best as we can if the required amount of data hasn't been
-// retrieved.
-static const uint32_t BUFFERING_WAIT_S = 30;
-
 // If audio queue has less than this many usecs of decoded audio, we won't risk
 // trying to decode the video, we'll skip decoding video up to the next
 // keyframe. We may increase this value for an individual decoder if we
@@ -223,7 +218,7 @@ MediaDecoderStateMachine::MediaDecoderStateMachine(MediaDecoder* aDecoder,
   mAmpleVideoFrames =
     std::max<uint32_t>(Preferences::GetUint("media.video-queue.default-size", 10), 3);
 
-  mBufferingWait = mScheduler->IsRealTime() ? 0 : BUFFERING_WAIT_S;
+  mBufferingWait = mScheduler->IsRealTime() ? 0 : mReader->GetBufferingWait();
   mLowDataThresholdUsecs = mScheduler->IsRealTime() ? 0 : LOW_DATA_THRESHOLD_USECS;
 
   mVideoPrerollFrames = mScheduler->IsRealTime() ? 0 : mAmpleVideoFrames / 2;
diff --git a/dom/media/mediasource/MediaSourceReader.h b/dom/media/mediasource/MediaSourceReader.h
index 1c543132491..d0e1df0a507 100644
--- a/dom/media/mediasource/MediaSourceReader.h
+++ b/dom/media/mediasource/MediaSourceReader.h
@@ -71,6 +71,12 @@ public:
   // as chrome/blink and assumes that we always start at t=0.
   virtual int64_t ComputeStartTime(const VideoData* aVideo, const AudioData* aAudio) MOZ_OVERRIDE { return 0; }
 
+  // Buffering waits (in which we decline to present decoded frames because we
+  // "don't have enough") don't really make sense for MSE. The delay is
+  // essentially a streaming heuristic, but JS is supposed to take care of that
+  // in the MSE world. Avoid injecting inexplicable delays.
+  virtual uint32_t GetBufferingWait() { return 0; }
+
   bool IsMediaSeekable() { return true; }
 
   nsresult ReadMetadata(MediaInfo* aInfo, MetadataTags** aTags) MOZ_OVERRIDE;

From 86a6d1207008ccaf48f7b608156f54ee22e51707 Mon Sep 17 00:00:00 2001
From: Bobby Holley <bobbyholley@gmail.com>
Date: Wed, 5 Nov 2014 10:09:00 +0100
Subject: [PATCH 075/153] Bug 1093020 - Tests. r=karlt

---
 dom/media/mediasource/test/mochitest.ini      |  1 +
 .../mediasource/test/test_BufferingWait.html  | 82 +++++++++++++++++++
 2 files changed, 83 insertions(+)
 create mode 100644 dom/media/mediasource/test/test_BufferingWait.html

diff --git a/dom/media/mediasource/test/mochitest.ini b/dom/media/mediasource/test/mochitest.ini
index ec1edb5ae72..bb27be932df 100644
--- a/dom/media/mediasource/test/mochitest.ini
+++ b/dom/media/mediasource/test/mochitest.ini
@@ -8,6 +8,7 @@ support-files =
 [test_MediaSource.html]
 [test_MediaSource_disabled.html]
 [test_BufferedSeek.html]
+[test_BufferingWait.html]
 [test_FrameSelection.html]
 [test_HaveMetadataUnbufferedSeek.html]
 [test_SeekableAfterEndOfStream.html]
diff --git a/dom/media/mediasource/test/test_BufferingWait.html b/dom/media/mediasource/test/test_BufferingWait.html
new file mode 100644
index 00000000000..f2bfc4ba94d
--- /dev/null
+++ b/dom/media/mediasource/test/test_BufferingWait.html
@@ -0,0 +1,82 @@
+<!DOCTYPE html>
+<html><head>
+<meta http-equiv="content-type" content="text/html; charset=windows-1252">
+  <title>MSE: Don't get stuck buffering for too long when we have frames to show</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="text/javascript" src="mediasource.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<pre id="test"><script class="testbody" type="text/javascript">
+
+SimpleTest.waitForExplicitFinish();
+
+var receivedSourceOpen = false;
+runWithMSE(function(ms, v) {
+  ms.addEventListener("sourceopen", function() {
+    ok(true, "Receive a sourceopen event");
+    ok(!receivedSourceOpen, "Should only receive one sourceopen for this test");
+    receivedSourceOpen = true;
+    var sb = ms.addSourceBuffer("video/webm");
+    ok(sb, "Create a SourceBuffer");
+
+    function once(target, name, cb) {
+      target.addEventListener(name, function() {
+        target.removeEventListener(name, cb);
+        cb();
+      });
+    }
+    function loadSegment(typedArray) {
+      info(`Loading buffer: [${typedArray.byteOffset}, ${typedArray.byteOffset + typedArray.byteLength})`);
+      return new Promise(function(resolve, reject) {
+        once(sb, 'update', resolve);
+        sb.appendBuffer(typedArray);
+      });
+    }
+
+    function waitUntilTime(targetTime) {
+      return new Promise(function(resolve, reject) {
+        v.addEventListener("waiting", function onwaiting() {
+          info("Got a waiting event at " + v.currentTime);
+          if (v.currentTime >= targetTime) {
+            ok(true, "Reached target time of: " + targetTime);
+            v.removeEventListener("waiting", onwaiting);
+            resolve();
+          }
+        });
+      });
+    }
+
+    fetchWithXHR("seek.webm", function(arrayBuffer) {
+      sb.addEventListener('error', (e) => { ok(false, "Got Error: " + e); SimpleTest.finish(); });
+      loadSegment.bind(null, new Uint8Array(arrayBuffer, 0, 318))().then(
+      loadSegment.bind(null, new Uint8Array(arrayBuffer, 318, 25223-318))).then(
+      loadSegment.bind(null, new Uint8Array(arrayBuffer, 25223, 46712-25223))).then(
+      /* Note - Missing |46712, 67833 - 46712| segment here corresponding to (0.8, 1.2] */
+      /* Note - Missing |67833, 88966 - 67833| segment here corresponding to (1.2, 1.6]  */
+      loadSegment.bind(null, new Uint8Array(arrayBuffer, 88966))).then(function() {
+        var promise = waitUntilTime(0.7);
+        info("Playing video. It should play for a bit, then fire 'waiting'");
+        v.play();
+        return promise;
+      }).then(function() {
+        window.firstStop = Date.now();
+        loadSegment(new Uint8Array(arrayBuffer, 46712, 67833 - 46712));
+        return waitUntilTime(1.0);
+      }).then(function() {
+        var waitDuration = (Date.now() - window.firstStop) / 1000;
+        ok(waitDuration < 15, "Should not spend an inordinate amount of time buffering: " + waitDuration);
+        SimpleTest.finish();
+        /* If we allow the rest of the stream to be played, we get stuck at
+           around 2s. See bug 1093133.
+        once(v, 'ended', SimpleTest.finish.bind(SimpleTest));
+        return loadSegment(new Uint8Array(arrayBuffer, 67833, 88966 - 67833));
+        */
+      });
+    });
+  });
+});
+</script>
+</pre>
+</body>
+</html>

From a987c71648b493e03da367f385e6f17769132739 Mon Sep 17 00:00:00 2001
From: Jon Coppeard <jcoppeard@mozilla.com>
Date: Wed, 5 Nov 2014 08:44:26 +0000
Subject: [PATCH 076/153] Bug 877924 - Always trace IDBFactory owner pointer
 r=mccr8

--HG--
extra : rebase_source : 626301faca90a21a03a9f983f7afe88dbdd9e6e7
---
 dom/indexedDB/IDBFactory.cpp | 17 +++--------------
 dom/indexedDB/IDBFactory.h   |  1 -
 2 files changed, 3 insertions(+), 15 deletions(-)

diff --git a/dom/indexedDB/IDBFactory.cpp b/dom/indexedDB/IDBFactory.cpp
index 3350bd0f2bb..bf22ab5f3b7 100644
--- a/dom/indexedDB/IDBFactory.cpp
+++ b/dom/indexedDB/IDBFactory.cpp
@@ -110,7 +110,6 @@ struct IDBFactory::PendingRequestInfo
 IDBFactory::IDBFactory()
   : mOwningObject(nullptr)
   , mBackgroundActor(nullptr)
-  , mRootedOwningObject(false)
   , mBackgroundActorFailed(false)
   , mPrivateBrowsingMode(false)
 {
@@ -124,10 +123,8 @@ IDBFactory::~IDBFactory()
 {
   MOZ_ASSERT_IF(mBackgroundActorFailed, !mBackgroundActor);
 
-  if (mRootedOwningObject) {
-    mOwningObject = nullptr;
-    mozilla::DropJSObjects(this);
-  }
+  mOwningObject = nullptr;
+  mozilla::DropJSObjects(this);
 
   if (mBackgroundActor) {
     mBackgroundActor->SendDeleteMeInternal();
@@ -271,9 +268,7 @@ IDBFactory::CreateForJSInternal(JSContext* aCx,
   nsRefPtr<IDBFactory> factory = new IDBFactory();
   factory->mPrincipalInfo = aPrincipalInfo.forget();
   factory->mOwningObject = aOwningObject;
-
   mozilla::HoldJSObjects(factory.get());
-  factory->mRootedOwningObject = true;
 
   factory.forget(aFactory);
   return NS_OK;
@@ -716,13 +711,7 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(IDBFactory)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_PRESERVED_WRAPPER
-  if (tmp->mOwningObject) {
-    tmp->mOwningObject = nullptr;
-  }
-  if (tmp->mRootedOwningObject) {
-    mozilla::DropJSObjects(tmp);
-    tmp->mRootedOwningObject = false;
-  }
+  tmp->mOwningObject = nullptr;
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mWindow)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
diff --git a/dom/indexedDB/IDBFactory.h b/dom/indexedDB/IDBFactory.h
index df3292dd78e..69952a4158d 100644
--- a/dom/indexedDB/IDBFactory.h
+++ b/dom/indexedDB/IDBFactory.h
@@ -73,7 +73,6 @@ class IDBFactory MOZ_FINAL
   PRThread* mOwningThread;
 #endif
 
-  bool mRootedOwningObject;
   bool mBackgroundActorFailed;
   bool mPrivateBrowsingMode;
 

From 67c285395ddf236ba5c13086f8fa4470794a81e5 Mon Sep 17 00:00:00 2001
From: Jon Coppeard <jcoppeard@mozilla.com>
Date: Wed, 5 Nov 2014 08:44:27 +0000
Subject: [PATCH 077/153] Bug 650161 - Update plugin tracing to work with
 compacting GC r=terrence r=johns

--HG--
extra : rebase_source : d6852def71710f71121735f24fc176141e911583
---
 dom/base/nsObjectLoadingContent.cpp |   4 +-
 dom/plugins/base/nsJSNPRuntime.cpp  | 254 +++++++++++++++++++++-------
 dom/plugins/base/nsJSNPRuntime.h    |   5 +-
 3 files changed, 201 insertions(+), 62 deletions(-)

diff --git a/dom/base/nsObjectLoadingContent.cpp b/dom/base/nsObjectLoadingContent.cpp
index 781f53efe32..ab4ca804aca 100644
--- a/dom/base/nsObjectLoadingContent.cpp
+++ b/dom/base/nsObjectLoadingContent.cpp
@@ -3602,9 +3602,9 @@ nsObjectLoadingContent::TeardownProtoChain()
     if (!proto) {
       break;
     }
-    // Unwrap while checking the jsclass - if the prototype is a wrapper for
+    // Unwrap while checking the class - if the prototype is a wrapper for
     // an NP object, that counts too.
-    if (JS_GetClass(js::UncheckedUnwrap(proto)) == &sNPObjectJSWrapperClass) {
+    if (nsNPObjWrapper::IsWrapper(js::UncheckedUnwrap(proto))) {
       // We found an NPObject on the proto chain, get its prototype...
       if (!::JS_GetPrototype(cx, proto, &proto)) {
         return;
diff --git a/dom/plugins/base/nsJSNPRuntime.cpp b/dom/plugins/base/nsJSNPRuntime.cpp
index 3d29d1eadb4..63897fe460a 100644
--- a/dom/plugins/base/nsJSNPRuntime.cpp
+++ b/dom/plugins/base/nsJSNPRuntime.cpp
@@ -54,6 +54,14 @@ struct JSObjWrapperHasher : public js::DefaultHasher<nsJSObjWrapperKey>
   }
 };
 
+class NPObjWrapperHashEntry : public PLDHashEntryHdr
+{
+public:
+  NPObject *mNPObj; // Must be the first member for the PLDHash stubs to work
+  JS::TenuredHeap<JSObject*> mJSObj;
+  NPP mNpp;
+};
+
 // Hash of JSObject wrappers that wraps JSObjects as NPObjects. There
 // will be one wrapper per JSObject per plugin instance, i.e. if two
 // plugins access the JSObject x, two wrappers for x will be
@@ -79,9 +87,8 @@ static PLDHashTable sNPObjWrappers;
 // wrappers and we can kill off hash tables etc.
 static int32_t sWrapperCount;
 
-// The JSRuntime. Used to unroot JSObjects when no JSContext is
-// reachable.
-static JSRuntime *sJSRuntime;
+// The runtime service used to register/unregister GC callbacks.
+nsCOMPtr<nsIJSRuntimeService> sCallbackRuntime;
 
 static nsTArray<NPObject*>* sDelayedReleases;
 
@@ -158,7 +165,10 @@ static bool
 NPObjWrapper_Convert(JSContext *cx, JS::Handle<JSObject*> obj, JSType type, JS::MutableHandle<JS::Value> vp);
 
 static void
-NPObjWrapper_Finalize(JSFreeOp *fop, JSObject *obj);
+NPObjWrapper_Finalize(js::FreeOp *fop, JSObject *obj);
+
+static void
+NPObjWrapper_ObjectMoved(JSObject *obj, const JSObject *old);
 
 static bool
 NPObjWrapper_Call(JSContext *cx, unsigned argc, JS::Value *vp);
@@ -171,7 +181,7 @@ CreateNPObjectMember(NPP npp, JSContext *cx, JSObject *obj, NPObject* npobj,
                      JS::Handle<jsid> id,  NPVariant* getPropertyResult,
                      JS::MutableHandle<JS::Value> vp);
 
-const JSClass sNPObjectJSWrapperClass =
+const static js::Class sNPObjectJSWrapperClass =
   {
     NPRUNTIME_JSCLASS_NAME,
     JSCLASS_HAS_PRIVATE | JSCLASS_IMPLEMENTS_BARRIERS | JSCLASS_NEW_RESOLVE | JSCLASS_NEW_ENUMERATE,
@@ -185,7 +195,17 @@ const JSClass sNPObjectJSWrapperClass =
     NPObjWrapper_Finalize,
     NPObjWrapper_Call,
     nullptr,                                                /* hasInstance */
-    NPObjWrapper_Construct
+    NPObjWrapper_Construct,
+    nullptr,                                                /* trace */
+    JS_NULL_CLASS_SPEC,
+    {
+      nullptr,                                              /* outerObject */
+      nullptr,                                              /* innerObject */
+      nullptr,                                              /* iteratorObject */
+      false,                                                /* isWrappedNative */
+      nullptr,                                              /* weakmapKeyDelegateOp */
+      NPObjWrapper_ObjectMoved
+    }
   };
 
 typedef struct NPObjectMemberPrivate {
@@ -220,6 +240,28 @@ static const JSClass sNPObjectMemberClass =
 static void
 OnWrapperDestroyed();
 
+static void
+TraceJSObjWrappers(JSTracer *trc, void *data)
+{
+  if (!sJSObjWrappers.initialized()) {
+    return;
+  }
+
+  // Trace all JSObjects in the sJSObjWrappers table and rekey the entries if
+  // any of them moved.
+  for (JSObjWrapperTable::Enum e(sJSObjWrappers); !e.empty(); e.popFront()) {
+    nsJSObjWrapperKey key = e.front().key();
+    JS_CallUnbarrieredObjectTracer(trc, &key.mJSObj, "sJSObjWrappers key object");
+    nsJSObjWrapper *wrapper = e.front().value();
+    if (wrapper->mJSObj) {
+      JS_CallObjectTracer(trc, &wrapper->mJSObj, "sJSObjWrappers wrapper object");
+    }
+    if (key != e.front().key()) {
+      e.rekeyFront(key);
+    }
+  }
+}
+
 static void
 DelayedReleaseGCCallback(JSGCStatus status)
 {
@@ -240,22 +282,116 @@ DelayedReleaseGCCallback(JSGCStatus status)
   }
 }
 
+static bool
+RegisterGCCallbacks()
+{
+  if (sCallbackRuntime) {
+    return true;
+  }
+
+  static const char rtsvc_id[] = "@mozilla.org/js/xpc/RuntimeService;1";
+  nsCOMPtr<nsIJSRuntimeService> rtsvc(do_GetService(rtsvc_id));
+  if (!rtsvc) {
+    return false;
+  }
+
+  JSRuntime *jsRuntime = nullptr;
+  rtsvc->GetRuntime(&jsRuntime);
+  MOZ_ASSERT(jsRuntime != nullptr);
+
+  // Register a callback to trace wrapped JSObjects.
+  if (!JS_AddExtraGCRootsTracer(jsRuntime, TraceJSObjWrappers, nullptr)) {
+    return false;
+  }
+
+  // Register our GC callback to perform delayed destruction of finalized
+  // NPObjects.
+  rtsvc->RegisterGCCallback(DelayedReleaseGCCallback);
+
+  // Set runtime pointer to indicate that callbacks have been registered.
+  sCallbackRuntime = rtsvc;
+  return true;
+}
+
+static void
+UnregisterGCCallbacks()
+{
+  MOZ_ASSERT(sCallbackRuntime);
+
+  JSRuntime *jsRuntime = nullptr;
+  sCallbackRuntime->GetRuntime(&jsRuntime);
+  MOZ_ASSERT(jsRuntime != nullptr);
+
+  // Remove tracing callback.
+  JS_RemoveExtraGCRootsTracer(jsRuntime, TraceJSObjWrappers, nullptr);
+
+  // Remove delayed destruction callback.
+  sCallbackRuntime->UnregisterGCCallback(DelayedReleaseGCCallback);
+
+  // Unset runtime pointer to indicate callbacks are no longer registered.
+  sCallbackRuntime = nullptr;
+}
+
+static bool
+CreateJSObjWrapperTable()
+{
+  MOZ_ASSERT(!sJSObjWrappersAccessible);
+  MOZ_ASSERT(!sJSObjWrappers.initialized());
+
+  if (!RegisterGCCallbacks()) {
+    return false;
+  }
+
+  if (!sJSObjWrappers.init(16)) {
+    NS_ERROR("Error initializing PLDHashTable sJSObjWrappers!");
+    return false;
+  }
+
+  sJSObjWrappersAccessible = true;
+  return true;
+}
+
+static void
+DestroyJSObjWrapperTable()
+{
+  MOZ_ASSERT(sJSObjWrappersAccessible);
+  MOZ_ASSERT(sJSObjWrappers.initialized());
+  MOZ_ASSERT(sJSObjWrappers.count() == 0);
+
+  // No more wrappers, and our hash was initialized. Finish the
+  // hash to prevent leaking it.
+  sJSObjWrappers.finish();
+  sJSObjWrappersAccessible = false;
+}
+
+static bool
+CreateNPObjWrapperTable()
+{
+  MOZ_ASSERT(!sNPObjWrappers.ops);
+
+  if (!RegisterGCCallbacks()) {
+    return false;
+  }
+
+  PL_DHashTableInit(&sNPObjWrappers, PL_DHashGetStubOps(), nullptr,
+                    sizeof(NPObjWrapperHashEntry));
+  return true;
+}
+
+static void
+DestroyNPObjWrapperTable()
+{
+  MOZ_ASSERT(sNPObjWrappers.EntryCount() == 0);
+
+  PL_DHashTableFinish(&sNPObjWrappers);
+
+  sNPObjWrappers.ops = nullptr;
+}
+
 static void
 OnWrapperCreated()
 {
-  if (sWrapperCount++ == 0) {
-    static const char rtsvc_id[] = "@mozilla.org/js/xpc/RuntimeService;1";
-    nsCOMPtr<nsIJSRuntimeService> rtsvc(do_GetService(rtsvc_id));
-    if (!rtsvc)
-      return;
-
-    rtsvc->GetRuntime(&sJSRuntime);
-    NS_ASSERTION(sJSRuntime != nullptr, "no JSRuntime?!");
-
-    // Register our GC callback to perform delayed destruction of finalized
-    // NPObjects. Leave this callback around and don't ever unregister it.
-    rtsvc->RegisterGCCallback(DelayedReleaseGCCallback);
-  }
+  ++sWrapperCount;
 }
 
 static void
@@ -265,26 +401,16 @@ OnWrapperDestroyed()
 
   if (--sWrapperCount == 0) {
     if (sJSObjWrappersAccessible) {
-      MOZ_ASSERT(sJSObjWrappers.count() == 0);
-
-      // No more wrappers, and our hash was initialized. Finish the
-      // hash to prevent leaking it.
-      sJSObjWrappers.finish();
-      sJSObjWrappersAccessible = false;
+      DestroyJSObjWrapperTable();
     }
 
     if (sNPObjWrappers.ops) {
-      MOZ_ASSERT(sNPObjWrappers.EntryCount() == 0);
-
       // No more wrappers, and our hash was initialized. Finish the
       // hash to prevent leaking it.
-      PL_DHashTableFinish(&sNPObjWrappers);
-
-      sNPObjWrappers.ops = nullptr;
+      DestroyNPObjWrapperTable();
     }
 
-    // No more need for this.
-    sJSRuntime = nullptr;
+    UnregisterGCCallbacks();
   }
 }
 
@@ -507,7 +633,7 @@ ReportExceptionIfPending(JSContext *cx)
 }
 
 nsJSObjWrapper::nsJSObjWrapper(NPP npp)
-  : mJSObj(GetJSContext(npp), nullptr), mNpp(npp)
+  : mJSObj(nullptr), mNpp(npp)
 {
   MOZ_COUNT_CTOR(nsJSObjWrapper);
   OnWrapperCreated();
@@ -517,7 +643,7 @@ nsJSObjWrapper::~nsJSObjWrapper()
 {
   MOZ_COUNT_DTOR(nsJSObjWrapper);
 
-  // Invalidate first, since it relies on sJSRuntime and sJSObjWrappers.
+  // Invalidate first, since it relies on sJSObjWrappers.
   NP_Invalidate(this);
 
   OnWrapperDestroyed();
@@ -982,9 +1108,7 @@ nsJSObjWrapper::GetNewOrUsed(NPP npp, JSContext *cx, JS::Handle<JSObject*> obj)
   // class and private from the JSObject, neither of which cares about
   // compartments.
 
-  const JSClass *clazz = JS_GetClass(obj);
-
-  if (clazz == &sNPObjectJSWrapperClass) {
+  if (nsNPObjWrapper::IsWrapper(obj)) {
     // obj is one of our own, its private data is the NPObject we're
     // looking for.
 
@@ -1005,12 +1129,8 @@ nsJSObjWrapper::GetNewOrUsed(NPP npp, JSContext *cx, JS::Handle<JSObject*> obj)
 
   if (!sJSObjWrappers.initialized()) {
     // No hash yet (or any more), initialize it.
-    if (!sJSObjWrappers.init(16)) {
-      NS_ERROR("Error initializing PLDHashTable!");
-
+    if (!CreateJSObjWrapperTable())
       return nullptr;
-    }
-    sJSObjWrappersAccessible = true;
   }
   MOZ_ASSERT(sJSObjWrappersAccessible);
 
@@ -1032,10 +1152,10 @@ nsJSObjWrapper::GetNewOrUsed(NPP npp, JSContext *cx, JS::Handle<JSObject*> obj)
     return nullptr;
   }
 
-  // Assign mJSObj, rooting the JSObject. Its lifetime is now tied to that of
-  // the NPObject.
   wrapper->mJSObj = obj;
 
+  // Insert the new wrapper into the hashtable, rooting the JSObject. Its
+  // lifetime is now tied to that of the NPObject.
   nsJSObjWrapperKey key(obj, npp);
   if (!sJSObjWrappers.putNew(key, wrapper)) {
     // Out of memory, free the wrapper we created.
@@ -1060,7 +1180,7 @@ GetNPObjectWrapper(JSContext *cx, JSObject *aObj, bool wrapResult = true)
 {
   JS::Rooted<JSObject*> obj(cx, aObj);
   while (obj && (obj = js::CheckedUnwrap(obj))) {
-    if (JS_GetClass(obj) == &sNPObjectJSWrapperClass) {
+    if (nsNPObjWrapper::IsWrapper(obj)) {
       if (wrapResult && !JS_WrapObject(cx, &obj)) {
         return nullptr;
       }
@@ -1627,7 +1747,7 @@ NPObjWrapper_Convert(JSContext *cx, JS::Handle<JSObject*> obj, JSType hint, JS::
 }
 
 static void
-NPObjWrapper_Finalize(JSFreeOp *fop, JSObject *obj)
+NPObjWrapper_Finalize(js::FreeOp *fop, JSObject *obj)
 {
   NPObject *npobj = (NPObject *)::JS_GetPrivate(obj);
   if (npobj) {
@@ -1641,6 +1761,28 @@ NPObjWrapper_Finalize(JSFreeOp *fop, JSObject *obj)
   sDelayedReleases->AppendElement(npobj);
 }
 
+static void
+NPObjWrapper_ObjectMoved(JSObject *obj, const JSObject *old)
+{
+  // The wrapper JSObject has been moved, so we need to update the entry in the
+  // sNPObjWrappers hash table, if present.
+
+  if (!sNPObjWrappers.ops) {
+    return;
+  }
+
+  NPObject *npobj = (NPObject *)::JS_GetPrivate(obj);
+  if (!npobj) {
+    return;
+  }
+
+  NPObjWrapperHashEntry *entry = static_cast<NPObjWrapperHashEntry *>
+    (PL_DHashTableOperate(&sNPObjWrappers, npobj, PL_DHASH_LOOKUP));
+  MOZ_ASSERT(PL_DHASH_ENTRY_IS_BUSY(entry) && entry->mJSObj);
+  MOZ_ASSERT(entry->mJSObj == old);
+  entry->mJSObj = obj;
+}
+
 static bool
 NPObjWrapper_Call(JSContext *cx, unsigned argc, JS::Value *vp)
 {
@@ -1657,14 +1799,11 @@ NPObjWrapper_Construct(JSContext *cx, unsigned argc, JS::Value *vp)
   return CallNPMethodInternal(cx, obj, args.length(), args.array(), vp, true);
 }
 
-class NPObjWrapperHashEntry : public PLDHashEntryHdr
+bool
+nsNPObjWrapper::IsWrapper(JSObject *obj)
 {
-public:
-  NPObject *mNPObj; // Must be the first member for the PLDHash stubs to work
-  JSObject *mJSObj;
-  NPP mNpp;
-};
-
+  return js::GetObjectClass(obj) == &sNPObjectJSWrapperClass;
+}
 
 // An NPObject is going away, make sure we null out the JS object's
 // private data in case this is an NPObject that came from a plugin
@@ -1736,8 +1875,9 @@ nsNPObjWrapper::GetNewOrUsed(NPP npp, JSContext *cx, NPObject *npobj)
 
   if (!sNPObjWrappers.ops) {
     // No hash yet (or any more), initialize it.
-    PL_DHashTableInit(&sNPObjWrappers, PL_DHashGetStubOps(), nullptr,
-                      sizeof(NPObjWrapperHashEntry));
+    if (!CreateNPObjWrapperTable()) {
+      return nullptr;
+    }
   }
 
   NPObjWrapperHashEntry *entry = static_cast<NPObjWrapperHashEntry *>
@@ -1767,8 +1907,8 @@ nsNPObjWrapper::GetNewOrUsed(NPP npp, JSContext *cx, NPObject *npobj)
 
   // No existing JSObject, create one.
 
-  JS::Rooted<JSObject*> obj(cx, ::JS_NewObject(cx, &sNPObjectJSWrapperClass, JS::NullPtr(),
-                                               JS::NullPtr()));
+  JS::Rooted<JSObject*> obj(cx, ::JS_NewObject(cx, js::Jsvalify(&sNPObjectJSWrapperClass),
+                                               JS::NullPtr(), JS::NullPtr()));
 
   if (generation != sNPObjWrappers.Generation()) {
       // Reload entry if the JS_NewObject call caused a GC and reallocated
diff --git a/dom/plugins/base/nsJSNPRuntime.h b/dom/plugins/base/nsJSNPRuntime.h
index 7bf82265df5..7d1a5f5c197 100644
--- a/dom/plugins/base/nsJSNPRuntime.h
+++ b/dom/plugins/base/nsJSNPRuntime.h
@@ -36,12 +36,10 @@ public:
   const NPP mNpp;
 };
 
-extern const JSClass sNPObjectJSWrapperClass;
-
 class nsJSObjWrapper : public NPObject
 {
 public:
-  JS::PersistentRooted<JSObject *> mJSObj;
+  JS::Heap<JSObject *> mJSObj;
   const NPP mNpp;
 
   static NPObject *GetNewOrUsed(NPP npp, JSContext *cx,
@@ -78,6 +76,7 @@ public:
 class nsNPObjWrapper
 {
 public:
+  static bool IsWrapper(JSObject *obj);
   static void OnDestroy(NPObject *npobj);
   static JSObject *GetNewOrUsed(NPP npp, JSContext *cx, NPObject *npobj);
 };

From 4358a27d3c9a72296bd9f63f5d16d3a5808fa456 Mon Sep 17 00:00:00 2001
From: Jonathan Watt <jwatt@jwatt.org>
Date: Wed, 5 Nov 2014 09:16:37 +0000
Subject: [PATCH 078/153] Bug 1093066 - Get rid of gfxContext's Stroke()
 methods. r=mattwoodrow

---
 gfx/thebes/gfxContext.cpp   | 44 -------------------------------------
 gfx/thebes/gfxContext.h     | 16 --------------
 layout/svg/SVGTextFrame.cpp | 26 ++++++++++++++++++++--
 layout/svg/nsSVGUtils.h     |  6 +++++
 4 files changed, 30 insertions(+), 62 deletions(-)

diff --git a/gfx/thebes/gfxContext.cpp b/gfx/thebes/gfxContext.cpp
index d887f60c3f4..645e4e71464 100644
--- a/gfx/thebes/gfxContext.cpp
+++ b/gfx/thebes/gfxContext.cpp
@@ -224,30 +224,6 @@ gfxContext::CurrentPoint()
   return ThebesPoint(mPathBuilder->CurrentPoint());
 }
 
-void
-gfxContext::Stroke()
-{
-  Stroke(PatternFromState(this));
-}
-
-void
-gfxContext::Stroke(const Pattern& aPattern)
-{
-  AzureState &state = CurrentState();
-  if (mPathIsRect) {
-    MOZ_ASSERT(!mTransformChanged);
-
-    mDT->StrokeRect(mRect, aPattern,
-                    state.strokeOptions,
-                    DrawOptions(1.0f, GetOp(), state.aaMode));
-  } else {
-    EnsurePath();
-
-    mDT->Stroke(mPath, aPattern, state.strokeOptions,
-                DrawOptions(1.0f, GetOp(), state.aaMode));
-  }
-}
-
 void
 gfxContext::Fill()
 {
@@ -523,26 +499,6 @@ gfxContext::CurrentAntialiasMode() const
   return CurrentState().aaMode;
 }
 
-void
-gfxContext::SetDash(gfxLineType ltype)
-{
-  static double dash[] = {5.0, 5.0};
-  static double dot[] = {1.0, 1.0};
-
-  switch (ltype) {
-      case gfxLineDashed:
-          SetDash(dash, 2, 0.0);
-          break;
-      case gfxLineDotted:
-          SetDash(dot, 2, 0.0);
-          break;
-      case gfxLineSolid:
-      default:
-          SetDash(nullptr, 0, 0.0);
-          break;
-  }
-}
-
 void
 gfxContext::SetDash(gfxFloat *dashes, int ndash, gfxFloat offset)
 {
diff --git a/gfx/thebes/gfxContext.h b/gfx/thebes/gfxContext.h
index d350aa881d0..9738b03c85c 100644
--- a/gfx/thebes/gfxContext.h
+++ b/gfx/thebes/gfxContext.h
@@ -100,15 +100,6 @@ public:
      ** Paths & Drawing
      **/
 
-    /**
-     * Stroke the current path using the current settings (such as line
-     * width and color).
-     * A path is set up using functions such as Line, Rectangle and Arc.
-     *
-     * Does not consume the current path.
-     */
-    void Stroke();
-    void Stroke(const Pattern& aPattern);
     /**
      * Fill the current path according to the current settings.
      *
@@ -368,13 +359,6 @@ public:
      ** Line Properties
      **/
 
-    typedef enum {
-        gfxLineSolid,
-        gfxLineDashed,
-        gfxLineDotted
-    } gfxLineType;
-
-    void SetDash(gfxLineType ltype);
     void SetDash(gfxFloat *dashes, int ndash, gfxFloat offset);
     // Return true if dashing is set, false if it's not enabled or the
     // context is in an error state.  |offset| can be nullptr to mean
diff --git a/layout/svg/SVGTextFrame.cpp b/layout/svg/SVGTextFrame.cpp
index aadb803bce5..abfb1e1f208 100644
--- a/layout/svg/SVGTextFrame.cpp
+++ b/layout/svg/SVGTextFrame.cpp
@@ -2989,8 +2989,30 @@ SVGTextDrawPathCallbacks::StrokeGeometry()
       GeneralPattern strokePattern;
       nsSVGUtils::MakeStrokePatternFor(mFrame, gfx, &strokePattern, /*aContextPaint*/ nullptr);
       if (strokePattern.GetPattern()) {
-        nsSVGUtils::SetupCairoStrokeGeometry(mFrame, gfx, /*aContextPaint*/ nullptr);
-        gfx->Stroke(strokePattern);
+        if (!mFrame->GetParent()->GetContent()->IsSVG()) {
+          // The cast that follows would be unsafe
+          MOZ_ASSERT(false, "Our nsTextFrame's parent's content should be SVG");
+          return;
+        }
+        nsSVGElement* svgOwner =
+          static_cast<nsSVGElement*>(mFrame->GetParent()->GetContent());
+
+        // Apply any stroke-specific transform
+        gfxMatrix outerSVGToUser;
+        if (nsSVGUtils::GetNonScalingStrokeTransform(mFrame, &outerSVGToUser) &&
+            outerSVGToUser.Invert()) {
+          gfx->Multiply(outerSVGToUser);
+        }
+
+        RefPtr<Path> path = gfx->GetPath();
+        SVGContentUtils::AutoStrokeOptions strokeOptions;
+        SVGContentUtils::GetStrokeOptions(&strokeOptions, svgOwner,
+                                          mFrame->StyleContext(),
+                                          /*aContextPaint*/ nullptr);
+        DrawOptions drawOptions;
+        drawOptions.mAntialiasMode =
+          nsSVGUtils::ToAntialiasMode(mFrame->StyleSVG()->mTextRendering);
+        gfx->GetDrawTarget()->Stroke(path, strokePattern, strokeOptions);
       }
     }
   }
diff --git a/layout/svg/nsSVGUtils.h b/layout/svg/nsSVGUtils.h
index 967aba34867..bfbfe024f05 100644
--- a/layout/svg/nsSVGUtils.h
+++ b/layout/svg/nsSVGUtils.h
@@ -187,6 +187,7 @@ class nsSVGUtils
 {
 public:
   typedef mozilla::dom::Element Element;
+  typedef mozilla::gfx::AntialiasMode AntialiasMode;
   typedef mozilla::gfx::FillRule FillRule;
   typedef mozilla::gfx::GeneralPattern GeneralPattern;
 
@@ -533,6 +534,11 @@ public:
              FillRule::FILL_EVEN_ODD : FillRule::FILL_WINDING;
   }
 
+  static AntialiasMode ToAntialiasMode(uint8_t aTextRendering) {
+    return aTextRendering == NS_STYLE_TEXT_RENDERING_OPTIMIZESPEED ?
+             AntialiasMode::NONE : AntialiasMode::SUBPIXEL;
+  }
+
   /**
    * Render a SVG glyph.
    * @param aElement the SVG glyph element to render

From 0c72a8d9689283afd55edc803618178e247fadc4 Mon Sep 17 00:00:00 2001
From: Jacek Caban <jacek@codeweavers.com>
Date: Wed, 5 Nov 2014 11:27:01 +0100
Subject: [PATCH 079/153] Bug 1092151 - Don't use dllimport/dllexport in
 non-shared gkmedias builds in libsoundtouch. r=padenot

---
 media/libsoundtouch/moz-libsoundtouch.patch | 2 +-
 media/libsoundtouch/src/STTypes.h           | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/media/libsoundtouch/moz-libsoundtouch.patch b/media/libsoundtouch/moz-libsoundtouch.patch
index 358aa22d4b0..1fcc3123b80 100644
--- a/media/libsoundtouch/moz-libsoundtouch.patch
+++ b/media/libsoundtouch/moz-libsoundtouch.patch
@@ -67,7 +67,7 @@ diff -u /src/STTypes.h /src/STTypes.h
 -#endif
 +#include "soundtouch_config.h"
  
-+#ifdef WIN32
++#if defined(WIN32) && defined(GKMEDIAS_SHARED_LIBRARY)
 +#ifdef BUILDING_SOUNDTOUCH
 +#define EXPORT __declspec(dllexport)
 +#else
diff --git a/media/libsoundtouch/src/STTypes.h b/media/libsoundtouch/src/STTypes.h
index f6963510220..f7a78a99171 100644
--- a/media/libsoundtouch/src/STTypes.h
+++ b/media/libsoundtouch/src/STTypes.h
@@ -56,7 +56,7 @@ typedef unsigned long   ulong;
 
 #include "soundtouch_config.h"
 
-#ifdef WIN32
+#if defined(WIN32) && defined(GKMEDIAS_SHARED_LIBRARY)
 #ifdef BUILDING_SOUNDTOUCH
 #define EXPORT __declspec(dllexport)
 #else

From 603ea385c95586d093b4647442da7be2cba53ed3 Mon Sep 17 00:00:00 2001
From: Jacek Caban <jacek@codeweavers.com>
Date: Wed, 5 Nov 2014 11:27:13 +0100
Subject: [PATCH 080/153] Bug 1092151 - Don't use dllimport/dllexport for OTS
 in non-shared gkmedias builds. r=glandium

---
 gfx/ots/src/moz.build | 2 +-
 gfx/thebes/moz.build  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/gfx/ots/src/moz.build b/gfx/ots/src/moz.build
index 3b627d2c0ab..4cf75eab807 100644
--- a/gfx/ots/src/moz.build
+++ b/gfx/ots/src/moz.build
@@ -58,7 +58,7 @@ DEFINES['PACKAGE_VERSION'] = '"moz"'
 DEFINES['PACKAGE_BUGREPORT'] = '"http://bugzilla.mozilla.org/"'
 DEFINES['NOMINMAX'] = True
 
-if CONFIG['OS_TARGET'] == 'WINNT':
+if CONFIG['GKMEDIAS_SHARED_LIBRARY']:
     DEFINES['OTS_DLL'] = True
     DEFINES['OTS_DLL_EXPORTS'] = True
 
diff --git a/gfx/thebes/moz.build b/gfx/thebes/moz.build
index bb6f4cf3239..1e33ae40d9d 100644
--- a/gfx/thebes/moz.build
+++ b/gfx/thebes/moz.build
@@ -293,5 +293,5 @@ if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('gtk2', 'gtk3', 'qt'):
 
 DEFINES['GRAPHITE2_STATIC'] = True
 
-if CONFIG['OS_TARGET'] == 'WINNT':
+if CONFIG['GKMEDIAS_SHARED_LIBRARY']:
     DEFINES['OTS_DLL'] = True

From 8c4b01cc96c97e3ef62f09c2803283b5d28a7494 Mon Sep 17 00:00:00 2001
From: Jacek Caban <jacek@codeweavers.com>
Date: Wed, 5 Nov 2014 11:29:47 +0100
Subject: [PATCH 081/153] Bug 1088130 - Fixed mingw cross compilation.

---
 dom/media/gmp-plugin/gmp-test-output-protection.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dom/media/gmp-plugin/gmp-test-output-protection.h b/dom/media/gmp-plugin/gmp-test-output-protection.h
index 0ba726d108b..85e9bfc4e91 100644
--- a/dom/media/gmp-plugin/gmp-test-output-protection.h
+++ b/dom/media/gmp-plugin/gmp-test-output-protection.h
@@ -11,7 +11,7 @@
 #include <vector>
 #include <windows.h>
 
-#include "Opmapi.h"
+#include "opmapi.h"
 #endif
 
 namespace mozilla {

From 0829321d8c6ee1e3bb783abc49116cb3f1a85665 Mon Sep 17 00:00:00 2001
From: Dave Hunt <dhunt@mozilla.com>
Date: Wed, 5 Nov 2014 10:44:19 +0000
Subject: [PATCH 082/153] Bug 1090148 - [mozlog] Remove test class from HTML
 formatter. r=cmanchester

---
 .../mozlog/structured/formatters/html/html.py    | 10 +++-------
 .../mozlog/structured/formatters/html/style.css  | 16 +++++-----------
 2 files changed, 8 insertions(+), 18 deletions(-)

diff --git a/testing/mozbase/mozlog/mozlog/structured/formatters/html/html.py b/testing/mozbase/mozlog/mozlog/structured/formatters/html/html.py
index 0912d09b3ab..5324bfa6cd9 100755
--- a/testing/mozbase/mozlog/mozlog/structured/formatters/html/html.py
+++ b/testing/mozbase/mozlog/mozlog/structured/formatters/html/html.py
@@ -94,8 +94,6 @@ class HTMLFormatter(base.BaseFormatter):
         self.make_result_html(data)
 
     def make_result_html(self, data):
-        cls_name = ""
-        tc_name = unicode(data["test"])
         tc_time = (data["time"] - self.start_times.pop(data["test"])) / 1000.
         additional_html = []
         debug = data.get("extra", {})
@@ -149,9 +147,8 @@ class HTMLFormatter(base.BaseFormatter):
 
         self.result_rows.append(
             html.tr([html.td(status_name, class_='col-result'),
-                     html.td(cls_name, class_='col-class'),
-                     html.td(tc_name, class_='col-name'),
-                     html.td("%.2f" % tc_time, class_='col-duration'),
+                     html.td(data['test'], class_='col-name'),
+                     html.td('%.2f' % tc_time, class_='col-duration'),
                      html.td(links_html, class_='col-links'),
                      html.td(additional_html, class_='debug')],
                     class_=status_name.lower() + ' results-table-row'))
@@ -189,8 +186,7 @@ class HTMLFormatter(base.BaseFormatter):
                     html.table([html.thead(
                         html.tr([
                             html.th('Result', class_='sortable', col='result'),
-                            html.th('Class', class_='sortable', col='class'),
-                            html.th('Test Name', class_='sortable', col='name'),
+                            html.th('Test', class_='sortable', col='name'),
                             html.th('Duration', class_='sortable numeric', col='duration'),
                             html.th('Links')]), id='results-table-head'),
                         html.tbody(self.result_rows, id='results-table-body')], id='results-table')))
diff --git a/testing/mozbase/mozlog/mozlog/structured/formatters/html/style.css b/testing/mozbase/mozlog/mozlog/structured/formatters/html/style.css
index 8c90bf4a998..67e65443335 100644
--- a/testing/mozbase/mozlog/mozlog/structured/formatters/html/style.css
+++ b/testing/mozbase/mozlog/mozlog/structured/formatters/html/style.css
@@ -44,22 +44,16 @@ table {
 span.pass, .pass .col-result {
 	color: green;
 }
-span.expected_fail, .expected_fail .col-result {
-	color: orange;
-}
+span.expected_fail, .expected_fail .col-result,
 span.skip, .skip .col-result {
 	color: orange;
 }
-span.unexpected_pass, .unexpected_pass .col-result {
+span.fail, .fail .col-result,
+span.unexpected_fail, .unexpected_fail .col-result,
+span.unexpected_pass, .unexpected_pass .col-result,
+span.error,.error .col-result {
 	color: red;
 }
-span.fail, .fail .col-result {
-	color: red;
-}
-span.error,.error .col-result  {
-	color: red;
-}
-
 
 /******************************
  * RESULTS TABLE

From 54455b50f2c68d7a59fe0091af0807f3f003e140 Mon Sep 17 00:00:00 2001
From: Jon Coppeard <jcoppeard@mozilla.com>
Date: Wed, 5 Nov 2014 10:57:33 +0000
Subject: [PATCH 083/153] Backed out changeset 2acbf923b6a8 (bug 650161) for
 causing hazards

---
 dom/base/nsObjectLoadingContent.cpp |   4 +-
 dom/plugins/base/nsJSNPRuntime.cpp  | 254 +++++++---------------------
 dom/plugins/base/nsJSNPRuntime.h    |   5 +-
 3 files changed, 62 insertions(+), 201 deletions(-)

diff --git a/dom/base/nsObjectLoadingContent.cpp b/dom/base/nsObjectLoadingContent.cpp
index ab4ca804aca..781f53efe32 100644
--- a/dom/base/nsObjectLoadingContent.cpp
+++ b/dom/base/nsObjectLoadingContent.cpp
@@ -3602,9 +3602,9 @@ nsObjectLoadingContent::TeardownProtoChain()
     if (!proto) {
       break;
     }
-    // Unwrap while checking the class - if the prototype is a wrapper for
+    // Unwrap while checking the jsclass - if the prototype is a wrapper for
     // an NP object, that counts too.
-    if (nsNPObjWrapper::IsWrapper(js::UncheckedUnwrap(proto))) {
+    if (JS_GetClass(js::UncheckedUnwrap(proto)) == &sNPObjectJSWrapperClass) {
       // We found an NPObject on the proto chain, get its prototype...
       if (!::JS_GetPrototype(cx, proto, &proto)) {
         return;
diff --git a/dom/plugins/base/nsJSNPRuntime.cpp b/dom/plugins/base/nsJSNPRuntime.cpp
index 63897fe460a..3d29d1eadb4 100644
--- a/dom/plugins/base/nsJSNPRuntime.cpp
+++ b/dom/plugins/base/nsJSNPRuntime.cpp
@@ -54,14 +54,6 @@ struct JSObjWrapperHasher : public js::DefaultHasher<nsJSObjWrapperKey>
   }
 };
 
-class NPObjWrapperHashEntry : public PLDHashEntryHdr
-{
-public:
-  NPObject *mNPObj; // Must be the first member for the PLDHash stubs to work
-  JS::TenuredHeap<JSObject*> mJSObj;
-  NPP mNpp;
-};
-
 // Hash of JSObject wrappers that wraps JSObjects as NPObjects. There
 // will be one wrapper per JSObject per plugin instance, i.e. if two
 // plugins access the JSObject x, two wrappers for x will be
@@ -87,8 +79,9 @@ static PLDHashTable sNPObjWrappers;
 // wrappers and we can kill off hash tables etc.
 static int32_t sWrapperCount;
 
-// The runtime service used to register/unregister GC callbacks.
-nsCOMPtr<nsIJSRuntimeService> sCallbackRuntime;
+// The JSRuntime. Used to unroot JSObjects when no JSContext is
+// reachable.
+static JSRuntime *sJSRuntime;
 
 static nsTArray<NPObject*>* sDelayedReleases;
 
@@ -165,10 +158,7 @@ static bool
 NPObjWrapper_Convert(JSContext *cx, JS::Handle<JSObject*> obj, JSType type, JS::MutableHandle<JS::Value> vp);
 
 static void
-NPObjWrapper_Finalize(js::FreeOp *fop, JSObject *obj);
-
-static void
-NPObjWrapper_ObjectMoved(JSObject *obj, const JSObject *old);
+NPObjWrapper_Finalize(JSFreeOp *fop, JSObject *obj);
 
 static bool
 NPObjWrapper_Call(JSContext *cx, unsigned argc, JS::Value *vp);
@@ -181,7 +171,7 @@ CreateNPObjectMember(NPP npp, JSContext *cx, JSObject *obj, NPObject* npobj,
                      JS::Handle<jsid> id,  NPVariant* getPropertyResult,
                      JS::MutableHandle<JS::Value> vp);
 
-const static js::Class sNPObjectJSWrapperClass =
+const JSClass sNPObjectJSWrapperClass =
   {
     NPRUNTIME_JSCLASS_NAME,
     JSCLASS_HAS_PRIVATE | JSCLASS_IMPLEMENTS_BARRIERS | JSCLASS_NEW_RESOLVE | JSCLASS_NEW_ENUMERATE,
@@ -195,17 +185,7 @@ const static js::Class sNPObjectJSWrapperClass =
     NPObjWrapper_Finalize,
     NPObjWrapper_Call,
     nullptr,                                                /* hasInstance */
-    NPObjWrapper_Construct,
-    nullptr,                                                /* trace */
-    JS_NULL_CLASS_SPEC,
-    {
-      nullptr,                                              /* outerObject */
-      nullptr,                                              /* innerObject */
-      nullptr,                                              /* iteratorObject */
-      false,                                                /* isWrappedNative */
-      nullptr,                                              /* weakmapKeyDelegateOp */
-      NPObjWrapper_ObjectMoved
-    }
+    NPObjWrapper_Construct
   };
 
 typedef struct NPObjectMemberPrivate {
@@ -240,28 +220,6 @@ static const JSClass sNPObjectMemberClass =
 static void
 OnWrapperDestroyed();
 
-static void
-TraceJSObjWrappers(JSTracer *trc, void *data)
-{
-  if (!sJSObjWrappers.initialized()) {
-    return;
-  }
-
-  // Trace all JSObjects in the sJSObjWrappers table and rekey the entries if
-  // any of them moved.
-  for (JSObjWrapperTable::Enum e(sJSObjWrappers); !e.empty(); e.popFront()) {
-    nsJSObjWrapperKey key = e.front().key();
-    JS_CallUnbarrieredObjectTracer(trc, &key.mJSObj, "sJSObjWrappers key object");
-    nsJSObjWrapper *wrapper = e.front().value();
-    if (wrapper->mJSObj) {
-      JS_CallObjectTracer(trc, &wrapper->mJSObj, "sJSObjWrappers wrapper object");
-    }
-    if (key != e.front().key()) {
-      e.rekeyFront(key);
-    }
-  }
-}
-
 static void
 DelayedReleaseGCCallback(JSGCStatus status)
 {
@@ -282,116 +240,22 @@ DelayedReleaseGCCallback(JSGCStatus status)
   }
 }
 
-static bool
-RegisterGCCallbacks()
-{
-  if (sCallbackRuntime) {
-    return true;
-  }
-
-  static const char rtsvc_id[] = "@mozilla.org/js/xpc/RuntimeService;1";
-  nsCOMPtr<nsIJSRuntimeService> rtsvc(do_GetService(rtsvc_id));
-  if (!rtsvc) {
-    return false;
-  }
-
-  JSRuntime *jsRuntime = nullptr;
-  rtsvc->GetRuntime(&jsRuntime);
-  MOZ_ASSERT(jsRuntime != nullptr);
-
-  // Register a callback to trace wrapped JSObjects.
-  if (!JS_AddExtraGCRootsTracer(jsRuntime, TraceJSObjWrappers, nullptr)) {
-    return false;
-  }
-
-  // Register our GC callback to perform delayed destruction of finalized
-  // NPObjects.
-  rtsvc->RegisterGCCallback(DelayedReleaseGCCallback);
-
-  // Set runtime pointer to indicate that callbacks have been registered.
-  sCallbackRuntime = rtsvc;
-  return true;
-}
-
-static void
-UnregisterGCCallbacks()
-{
-  MOZ_ASSERT(sCallbackRuntime);
-
-  JSRuntime *jsRuntime = nullptr;
-  sCallbackRuntime->GetRuntime(&jsRuntime);
-  MOZ_ASSERT(jsRuntime != nullptr);
-
-  // Remove tracing callback.
-  JS_RemoveExtraGCRootsTracer(jsRuntime, TraceJSObjWrappers, nullptr);
-
-  // Remove delayed destruction callback.
-  sCallbackRuntime->UnregisterGCCallback(DelayedReleaseGCCallback);
-
-  // Unset runtime pointer to indicate callbacks are no longer registered.
-  sCallbackRuntime = nullptr;
-}
-
-static bool
-CreateJSObjWrapperTable()
-{
-  MOZ_ASSERT(!sJSObjWrappersAccessible);
-  MOZ_ASSERT(!sJSObjWrappers.initialized());
-
-  if (!RegisterGCCallbacks()) {
-    return false;
-  }
-
-  if (!sJSObjWrappers.init(16)) {
-    NS_ERROR("Error initializing PLDHashTable sJSObjWrappers!");
-    return false;
-  }
-
-  sJSObjWrappersAccessible = true;
-  return true;
-}
-
-static void
-DestroyJSObjWrapperTable()
-{
-  MOZ_ASSERT(sJSObjWrappersAccessible);
-  MOZ_ASSERT(sJSObjWrappers.initialized());
-  MOZ_ASSERT(sJSObjWrappers.count() == 0);
-
-  // No more wrappers, and our hash was initialized. Finish the
-  // hash to prevent leaking it.
-  sJSObjWrappers.finish();
-  sJSObjWrappersAccessible = false;
-}
-
-static bool
-CreateNPObjWrapperTable()
-{
-  MOZ_ASSERT(!sNPObjWrappers.ops);
-
-  if (!RegisterGCCallbacks()) {
-    return false;
-  }
-
-  PL_DHashTableInit(&sNPObjWrappers, PL_DHashGetStubOps(), nullptr,
-                    sizeof(NPObjWrapperHashEntry));
-  return true;
-}
-
-static void
-DestroyNPObjWrapperTable()
-{
-  MOZ_ASSERT(sNPObjWrappers.EntryCount() == 0);
-
-  PL_DHashTableFinish(&sNPObjWrappers);
-
-  sNPObjWrappers.ops = nullptr;
-}
-
 static void
 OnWrapperCreated()
 {
-  ++sWrapperCount;
+  if (sWrapperCount++ == 0) {
+    static const char rtsvc_id[] = "@mozilla.org/js/xpc/RuntimeService;1";
+    nsCOMPtr<nsIJSRuntimeService> rtsvc(do_GetService(rtsvc_id));
+    if (!rtsvc)
+      return;
+
+    rtsvc->GetRuntime(&sJSRuntime);
+    NS_ASSERTION(sJSRuntime != nullptr, "no JSRuntime?!");
+
+    // Register our GC callback to perform delayed destruction of finalized
+    // NPObjects. Leave this callback around and don't ever unregister it.
+    rtsvc->RegisterGCCallback(DelayedReleaseGCCallback);
+  }
 }
 
 static void
@@ -401,16 +265,26 @@ OnWrapperDestroyed()
 
   if (--sWrapperCount == 0) {
     if (sJSObjWrappersAccessible) {
-      DestroyJSObjWrapperTable();
+      MOZ_ASSERT(sJSObjWrappers.count() == 0);
+
+      // No more wrappers, and our hash was initialized. Finish the
+      // hash to prevent leaking it.
+      sJSObjWrappers.finish();
+      sJSObjWrappersAccessible = false;
     }
 
     if (sNPObjWrappers.ops) {
+      MOZ_ASSERT(sNPObjWrappers.EntryCount() == 0);
+
       // No more wrappers, and our hash was initialized. Finish the
       // hash to prevent leaking it.
-      DestroyNPObjWrapperTable();
+      PL_DHashTableFinish(&sNPObjWrappers);
+
+      sNPObjWrappers.ops = nullptr;
     }
 
-    UnregisterGCCallbacks();
+    // No more need for this.
+    sJSRuntime = nullptr;
   }
 }
 
@@ -633,7 +507,7 @@ ReportExceptionIfPending(JSContext *cx)
 }
 
 nsJSObjWrapper::nsJSObjWrapper(NPP npp)
-  : mJSObj(nullptr), mNpp(npp)
+  : mJSObj(GetJSContext(npp), nullptr), mNpp(npp)
 {
   MOZ_COUNT_CTOR(nsJSObjWrapper);
   OnWrapperCreated();
@@ -643,7 +517,7 @@ nsJSObjWrapper::~nsJSObjWrapper()
 {
   MOZ_COUNT_DTOR(nsJSObjWrapper);
 
-  // Invalidate first, since it relies on sJSObjWrappers.
+  // Invalidate first, since it relies on sJSRuntime and sJSObjWrappers.
   NP_Invalidate(this);
 
   OnWrapperDestroyed();
@@ -1108,7 +982,9 @@ nsJSObjWrapper::GetNewOrUsed(NPP npp, JSContext *cx, JS::Handle<JSObject*> obj)
   // class and private from the JSObject, neither of which cares about
   // compartments.
 
-  if (nsNPObjWrapper::IsWrapper(obj)) {
+  const JSClass *clazz = JS_GetClass(obj);
+
+  if (clazz == &sNPObjectJSWrapperClass) {
     // obj is one of our own, its private data is the NPObject we're
     // looking for.
 
@@ -1129,8 +1005,12 @@ nsJSObjWrapper::GetNewOrUsed(NPP npp, JSContext *cx, JS::Handle<JSObject*> obj)
 
   if (!sJSObjWrappers.initialized()) {
     // No hash yet (or any more), initialize it.
-    if (!CreateJSObjWrapperTable())
+    if (!sJSObjWrappers.init(16)) {
+      NS_ERROR("Error initializing PLDHashTable!");
+
       return nullptr;
+    }
+    sJSObjWrappersAccessible = true;
   }
   MOZ_ASSERT(sJSObjWrappersAccessible);
 
@@ -1152,10 +1032,10 @@ nsJSObjWrapper::GetNewOrUsed(NPP npp, JSContext *cx, JS::Handle<JSObject*> obj)
     return nullptr;
   }
 
+  // Assign mJSObj, rooting the JSObject. Its lifetime is now tied to that of
+  // the NPObject.
   wrapper->mJSObj = obj;
 
-  // Insert the new wrapper into the hashtable, rooting the JSObject. Its
-  // lifetime is now tied to that of the NPObject.
   nsJSObjWrapperKey key(obj, npp);
   if (!sJSObjWrappers.putNew(key, wrapper)) {
     // Out of memory, free the wrapper we created.
@@ -1180,7 +1060,7 @@ GetNPObjectWrapper(JSContext *cx, JSObject *aObj, bool wrapResult = true)
 {
   JS::Rooted<JSObject*> obj(cx, aObj);
   while (obj && (obj = js::CheckedUnwrap(obj))) {
-    if (nsNPObjWrapper::IsWrapper(obj)) {
+    if (JS_GetClass(obj) == &sNPObjectJSWrapperClass) {
       if (wrapResult && !JS_WrapObject(cx, &obj)) {
         return nullptr;
       }
@@ -1747,7 +1627,7 @@ NPObjWrapper_Convert(JSContext *cx, JS::Handle<JSObject*> obj, JSType hint, JS::
 }
 
 static void
-NPObjWrapper_Finalize(js::FreeOp *fop, JSObject *obj)
+NPObjWrapper_Finalize(JSFreeOp *fop, JSObject *obj)
 {
   NPObject *npobj = (NPObject *)::JS_GetPrivate(obj);
   if (npobj) {
@@ -1761,28 +1641,6 @@ NPObjWrapper_Finalize(js::FreeOp *fop, JSObject *obj)
   sDelayedReleases->AppendElement(npobj);
 }
 
-static void
-NPObjWrapper_ObjectMoved(JSObject *obj, const JSObject *old)
-{
-  // The wrapper JSObject has been moved, so we need to update the entry in the
-  // sNPObjWrappers hash table, if present.
-
-  if (!sNPObjWrappers.ops) {
-    return;
-  }
-
-  NPObject *npobj = (NPObject *)::JS_GetPrivate(obj);
-  if (!npobj) {
-    return;
-  }
-
-  NPObjWrapperHashEntry *entry = static_cast<NPObjWrapperHashEntry *>
-    (PL_DHashTableOperate(&sNPObjWrappers, npobj, PL_DHASH_LOOKUP));
-  MOZ_ASSERT(PL_DHASH_ENTRY_IS_BUSY(entry) && entry->mJSObj);
-  MOZ_ASSERT(entry->mJSObj == old);
-  entry->mJSObj = obj;
-}
-
 static bool
 NPObjWrapper_Call(JSContext *cx, unsigned argc, JS::Value *vp)
 {
@@ -1799,11 +1657,14 @@ NPObjWrapper_Construct(JSContext *cx, unsigned argc, JS::Value *vp)
   return CallNPMethodInternal(cx, obj, args.length(), args.array(), vp, true);
 }
 
-bool
-nsNPObjWrapper::IsWrapper(JSObject *obj)
+class NPObjWrapperHashEntry : public PLDHashEntryHdr
 {
-  return js::GetObjectClass(obj) == &sNPObjectJSWrapperClass;
-}
+public:
+  NPObject *mNPObj; // Must be the first member for the PLDHash stubs to work
+  JSObject *mJSObj;
+  NPP mNpp;
+};
+
 
 // An NPObject is going away, make sure we null out the JS object's
 // private data in case this is an NPObject that came from a plugin
@@ -1875,9 +1736,8 @@ nsNPObjWrapper::GetNewOrUsed(NPP npp, JSContext *cx, NPObject *npobj)
 
   if (!sNPObjWrappers.ops) {
     // No hash yet (or any more), initialize it.
-    if (!CreateNPObjWrapperTable()) {
-      return nullptr;
-    }
+    PL_DHashTableInit(&sNPObjWrappers, PL_DHashGetStubOps(), nullptr,
+                      sizeof(NPObjWrapperHashEntry));
   }
 
   NPObjWrapperHashEntry *entry = static_cast<NPObjWrapperHashEntry *>
@@ -1907,8 +1767,8 @@ nsNPObjWrapper::GetNewOrUsed(NPP npp, JSContext *cx, NPObject *npobj)
 
   // No existing JSObject, create one.
 
-  JS::Rooted<JSObject*> obj(cx, ::JS_NewObject(cx, js::Jsvalify(&sNPObjectJSWrapperClass),
-                                               JS::NullPtr(), JS::NullPtr()));
+  JS::Rooted<JSObject*> obj(cx, ::JS_NewObject(cx, &sNPObjectJSWrapperClass, JS::NullPtr(),
+                                               JS::NullPtr()));
 
   if (generation != sNPObjWrappers.Generation()) {
       // Reload entry if the JS_NewObject call caused a GC and reallocated
diff --git a/dom/plugins/base/nsJSNPRuntime.h b/dom/plugins/base/nsJSNPRuntime.h
index 7d1a5f5c197..7bf82265df5 100644
--- a/dom/plugins/base/nsJSNPRuntime.h
+++ b/dom/plugins/base/nsJSNPRuntime.h
@@ -36,10 +36,12 @@ public:
   const NPP mNpp;
 };
 
+extern const JSClass sNPObjectJSWrapperClass;
+
 class nsJSObjWrapper : public NPObject
 {
 public:
-  JS::Heap<JSObject *> mJSObj;
+  JS::PersistentRooted<JSObject *> mJSObj;
   const NPP mNpp;
 
   static NPObject *GetNewOrUsed(NPP npp, JSContext *cx,
@@ -76,7 +78,6 @@ public:
 class nsNPObjWrapper
 {
 public:
-  static bool IsWrapper(JSObject *obj);
   static void OnDestroy(NPObject *npobj);
   static JSObject *GetNewOrUsed(NPP npp, JSContext *cx, NPObject *npobj);
 };

From d3a4dbb05e37c375694e79e30138f80508924fb2 Mon Sep 17 00:00:00 2001
From: "Carsten \"Tomcat\" Book" <cbook@mozilla.com>
Date: Wed, 5 Nov 2014 12:57:43 +0100
Subject: [PATCH 084/153] Backed out 10 changesets (bug 1091008, bug 1093020,
 bug 1063323) for windows m2 permanent test failures on a CLOSED TREE

Backed out changeset 21ddb8a58fea (bug 1093020)
Backed out changeset fe9e11333c7d (bug 1093020)
Backed out changeset bba774c54652 (bug 1063323)
Backed out changeset 16f58d7e1e17 (bug 1091008)
Backed out changeset 649bfc6dad4d (bug 1091008)
Backed out changeset 6f270b2d90f4 (bug 1091008)
Backed out changeset 966093bbc26a (bug 1091008)
Backed out changeset 9de4746aa59a (bug 1091008)
Backed out changeset 856016c0118a (bug 1091008)
Backed out changeset 8aaa10a8d956 (bug 1091008)
---
 dom/html/HTMLMediaElement.cpp                 |  4 +-
 dom/html/TimeRanges.h                         |  9 --
 dom/media/MediaDecoder.cpp                    | 17 +---
 dom/media/MediaDecoder.h                      |  9 +-
 dom/media/MediaDecoderReader.cpp              | 14 +---
 dom/media/MediaDecoderReader.h                | 18 ++--
 dom/media/MediaDecoderStateMachine.cpp        | 66 ++++++++-------
 dom/media/MediaDecoderStateMachine.h          |  6 +-
 dom/media/MediaResource.h                     | 27 ------
 dom/media/fmp4/MP4Reader.cpp                  | 15 ++--
 dom/media/fmp4/MP4Reader.h                    |  3 +-
 dom/media/gstreamer/GStreamerReader.cpp       |  5 +-
 dom/media/gstreamer/GStreamerReader.h         |  2 +-
 dom/media/gtest/TestMP4Reader.cpp             | 16 ++--
 dom/media/mediasource/MediaSource.cpp         | 41 ++++++++++
 dom/media/mediasource/MediaSource.h           |  2 +
 dom/media/mediasource/MediaSourceDecoder.cpp  |  9 +-
 dom/media/mediasource/MediaSourceDecoder.h    |  1 -
 dom/media/mediasource/MediaSourceReader.cpp   | 51 ------------
 dom/media/mediasource/MediaSourceReader.h     |  9 --
 dom/media/mediasource/SourceBufferDecoder.cpp |  3 +-
 dom/media/mediasource/TrackBuffer.cpp         |  1 +
 dom/media/mediasource/TrackBuffer.h           |  2 +-
 dom/media/mediasource/test/mochitest.ini      |  2 -
 .../mediasource/test/test_BufferingWait.html  | 82 -------------------
 .../test/test_WaitingOnMissingData.html       | 72 ----------------
 dom/media/ogg/OggReader.cpp                   | 13 ++-
 dom/media/ogg/OggReader.h                     |  2 +-
 dom/media/omx/RtspMediaCodecReader.h          |  3 +-
 dom/media/omx/RtspOmxReader.h                 |  3 +-
 dom/media/raw/RawReader.cpp                   |  2 +-
 dom/media/raw/RawReader.h                     |  2 +-
 dom/media/wave/WaveReader.cpp                 |  9 +-
 dom/media/wave/WaveReader.h                   |  2 +-
 dom/media/webm/WebMReader.cpp                 |  7 +-
 dom/media/webm/WebMReader.h                   |  2 +-
 36 files changed, 146 insertions(+), 385 deletions(-)
 delete mode 100644 dom/media/mediasource/test/test_BufferingWait.html
 delete mode 100644 dom/media/mediasource/test/test_WaitingOnMissingData.html

diff --git a/dom/html/HTMLMediaElement.cpp b/dom/html/HTMLMediaElement.cpp
index a5e021afc8d..366cbcdc04c 100644
--- a/dom/html/HTMLMediaElement.cpp
+++ b/dom/html/HTMLMediaElement.cpp
@@ -3678,7 +3678,9 @@ HTMLMediaElement::Buffered() const
 {
   nsRefPtr<TimeRanges> ranges = new TimeRanges();
   if (mReadyState > nsIDOMHTMLMediaElement::HAVE_NOTHING) {
-    if (mDecoder) {
+    if (mMediaSource) {
+      mMediaSource->GetBuffered(ranges);
+    } else if (mDecoder) {
       // If GetBuffered fails we ignore the error result and just return the
       // time ranges we found up till the error.
       mDecoder->GetBuffered(ranges);
diff --git a/dom/html/TimeRanges.h b/dom/html/TimeRanges.h
index 8ad3c350e35..97b8b127bca 100644
--- a/dom/html/TimeRanges.h
+++ b/dom/html/TimeRanges.h
@@ -92,15 +92,6 @@ public:
   static const index_type NoIndex = index_type(-1);
 
   index_type Find(double aTime);
-
-  bool Contains(double aStart, double aEnd) {
-    index_type target = Find(aStart);
-    if (target == NoIndex) {
-      return false;
-    }
-
-    return mRanges[target].mEnd >= aEnd;
-  }
 };
 
 } // namespace dom
diff --git a/dom/media/MediaDecoder.cpp b/dom/media/MediaDecoder.cpp
index c386459968f..bdb28990768 100644
--- a/dom/media/MediaDecoder.cpp
+++ b/dom/media/MediaDecoder.cpp
@@ -679,22 +679,11 @@ void MediaDecoder::QueueMetadata(int64_t aPublishTime,
 }
 
 bool
-MediaDecoder::IsExpectingMoreData()
+MediaDecoder::IsDataCachedToEndOfResource()
 {
   ReentrantMonitorAutoEnter mon(GetReentrantMonitor());
-
-  // If there's no resource, we're probably just getting set up.
-  if (!mResource) {
-    return true;
-  }
-
-  // If we've downloaded anything, we're not waiting for anything.
-  if (mResource->IsDataCachedToEndOfResource(mDecoderPosition)) {
-    return false;
-  }
-
-  // Otherwise, we should be getting data unless the stream is suspended.
-  return !mResource->IsSuspended();
+  return (mResource &&
+          mResource->IsDataCachedToEndOfResource(mDecoderPosition));
 }
 
 void MediaDecoder::MetadataLoaded(MediaInfo* aInfo, MetadataTags* aTags)
diff --git a/dom/media/MediaDecoder.h b/dom/media/MediaDecoder.h
index cf602de2f73..d0026a907f6 100644
--- a/dom/media/MediaDecoder.h
+++ b/dom/media/MediaDecoder.h
@@ -798,12 +798,9 @@ public:
   // Call on the main thread only.
   void FirstFrameLoaded();
 
-  // Returns true if the this decoder is expecting any more data to arrive
-  // sometime in the not-too-distant future, either from the network or from
-  // an appendBuffer call on a MediaSource element.
-  //
-  // Acquires the monitor. Call from any thread.
-  virtual bool IsExpectingMoreData();
+  // Returns true if the resource has been loaded. Acquires the monitor.
+  // Call from any thread.
+  virtual bool IsDataCachedToEndOfResource();
 
   // Called when the video has completed playing.
   // Call on the main thread only.
diff --git a/dom/media/MediaDecoderReader.cpp b/dom/media/MediaDecoderReader.cpp
index bebaf17c723..0ba1c1091d4 100644
--- a/dom/media/MediaDecoderReader.cpp
+++ b/dom/media/MediaDecoderReader.cpp
@@ -6,7 +6,6 @@
 
 #include "MediaDecoderReader.h"
 #include "AbstractMediaDecoder.h"
-#include "MediaResource.h"
 #include "VideoUtils.h"
 #include "ImageContainer.h"
 
@@ -62,7 +61,6 @@ MediaDecoderReader::MediaDecoderReader(AbstractMediaDecoder* aDecoder)
   : mAudioCompactor(mAudioQueue)
   , mDecoder(aDecoder)
   , mIgnoreAudioOutputFormat(false)
-  , mStartTime(-1)
   , mAudioDiscontinuity(false)
   , mVideoDiscontinuity(false)
 {
@@ -122,17 +120,11 @@ VideoData* MediaDecoderReader::DecodeToFirstVideoData()
   return (d = VideoQueue().PeekFront()) ? d : nullptr;
 }
 
-void
-MediaDecoderReader::SetStartTime(int64_t aStartTime)
-{
-  mDecoder->GetReentrantMonitor().AssertCurrentThreadIn();
-  mStartTime = aStartTime;
-}
-
 nsresult
-MediaDecoderReader::GetBuffered(mozilla::dom::TimeRanges* aBuffered)
+MediaDecoderReader::GetBuffered(mozilla::dom::TimeRanges* aBuffered,
+                                int64_t aStartTime)
 {
-  AutoPinned<MediaResource> stream(mDecoder->GetResource());
+  MediaResource* stream = mDecoder->GetResource();
   int64_t durationUs = 0;
   {
     ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
diff --git a/dom/media/MediaDecoderReader.h b/dom/media/MediaDecoderReader.h
index 2a2fc666e85..576539680d9 100644
--- a/dom/media/MediaDecoderReader.h
+++ b/dom/media/MediaDecoderReader.h
@@ -129,7 +129,9 @@ public:
     mIgnoreAudioOutputFormat = true;
   }
 
-  // Populates aBuffered with the time ranges which are buffered. This function
+  // Populates aBuffered with the time ranges which are buffered. aStartTime
+  // must be the presentation time of the first frame in the media, e.g.
+  // the media time corresponding to playback time/position 0. This function
   // is called on the main, decode, and state machine threads.
   //
   // This base implementation in MediaDecoderReader estimates the time ranges
@@ -143,15 +145,11 @@ public:
   // The OggReader relies on this base implementation not performing I/O,
   // since in FirefoxOS we can't do I/O on the main thread, where this is
   // called.
-  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered);
+  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered,
+                               int64_t aStartTime);
 
   virtual int64_t ComputeStartTime(const VideoData* aVideo, const AudioData* aAudio);
 
-  // Wait this number of seconds when buffering, then leave and play
-  // as best as we can if the required amount of data hasn't been
-  // retrieved.
-  virtual uint32_t GetBufferingWait() { return 30; }
-
   // Returns the number of bytes of memory allocated by structures/frames in
   // the video queue.
   size_t SizeOfVideoQueueInBytes() const;
@@ -181,7 +179,6 @@ public:
   // Indicates if the media is seekable.
   // ReadMetada should be called before calling this method.
   virtual bool IsMediaSeekable() = 0;
-  void SetStartTime(int64_t aStartTime);
 
 protected:
   virtual ~MediaDecoderReader();
@@ -238,11 +235,6 @@ protected:
   // what we support.
   bool mIgnoreAudioOutputFormat;
 
-  // The start time of the media, in microseconds. This is the presentation
-  // time of the first frame decoded from the media. This is initialized to -1,
-  // and then set to a value >= by MediaDecoderStateMachine::SetStartTime(),
-  // after which point it never changes.
-  int64_t mStartTime;
 private:
 
   nsRefPtr<RequestSampleCallback> mSampleDecodedCallback;
diff --git a/dom/media/MediaDecoderStateMachine.cpp b/dom/media/MediaDecoderStateMachine.cpp
index 0b545de2934..86549e7b15d 100644
--- a/dom/media/MediaDecoderStateMachine.cpp
+++ b/dom/media/MediaDecoderStateMachine.cpp
@@ -84,6 +84,11 @@ extern PRLogModuleInfo* gMediaDecoderLog;
 #undef GetCurrentTime
 #endif
 
+// Wait this number of seconds when buffering, then leave and play
+// as best as we can if the required amount of data hasn't been
+// retrieved.
+static const uint32_t BUFFERING_WAIT_S = 30;
+
 // If audio queue has less than this many usecs of decoded audio, we won't risk
 // trying to decode the video, we'll skip decoding video up to the next
 // keyframe. We may increase this value for an individual decoder if we
@@ -218,7 +223,7 @@ MediaDecoderStateMachine::MediaDecoderStateMachine(MediaDecoder* aDecoder,
   mAmpleVideoFrames =
     std::max<uint32_t>(Preferences::GetUint("media.video-queue.default-size", 10), 3);
 
-  mBufferingWait = mScheduler->IsRealTime() ? 0 : mReader->GetBufferingWait();
+  mBufferingWait = mScheduler->IsRealTime() ? 0 : BUFFERING_WAIT_S;
   mLowDataThresholdUsecs = mScheduler->IsRealTime() ? 0 : LOW_DATA_THRESHOLD_USECS;
 
   mVideoPrerollFrames = mScheduler->IsRealTime() ? 0 : mAmpleVideoFrames / 2;
@@ -1489,11 +1494,8 @@ void MediaDecoderStateMachine::NotifyDataArrived(const char* aBuffer,
   // faster than played, mEndTime won't reflect the end of playable data
   // since we haven't played the frame at the end of buffered data. So update
   // mEndTime here as new data is downloaded to prevent such a lag.
-  //
-  // Make sure to only do this if we have a start time, otherwise the reader
-  // doesn't know how to compute GetBuffered.
   nsRefPtr<dom::TimeRanges> buffered = new dom::TimeRanges();
-  if (mDecoder->IsInfinite() && (mStartTime != -1) &&
+  if (mDecoder->IsInfinite() &&
       NS_SUCCEEDED(mDecoder->GetBuffered(buffered)))
   {
     uint32_t length = 0;
@@ -1850,29 +1852,28 @@ bool MediaDecoderStateMachine::HasLowUndecodedData()
   return HasLowUndecodedData(mLowDataThresholdUsecs);
 }
 
-bool MediaDecoderStateMachine::HasLowUndecodedData(int64_t aUsecs)
+bool MediaDecoderStateMachine::HasLowUndecodedData(double aUsecs)
 {
   AssertCurrentThreadInMonitor();
   NS_ASSERTION(mState > DECODER_STATE_DECODING_METADATA,
                "Must have loaded metadata for GetBuffered() to work");
 
-  nsRefPtr<dom::TimeRanges> buffered = new dom::TimeRanges();
-  nsresult rv = mReader->GetBuffered(buffered.get());
-  NS_ENSURE_SUCCESS(rv, false);
-
-  int64_t endOfDecodedVideoData = INT64_MAX;
-  if (HasVideo() && !VideoQueue().AtEndOfStream()) {
-    endOfDecodedVideoData = VideoQueue().Peek() ? VideoQueue().Peek()->GetEndTime() : mVideoFrameEndTime;
+  bool reliable;
+  double bytesPerSecond = mDecoder->ComputePlaybackRate(&reliable);
+  if (!reliable) {
+    // Default to assuming we have enough
+    return false;
   }
-  int64_t endOfDecodedAudioData = INT64_MAX;
-  if (HasAudio() && !AudioQueue().AtEndOfStream()) {
-    endOfDecodedAudioData = AudioQueue().Peek() ? AudioQueue().Peek()->GetEndTime() : GetAudioClock();
-  }
-  int64_t endOfDecodedData = std::min(endOfDecodedVideoData, endOfDecodedAudioData);
 
-  return endOfDecodedData != INT64_MAX &&
-         !buffered->Contains(static_cast<double>(endOfDecodedData) / USECS_PER_S,
-                             static_cast<double>(std::min(endOfDecodedData + aUsecs, GetDuration())) / USECS_PER_S);
+  MediaResource* stream = mDecoder->GetResource();
+  int64_t currentPos = stream->Tell();
+  int64_t requiredPos = currentPos + int64_t((aUsecs/1000000.0)*bytesPerSecond);
+  int64_t length = stream->GetLength();
+  if (length >= 0) {
+    requiredPos = std::min(requiredPos, length);
+  }
+
+  return stream->GetCachedDataEnd(currentPos) < requiredPos;
 }
 
 void
@@ -2420,8 +2421,9 @@ nsresult MediaDecoderStateMachine::RunStateMachine()
       if ((isLiveStream || !mDecoder->CanPlayThrough()) &&
             elapsed < TimeDuration::FromSeconds(mBufferingWait * mPlaybackRate) &&
             (mQuickBuffering ? HasLowDecodedData(QUICK_BUFFERING_LOW_DATA_USECS)
-                             : HasLowUndecodedData(mBufferingWait * USECS_PER_S)) &&
-            mDecoder->IsExpectingMoreData())
+                            : HasLowUndecodedData(mBufferingWait * USECS_PER_S)) &&
+            !mDecoder->IsDataCachedToEndOfResource() &&
+            !resource->IsSuspended())
       {
         DECODER_LOG("Buffering: wait %ds, timeout in %.3lfs %s",
                     mBufferingWait, mBufferingWait - elapsed.ToSeconds(),
@@ -2680,10 +2682,12 @@ void MediaDecoderStateMachine::AdvanceFrame()
 
   // Check to see if we don't have enough data to play up to the next frame.
   // If we don't, switch to buffering mode.
+  MediaResource* resource = mDecoder->GetResource();
   if (mState == DECODER_STATE_DECODING &&
       mDecoder->GetState() == MediaDecoder::PLAY_STATE_PLAYING &&
       HasLowDecodedData(remainingTime + EXHAUSTED_DATA_MARGIN_USECS) &&
-      mDecoder->IsExpectingMoreData()) {
+      !mDecoder->IsDataCachedToEndOfResource() &&
+      !resource->IsSuspended()) {
     if (JustExitedQuickBuffering() || HasLowUndecodedData()) {
       if (currentFrame) {
         VideoQueue().PushFront(currentFrame.forget());
@@ -2889,11 +2893,6 @@ void MediaDecoderStateMachine::SetStartTime(int64_t aStartTimeUsecs)
       mEndTime = mStartTime + mEndTime;
     }
   }
-
-  // Pass along this immutable value to the reader so that it can make
-  // calculations independently of the state machine.
-  mReader->SetStartTime(mStartTime);
-
   // Set the audio start time to be start of media. If this lies before the
   // first actual audio frame we have, we'll inject silence during playback
   // to ensure the audio starts at the correct time.
@@ -2981,6 +2980,15 @@ void MediaDecoderStateMachine::StartBuffering()
 #endif
 }
 
+nsresult MediaDecoderStateMachine::GetBuffered(dom::TimeRanges* aBuffered) {
+  MediaResource* resource = mDecoder->GetResource();
+  NS_ENSURE_TRUE(resource, NS_ERROR_FAILURE);
+  resource->Pin();
+  nsresult res = mReader->GetBuffered(aBuffered, mStartTime);
+  resource->Unpin();
+  return res;
+}
+
 void MediaDecoderStateMachine::SetPlayStartTime(const TimeStamp& aTimeStamp)
 {
   AssertCurrentThreadInMonitor();
diff --git a/dom/media/MediaDecoderStateMachine.h b/dom/media/MediaDecoderStateMachine.h
index a35741158ab..f334a1c2962 100644
--- a/dom/media/MediaDecoderStateMachine.h
+++ b/dom/media/MediaDecoderStateMachine.h
@@ -254,9 +254,7 @@ public:
     return mState == DECODER_STATE_SEEKING;
   }
 
-  nsresult GetBuffered(dom::TimeRanges* aBuffered) {
-    return mReader->GetBuffered(aBuffered);
-  }
+  nsresult GetBuffered(dom::TimeRanges* aBuffered);
 
   void SetPlaybackRate(double aPlaybackRate);
   void SetPreservesPitch(bool aPreservesPitch);
@@ -427,7 +425,7 @@ protected:
   bool HasLowUndecodedData();
 
   // Returns true if we have less than aUsecs of undecoded data available.
-  bool HasLowUndecodedData(int64_t aUsecs);
+  bool HasLowUndecodedData(double aUsecs);
 
   // Returns the number of unplayed usecs of audio we've got decoded and/or
   // pushed to the hardware waiting to play. This is how much audio we can
diff --git a/dom/media/MediaResource.h b/dom/media/MediaResource.h
index 1be171208c8..f9ff63b5ef3 100644
--- a/dom/media/MediaResource.h
+++ b/dom/media/MediaResource.h
@@ -718,33 +718,6 @@ protected:
   bool mIsTransportSeekable;
 };
 
-/**
- * RAII class that handles pinning and unpinning for MediaResource and derived.
- * This should be used when making calculations that involve potentially-cached
- * MediaResource data, so that the state of the world can't change out from under
- * us.
- */
-template<class T>
-class MOZ_STACK_CLASS AutoPinned {
- public:
-  explicit AutoPinned(T* aResource MOZ_GUARD_OBJECT_NOTIFIER_PARAM) : mResource(aResource) {
-    MOZ_GUARD_OBJECT_NOTIFIER_INIT;
-    MOZ_ASSERT(mResource);
-    mResource->Pin();
-  }
-
-  ~AutoPinned() {
-    mResource->Unpin();
-  }
-
-  operator T*() const { return mResource; }
-  T* operator->() const { return mResource; }
-
-private:
-  T* mResource;
-  MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
-};
-
 } // namespace mozilla
 
 #endif
diff --git a/dom/media/fmp4/MP4Reader.cpp b/dom/media/fmp4/MP4Reader.cpp
index e627f2e8371..44231c0ed08 100644
--- a/dom/media/fmp4/MP4Reader.cpp
+++ b/dom/media/fmp4/MP4Reader.cpp
@@ -800,11 +800,13 @@ MP4Reader::UpdateIndex()
     return;
   }
 
-  AutoPinned<MediaResource> resource(mDecoder->GetResource());
+  MediaResource* resource = mDecoder->GetResource();
+  resource->Pin();
   nsTArray<MediaByteRange> ranges;
   if (NS_SUCCEEDED(resource->GetCachedRanges(ranges))) {
     mDemuxer->UpdateIndex(ranges);
   }
+  resource->Unpin();
 }
 
 int64_t
@@ -819,24 +821,25 @@ MP4Reader::GetEvictionOffset(double aTime)
 }
 
 nsresult
-MP4Reader::GetBuffered(dom::TimeRanges* aBuffered)
+MP4Reader::GetBuffered(dom::TimeRanges* aBuffered, int64_t aStartTime)
 {
   MonitorAutoLock mon(mIndexMonitor);
   if (!mIndexReady) {
     return NS_OK;
   }
-  MOZ_ASSERT(mStartTime != -1, "Need to finish metadata decode first");
 
-  AutoPinned<MediaResource> resource(mDecoder->GetResource());
+  MediaResource* resource = mDecoder->GetResource();
   nsTArray<MediaByteRange> ranges;
+  resource->Pin();
   nsresult rv = resource->GetCachedRanges(ranges);
+  resource->Unpin();
 
   if (NS_SUCCEEDED(rv)) {
     nsTArray<Interval<Microseconds>> timeRanges;
     mDemuxer->ConvertByteRangesToTime(ranges, &timeRanges);
     for (size_t i = 0; i < timeRanges.Length(); i++) {
-      aBuffered->Add((timeRanges[i].start - mStartTime) / 1000000.0,
-                     (timeRanges[i].end - mStartTime) / 1000000.0);
+      aBuffered->Add((timeRanges[i].start - aStartTime) / 1000000.0,
+                     (timeRanges[i].end - aStartTime) / 1000000.0);
     }
   }
 
diff --git a/dom/media/fmp4/MP4Reader.h b/dom/media/fmp4/MP4Reader.h
index 517431dd0b5..43f816e5e0e 100644
--- a/dom/media/fmp4/MP4Reader.h
+++ b/dom/media/fmp4/MP4Reader.h
@@ -57,7 +57,8 @@ public:
 
   virtual int64_t GetEvictionOffset(double aTime) MOZ_OVERRIDE;
 
-  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered) MOZ_OVERRIDE;
+  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered,
+                               int64_t aStartTime) MOZ_OVERRIDE;
 
   // For Media Resource Management
   virtual bool IsWaitingMediaResources() MOZ_OVERRIDE;
diff --git a/dom/media/gstreamer/GStreamerReader.cpp b/dom/media/gstreamer/GStreamerReader.cpp
index 94e5c37cb8f..abc95131a55 100644
--- a/dom/media/gstreamer/GStreamerReader.cpp
+++ b/dom/media/gstreamer/GStreamerReader.cpp
@@ -815,7 +815,8 @@ nsresult GStreamerReader::Seek(int64_t aTarget,
   return NS_OK;
 }
 
-nsresult GStreamerReader::GetBuffered(dom::TimeRanges* aBuffered)
+nsresult GStreamerReader::GetBuffered(dom::TimeRanges* aBuffered,
+                                      int64_t aStartTime)
 {
   if (!mInfo.HasValidMedia()) {
     return NS_OK;
@@ -824,7 +825,7 @@ nsresult GStreamerReader::GetBuffered(dom::TimeRanges* aBuffered)
 #if GST_VERSION_MAJOR == 0
   GstFormat format = GST_FORMAT_TIME;
 #endif
-  AutoPinned<MediaResource> resource(mDecoder->GetResource());
+  MediaResource* resource = mDecoder->GetResource();
   nsTArray<MediaByteRange> ranges;
   resource->GetCachedRanges(ranges);
 
diff --git a/dom/media/gstreamer/GStreamerReader.h b/dom/media/gstreamer/GStreamerReader.h
index 8c816e01d55..c2a14dc5a9f 100644
--- a/dom/media/gstreamer/GStreamerReader.h
+++ b/dom/media/gstreamer/GStreamerReader.h
@@ -52,7 +52,7 @@ public:
                         int64_t aStartTime,
                         int64_t aEndTime,
                         int64_t aCurrentTime);
-  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered);
+  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered, int64_t aStartTime);
 
   virtual void NotifyDataArrived(const char *aBuffer,
                                  uint32_t aLength,
diff --git a/dom/media/gtest/TestMP4Reader.cpp b/dom/media/gtest/TestMP4Reader.cpp
index 4a13b92df63..6c464b12e9b 100644
--- a/dom/media/gtest/TestMP4Reader.cpp
+++ b/dom/media/gtest/TestMP4Reader.cpp
@@ -36,12 +36,6 @@ public:
     decoder->SetResource(resource);
 
     reader->Init(nullptr);
-    {
-      // This needs to be done before invoking GetBuffered. This is normally
-      // done by MediaDecoderStateMachine.
-      ReentrantMonitorAutoEnter mon(decoder->GetReentrantMonitor());
-      reader->SetStartTime(0);
-    }
   }
 
   void Init() {
@@ -78,7 +72,7 @@ TEST(MP4Reader, BufferedRange)
   b->resource->MockAddBufferedRange(248400, 327455);
 
   nsRefPtr<TimeRanges> ranges = new TimeRanges();
-  EXPECT_EQ(NS_OK, b->reader->GetBuffered(ranges));
+  EXPECT_EQ(NS_OK, b->reader->GetBuffered(ranges, 0));
   EXPECT_EQ(1U, ranges->Length());
   double start = 0;
   EXPECT_EQ(NS_OK, ranges->Start(0, &start));
@@ -99,7 +93,7 @@ TEST(MP4Reader, BufferedRangeMissingLastByte)
   b->resource->MockAddBufferedRange(324913, 327455);
 
   nsRefPtr<TimeRanges> ranges = new TimeRanges();
-  EXPECT_EQ(NS_OK, b->reader->GetBuffered(ranges));
+  EXPECT_EQ(NS_OK, b->reader->GetBuffered(ranges, 0));
   EXPECT_EQ(1U, ranges->Length());
   double start = 0;
   EXPECT_EQ(NS_OK, ranges->Start(0, &start));
@@ -120,7 +114,7 @@ TEST(MP4Reader, BufferedRangeSyncFrame)
   b->resource->MockAddBufferedRange(146336, 327455);
 
   nsRefPtr<TimeRanges> ranges = new TimeRanges();
-  EXPECT_EQ(NS_OK, b->reader->GetBuffered(ranges));
+  EXPECT_EQ(NS_OK, b->reader->GetBuffered(ranges, 0));
   EXPECT_EQ(1U, ranges->Length());
   double start = 0;
   EXPECT_EQ(NS_OK, ranges->Start(0, &start));
@@ -178,7 +172,7 @@ TEST(MP4Reader, CompositionOrder)
   b->resource->MockAddBufferedRange(13220, 13901);
 
   nsRefPtr<TimeRanges> ranges = new TimeRanges();
-  EXPECT_EQ(NS_OK, b->reader->GetBuffered(ranges));
+  EXPECT_EQ(NS_OK, b->reader->GetBuffered(ranges, 0));
   EXPECT_EQ(2U, ranges->Length());
 
   double start = 0;
@@ -228,7 +222,7 @@ TEST(MP4Reader, Normalised)
   b->resource->MockAddBufferedRange(48, 13901);
 
   nsRefPtr<TimeRanges> ranges = new TimeRanges();
-  EXPECT_EQ(NS_OK, b->reader->GetBuffered(ranges));
+  EXPECT_EQ(NS_OK, b->reader->GetBuffered(ranges, 0));
   EXPECT_EQ(1U, ranges->Length());
 
   double start = 0;
diff --git a/dom/media/mediasource/MediaSource.cpp b/dom/media/mediasource/MediaSource.cpp
index 3f047a2bb2a..547b42846ed 100644
--- a/dom/media/mediasource/MediaSource.cpp
+++ b/dom/media/mediasource/MediaSource.cpp
@@ -350,6 +350,47 @@ MediaSource::Detach()
   }
 }
 
+void
+MediaSource::GetBuffered(TimeRanges* aBuffered)
+{
+  MOZ_ASSERT(aBuffered->Length() == 0);
+  if (mActiveSourceBuffers->IsEmpty()) {
+    return;
+  }
+
+  double highestEndTime = 0;
+
+  nsTArray<nsRefPtr<TimeRanges>> activeRanges;
+  for (uint32_t i = 0; i < mActiveSourceBuffers->Length(); ++i) {
+    bool found;
+    SourceBuffer* sourceBuffer = mActiveSourceBuffers->IndexedGetter(i, found);
+
+    ErrorResult dummy;
+    *activeRanges.AppendElement() = sourceBuffer->GetBuffered(dummy);
+
+    highestEndTime = std::max(highestEndTime, activeRanges.LastElement()->GetEndTime());
+  }
+
+  TimeRanges* intersectionRanges = aBuffered;
+  intersectionRanges->Add(0, highestEndTime);
+
+  for (uint32_t i = 0; i < activeRanges.Length(); ++i) {
+    TimeRanges* sourceRanges = activeRanges[i];
+
+    if (mReadyState == MediaSourceReadyState::Ended) {
+      // Set the end time on the last range to highestEndTime by adding a
+      // new range spanning the current end time to highestEndTime, which
+      // Normalize() will then merge with the old last range.
+      sourceRanges->Add(sourceRanges->GetEndTime(), highestEndTime);
+      sourceRanges->Normalize();
+    }
+
+    intersectionRanges->Intersection(sourceRanges);
+  }
+
+  MSE_DEBUG("MediaSource(%p)::GetBuffered ranges=%s", this, DumpTimeRanges(intersectionRanges).get());
+}
+
 MediaSource::MediaSource(nsPIDOMWindow* aWindow)
   : DOMEventTargetHelper(aWindow)
   , mDuration(UnspecifiedNaN<double>())
diff --git a/dom/media/mediasource/MediaSource.h b/dom/media/mediasource/MediaSource.h
index 0698799fd3b..6a4c743685a 100644
--- a/dom/media/mediasource/MediaSource.h
+++ b/dom/media/mediasource/MediaSource.h
@@ -74,6 +74,8 @@ public:
   bool Attach(MediaSourceDecoder* aDecoder);
   void Detach();
 
+  void GetBuffered(TimeRanges* aBuffered);
+
   // Set mReadyState to aState and fire the required events at the MediaSource.
   void SetReadyState(MediaSourceReadyState aState);
 
diff --git a/dom/media/mediasource/MediaSourceDecoder.cpp b/dom/media/mediasource/MediaSourceDecoder.cpp
index 5105d1240c3..607c074353b 100644
--- a/dom/media/mediasource/MediaSourceDecoder.cpp
+++ b/dom/media/mediasource/MediaSourceDecoder.cpp
@@ -82,7 +82,7 @@ MediaSourceDecoder::GetSeekable(dom::TimeRanges* aSeekable)
     // Return empty range.
   } else if (duration > 0 && mozilla::IsInfinite(duration)) {
     nsRefPtr<dom::TimeRanges> bufferedRanges = new dom::TimeRanges();
-    mReader->GetBuffered(bufferedRanges);
+    mMediaSource->GetBuffered(bufferedRanges);
     aSeekable->Add(bufferedRanges->GetStartTime(), bufferedRanges->GetEndTime());
   } else {
     aSeekable->Add(0, duration);
@@ -164,13 +164,6 @@ MediaSourceDecoder::Ended()
   mon.NotifyAll();
 }
 
-bool
-MediaSourceDecoder::IsExpectingMoreData()
-{
-  ReentrantMonitorAutoEnter mon(GetReentrantMonitor());
-  return !mReader->IsEnded();
-}
-
 void
 MediaSourceDecoder::SetMediaSourceDuration(double aDuration)
 {
diff --git a/dom/media/mediasource/MediaSourceDecoder.h b/dom/media/mediasource/MediaSourceDecoder.h
index 22fabfec900..20aeb0d67cd 100644
--- a/dom/media/mediasource/MediaSourceDecoder.h
+++ b/dom/media/mediasource/MediaSourceDecoder.h
@@ -52,7 +52,6 @@ public:
   void OnTrackBufferConfigured(TrackBuffer* aTrackBuffer, const MediaInfo& aInfo);
 
   void Ended();
-  bool IsExpectingMoreData() MOZ_OVERRIDE;
 
   void SetMediaSourceDuration(double aDuration);
 
diff --git a/dom/media/mediasource/MediaSourceReader.cpp b/dom/media/mediasource/MediaSourceReader.cpp
index 89a90cb9064..c34413d8493 100644
--- a/dom/media/mediasource/MediaSourceReader.cpp
+++ b/dom/media/mediasource/MediaSourceReader.cpp
@@ -33,8 +33,6 @@ extern PRLogModuleInfo* GetMediaSourceAPILog();
 #define MSE_API(...)
 #endif
 
-using mozilla::dom::TimeRanges;
-
 namespace mozilla {
 
 MediaSourceReader::MediaSourceReader(MediaSourceDecoder* aDecoder)
@@ -311,15 +309,6 @@ MediaSourceReader::CreateSubDecoder(const nsACString& aType)
   if (!reader) {
     return nullptr;
   }
-
-  // MSE uses a start time of 0 everywhere. Set that immediately on the
-  // subreader to make sure that it's always in a state where we can invoke
-  // GetBuffered on it.
-  {
-    ReentrantMonitorAutoEnter mon(decoder->GetReentrantMonitor());
-    reader->SetStartTime(0);
-  }
-
   // Set a callback on the subreader that forwards calls to this reader.
   // This reader will then forward them onto the state machine via this
   // reader's callback.
@@ -448,46 +437,6 @@ MediaSourceReader::Seek(int64_t aTime, int64_t aStartTime, int64_t aEndTime,
   return NS_OK;
 }
 
-nsresult
-MediaSourceReader::GetBuffered(dom::TimeRanges* aBuffered)
-{
-  ReentrantMonitorAutoEnter mon(mDecoder->GetReentrantMonitor());
-  MOZ_ASSERT(aBuffered->Length() == 0);
-  if (mTrackBuffers.IsEmpty()) {
-    return NS_OK;
-  }
-
-  double highestEndTime = 0;
-
-  nsTArray<nsRefPtr<TimeRanges>> activeRanges;
-  for (uint32_t i = 0; i < mTrackBuffers.Length(); ++i) {
-    nsRefPtr<TimeRanges> r = new TimeRanges();
-    mTrackBuffers[i]->Buffered(r);
-    activeRanges.AppendElement(r);
-    highestEndTime = std::max(highestEndTime, activeRanges.LastElement()->GetEndTime());
-  }
-
-  TimeRanges* intersectionRanges = aBuffered;
-  intersectionRanges->Add(0, highestEndTime);
-
-  for (uint32_t i = 0; i < activeRanges.Length(); ++i) {
-    TimeRanges* sourceRanges = activeRanges[i];
-
-    if (IsEnded()) {
-      // Set the end time on the last range to highestEndTime by adding a
-      // new range spanning the current end time to highestEndTime, which
-      // Normalize() will then merge with the old last range.
-      sourceRanges->Add(sourceRanges->GetEndTime(), highestEndTime);
-      sourceRanges->Normalize();
-    }
-
-    intersectionRanges->Intersection(sourceRanges);
-  }
-
-  MSE_DEBUG("MediaSourceReader(%p)::GetBuffered ranges=%s", this, DumpTimeRanges(intersectionRanges).get());
-  return NS_OK;
-}
-
 nsresult
 MediaSourceReader::ReadMetadata(MediaInfo* aInfo, MetadataTags** aTags)
 {
diff --git a/dom/media/mediasource/MediaSourceReader.h b/dom/media/mediasource/MediaSourceReader.h
index d0e1df0a507..0544145deff 100644
--- a/dom/media/mediasource/MediaSourceReader.h
+++ b/dom/media/mediasource/MediaSourceReader.h
@@ -71,21 +71,12 @@ public:
   // as chrome/blink and assumes that we always start at t=0.
   virtual int64_t ComputeStartTime(const VideoData* aVideo, const AudioData* aAudio) MOZ_OVERRIDE { return 0; }
 
-  // Buffering waits (in which we decline to present decoded frames because we
-  // "don't have enough") don't really make sense for MSE. The delay is
-  // essentially a streaming heuristic, but JS is supposed to take care of that
-  // in the MSE world. Avoid injecting inexplicable delays.
-  virtual uint32_t GetBufferingWait() { return 0; }
-
   bool IsMediaSeekable() { return true; }
 
   nsresult ReadMetadata(MediaInfo* aInfo, MetadataTags** aTags) MOZ_OVERRIDE;
   nsresult Seek(int64_t aTime, int64_t aStartTime, int64_t aEndTime,
                 int64_t aCurrentTime) MOZ_OVERRIDE;
 
-  // Acquires the decoder monitor, and is thus callable on any thread.
-  nsresult GetBuffered(dom::TimeRanges* aBuffered) MOZ_OVERRIDE;
-
   already_AddRefed<SourceBufferDecoder> CreateSubDecoder(const nsACString& aType);
 
   void AddTrackBuffer(TrackBuffer* aTrackBuffer);
diff --git a/dom/media/mediasource/SourceBufferDecoder.cpp b/dom/media/mediasource/SourceBufferDecoder.cpp
index 8a7ec995f94..24cb642c856 100644
--- a/dom/media/mediasource/SourceBufferDecoder.cpp
+++ b/dom/media/mediasource/SourceBufferDecoder.cpp
@@ -210,7 +210,8 @@ SourceBufferDecoder::NotifyDataArrived(const char* aBuffer, uint32_t aLength, in
 nsresult
 SourceBufferDecoder::GetBuffered(dom::TimeRanges* aBuffered)
 {
-  return mReader->GetBuffered(aBuffered);
+  // XXX: Need mStartTime (from StateMachine) instead of passing 0.
+  return mReader->GetBuffered(aBuffered, 0);
 }
 
 int64_t
diff --git a/dom/media/mediasource/TrackBuffer.cpp b/dom/media/mediasource/TrackBuffer.cpp
index 185007ea446..f8e2a40fa42 100644
--- a/dom/media/mediasource/TrackBuffer.cpp
+++ b/dom/media/mediasource/TrackBuffer.cpp
@@ -191,6 +191,7 @@ double
 TrackBuffer::Buffered(dom::TimeRanges* aRanges)
 {
   ReentrantMonitorAutoEnter mon(mParentDecoder->GetReentrantMonitor());
+  MOZ_ASSERT(NS_IsMainThread());
 
   double highestEndTime = 0;
 
diff --git a/dom/media/mediasource/TrackBuffer.h b/dom/media/mediasource/TrackBuffer.h
index 3d6cded3856..3510afaa5ff 100644
--- a/dom/media/mediasource/TrackBuffer.h
+++ b/dom/media/mediasource/TrackBuffer.h
@@ -43,7 +43,7 @@ public:
 
   // Returns the highest end time of all of the buffered ranges in the
   // decoders managed by this TrackBuffer, and returns the union of the
-  // decoders buffered ranges in aRanges. This may be called on any thread.
+  // decoders buffered ranges in aRanges.
   double Buffered(dom::TimeRanges* aRanges);
 
   // Mark the current decoder's resource as ended, clear mCurrentDecoder and
diff --git a/dom/media/mediasource/test/mochitest.ini b/dom/media/mediasource/test/mochitest.ini
index bb27be932df..8ca2c7bfaf8 100644
--- a/dom/media/mediasource/test/mochitest.ini
+++ b/dom/media/mediasource/test/mochitest.ini
@@ -8,7 +8,6 @@ support-files =
 [test_MediaSource.html]
 [test_MediaSource_disabled.html]
 [test_BufferedSeek.html]
-[test_BufferingWait.html]
 [test_FrameSelection.html]
 [test_HaveMetadataUnbufferedSeek.html]
 [test_SeekableAfterEndOfStream.html]
@@ -17,4 +16,3 @@ support-files =
 [test_SeekableBeforeEndOfStreamSplit.html]
 [test_SplitAppendDelay.html]
 [test_SplitAppend.html]
-[test_WaitingOnMissingData.html]
diff --git a/dom/media/mediasource/test/test_BufferingWait.html b/dom/media/mediasource/test/test_BufferingWait.html
deleted file mode 100644
index f2bfc4ba94d..00000000000
--- a/dom/media/mediasource/test/test_BufferingWait.html
+++ /dev/null
@@ -1,82 +0,0 @@
-<!DOCTYPE html>
-<html><head>
-<meta http-equiv="content-type" content="text/html; charset=windows-1252">
-  <title>MSE: Don't get stuck buffering for too long when we have frames to show</title>
-  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <script type="text/javascript" src="mediasource.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
-</head>
-<body>
-<pre id="test"><script class="testbody" type="text/javascript">
-
-SimpleTest.waitForExplicitFinish();
-
-var receivedSourceOpen = false;
-runWithMSE(function(ms, v) {
-  ms.addEventListener("sourceopen", function() {
-    ok(true, "Receive a sourceopen event");
-    ok(!receivedSourceOpen, "Should only receive one sourceopen for this test");
-    receivedSourceOpen = true;
-    var sb = ms.addSourceBuffer("video/webm");
-    ok(sb, "Create a SourceBuffer");
-
-    function once(target, name, cb) {
-      target.addEventListener(name, function() {
-        target.removeEventListener(name, cb);
-        cb();
-      });
-    }
-    function loadSegment(typedArray) {
-      info(`Loading buffer: [${typedArray.byteOffset}, ${typedArray.byteOffset + typedArray.byteLength})`);
-      return new Promise(function(resolve, reject) {
-        once(sb, 'update', resolve);
-        sb.appendBuffer(typedArray);
-      });
-    }
-
-    function waitUntilTime(targetTime) {
-      return new Promise(function(resolve, reject) {
-        v.addEventListener("waiting", function onwaiting() {
-          info("Got a waiting event at " + v.currentTime);
-          if (v.currentTime >= targetTime) {
-            ok(true, "Reached target time of: " + targetTime);
-            v.removeEventListener("waiting", onwaiting);
-            resolve();
-          }
-        });
-      });
-    }
-
-    fetchWithXHR("seek.webm", function(arrayBuffer) {
-      sb.addEventListener('error', (e) => { ok(false, "Got Error: " + e); SimpleTest.finish(); });
-      loadSegment.bind(null, new Uint8Array(arrayBuffer, 0, 318))().then(
-      loadSegment.bind(null, new Uint8Array(arrayBuffer, 318, 25223-318))).then(
-      loadSegment.bind(null, new Uint8Array(arrayBuffer, 25223, 46712-25223))).then(
-      /* Note - Missing |46712, 67833 - 46712| segment here corresponding to (0.8, 1.2] */
-      /* Note - Missing |67833, 88966 - 67833| segment here corresponding to (1.2, 1.6]  */
-      loadSegment.bind(null, new Uint8Array(arrayBuffer, 88966))).then(function() {
-        var promise = waitUntilTime(0.7);
-        info("Playing video. It should play for a bit, then fire 'waiting'");
-        v.play();
-        return promise;
-      }).then(function() {
-        window.firstStop = Date.now();
-        loadSegment(new Uint8Array(arrayBuffer, 46712, 67833 - 46712));
-        return waitUntilTime(1.0);
-      }).then(function() {
-        var waitDuration = (Date.now() - window.firstStop) / 1000;
-        ok(waitDuration < 15, "Should not spend an inordinate amount of time buffering: " + waitDuration);
-        SimpleTest.finish();
-        /* If we allow the rest of the stream to be played, we get stuck at
-           around 2s. See bug 1093133.
-        once(v, 'ended', SimpleTest.finish.bind(SimpleTest));
-        return loadSegment(new Uint8Array(arrayBuffer, 67833, 88966 - 67833));
-        */
-      });
-    });
-  });
-});
-</script>
-</pre>
-</body>
-</html>
diff --git a/dom/media/mediasource/test/test_WaitingOnMissingData.html b/dom/media/mediasource/test/test_WaitingOnMissingData.html
deleted file mode 100644
index 10b40b19726..00000000000
--- a/dom/media/mediasource/test/test_WaitingOnMissingData.html
+++ /dev/null
@@ -1,72 +0,0 @@
-<!DOCTYPE html>
-<html><head>
-<meta http-equiv="content-type" content="text/html; charset=windows-1252">
-  <title>MSE: |waiting| event when source data is missing</title>
-  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <script type="text/javascript" src="mediasource.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
-</head>
-<body>
-<pre id="test"><script class="testbody" type="text/javascript">
-
-SimpleTest.waitForExplicitFinish();
-
-var receivedSourceOpen = false;
-runWithMSE(function(ms, v) {
-  ms.addEventListener("sourceopen", function() {
-    ok(true, "Receive a sourceopen event");
-    ok(!receivedSourceOpen, "Should only receive one sourceopen for this test");
-    receivedSourceOpen = true;
-    var sb = ms.addSourceBuffer("video/webm");
-    ok(sb, "Create a SourceBuffer");
-
-    function once(target, name, cb) {
-      target.addEventListener(name, function() {
-        target.removeEventListener(name, cb);
-        cb();
-      });
-    }
-    function loadSegment(typedArray) {
-      info(`Loading buffer: [${typedArray.byteOffset}, ${typedArray.byteOffset + typedArray.byteLength})`);
-      return new Promise(function(resolve, reject) {
-        once(sb, 'update', resolve);
-        sb.appendBuffer(typedArray);
-      });
-    }
-
-    fetchWithXHR("seek.webm", function(arrayBuffer) {
-      sb.addEventListener('error', (e) => { ok(false, "Got Error: " + e); SimpleTest.finish(); });
-      loadSegment.bind(null, new Uint8Array(arrayBuffer, 0, 318))().then(
-      loadSegment.bind(null, new Uint8Array(arrayBuffer, 318, 25223-318))).then(
-      loadSegment.bind(null, new Uint8Array(arrayBuffer, 25223, 46712-25223))).then(
-      /* Note - Missing |46712, 67833 - 46712| segment here */
-      loadSegment.bind(null, new Uint8Array(arrayBuffer, 67833, 88966 - 67833))).then(
-      loadSegment.bind(null, new Uint8Array(arrayBuffer, 88966))).then(function() {
-
-        v.addEventListener("waiting", function onwaiting() {
-          ok(true, "Got a waiting event at " + v.currentTime);
-          if (v.currentTime > 0.7 && v.currentTime < 1.2) {
-            v.removeEventListener("waiting", onwaiting);
-            todo(v.currentTime >= 0.8, "See bug 1091774");
-            gotWaiting = true;
-            ok(true, "Received waiting event at time " + v.currentTime);
-            loadSegment(new Uint8Array(arrayBuffer, 46712, 67833 - 46712)).then(() => ms.endOfStream());
-          }
-        });
-
-        info("Playing video. It should play for a bit, then fire 'waiting'");
-        v.play();
-      });
-    });
-  });
-  v.addEventListener("ended", function () {
-    ok(Math.abs(v.duration - 4) < 0.1, "Video has correct duration. This fuzz factor is due to bug 1065207");
-    is(v.currentTime, v.duration, "Video has correct current time: " + v.currentTime);
-    ok(gotWaiting, "Received waiting event and playback continued after data added");
-    SimpleTest.finish();
-  });
-});
-</script>
-</pre>
-</body>
-</html>
diff --git a/dom/media/ogg/OggReader.cpp b/dom/media/ogg/OggReader.cpp
index 54779f859da..e0b52df3658 100644
--- a/dom/media/ogg/OggReader.cpp
+++ b/dom/media/ogg/OggReader.cpp
@@ -1881,16 +1881,15 @@ nsresult OggReader::SeekBisection(int64_t aTarget,
   return NS_OK;
 }
 
-nsresult OggReader::GetBuffered(dom::TimeRanges* aBuffered)
+nsresult OggReader::GetBuffered(dom::TimeRanges* aBuffered, int64_t aStartTime)
 {
-  MOZ_ASSERT(mStartTime != -1, "Need to finish metadata decode first");
   {
     mozilla::ReentrantMonitorAutoEnter mon(mMonitor);
     if (mIsChained)
       return NS_ERROR_FAILURE;
   }
 #ifdef OGG_ESTIMATE_BUFFERED
-  return MediaDecoderReader::GetBuffered(aBuffered);
+  return MediaDecoderReader::GetBuffered(aBuffered, aStartTime);
 #else
   // HasAudio and HasVideo are not used here as they take a lock and cause
   // a deadlock. Accessing mInfo doesn't require a lock - it doesn't change
@@ -1900,7 +1899,7 @@ nsresult OggReader::GetBuffered(dom::TimeRanges* aBuffered)
     return NS_OK;
   }
 
-  AutoPinned<MediaResource> resource(mDecoder->GetResource());
+  MediaResource* resource = mDecoder->GetResource();
   nsTArray<MediaByteRange> ranges;
   nsresult res = resource->GetCachedRanges(ranges);
   NS_ENSURE_SUCCESS(res, res);
@@ -1920,7 +1919,7 @@ nsresult OggReader::GetBuffered(dom::TimeRanges* aBuffered)
     // we special-case (startOffset == 0) so that the first
     // buffered range always appears to be buffered from the media start
     // time, rather than from the end-time of the first page.
-    int64_t startTime = (startOffset == 0) ? mStartTime : -1;
+    int64_t startTime = (startOffset == 0) ? aStartTime : -1;
 
     // Find the start time of the range. Read pages until we find one with a
     // granulepos which we can convert into a timestamp to use as the time of
@@ -1988,8 +1987,8 @@ nsresult OggReader::GetBuffered(dom::TimeRanges* aBuffered)
       // find an end time.
       int64_t endTime = RangeEndTime(startOffset, endOffset, true);
       if (endTime != -1) {
-        aBuffered->Add((startTime - mStartTime) / static_cast<double>(USECS_PER_S),
-                       (endTime - mStartTime) / static_cast<double>(USECS_PER_S));
+        aBuffered->Add((startTime - aStartTime) / static_cast<double>(USECS_PER_S),
+                       (endTime - aStartTime) / static_cast<double>(USECS_PER_S));
       }
     }
   }
diff --git a/dom/media/ogg/OggReader.h b/dom/media/ogg/OggReader.h
index ef3b03e8237..12a581b56a4 100644
--- a/dom/media/ogg/OggReader.h
+++ b/dom/media/ogg/OggReader.h
@@ -79,7 +79,7 @@ public:
   virtual nsresult ReadMetadata(MediaInfo* aInfo,
                                 MetadataTags** aTags);
   virtual nsresult Seek(int64_t aTime, int64_t aStartTime, int64_t aEndTime, int64_t aCurrentTime);
-  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered);
+  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered, int64_t aStartTime);
 
   virtual bool IsMediaSeekable() MOZ_OVERRIDE;
 
diff --git a/dom/media/omx/RtspMediaCodecReader.h b/dom/media/omx/RtspMediaCodecReader.h
index c7c0714672e..37d32c7d8e4 100644
--- a/dom/media/omx/RtspMediaCodecReader.h
+++ b/dom/media/omx/RtspMediaCodecReader.h
@@ -48,7 +48,8 @@ public:
   // we returned are not useful for the MediaDecodeStateMachine. Unlike the
   // ChannelMediaResource, it has a "cache" that can store the whole streaming
   // data so the |GetBuffered| function can retrieve useful time ranges.
-  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered) MOZ_OVERRIDE {
+  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered,
+                               int64_t aStartTime) MOZ_OVERRIDE {
     return NS_OK;
   }
 
diff --git a/dom/media/omx/RtspOmxReader.h b/dom/media/omx/RtspOmxReader.h
index f7af4489001..7ec425f3ef3 100644
--- a/dom/media/omx/RtspOmxReader.h
+++ b/dom/media/omx/RtspOmxReader.h
@@ -58,7 +58,8 @@ public:
   // we returned are not useful for the MediaDecodeStateMachine. Unlike the
   // ChannelMediaResource, it has a "cache" that can store the whole streaming
   // data so the |GetBuffered| function can retrieve useful time ranges.
-  virtual nsresult GetBuffered(mozilla::dom::TimeRanges* aBuffered) MOZ_FINAL MOZ_OVERRIDE {
+  virtual nsresult GetBuffered(mozilla::dom::TimeRanges* aBuffered,
+                               int64_t aStartTime) MOZ_FINAL MOZ_OVERRIDE {
     return NS_OK;
   }
 
diff --git a/dom/media/raw/RawReader.cpp b/dom/media/raw/RawReader.cpp
index 440dce85ce1..49aab9a949c 100644
--- a/dom/media/raw/RawReader.cpp
+++ b/dom/media/raw/RawReader.cpp
@@ -284,7 +284,7 @@ nsresult RawReader::Seek(int64_t aTime, int64_t aStartTime, int64_t aEndTime, in
   return NS_OK;
 }
 
-nsresult RawReader::GetBuffered(dom::TimeRanges* aBuffered)
+nsresult RawReader::GetBuffered(dom::TimeRanges* aBuffered, int64_t aStartTime)
 {
   return NS_OK;
 }
diff --git a/dom/media/raw/RawReader.h b/dom/media/raw/RawReader.h
index de4b80793ef..b1f91932a90 100644
--- a/dom/media/raw/RawReader.h
+++ b/dom/media/raw/RawReader.h
@@ -40,7 +40,7 @@ public:
   virtual nsresult ReadMetadata(MediaInfo* aInfo,
                                 MetadataTags** aTags);
   virtual nsresult Seek(int64_t aTime, int64_t aStartTime, int64_t aEndTime, int64_t aCurrentTime);
-  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered);
+  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered, int64_t aStartTime);
 
   virtual bool IsMediaSeekable() MOZ_OVERRIDE;
 
diff --git a/dom/media/wave/WaveReader.cpp b/dom/media/wave/WaveReader.cpp
index b568dfba1e2..2476b6134cb 100644
--- a/dom/media/wave/WaveReader.cpp
+++ b/dom/media/wave/WaveReader.cpp
@@ -278,15 +278,14 @@ static double RoundToUsecs(double aSeconds) {
   return floor(aSeconds * USECS_PER_S) / USECS_PER_S;
 }
 
-nsresult WaveReader::GetBuffered(dom::TimeRanges* aBuffered)
+nsresult WaveReader::GetBuffered(dom::TimeRanges* aBuffered, int64_t aStartTime)
 {
   if (!mInfo.HasAudio()) {
     return NS_OK;
   }
-  AutoPinned<MediaResource> resource(mDecoder->GetResource());
-  int64_t startOffset = resource->GetNextCachedData(mWavePCMOffset);
+  int64_t startOffset = mDecoder->GetResource()->GetNextCachedData(mWavePCMOffset);
   while (startOffset >= 0) {
-    int64_t endOffset = resource->GetCachedDataEnd(startOffset);
+    int64_t endOffset = mDecoder->GetResource()->GetCachedDataEnd(startOffset);
     // Bytes [startOffset..endOffset] are cached.
     NS_ASSERTION(startOffset >= mWavePCMOffset, "Integer underflow in GetBuffered");
     NS_ASSERTION(endOffset >= mWavePCMOffset, "Integer underflow in GetBuffered");
@@ -296,7 +295,7 @@ nsresult WaveReader::GetBuffered(dom::TimeRanges* aBuffered)
     // the media element.
     aBuffered->Add(RoundToUsecs(BytesToTime(startOffset - mWavePCMOffset)),
                    RoundToUsecs(BytesToTime(endOffset - mWavePCMOffset)));
-    startOffset = resource->GetNextCachedData(endOffset);
+    startOffset = mDecoder->GetResource()->GetNextCachedData(endOffset);
   }
   return NS_OK;
 }
diff --git a/dom/media/wave/WaveReader.h b/dom/media/wave/WaveReader.h
index 3a62231b7da..f9e47cb43a5 100644
--- a/dom/media/wave/WaveReader.h
+++ b/dom/media/wave/WaveReader.h
@@ -44,7 +44,7 @@ public:
   virtual nsresult ReadMetadata(MediaInfo* aInfo,
                                 MetadataTags** aTags);
   virtual nsresult Seek(int64_t aTime, int64_t aStartTime, int64_t aEndTime, int64_t aCurrentTime);
-  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered);
+  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered, int64_t aStartTime);
 
   // To seek in a buffered range, we just have to seek the stream.
   virtual bool IsSeekableInBufferedRanges() {
diff --git a/dom/media/webm/WebMReader.cpp b/dom/media/webm/WebMReader.cpp
index c59b1b15112..7f8c993ea2d 100644
--- a/dom/media/webm/WebMReader.cpp
+++ b/dom/media/webm/WebMReader.cpp
@@ -1085,14 +1085,13 @@ nsresult WebMReader::Seek(int64_t aTarget, int64_t aStartTime, int64_t aEndTime,
   return NS_OK;
 }
 
-nsresult WebMReader::GetBuffered(dom::TimeRanges* aBuffered)
+nsresult WebMReader::GetBuffered(dom::TimeRanges* aBuffered, int64_t aStartTime)
 {
-  MOZ_ASSERT(mStartTime != -1, "Need to finish metadata decode first");
   if (aBuffered->Length() != 0) {
     return NS_ERROR_FAILURE;
   }
 
-  AutoPinned<MediaResource> resource(mDecoder->GetResource());
+  MediaResource* resource = mDecoder->GetResource();
 
   // Special case completely cached files.  This also handles local files.
   if (mContext && resource->IsDataCachedToEndOfResource(0)) {
@@ -1115,7 +1114,7 @@ nsresult WebMReader::GetBuffered(dom::TimeRanges* aBuffered)
                                                         ranges[index].mEnd,
                                                         &start, &end);
     if (rv) {
-      int64_t startOffset = mStartTime * NS_PER_USEC;
+      int64_t startOffset = aStartTime * NS_PER_USEC;
       NS_ASSERTION(startOffset >= 0 && uint64_t(startOffset) <= start,
                    "startOffset negative or larger than start time");
       if (!(startOffset >= 0 && uint64_t(startOffset) <= start)) {
diff --git a/dom/media/webm/WebMReader.h b/dom/media/webm/WebMReader.h
index 77bcbe454c1..8fe67cf4b17 100644
--- a/dom/media/webm/WebMReader.h
+++ b/dom/media/webm/WebMReader.h
@@ -136,7 +136,7 @@ public:
                                 MetadataTags** aTags);
   virtual nsresult Seek(int64_t aTime, int64_t aStartTime, int64_t aEndTime,
                         int64_t aCurrentTime);
-  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered);
+  virtual nsresult GetBuffered(dom::TimeRanges* aBuffered, int64_t aStartTime);
   virtual void NotifyDataArrived(const char* aBuffer, uint32_t aLength,
                                  int64_t aOffset);
   virtual int64_t GetEvictionOffset(double aTime);

From 92c2022f68f73b6e15499a9370715fe98001696b Mon Sep 17 00:00:00 2001
From: Chris Lord <chrislord.net@gmail.com>
Date: Tue, 4 Nov 2014 17:15:30 +0000
Subject: [PATCH 085/153] Bug 1084321 - Remove b2g app meta viewport
 work-around. r=kats,roc

---
 dom/base/nsDocument.cpp                       | 26 -------------------
 .../page_scroll_with_fixed_pos_window.html    |  1 +
 .../test/test_page_scroll_with_fixed_pos.html |  1 +
 .../image/background-image-zoom-1-ref.html    |  2 ++
 .../image/background-image-zoom-1.html        |  2 ++
 .../svg/svg-effects-area-zoomed-out-ref.xhtml |  1 +
 .../svg/svg-effects-area-zoomed-out.xhtml     |  1 +
 7 files changed, 8 insertions(+), 26 deletions(-)

diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
index 0d61dfbb9e4..8f4032e479b 100644
--- a/dom/base/nsDocument.cpp
+++ b/dom/base/nsDocument.cpp
@@ -7728,32 +7728,6 @@ nsDocument::GetViewportInfo(const ScreenIntSize& aDisplaySize)
                               /*allowZoom*/true,
                               /*allowDoubleTapZoom*/false);
       }
-
-      // Bug 940036. This is bad. When FirefoxOS was built, apps installed
-      // where not using the AsyncPanZoom code. As a result a lot of apps
-      // in the marketplace does not use it yet and instead are built to
-      // render correctly in FirefoxOS only. For a smooth transition the above
-      // code force installed apps to render as if they have a viewport with
-      // content="width=device-width, height=device-height, user-scalable=no".
-      // This could be safely remove once it is known that most apps in the
-      // marketplace use it and that users does not use an old version of the
-      // app that does not use it.
-      nsCOMPtr<nsIDocShell> docShell(mDocumentContainer);
-      if (docShell && docShell->GetIsApp()) {
-        nsString uri;
-        GetDocumentURI(uri);
-        if (!uri.EqualsLiteral("about:blank")) {
-          nsContentUtils::ReportToConsole(nsIScriptError::warningFlag,
-                                          NS_LITERAL_CSTRING("DOM"), this,
-                                          nsContentUtils::eDOM_PROPERTIES,
-                                          "ImplicitMetaViewportTagFallback");
-        }
-        mViewportType = DisplayWidthHeightNoZoom;
-        return nsViewportInfo(aDisplaySize,
-                              defaultScale,
-                              /*allowZoom*/false,
-                              /*allowDoubleTapZoom*/false);
-      }
     }
 
     nsAutoString minScaleStr;
diff --git a/layout/generic/test/page_scroll_with_fixed_pos_window.html b/layout/generic/test/page_scroll_with_fixed_pos_window.html
index 97e2b704965..d66ef3bd18e 100644
--- a/layout/generic/test/page_scroll_with_fixed_pos_window.html
+++ b/layout/generic/test/page_scroll_with_fixed_pos_window.html
@@ -1,6 +1,7 @@
 <!DOCTYPE HTML>
 <html>
 <head>
+  <meta name="viewport" content="width=device-width, height=device-height, initial-scale=1, user-scalable=no" />
   <title>Scrolling by pages with fixed-pos headers and footers</title>
   <style>
   .fp { position:fixed; left:0; width:100%; }
diff --git a/layout/generic/test/test_page_scroll_with_fixed_pos.html b/layout/generic/test/test_page_scroll_with_fixed_pos.html
index 309ae7f4e1e..551d6e29962 100644
--- a/layout/generic/test/test_page_scroll_with_fixed_pos.html
+++ b/layout/generic/test/test_page_scroll_with_fixed_pos.html
@@ -1,6 +1,7 @@
 <!DOCTYPE HTML>
 <html>
 <head>
+  <meta name="viewport" content="width=device-width, height=device-height, initial-scale=1, user-scalable=no" />
   <title>Scrolling by pages with fixed-pos headers and footers</title>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
diff --git a/layout/reftests/image/background-image-zoom-1-ref.html b/layout/reftests/image/background-image-zoom-1-ref.html
index 944262e17df..b23048bb61a 100644
--- a/layout/reftests/image/background-image-zoom-1-ref.html
+++ b/layout/reftests/image/background-image-zoom-1-ref.html
@@ -5,6 +5,7 @@
     -->
 <html>
 <head>
+<meta name="viewport" content="width=device-width, height=device-height, initial-scale=1, user-scalable=no" />
 <title>reference background-image-rendering: -moz-crisp-edges</title>
 <style>
 html
@@ -13,6 +14,7 @@ background-image: url('big.png');
 background-attachment:fixed;
 background-position: 20px 20px;
 background-repeat: no-repeat;
+overflow: hidden;
 }
 </style>
 </head>
diff --git a/layout/reftests/image/background-image-zoom-1.html b/layout/reftests/image/background-image-zoom-1.html
index 4b93bfb029c..0572099a375 100644
--- a/layout/reftests/image/background-image-zoom-1.html
+++ b/layout/reftests/image/background-image-zoom-1.html
@@ -5,6 +5,7 @@
     -->
 <html reftest-zoom="5">
 <head>
+<meta name="viewport" content="width=device-width, height=device-height, initial-scale=1, user-scalable=no" />
 <title>test background-image-rendering: -moz-crisp-edges</title>
 <style>
 html
@@ -14,6 +15,7 @@ image-rendering: -moz-crisp-edges;
 background-attachment:fixed;
 background-position: 4px 4px;
 background-repeat: no-repeat;
+overflow: hidden;
 }
 </style>
 </head>
diff --git a/layout/reftests/svg/svg-effects-area-zoomed-out-ref.xhtml b/layout/reftests/svg/svg-effects-area-zoomed-out-ref.xhtml
index fc3de771167..494989f09ad 100644
--- a/layout/reftests/svg/svg-effects-area-zoomed-out-ref.xhtml
+++ b/layout/reftests/svg/svg-effects-area-zoomed-out-ref.xhtml
@@ -1,6 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml" reftest-zoom="0.6">
 <head>
+  <meta name="viewport" content="width=device-width, height=device-height, initial-scale=1, user-scalable=no" />
   <title>Test for bug 541270 (SVG Effects area)</title>
   <style type="text/css">
   html, body, div { display: block; width: 100%; height: 100%; border: none; margin: 0; padding: 0; }
diff --git a/layout/reftests/svg/svg-effects-area-zoomed-out.xhtml b/layout/reftests/svg/svg-effects-area-zoomed-out.xhtml
index e245390f4b0..8600eb9b75e 100644
--- a/layout/reftests/svg/svg-effects-area-zoomed-out.xhtml
+++ b/layout/reftests/svg/svg-effects-area-zoomed-out.xhtml
@@ -1,6 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <html lang="en" xml:lang="en" xmlns="http://www.w3.org/1999/xhtml" reftest-zoom="0.6">
 <head>
+  <meta name="viewport" content="width=device-width, height=device-height, initial-scale=1, user-scalable=no" />
   <title>Test for bug 541270 (SVG Effects area)</title>
   <style type="text/css">
   html, body, div { display: block; width: 100%; height: 100%; border: none; margin: 0; padding: 0; }

From 88d710171f32e41915b5734e15c09eb3b4a39865 Mon Sep 17 00:00:00 2001
From: James Kitchener <jkitch.bug@internode.on.net>
Date: Wed, 5 Nov 2014 01:34:00 +0100
Subject: [PATCH 086/153] Bug 971432 - Move baseURI to nsILoadInfo. r=bz

---
 docshell/base/LoadInfo.cpp                    | 12 ++++++-
 docshell/base/LoadInfo.h                      |  5 ++-
 docshell/base/nsDocShell.cpp                  | 33 +++++++++----------
 docshell/base/nsILoadInfo.idl                 |  9 ++++-
 netwerk/base/public/nsIInputStreamChannel.idl |  8 +----
 netwerk/base/public/nsNetUtil.h               | 18 ++++++----
 netwerk/base/src/nsInputStreamChannel.cpp     | 15 ---------
 netwerk/base/src/nsInputStreamChannel.h       |  1 -
 .../viewsource/nsIViewSourceChannel.idl       | 11 +------
 .../viewsource/nsViewSourceChannel.cpp        | 27 +--------------
 .../protocol/viewsource/nsViewSourceChannel.h |  4 +--
 .../viewsource/nsViewSourceHandler.cpp        |  4 +--
 .../protocol/viewsource/nsViewSourceHandler.h |  2 +-
 13 files changed, 57 insertions(+), 92 deletions(-)

diff --git a/docshell/base/LoadInfo.cpp b/docshell/base/LoadInfo.cpp
index c8edaa1d2c5..841dc895bb5 100644
--- a/docshell/base/LoadInfo.cpp
+++ b/docshell/base/LoadInfo.cpp
@@ -17,11 +17,13 @@ namespace mozilla {
 LoadInfo::LoadInfo(nsIPrincipal* aPrincipal,
                    nsINode* aLoadingContext,
                    nsSecurityFlags aSecurityFlags,
-                   nsContentPolicyType aContentPolicyType)
+                   nsContentPolicyType aContentPolicyType,
+                   nsIURI* aBaseURI)
   : mPrincipal(aPrincipal)
   , mLoadingContext(do_GetWeakReference(aLoadingContext))
   , mSecurityFlags(aSecurityFlags)
   , mContentPolicyType(aContentPolicyType)
+  , mBaseURI(aBaseURI)
 {
   MOZ_ASSERT(aPrincipal);
   // if the load is sandboxed, we can not also inherit the principal
@@ -95,4 +97,12 @@ LoadInfo::GetContentPolicyType(nsContentPolicyType* outContentPolicyType)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+LoadInfo::GetBaseURI(nsIURI** aBaseURI)
+{
+  *aBaseURI = mBaseURI;
+  NS_IF_ADDREF(*aBaseURI);
+  return NS_OK;
+}
+
 } // namespace mozilla
diff --git a/docshell/base/LoadInfo.h b/docshell/base/LoadInfo.h
index 3bed21619ed..7daf725241a 100644
--- a/docshell/base/LoadInfo.h
+++ b/docshell/base/LoadInfo.h
@@ -11,6 +11,7 @@
 #include "nsILoadInfo.h"
 #include "nsIPrincipal.h"
 #include "nsIWeakReferenceUtils.h" // for nsWeakPtr
+#include "nsIURI.h"
 
 class nsINode;
 
@@ -29,7 +30,8 @@ public:
   LoadInfo(nsIPrincipal* aPrincipal,
            nsINode* aLoadingContext,
            nsSecurityFlags aSecurityFlags,
-           nsContentPolicyType aContentPolicyType);
+           nsContentPolicyType aContentPolicyType,
+           nsIURI* aBaseURI = nullptr);
 
 private:
   ~LoadInfo();
@@ -38,6 +40,7 @@ private:
   nsWeakPtr              mLoadingContext;
   nsSecurityFlags        mSecurityFlags;
   nsContentPolicyType    mContentPolicyType;
+  nsCOMPtr<nsIURI>       mBaseURI;
 };
 
 } // namespace mozilla
diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index fc77788bd57..1fd2ae4b409 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -10268,12 +10268,15 @@ nsDocShell::DoURILoad(nsIURI * aURI,
     }
 
     if (!isSrcdoc) {
+      nsCOMPtr<nsILoadInfo> loadInfo =
+        new mozilla::LoadInfo(requestingPrincipal,
+                              requestingNode,
+                              securityFlags,
+                              aContentPolicyType,
+                              aBaseURI);
         rv = NS_NewChannelInternal(getter_AddRefs(channel),
                                    aURI,
-                                   requestingNode,
-                                   requestingPrincipal,
-                                   securityFlags,
-                                   aContentPolicyType,
+                                   loadInfo,
                                    nullptr,   // loadGroup
                                    static_cast<nsIInterfaceRequestor*>(this),
                                    loadFlags);
@@ -10293,12 +10296,6 @@ nsDocShell::DoURILoad(nsIURI * aURI,
             }
             return rv;
         }
-        if (aBaseURI) {
-            nsCOMPtr<nsIViewSourceChannel> vsc = do_QueryInterface(channel);
-            if (vsc) {
-                vsc->SetBaseURI(aBaseURI);
-            }
-        }
     }
     else {
         nsAutoCString scheme;
@@ -10311,14 +10308,14 @@ nsDocShell::DoURILoad(nsIURI * aURI,
             nsViewSourceHandler *vsh = nsViewSourceHandler::GetInstance();
             NS_ENSURE_TRUE(vsh,NS_ERROR_FAILURE);
 
-            rv = vsh->NewSrcdocChannel(aURI, aSrcdoc, aBaseURI,
-                                       getter_AddRefs(channel));
+            rv = vsh->NewSrcdocChannel(aURI, aSrcdoc, getter_AddRefs(channel));
             NS_ENSURE_SUCCESS(rv, rv);
             nsCOMPtr<nsILoadInfo> loadInfo =
               new LoadInfo(requestingPrincipal,
                            requestingNode,
                            securityFlags,
-                           aContentPolicyType);
+                           aContentPolicyType,
+                           aBaseURI);
             channel->SetLoadInfo(loadInfo);
         }
         else {
@@ -10330,11 +10327,9 @@ nsDocShell::DoURILoad(nsIURI * aURI,
                                                   requestingPrincipal,
                                                   securityFlags,
                                                   aContentPolicyType,
-                                                  true);
+                                                  true,
+                                                  aBaseURI);
             NS_ENSURE_SUCCESS(rv, rv);
-            nsCOMPtr<nsIInputStreamChannel> isc = do_QueryInterface(channel);
-            MOZ_ASSERT(isc);
-            isc->SetBaseURI(aBaseURI);
         }
     }
 
@@ -11590,8 +11585,10 @@ nsDocShell::AddToSessionHistory(nsIURI * aURI, nsIChannel * aChannel,
             nsAutoString srcdoc;
             inStrmChan->GetSrcdocData(srcdoc);
             entry->SetSrcdocData(srcdoc);
+            nsCOMPtr<nsILoadInfo> loadInfo;
+            aChannel->GetLoadInfo(getter_AddRefs(loadInfo));
             nsCOMPtr<nsIURI> baseURI;
-            inStrmChan->GetBaseURI(getter_AddRefs(baseURI));
+            loadInfo->GetBaseURI(getter_AddRefs(baseURI));
             entry->SetBaseURI(baseURI);
         }
     }
diff --git a/docshell/base/nsILoadInfo.idl b/docshell/base/nsILoadInfo.idl
index 43c1a671ac0..da0808351cf 100644
--- a/docshell/base/nsILoadInfo.idl
+++ b/docshell/base/nsILoadInfo.idl
@@ -10,13 +10,14 @@
 interface nsIDOMDocument;
 interface nsINode;
 interface nsIPrincipal;
+interface nsIURI;
 
 typedef unsigned long nsSecurityFlags;
 
 /**
  * An nsILoadOwner represents per-load information about who started the load.
  */
-[scriptable, builtinclass, uuid(046db047-a1c1-4519-8ec7-99f3054bc9ac)]
+[scriptable, builtinclass, uuid(b22b8ee7-047a-4351-a749-13c6d39f6b17)]
 interface nsILoadInfo : nsISupports
 {
   /**
@@ -148,4 +149,10 @@ interface nsILoadInfo : nsISupports
   }
 %}
 
+  /**
+   * A base URI for use in situations where it cannot otherwise be inferred.
+   * This attribute may be null.  The value of this attribute may be
+   * ignored if the base URI can be inferred by the channel's URI.
+   */
+   readonly attribute nsIURI baseURI;
 };
diff --git a/netwerk/base/public/nsIInputStreamChannel.idl b/netwerk/base/public/nsIInputStreamChannel.idl
index a5d98eeec11..73bcfa1b5cd 100644
--- a/netwerk/base/public/nsIInputStreamChannel.idl
+++ b/netwerk/base/public/nsIInputStreamChannel.idl
@@ -13,7 +13,7 @@ interface nsIURI;
  * This interface provides methods to initialize an input stream channel.
  * The input stream channel serves as a data pump for an input stream.
  */
-[scriptable, uuid(17a17ce4-9a07-43fb-a0a3-947a6e21476c)]
+[scriptable, uuid(e1e95852-914b-4d83-b574-23f114db9b89)]
 interface nsIInputStreamChannel : nsISupports
 {
     /**
@@ -55,10 +55,4 @@ interface nsIInputStreamChannel : nsISupports
      * Returns true if srcdocData has been set within the channel.
      */
     readonly attribute boolean isSrcdocChannel;
-
-    /**
-     * The base URI to be used for the channel.  Used when the base URI cannot
-     * be inferred by other means, for example when this is a srcdoc channel.
-     */
-    attribute nsIURI baseURI;
 };
diff --git a/netwerk/base/public/nsNetUtil.h b/netwerk/base/public/nsNetUtil.h
index d2f91af90df..4e01a7ed3ba 100644
--- a/netwerk/base/public/nsNetUtil.h
+++ b/netwerk/base/public/nsNetUtil.h
@@ -605,7 +605,8 @@ NS_NewInputStreamChannelInternal(nsIChannel**        outChannel,
                                  nsINode*            aRequestingNode,
                                  nsIPrincipal*       aRequestingPrincipal,
                                  nsSecurityFlags     aSecurityFlags,
-                                 nsContentPolicyType aContentPolicyType)
+                                 nsContentPolicyType aContentPolicyType,
+                                 nsIURI*             aBaseURI = nullptr)
 {
   nsresult rv;
   nsCOMPtr<nsIInputStreamChannel> isc =
@@ -633,7 +634,8 @@ NS_NewInputStreamChannelInternal(nsIChannel**        outChannel,
     new mozilla::LoadInfo(aRequestingPrincipal,
                           aRequestingNode,
                           aSecurityFlags,
-                          aContentPolicyType);
+                          aContentPolicyType,
+                          aBaseURI);
   if (!loadInfo) {
     return NS_ERROR_UNEXPECTED;
   }
@@ -679,7 +681,8 @@ NS_NewInputStreamChannelInternal(nsIChannel**        outChannel,
                                  nsIPrincipal*       aRequestingPrincipal,
                                  nsSecurityFlags     aSecurityFlags,
                                  nsContentPolicyType aContentPolicyType,
-                                 bool                aIsSrcdocChannel = false)
+                                 bool                aIsSrcdocChannel = false,
+                                 nsIURI*             aBaseURI = nullptr)
 {
   nsresult rv;
   nsCOMPtr<nsIStringInputStream> stream;
@@ -704,7 +707,8 @@ NS_NewInputStreamChannelInternal(nsIChannel**        outChannel,
                                         aRequestingNode,
                                         aRequestingPrincipal,
                                         aSecurityFlags,
-                                        aContentPolicyType);
+                                        aContentPolicyType,
+                                        aBaseURI);
 
   NS_ENSURE_SUCCESS(rv, rv);
 
@@ -725,7 +729,8 @@ NS_NewInputStreamChannel(nsIChannel**        outChannel,
                          nsIPrincipal*       aRequestingPrincipal,
                          nsSecurityFlags     aSecurityFlags,
                          nsContentPolicyType aContentPolicyType,
-                         bool                aIsSrcdocChannel = false)
+                         bool                aIsSrcdocChannel = false,
+                         nsIURI*             aBaseURI = nullptr)
 {
   return NS_NewInputStreamChannelInternal(outChannel,
                                           aUri,
@@ -735,7 +740,8 @@ NS_NewInputStreamChannel(nsIChannel**        outChannel,
                                           aRequestingPrincipal,
                                           aSecurityFlags,
                                           aContentPolicyType,
-                                          aIsSrcdocChannel);
+                                          aIsSrcdocChannel,
+                                          aBaseURI);
 }
 
 inline nsresult
diff --git a/netwerk/base/src/nsInputStreamChannel.cpp b/netwerk/base/src/nsInputStreamChannel.cpp
index 5aa4d70abdd..de1e0240edd 100644
--- a/netwerk/base/src/nsInputStreamChannel.cpp
+++ b/netwerk/base/src/nsInputStreamChannel.cpp
@@ -89,18 +89,3 @@ nsInputStreamChannel::GetIsSrcdocChannel(bool *aIsSrcdocChannel)
   *aIsSrcdocChannel = mIsSrcdocChannel;
   return NS_OK;
 }
-
-NS_IMETHODIMP
-nsInputStreamChannel::GetBaseURI(nsIURI** aBaseURI)
-{
-  *aBaseURI = mBaseURI;
-  NS_IF_ADDREF(*aBaseURI);
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsInputStreamChannel::SetBaseURI(nsIURI* aBaseURI)
-{
-  mBaseURI = aBaseURI;
-  return NS_OK;
-}
diff --git a/netwerk/base/src/nsInputStreamChannel.h b/netwerk/base/src/nsInputStreamChannel.h
index 4c3b8cc77b9..b5e33cf26a0 100644
--- a/netwerk/base/src/nsInputStreamChannel.h
+++ b/netwerk/base/src/nsInputStreamChannel.h
@@ -33,7 +33,6 @@ protected:
 
 private:
     nsCOMPtr<nsIInputStream> mContentStream;
-    nsCOMPtr<nsIURI> mBaseURI;
     nsString mSrcdocData;
     bool mIsSrcdocChannel;
 };
diff --git a/netwerk/protocol/viewsource/nsIViewSourceChannel.idl b/netwerk/protocol/viewsource/nsIViewSourceChannel.idl
index de407124598..e0cc46674e0 100644
--- a/netwerk/protocol/viewsource/nsIViewSourceChannel.idl
+++ b/netwerk/protocol/viewsource/nsIViewSourceChannel.idl
@@ -5,7 +5,7 @@
 
 #include "nsIChannel.idl"
 
-[uuid(ac5bcfe9-fe54-4e9a-95fb-cd7aa558c5bc)]
+[uuid(72d9580a-b636-4392-b888-6c003c56f3d7)]
 interface nsIViewSourceChannel : nsIChannel
 {
     /**
@@ -24,15 +24,6 @@ interface nsIViewSourceChannel : nsIChannel
      * Whether the channel was created to view the source of a srcdoc document.
      */
     readonly attribute boolean isSrcdocChannel;
-
-    /**
-     * Set to indicate the base URI.  If this channel is a srcdoc channel, it
-     * returns the base URI provided by the embedded channel.  It is used to
-     * provide an indication of the base URI in circumstances where it isn't
-     * otherwise recoverable.  Returns null when it isn't set and isn't a
-     * srcdoc channel.
-     */
-    attribute nsIURI baseURI;
 };
 
 
diff --git a/netwerk/protocol/viewsource/nsViewSourceChannel.cpp b/netwerk/protocol/viewsource/nsViewSourceChannel.cpp
index 99d6c6c4efb..f57ca8d440d 100644
--- a/netwerk/protocol/viewsource/nsViewSourceChannel.cpp
+++ b/netwerk/protocol/viewsource/nsViewSourceChannel.cpp
@@ -72,8 +72,7 @@ nsViewSourceChannel::Init(nsIURI* uri)
 }
 
 nsresult
-nsViewSourceChannel::InitSrcdoc(nsIURI* aURI, const nsAString &aSrcdoc,
-                                nsIURI* aBaseURI)
+nsViewSourceChannel::InitSrcdoc(nsIURI* aURI, const nsAString &aSrcdoc)
 {
 
     nsresult rv;
@@ -98,9 +97,6 @@ nsViewSourceChannel::InitSrcdoc(nsIURI* aURI, const nsAString &aSrcdoc,
     NS_ENSURE_SUCCESS(rv, rv);
     mOriginalURI = aURI;
     mIsSrcdocChannel = true;
-    nsCOMPtr<nsIInputStreamChannel> isc = do_QueryInterface(mChannel);
-    MOZ_ASSERT(isc);
-    isc->SetBaseURI(aBaseURI);
 
     mChannel->SetOriginalURI(mOriginalURI);
     mHttpChannel = do_QueryInterface(mChannel);
@@ -524,27 +520,6 @@ nsViewSourceChannel::GetIsSrcdocChannel(bool* aIsSrcdocChannel)
     return NS_OK;
 }
 
-NS_IMETHODIMP
-nsViewSourceChannel::GetBaseURI(nsIURI** aBaseURI)
-{
-  if (mIsSrcdocChannel) {
-    nsCOMPtr<nsIInputStreamChannel> isc = do_QueryInterface(mChannel);
-    if (isc) {
-      return isc->GetBaseURI(aBaseURI);
-    }
-  }
-  *aBaseURI = mBaseURI;
-  NS_IF_ADDREF(*aBaseURI);
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsViewSourceChannel::SetBaseURI(nsIURI* aBaseURI)
-{
-  mBaseURI = aBaseURI;
-  return NS_OK;
-}
-
 // nsIRequestObserver methods
 NS_IMETHODIMP
 nsViewSourceChannel::OnStartRequest(nsIRequest *aRequest, nsISupports *aContext)
diff --git a/netwerk/protocol/viewsource/nsViewSourceChannel.h b/netwerk/protocol/viewsource/nsViewSourceChannel.h
index 1c66a501d37..2e9479f60fa 100644
--- a/netwerk/protocol/viewsource/nsViewSourceChannel.h
+++ b/netwerk/protocol/viewsource/nsViewSourceChannel.h
@@ -49,8 +49,7 @@ public:
 
     nsresult Init(nsIURI* uri);
 
-    nsresult InitSrcdoc(nsIURI* aURI, const nsAString &aSrcdoc,
-                                    nsIURI* aBaseURI);
+    nsresult InitSrcdoc(nsIURI* aURI, const nsAString &aSrcdoc);
 
 protected:
     ~nsViewSourceChannel() {}
@@ -63,7 +62,6 @@ protected:
     nsCOMPtr<nsIUploadChannel>  mUploadChannel;
     nsCOMPtr<nsIStreamListener> mListener;
     nsCOMPtr<nsIURI>            mOriginalURI;
-    nsCOMPtr<nsIURI>            mBaseURI;
     nsCString                   mContentType;
     bool                        mIsDocument; // keeps track of the LOAD_DOCUMENT_URI flag
     bool                        mOpened;
diff --git a/netwerk/protocol/viewsource/nsViewSourceHandler.cpp b/netwerk/protocol/viewsource/nsViewSourceHandler.cpp
index 1e11bfba37d..979aea3510c 100644
--- a/netwerk/protocol/viewsource/nsViewSourceHandler.cpp
+++ b/netwerk/protocol/viewsource/nsViewSourceHandler.cpp
@@ -118,7 +118,7 @@ nsViewSourceHandler::NewChannel(nsIURI* uri, nsIChannel* *result)
 
 nsresult
 nsViewSourceHandler::NewSrcdocChannel(nsIURI* uri, const nsAString &srcdoc,
-                                      nsIURI* baseURI, nsIChannel* *result)
+                                      nsIChannel* *result)
 {
     NS_ENSURE_ARG_POINTER(uri);
     nsViewSourceChannel *channel = new nsViewSourceChannel();
@@ -126,7 +126,7 @@ nsViewSourceHandler::NewSrcdocChannel(nsIURI* uri, const nsAString &srcdoc,
         return NS_ERROR_OUT_OF_MEMORY;
     NS_ADDREF(channel);
 
-    nsresult rv = channel->InitSrcdoc(uri, srcdoc, baseURI);
+    nsresult rv = channel->InitSrcdoc(uri, srcdoc);
     if (NS_FAILED(rv)) {
         NS_RELEASE(channel);
         return rv;
diff --git a/netwerk/protocol/viewsource/nsViewSourceHandler.h b/netwerk/protocol/viewsource/nsViewSourceHandler.h
index aa5b4295d6f..eb0ad00607c 100644
--- a/netwerk/protocol/viewsource/nsViewSourceHandler.h
+++ b/netwerk/protocol/viewsource/nsViewSourceHandler.h
@@ -20,7 +20,7 @@ public:
     // Creates a new nsViewSourceChannel to view the source of an about:srcdoc
     // URI with contents specified by srcdoc.
     nsresult NewSrcdocChannel(nsIURI* uri, const nsAString &srcdoc,
-                              nsIURI* baseURI, nsIChannel** result);
+                              nsIChannel** result);
 
     static nsViewSourceHandler* GetInstance();
 

From 2ecb7806077962e0360bed83c1ee723ab6645d9d Mon Sep 17 00:00:00 2001
From: James Kitchener <jkitch.bug@internode.on.net>
Date: Fri, 24 Oct 2014 20:39:00 +0200
Subject: [PATCH 087/153] Bug 971432 - parser changes needed after moving
 baseURI to nsILoadInfo. r=hsivonen

---
 parser/html/nsHtml5TreeOpExecutor.cpp | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/parser/html/nsHtml5TreeOpExecutor.cpp b/parser/html/nsHtml5TreeOpExecutor.cpp
index 235effc2666..fef3c4987b6 100644
--- a/parser/html/nsHtml5TreeOpExecutor.cpp
+++ b/parser/html/nsHtml5TreeOpExecutor.cpp
@@ -29,6 +29,7 @@
 #include "nsIScriptContext.h"
 #include "mozilla/Preferences.h"
 #include "nsIHTMLDocument.h"
+#include "nsILoadInfo.h"
 
 using namespace mozilla;
 
@@ -797,12 +798,15 @@ nsHtml5TreeOpExecutor::GetViewSourceBaseURI()
     // We query the channel for the baseURI because in certain situations it
     // cannot otherwise be determined. If this process fails, fall back to the
     // standard method.
-    nsCOMPtr<nsIViewSourceChannel> vsc;
-    vsc = do_QueryInterface(mDocument->GetChannel());
-    if (vsc) {
-      nsresult rv =  vsc->GetBaseURI(getter_AddRefs(mViewSourceBaseURI));
-      if (NS_SUCCEEDED(rv) && mViewSourceBaseURI) {
-        return mViewSourceBaseURI;
+    nsCOMPtr<nsIChannel> channel = mDocument->GetChannel();
+    if (channel) {
+      nsCOMPtr<nsILoadInfo> loadInfo;
+      nsresult rv = channel->GetLoadInfo(getter_AddRefs(loadInfo));
+      if (NS_SUCCEEDED(rv) && loadInfo) {
+        rv = loadInfo->GetBaseURI(getter_AddRefs(mViewSourceBaseURI));
+        if (NS_SUCCEEDED(rv) && mViewSourceBaseURI) {
+          return mViewSourceBaseURI;
+        }
       }
     }
 

From c666c36a748cc326b10205ef6ffe8d48f60b38e1 Mon Sep 17 00:00:00 2001
From: Kershaw Chang <kechang@mozilla.com>
Date: Tue, 4 Nov 2014 02:58:00 +0100
Subject: [PATCH 088/153] Bug 1041419 - Patch 1: Add GetBrowserOrId in
 ContentChild. r=smaug

---
 dom/ipc/ContentChild.cpp | 12 ++++++++++++
 dom/ipc/ContentChild.h   |  5 +++++
 2 files changed, 17 insertions(+)

diff --git a/dom/ipc/ContentChild.cpp b/dom/ipc/ContentChild.cpp
index 40990de5897..d7f89d9516c 100644
--- a/dom/ipc/ContentChild.cpp
+++ b/dom/ipc/ContentChild.cpp
@@ -2363,6 +2363,18 @@ ContentChild::RecvOnAppThemeChanged()
     return true;
 }
 
+PBrowserOrId
+ContentChild::GetBrowserOrId(TabChild* aTabChild)
+{
+    if (!aTabChild ||
+        this == aTabChild->Manager()) {
+        return PBrowserOrId(aTabChild);
+    }
+    else {
+        return PBrowserOrId(aTabChild->GetTabId());
+    }
+}
+
 } // namespace dom
 } // namespace mozilla
 
diff --git a/dom/ipc/ContentChild.h b/dom/ipc/ContentChild.h
index 20a5d3e279a..8457dd78f6c 100644
--- a/dom/ipc/ContentChild.h
+++ b/dom/ipc/ContentChild.h
@@ -10,6 +10,7 @@
 #include "mozilla/Attributes.h"
 #include "mozilla/dom/ContentBridgeParent.h"
 #include "mozilla/dom/nsIContentChild.h"
+#include "mozilla/dom/PBrowserOrId.h"
 #include "mozilla/dom/PContentChild.h"
 #include "nsHashKeys.h"
 #include "nsIObserver.h"
@@ -48,6 +49,7 @@ class PrefObserver;
 class ConsoleListener;
 class PStorageChild;
 class ClonedMessageData;
+class TabChild;
 
 class ContentChild : public PContentChild
                    , public nsIContentChild
@@ -403,6 +405,9 @@ public:
 
     void GetAvailableDictionaries(InfallibleTArray<nsString>& aDictionaries);
 
+    PBrowserOrId
+    GetBrowserOrId(TabChild* aTabChild);
+
 private:
     virtual void ActorDestroy(ActorDestroyReason why) MOZ_OVERRIDE;
 

From 7003e659fa38c0530d30deb3bd3ce4b7b99ee80d Mon Sep 17 00:00:00 2001
From: Kershaw Chang <kechang@mozilla.com>
Date: Tue, 4 Nov 2014 02:58:00 +0100
Subject: [PATCH 089/153] Bug 1041419 - Patch 2: Replace PBrowser with
 PBrowserOrId in PWyciwygChannel. r=honzab

---
 netwerk/protocol/http/HttpChannelChild.cpp     | 18 ++++--------------
 netwerk/protocol/wyciwyg/PWyciwygChannel.ipdl  |  5 +++--
 .../protocol/wyciwyg/WyciwygChannelChild.cpp   |  8 +++++++-
 .../protocol/wyciwyg/WyciwygChannelParent.cpp  |  6 +++---
 .../protocol/wyciwyg/WyciwygChannelParent.h    |  6 +++---
 5 files changed, 20 insertions(+), 23 deletions(-)

diff --git a/netwerk/protocol/http/HttpChannelChild.cpp b/netwerk/protocol/http/HttpChannelChild.cpp
index 7b4dd0df516..da69687ac76 100644
--- a/netwerk/protocol/http/HttpChannelChild.cpp
+++ b/netwerk/protocol/http/HttpChannelChild.cpp
@@ -1051,13 +1051,8 @@ HttpChannelChild::ConnectParent(uint32_t id)
   AddIPDLReference();
 
   HttpChannelConnectArgs connectArgs(id);
-  PBrowserOrId browser;
-  if (!tabChild ||
-      static_cast<ContentChild*>(gNeckoChild->Manager()) == tabChild->Manager()) {
-    browser = tabChild;
-  } else {
-    browser = tabChild->GetTabId();
-  }
+  PBrowserOrId browser = static_cast<ContentChild*>(gNeckoChild->Manager())
+                         ->GetBrowserOrId(tabChild);
   if (!gNeckoChild->
         SendPHttpChannelConstructor(this, browser,
                                     IPC::SerializedLoadContext(this),
@@ -1521,13 +1516,8 @@ HttpChannelChild::ContinueAsyncOpen()
   // until OnStopRequest, or we do a redirect, or we hit an IPDL error.
   AddIPDLReference();
 
-  PBrowserOrId browser;
-  if (!tabChild ||
-      static_cast<ContentChild*>(gNeckoChild->Manager()) == tabChild->Manager()) {
-    browser = tabChild;
-  } else {
-    browser = tabChild->GetTabId();
-  }
+  PBrowserOrId browser = static_cast<ContentChild*>(gNeckoChild->Manager())
+                         ->GetBrowserOrId(tabChild);
   gNeckoChild->SendPHttpChannelConstructor(this, browser,
                                            IPC::SerializedLoadContext(this),
                                            openArgs);
diff --git a/netwerk/protocol/wyciwyg/PWyciwygChannel.ipdl b/netwerk/protocol/wyciwyg/PWyciwygChannel.ipdl
index 42eb6316988..d3a815f2c48 100644
--- a/netwerk/protocol/wyciwyg/PWyciwygChannel.ipdl
+++ b/netwerk/protocol/wyciwyg/PWyciwygChannel.ipdl
@@ -6,6 +6,7 @@ include protocol PNecko;
 include protocol PBrowser;
 include URIParams;
 include PBackgroundSharedTypes;
+include PBrowserOrId;
 
 using class IPC::SerializedLoadContext from "SerializedLoadContext.h";
 
@@ -27,8 +28,8 @@ parent:
   AsyncOpen(URIParams             originalURI,
             uint32_t              loadFlags,
             SerializedLoadContext loadContext,
-            PBrowser browser);
-  AppData(SerializedLoadContext loadContext, PBrowser browser);
+            PBrowserOrId browser);
+  AppData(SerializedLoadContext loadContext, PBrowserOrId browser);
 
   // methods corresponding to those of nsIWyciwygChannel
   WriteToCacheEntry(nsString data);
diff --git a/netwerk/protocol/wyciwyg/WyciwygChannelChild.cpp b/netwerk/protocol/wyciwyg/WyciwygChannelChild.cpp
index bd5bab698cf..29234633be5 100644
--- a/netwerk/protocol/wyciwyg/WyciwygChannelChild.cpp
+++ b/netwerk/protocol/wyciwyg/WyciwygChannelChild.cpp
@@ -9,6 +9,7 @@
 #include "mozilla/net/ChannelEventQueue.h"
 #include "WyciwygChannelChild.h"
 #include "mozilla/dom/TabChild.h"
+#include "mozilla/dom/ContentChild.h"
 
 #include "nsCharsetSource.h"
 #include "nsStringStream.h"
@@ -22,6 +23,7 @@
 #include "nsProxyRelease.h"
 
 using namespace mozilla::ipc;
+using namespace mozilla::dom;
 
 namespace mozilla {
 namespace net {
@@ -673,7 +675,11 @@ WyciwygChannelChild::WriteToCacheEntry(const nsAString & aData)
 
   if (!mSentAppData) {
     mozilla::dom::TabChild* tabChild = GetTabChild(this);
-    SendAppData(IPC::SerializedLoadContext(this), tabChild);
+
+    PBrowserOrId browser = static_cast<ContentChild*>(Manager()->Manager())
+                           ->GetBrowserOrId(tabChild);
+
+    SendAppData(IPC::SerializedLoadContext(this), browser);
     mSentAppData = true;
   }
 
diff --git a/netwerk/protocol/wyciwyg/WyciwygChannelParent.cpp b/netwerk/protocol/wyciwyg/WyciwygChannelParent.cpp
index 474a0e5955a..1857d87e78d 100644
--- a/netwerk/protocol/wyciwyg/WyciwygChannelParent.cpp
+++ b/netwerk/protocol/wyciwyg/WyciwygChannelParent.cpp
@@ -109,7 +109,7 @@ WyciwygChannelParent::RecvInit(const URIParams&          aURI,
 
 bool
 WyciwygChannelParent::RecvAppData(const IPC::SerializedLoadContext& loadContext,
-                                  PBrowserParent* parent)
+                                  const PBrowserOrId &parent)
 {
   LOG(("WyciwygChannelParent RecvAppData [this=%p]\n", this));
 
@@ -122,7 +122,7 @@ WyciwygChannelParent::RecvAppData(const IPC::SerializedLoadContext& loadContext,
 
 bool
 WyciwygChannelParent::SetupAppData(const IPC::SerializedLoadContext& loadContext,
-                                   PBrowserParent* aParent)
+                                   const PBrowserOrId &aParent)
 {
   if (!mChannel)
     return true;
@@ -151,7 +151,7 @@ bool
 WyciwygChannelParent::RecvAsyncOpen(const URIParams& aOriginal,
                                     const uint32_t& aLoadFlags,
                                     const IPC::SerializedLoadContext& loadContext,
-                                    PBrowserParent* aParent)
+                                    const PBrowserOrId &aParent)
 {
   nsCOMPtr<nsIURI> original = DeserializeURI(aOriginal);
   if (!original)
diff --git a/netwerk/protocol/wyciwyg/WyciwygChannelParent.h b/netwerk/protocol/wyciwyg/WyciwygChannelParent.h
index 021512896d9..cf5060f3b11 100644
--- a/netwerk/protocol/wyciwyg/WyciwygChannelParent.h
+++ b/netwerk/protocol/wyciwyg/WyciwygChannelParent.h
@@ -42,7 +42,7 @@ protected:
   virtual bool RecvAsyncOpen(const URIParams& original,
                              const uint32_t& loadFlags,
                              const IPC::SerializedLoadContext& loadContext,
-                             PBrowserParent* parent) MOZ_OVERRIDE;
+                             const PBrowserOrId &parent) MOZ_OVERRIDE;
   virtual bool RecvWriteToCacheEntry(const nsString& data) MOZ_OVERRIDE;
   virtual bool RecvCloseCacheEntry(const nsresult& reason) MOZ_OVERRIDE;
   virtual bool RecvSetCharsetAndSource(const int32_t& source,
@@ -50,12 +50,12 @@ protected:
   virtual bool RecvSetSecurityInfo(const nsCString& securityInfo) MOZ_OVERRIDE;
   virtual bool RecvCancel(const nsresult& statusCode) MOZ_OVERRIDE;
   virtual bool RecvAppData(const IPC::SerializedLoadContext& loadContext,
-                           PBrowserParent* parent) MOZ_OVERRIDE;
+                           const PBrowserOrId &parent) MOZ_OVERRIDE;
 
   virtual void ActorDestroy(ActorDestroyReason why) MOZ_OVERRIDE;
 
   bool SetupAppData(const IPC::SerializedLoadContext& loadContext,
-                    PBrowserParent* aParent);
+                    const PBrowserOrId &aParent);
 
   nsCOMPtr<nsIWyciwygChannel> mChannel;
   bool mIPCClosed;

From a245df4f86402abea1b151238556ef4aea9cfecd Mon Sep 17 00:00:00 2001
From: Jonathan Kew <jkew@mozilla.com>
Date: Tue, 4 Nov 2014 13:49:46 +0000
Subject: [PATCH 090/153] Bug 1076904 - Include a copy of FreeType's
 LICENSE.TXT at the top level of modules/freetype2. r=gerv

---
 modules/freetype2/LICENSE.TXT        | 37 ++++++++++++++++++++++++++++
 modules/freetype2/README.moz-patches |  4 ++-
 2 files changed, 40 insertions(+), 1 deletion(-)
 create mode 100644 modules/freetype2/LICENSE.TXT

diff --git a/modules/freetype2/LICENSE.TXT b/modules/freetype2/LICENSE.TXT
new file mode 100644
index 00000000000..99dc342d764
--- /dev/null
+++ b/modules/freetype2/LICENSE.TXT
@@ -0,0 +1,37 @@
+
+The  FreeType 2  font  engine is  copyrighted  work and  cannot be  used
+legally  without a  software license.   In  order to  make this  project
+usable  to a vast  majority of  developers, we  distribute it  under two
+mutually exclusive open-source licenses.
+
+This means  that *you* must choose  *one* of the  two licenses described
+below, then obey  all its terms and conditions when  using FreeType 2 in
+any of your projects or products.
+
+  - The FreeType License, found in  the file `FTL.TXT', which is similar
+    to the original BSD license *with* an advertising clause that forces
+    you  to  explicitly cite  the  FreeType  project  in your  product's
+    documentation.  All  details are in the license  file.  This license
+    is  suited  to products  which  don't  use  the GNU  General  Public
+    License.
+
+    Note that  this license  is  compatible  to the  GNU General  Public
+    License version 3, but not version 2.
+
+  - The GNU General Public License version 2, found in  `GPLv2.TXT' (any
+    later version can be used  also), for programs which already use the
+    GPL.  Note  that the  FTL is  incompatible  with  GPLv2 due  to  its
+    advertisement clause.
+
+The contributed BDF and PCF drivers come with a license similar  to that
+of the X Window System.  It is compatible to the above two licenses (see
+file src/bdf/README and src/pcf/README).
+
+The gzip module uses the zlib license (see src/gzip/zlib.h) which too is
+compatible to the above two licenses.
+
+The MD5 checksum support (only used for debugging in development builds)
+is in the public domain.
+
+
+--- end of LICENSE.TXT ---
diff --git a/modules/freetype2/README.moz-patches b/modules/freetype2/README.moz-patches
index 050abdd82c0..854ed516206 100644
--- a/modules/freetype2/README.moz-patches
+++ b/modules/freetype2/README.moz-patches
@@ -1,4 +1,6 @@
 This directory contains freetype2 v2.5.3 downloaded from
 http://savannah.nongnu.org/download/freetype/
 
-There are currently no local changes applied to the freetype tree.
+There are currently no local changes applied to the freetype tree,
+except that the file docs/LICENSE.TXT has been copied to the top-level
+directory of the FreeType tree as LICENSE.TXT.

From 2e68ce12bc7e531f6a72f9afc13f7a9c69f212f4 Mon Sep 17 00:00:00 2001
From: Dragana Damjanovic <dd.mozilla@gmail.com>
Date: Wed, 22 Oct 2014 02:06:00 +0200
Subject: [PATCH 091/153] Bug 1087213 - Implenent bind function in
 nsNSSIOLayer. r=honza

---
 security/manager/ssl/src/nsNSSIOLayer.cpp | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/security/manager/ssl/src/nsNSSIOLayer.cpp b/security/manager/ssl/src/nsNSSIOLayer.cpp
index 96f0ed6e21c..7bb6b2cbf7d 100644
--- a/security/manager/ssl/src/nsNSSIOLayer.cpp
+++ b/security/manager/ssl/src/nsNSSIOLayer.cpp
@@ -1569,6 +1569,16 @@ PSMSend(PRFileDesc* fd, const void* buf, int32_t amount, int flags,
   return checkHandshake(bytesWritten, false, fd, socketInfo);
 }
 
+static PRStatus
+PSMBind(PRFileDesc* fd, const PRNetAddr *addr)
+{
+  nsNSSShutDownPreventionLock locker;
+  if (!getSocketInfoIfRunning(fd, not_reading_or_writing, locker))
+    return PR_FAILURE;
+
+  return fd->lower->methods->bind(fd->lower, addr);
+}
+
 static int32_t
 nsSSLIOLayerRead(PRFileDesc* fd, void* buf, int32_t amount)
 {
@@ -1715,7 +1725,6 @@ nsSSLIOLayerHelpers::Init()
     nsSSLIOLayerMethods.fileInfo64 = (PRFileInfo64FN) _PSM_InvalidStatus;
     nsSSLIOLayerMethods.writev = (PRWritevFN) _PSM_InvalidInt;
     nsSSLIOLayerMethods.accept = (PRAcceptFN) _PSM_InvalidDesc;
-    nsSSLIOLayerMethods.bind = (PRBindFN) _PSM_InvalidStatus;
     nsSSLIOLayerMethods.listen = (PRListenFN) _PSM_InvalidStatus;
     nsSSLIOLayerMethods.shutdown = (PRShutdownFN) _PSM_InvalidStatus;
     nsSSLIOLayerMethods.recvfrom = (PRRecvfromFN) _PSM_InvalidInt;
@@ -1731,6 +1740,7 @@ nsSSLIOLayerHelpers::Init()
     nsSSLIOLayerMethods.recv = PSMRecv;
     nsSSLIOLayerMethods.send = PSMSend;
     nsSSLIOLayerMethods.connectcontinue = PSMConnectcontinue;
+    nsSSLIOLayerMethods.bind = PSMBind;
 
     nsSSLIOLayerMethods.connect = nsSSLIOLayerConnect;
     nsSSLIOLayerMethods.close = nsSSLIOLayerClose;

From c6102fe0592af5ef08849d91db5fee48fb78526f Mon Sep 17 00:00:00 2001
From: "Xidorn Quan [:xidorn]" <quanxunzhen@gmail.com>
Date: Tue, 4 Nov 2014 15:45:00 +0100
Subject: [PATCH 092/153] Bug 1085311 - Vertical writing-mode support for
 single-line <input> fields. r=jfkthame

---
 layout/forms/nsTextControlFrame.cpp  | 58 +++++++++++++++-------------
 layout/forms/nsTextControlFrame.h    |  5 ++-
 layout/generic/nsFrame.cpp           | 10 +++--
 layout/generic/nsHTMLReflowState.cpp | 18 ++++-----
 layout/generic/nsHTMLReflowState.h   |  2 +-
 layout/generic/nsTextFrame.cpp       |  5 ++-
 6 files changed, 54 insertions(+), 44 deletions(-)

diff --git a/layout/forms/nsTextControlFrame.cpp b/layout/forms/nsTextControlFrame.cpp
index df82c97ebcc..ea69931a390 100644
--- a/layout/forms/nsTextControlFrame.cpp
+++ b/layout/forms/nsTextControlFrame.cpp
@@ -143,8 +143,9 @@ nsTextControlFrame::GetType() const
 
 nsresult
 nsTextControlFrame::CalcIntrinsicSize(nsRenderingContext* aRenderingContext,
-                                      nsSize&             aIntrinsicSize,
-                                      float               aFontSizeInflation)
+                                      WritingMode aWM,
+                                      LogicalSize& aIntrinsicSize,
+                                      float aFontSizeInflation)
 {
   // Get leading and the Average/MaxAdvance char width 
   nscoord lineHeight  = 0;
@@ -165,7 +166,7 @@ nsTextControlFrame::CalcIntrinsicSize(nsRenderingContext* aRenderingContext,
 
   // Set the width equal to the width in characters
   int32_t cols = GetCols();
-  aIntrinsicSize.width = cols * charWidth;
+  aIntrinsicSize.ISize(aWM) = cols * charWidth;
 
   // To better match IE, take the maximum character width(in twips) and remove
   // 4 pixels add this on as additional padding(internalPadding). But only do
@@ -182,12 +183,12 @@ nsTextControlFrame::CalcIntrinsicSize(nsRenderingContext* aRenderingContext,
       internalPadding += t - rest;
     }
     // Now add the extra padding on (so that small input sizes work well)
-    aIntrinsicSize.width += internalPadding;
+    aIntrinsicSize.ISize(aWM) += internalPadding;
   } else {
     // This is to account for the anonymous <br> having a 1 twip width
     // in Full Standards mode, see BRFrame::Reflow and bug 228752.
     if (PresContext()->CompatibilityMode() == eCompatibility_FullStandards) {
-      aIntrinsicSize.width += 1;
+      aIntrinsicSize.ISize(aWM) += 1;
     }
   }
 
@@ -197,14 +198,14 @@ nsTextControlFrame::CalcIntrinsicSize(nsRenderingContext* aRenderingContext,
     if (eStyleUnit_Coord == lsCoord.GetUnit()) {
       nscoord letterSpacing = lsCoord.GetCoordValue();
       if (letterSpacing != 0) {
-        aIntrinsicSize.width += cols * letterSpacing;
+        aIntrinsicSize.ISize(aWM) += cols * letterSpacing;
       }
     }
   }
 
   // Set the height equal to total number of rows (times the height of each
   // line, of course)
-  aIntrinsicSize.height = lineHeight * GetRows();
+  aIntrinsicSize.BSize(aWM) = lineHeight * GetRows();
 
   // Add in the size of the scrollbars for textarea
   if (IsTextArea()) {
@@ -217,9 +218,8 @@ nsTextControlFrame::CalcIntrinsicSize(nsRenderingContext* aRenderingContext,
       nsMargin scrollbarSizes =
       scrollableFrame->GetDesiredScrollbarSizes(PresContext(), aRenderingContext);
 
-      aIntrinsicSize.width  += scrollbarSizes.LeftRight();
-
-      aIntrinsicSize.height += scrollbarSizes.TopBottom();;
+      aIntrinsicSize.Width(aWM) += scrollbarSizes.LeftRight();
+      aIntrinsicSize.Height(aWM) += scrollbarSizes.TopBottom();
     }
   }
 
@@ -425,10 +425,11 @@ nsTextControlFrame::GetPrefISize(nsRenderingContext* aRenderingContext)
     DISPLAY_PREF_WIDTH(this, result);
 
     float inflation = nsLayoutUtils::FontSizeInflationFor(this);
-    nsSize autoSize;
-    CalcIntrinsicSize(aRenderingContext, autoSize, inflation);
+    WritingMode wm = GetWritingMode();
+    LogicalSize autoSize(wm);
+    CalcIntrinsicSize(aRenderingContext, wm, autoSize, inflation);
 
-    return autoSize.width; 
+    return autoSize.ISize(wm);
 }
 
 nscoord
@@ -454,29 +455,32 @@ nsTextControlFrame::ComputeAutoSize(nsRenderingContext *aRenderingContext,
                                     bool aShrinkWrap)
 {
   float inflation = nsLayoutUtils::FontSizeInflationFor(this);
-  // XXX CalcIntrinsicSize needs to be updated to use a LogicalSize
-  nsSize autoSize;
-  nsresult rv = CalcIntrinsicSize(aRenderingContext, autoSize, inflation);
+  LogicalSize autoSize(aWM);
+  nsresult rv = CalcIntrinsicSize(aRenderingContext, aWM, autoSize, inflation);
   if (NS_FAILED(rv)) {
     // What now?
-    autoSize.SizeTo(0, 0);
+    autoSize.SizeTo(aWM, 0, 0);
   }
 #ifdef DEBUG
   // Note: Ancestor ComputeAutoSize only computes a width if we're auto-width
-  else if (StylePosition()->mWidth.GetUnit() == eStyleUnit_Auto) {
-    LogicalSize ancestorAutoSize =
-      nsContainerFrame::ComputeAutoSize(aRenderingContext, aWM,
-                                        aCBSize, aAvailableISize,
-                                        aMargin, aBorder,
-                                        aPadding, aShrinkWrap);
-    // Disabled when there's inflation; see comment in GetPrefSize.
-    NS_ASSERTION(inflation != 1.0f ||
-                 ancestorAutoSize.Width(aWM) == autoSize.width,
+  else {
+    const nsStyleCoord& inlineStyleCoord =
+      aWM.IsVertical() ? StylePosition()->mHeight : StylePosition()->mWidth;
+    if (inlineStyleCoord.GetUnit() == eStyleUnit_Auto) {
+      LogicalSize ancestorAutoSize =
+        nsContainerFrame::ComputeAutoSize(aRenderingContext, aWM,
+                                          aCBSize, aAvailableISize,
+                                          aMargin, aBorder,
+                                          aPadding, aShrinkWrap);
+      // Disabled when there's inflation; see comment in GetPrefSize.
+      MOZ_ASSERT(inflation != 1.0f ||
+                 ancestorAutoSize.ISize(aWM) == autoSize.ISize(aWM),
                  "Incorrect size computed by ComputeAutoSize?");
+    }
   }
 #endif
 
-  return LogicalSize(aWM, autoSize);
+  return autoSize;
 }
 
 void
diff --git a/layout/forms/nsTextControlFrame.h b/layout/forms/nsTextControlFrame.h
index 9aee76c5ca6..4d85c23ee5d 100644
--- a/layout/forms/nsTextControlFrame.h
+++ b/layout/forms/nsTextControlFrame.h
@@ -272,8 +272,9 @@ protected:
   // etc.  Just the size of our actual area for the text (and the scrollbars,
   // for <textarea>).
   nsresult CalcIntrinsicSize(nsRenderingContext* aRenderingContext,
-                             nsSize&             aIntrinsicSize,
-                             float               aFontSizeInflation);
+                             mozilla::WritingMode aWM,
+                             mozilla::LogicalSize& aIntrinsicSize,
+                             float aFontSizeInflation);
 
   nsresult ScrollSelectionIntoView() MOZ_OVERRIDE;
 
diff --git a/layout/generic/nsFrame.cpp b/layout/generic/nsFrame.cpp
index ed331649e0d..2cc1a5ac4d2 100644
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -3800,9 +3800,13 @@ nsFrame::GetCursor(const nsPoint& aPoint,
     // If this is editable, I-beam cursor is better for most elements.
     aCursor.mCursor =
       (mContent && mContent->IsEditable())
-      ? GetWritingMode().IsVertical()
-        ? NS_STYLE_CURSOR_VERTICAL_TEXT : NS_STYLE_CURSOR_TEXT
-      : NS_STYLE_CURSOR_DEFAULT;
+      ? NS_STYLE_CURSOR_TEXT : NS_STYLE_CURSOR_DEFAULT;
+  }
+  if (NS_STYLE_CURSOR_TEXT == aCursor.mCursor &&
+      GetWritingMode().IsVertical()) {
+    // Per CSS UI spec, UA may treat value 'text' as
+    // 'vertical-text' for vertical text.
+    aCursor.mCursor = NS_STYLE_CURSOR_VERTICAL_TEXT;
   }
 
   return NS_OK;
diff --git a/layout/generic/nsHTMLReflowState.cpp b/layout/generic/nsHTMLReflowState.cpp
index ee3ba16c134..cc334691e55 100644
--- a/layout/generic/nsHTMLReflowState.cpp
+++ b/layout/generic/nsHTMLReflowState.cpp
@@ -2478,7 +2478,7 @@ GetNormalLineHeight(nsFontMetrics* aFontMetrics)
 
 static inline nscoord
 ComputeLineHeight(nsStyleContext* aStyleContext,
-                  nscoord aBlockHeight,
+                  nscoord aBlockBSize,
                   float aFontSizeInflation)
 {
   const nsStyleCoord& lhCoord = aStyleContext->StyleText()->mLineHeight;
@@ -2505,8 +2505,8 @@ ComputeLineHeight(nsStyleContext* aStyleContext,
   if (lhCoord.GetUnit() == eStyleUnit_Enumerated) {
     NS_ASSERTION(lhCoord.GetIntValue() == NS_STYLE_LINE_HEIGHT_BLOCK_HEIGHT,
                  "bad line-height value");
-    if (aBlockHeight != NS_AUTOHEIGHT) {
-      return aBlockHeight;
+    if (aBlockBSize != NS_AUTOHEIGHT) {
+      return aBlockBSize;
     }
   }
 
@@ -2520,24 +2520,24 @@ ComputeLineHeight(nsStyleContext* aStyleContext,
 nscoord
 nsHTMLReflowState::CalcLineHeight() const
 {
-  nscoord blockHeight =
-    nsLayoutUtils::IsNonWrapperBlock(frame) ? ComputedHeight() :
-    (mCBReflowState ? mCBReflowState->ComputedHeight() : NS_AUTOHEIGHT);
+  nscoord blockBSize =
+    nsLayoutUtils::IsNonWrapperBlock(frame) ? ComputedBSize() :
+    (mCBReflowState ? mCBReflowState->ComputedBSize() : NS_AUTOHEIGHT);
 
-  return CalcLineHeight(frame->GetContent(), frame->StyleContext(), blockHeight,
+  return CalcLineHeight(frame->GetContent(), frame->StyleContext(), blockBSize,
                         nsLayoutUtils::FontSizeInflationFor(frame));
 }
 
 /* static */ nscoord
 nsHTMLReflowState::CalcLineHeight(nsIContent* aContent,
                                   nsStyleContext* aStyleContext,
-                                  nscoord aBlockHeight,
+                                  nscoord aBlockBSize,
                                   float aFontSizeInflation)
 {
   NS_PRECONDITION(aStyleContext, "Must have a style context");
 
   nscoord lineHeight =
-    ComputeLineHeight(aStyleContext, aBlockHeight, aFontSizeInflation);
+    ComputeLineHeight(aStyleContext, aBlockBSize, aFontSizeInflation);
 
   NS_ASSERTION(lineHeight >= 0, "ComputeLineHeight screwed up");
 
diff --git a/layout/generic/nsHTMLReflowState.h b/layout/generic/nsHTMLReflowState.h
index db84340e975..f5ab4ad245e 100644
--- a/layout/generic/nsHTMLReflowState.h
+++ b/layout/generic/nsHTMLReflowState.h
@@ -637,7 +637,7 @@ public:
    */
   static nscoord CalcLineHeight(nsIContent* aContent,
                                 nsStyleContext* aStyleContext,
-                                nscoord aBlockHeight,
+                                nscoord aBlockBSize,
                                 float aFontSizeInflation);
 
 
diff --git a/layout/generic/nsTextFrame.cpp b/layout/generic/nsTextFrame.cpp
index 7a334383bbc..f6fdf3c8e19 100644
--- a/layout/generic/nsTextFrame.cpp
+++ b/layout/generic/nsTextFrame.cpp
@@ -4242,9 +4242,10 @@ nsTextFrame::GetCursor(const nsPoint& aPoint,
         }
       }
     }
+    return NS_OK;
+  } else {
+    return nsFrame::GetCursor(aPoint, aCursor);
   }
-
-  return NS_OK;
 }
 
 nsIFrame*

From 8c558ad02689a8f8821f596d3c8030012fb18b21 Mon Sep 17 00:00:00 2001
From: Emanuel Hoogeveen <emanuel.hoogeveen@gmail.com>
Date: Wed, 5 Nov 2014 00:33:00 +0100
Subject: [PATCH 093/153] Bug 1084651 - Part 1: Thread SliceBudget through
 several functions to choose the budget type at the source. r=billm

---
 js/src/builtin/TestingFunctions.cpp           | 11 ++-
 js/src/gc/GCRuntime.h                         | 10 +--
 js/src/jsapi-tests/testGCFinalizeCallback.cpp |  6 +-
 js/src/jsapi-tests/testWeakMap.cpp            |  6 +-
 js/src/jsgc.cpp                               | 80 +++++++++----------
 5 files changed, 58 insertions(+), 55 deletions(-)

diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctions.cpp
index 55b851a7220..89a17af7feb 100644
--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@@ -628,16 +628,15 @@ GCSlice(JSContext *cx, unsigned argc, Value *vp)
         return false;
     }
 
-    bool limit = true;
-    uint32_t budget = 0;
+    SliceBudget budget;
     if (args.length() == 1) {
-        if (!ToUint32(cx, args[0], &budget))
+        uint32_t work = 0;
+        if (!ToUint32(cx, args[0], &work))
             return false;
-    } else {
-        limit = false;
+        budget = SliceBudget(SliceBudget::WorkBudget(work));
     }
 
-    cx->runtime()->gc.gcDebugSlice(limit, budget);
+    cx->runtime()->gc.gcDebugSlice(budget);
     args.rval().setUndefined();
     return true;
 }
diff --git a/js/src/gc/GCRuntime.h b/js/src/gc/GCRuntime.h
index e09de781dcd..faab260bbf4 100644
--- a/js/src/gc/GCRuntime.h
+++ b/js/src/gc/GCRuntime.h
@@ -281,7 +281,7 @@ class GCRuntime
     void gc(JSGCInvocationKind gckind, JS::gcreason::Reason reason);
     void gcSlice(JSGCInvocationKind gckind, JS::gcreason::Reason reason, int64_t millis = 0);
     void gcFinalSlice(JSGCInvocationKind gckind, JS::gcreason::Reason reason);
-    void gcDebugSlice(bool limit, int64_t objCount);
+    void gcDebugSlice(SliceBudget &budget);
 
     void runDebugGC();
     inline void poke();
@@ -509,14 +509,14 @@ class GCRuntime
 
     bool initZeal();
     void requestMajorGC(JS::gcreason::Reason reason);
-    void collect(bool incremental, int64_t budget, JSGCInvocationKind gckind,
+    void collect(bool incremental, SliceBudget &budget, JSGCInvocationKind gckind,
                  JS::gcreason::Reason reason);
-    bool gcCycle(bool incremental, int64_t budget, JSGCInvocationKind gckind,
+    bool gcCycle(bool incremental, SliceBudget &budget, JSGCInvocationKind gckind,
                  JS::gcreason::Reason reason);
     gcstats::ZoneGCStats scanZonesBeforeGC();
-    void budgetIncrementalGC(int64_t *budget);
+    void budgetIncrementalGC(SliceBudget &budget);
     void resetIncrementalGC(const char *reason);
-    void incrementalCollectSlice(int64_t budget, JS::gcreason::Reason reason);
+    void incrementalCollectSlice(SliceBudget &budget, JS::gcreason::Reason reason);
     void pushZealSelectedObjects();
     void purgeRuntime();
     bool beginMarkPhase(JS::gcreason::Reason reason);
diff --git a/js/src/jsapi-tests/testGCFinalizeCallback.cpp b/js/src/jsapi-tests/testGCFinalizeCallback.cpp
index 16ec36b58e5..c8e35e7a702 100644
--- a/js/src/jsapi-tests/testGCFinalizeCallback.cpp
+++ b/js/src/jsapi-tests/testGCFinalizeCallback.cpp
@@ -87,12 +87,14 @@ BEGIN_TEST(testGCFinalizeCallback)
     FinalizeCalls = 0;
     JS_SetGCZeal(cx, 9, 1000000);
     JS::PrepareForFullGC(rt);
-    rt->gc.gcDebugSlice(true, 1);
+    js::SliceBudget budget(js::SliceBudget::WorkBudget(1));
+    rt->gc.gcDebugSlice(budget);
     CHECK(rt->gc.state() == js::gc::MARK);
     CHECK(rt->gc.isFullGc());
 
     JS::RootedObject global4(cx, createTestGlobal());
-    rt->gc.gcDebugSlice(true, 1);
+    budget = js::SliceBudget(js::SliceBudget::WorkBudget(1));
+    rt->gc.gcDebugSlice(budget);
     CHECK(rt->gc.state() == js::gc::NO_INCREMENTAL);
     CHECK(!rt->gc.isFullGc());
     CHECK(checkMultipleGroups());
diff --git a/js/src/jsapi-tests/testWeakMap.cpp b/js/src/jsapi-tests/testWeakMap.cpp
index 8a85ab3c85f..0f85be1bb19 100644
--- a/js/src/jsapi-tests/testWeakMap.cpp
+++ b/js/src/jsapi-tests/testWeakMap.cpp
@@ -89,7 +89,8 @@ BEGIN_TEST(testWeakMap_keyDelegates)
      * zone to finish marking before the delegate zone.
      */
     CHECK(newCCW(map, delegate));
-    rt->gc.gcDebugSlice(true, 1000000);
+    js::SliceBudget budget(js::SliceBudget::WorkBudget(1000000));
+    rt->gc.gcDebugSlice(budget);
 #ifdef DEBUG
     CHECK(map->zone()->lastZoneGroupIndex() < delegate->zone()->lastZoneGroupIndex());
 #endif
@@ -102,7 +103,8 @@ BEGIN_TEST(testWeakMap_keyDelegates)
     /* Check the delegate keeps the entry alive even if the key is not reachable. */
     key = nullptr;
     CHECK(newCCW(map, delegate));
-    rt->gc.gcDebugSlice(true, 100000);
+    budget = js::SliceBudget(js::SliceBudget::WorkBudget(100000));
+    rt->gc.gcDebugSlice(budget);
     CHECK(checkSize(map, 1));
 
     /*
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index 1ffacbdb245..86a2bef9eed 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -1457,7 +1457,7 @@ GCRuntime::setParameter(JSGCParamKey key, uint32_t value)
         setMaxMallocBytes(value);
         break;
       case JSGC_SLICE_TIME_BUDGET:
-        sliceBudget = SliceBudget::TimeBudget(value);
+        sliceBudget = value;
         break;
       case JSGC_MARK_STACK_LIMIT:
         setMarkStackLimit(value);
@@ -1554,7 +1554,7 @@ GCRuntime::getParameter(JSGCParamKey key, const AutoLockGC &lock)
       case JSGC_TOTAL_CHUNKS:
         return uint32_t(chunkSet.count() + emptyChunks(lock).count());
       case JSGC_SLICE_TIME_BUDGET:
-        return uint32_t(sliceBudget > 0 ? sliceBudget / PRMJ_USEC_PER_MSEC : 0);
+        return uint32_t(sliceBudget > 0 ? sliceBudget : 0);
       case JSGC_MARK_STACK_LIMIT:
         return marker.maxCapacity();
       case JSGC_HIGH_FREQUENCY_TIME_LIMIT:
@@ -5533,7 +5533,7 @@ GCRuntime::resetIncrementalGC(const char *reason)
         break;
       }
 
-      case SWEEP:
+      case SWEEP: {
         marker.reset();
 
         for (CompartmentsIter c(rt, SkipAtoms); !c.done(); c.next())
@@ -5541,13 +5541,15 @@ GCRuntime::resetIncrementalGC(const char *reason)
 
         /* Finish sweeping the current zone group, then abort. */
         abortSweepAfterCurrentGroup = true;
-        incrementalCollectSlice(SliceBudget::Unlimited, JS::gcreason::RESET);
+        SliceBudget budget;
+        incrementalCollectSlice(budget, JS::gcreason::RESET);
 
         {
             gcstats::AutoPhase ap(stats, gcstats::PHASE_WAIT_BACKGROUND_THREAD);
             rt->gc.waitBackgroundSweepOrAllocEnd();
         }
         break;
+      }
 
       default:
         MOZ_CRASH("Invalid incremental GC state");
@@ -5635,8 +5637,7 @@ GCRuntime::pushZealSelectedObjects()
 }
 
 void
-GCRuntime::incrementalCollectSlice(int64_t budget,
-                                   JS::gcreason::Reason reason)
+GCRuntime::incrementalCollectSlice(SliceBudget &budget, JS::gcreason::Reason reason)
 {
     MOZ_ASSERT(rt->currentThreadHasExclusiveAccess());
 
@@ -5649,7 +5650,7 @@ GCRuntime::incrementalCollectSlice(int64_t budget,
 
     int zeal = 0;
 #ifdef JS_GC_ZEAL
-    if (reason == JS::gcreason::DEBUG_GC && budget != SliceBudget::Unlimited) {
+    if (reason == JS::gcreason::DEBUG_GC && !budget.isUnlimited()) {
         /*
          * Do the incremental collection type specified by zeal mode if the
          * collection was triggered by runDebugGC() and incremental GC has not
@@ -5660,18 +5661,16 @@ GCRuntime::incrementalCollectSlice(int64_t budget,
 #endif
 
     MOZ_ASSERT_IF(incrementalState != NO_INCREMENTAL, isIncremental);
-    isIncremental = budget != SliceBudget::Unlimited;
+    isIncremental = !budget.isUnlimited();
 
     if (zeal == ZealIncrementalRootsThenFinish || zeal == ZealIncrementalMarkAllThenFinish) {
         /*
          * Yields between slices occurs at predetermined points in these modes;
          * the budget is not used.
          */
-        budget = SliceBudget::Unlimited;
+        budget.reset();
     }
 
-    SliceBudget sliceBudget(budget);
-
     if (incrementalState == NO_INCREMENTAL) {
         incrementalState = MARK_ROOTS;
         lastMarkSlice = false;
@@ -5701,11 +5700,11 @@ GCRuntime::incrementalCollectSlice(int64_t budget,
       case MARK: {
         /* If we needed delayed marking for gray roots, then collect until done. */
         if (!marker.hasBufferedGrayRoots()) {
-            sliceBudget.reset();
+            budget.reset();
             isIncremental = false;
         }
 
-        bool finished = drainMarkStack(sliceBudget, gcstats::PHASE_MARK);
+        bool finished = drainMarkStack(budget, gcstats::PHASE_MARK);
         if (!finished)
             break;
 
@@ -5731,7 +5730,7 @@ GCRuntime::incrementalCollectSlice(int64_t budget,
          * now exhasted.
          */
         beginSweepPhase(lastGC);
-        if (sliceBudget.isOverBudget())
+        if (budget.isOverBudget())
             break;
 
         /*
@@ -5745,7 +5744,7 @@ GCRuntime::incrementalCollectSlice(int64_t budget,
       }
 
       case SWEEP: {
-        bool finished = sweepPhase(sliceBudget);
+        bool finished = sweepPhase(budget);
         if (!finished)
             break;
 
@@ -5786,32 +5785,32 @@ gc::IsIncrementalGCSafe(JSRuntime *rt)
 }
 
 void
-GCRuntime::budgetIncrementalGC(int64_t *budget)
+GCRuntime::budgetIncrementalGC(SliceBudget &budget)
 {
     IncrementalSafety safe = IsIncrementalGCSafe(rt);
     if (!safe) {
         resetIncrementalGC(safe.reason());
-        *budget = SliceBudget::Unlimited;
+        budget.reset();
         stats.nonincremental(safe.reason());
         return;
     }
 
     if (mode != JSGC_MODE_INCREMENTAL) {
         resetIncrementalGC("GC mode change");
-        *budget = SliceBudget::Unlimited;
+        budget.reset();
         stats.nonincremental("GC mode");
         return;
     }
 
     if (isTooMuchMalloc()) {
-        *budget = SliceBudget::Unlimited;
+        budget.reset();
         stats.nonincremental("malloc bytes trigger");
     }
 
     bool reset = false;
     for (ZonesIter zone(rt, WithAtoms); !zone.done(); zone.next()) {
         if (zone->usage.gcBytes() >= zone->threshold.gcTriggerBytes()) {
-            *budget = SliceBudget::Unlimited;
+            budget.reset();
             stats.nonincremental("allocation trigger");
         }
 
@@ -5822,7 +5821,7 @@ GCRuntime::budgetIncrementalGC(int64_t *budget)
         }
 
         if (zone->isTooMuchMalloc()) {
-            *budget = SliceBudget::Unlimited;
+            budget.reset();
             stats.nonincremental("malloc bytes trigger");
         }
     }
@@ -5868,7 +5867,7 @@ struct AutoDisableStoreBuffer
  * to run another cycle.
  */
 MOZ_NEVER_INLINE bool
-GCRuntime::gcCycle(bool incremental, int64_t budget, JSGCInvocationKind gckind,
+GCRuntime::gcCycle(bool incremental, SliceBudget &budget, JSGCInvocationKind gckind,
                    JS::gcreason::Reason reason)
 {
     minorGC(reason);
@@ -5922,9 +5921,9 @@ GCRuntime::gcCycle(bool incremental, int64_t budget, JSGCInvocationKind gckind,
             resetIncrementalGC("requested");
 
         stats.nonincremental("requested");
-        budget = SliceBudget::Unlimited;
+        budget.reset();
     } else {
-        budgetIncrementalGC(&budget);
+        budgetIncrementalGC(budget);
     }
 
     /* The GC was reset, so we need a do-over. */
@@ -6017,7 +6016,7 @@ GCRuntime::scanZonesBeforeGC()
 }
 
 void
-GCRuntime::collect(bool incremental, int64_t budget, JSGCInvocationKind gckind,
+GCRuntime::collect(bool incremental, SliceBudget &budget, JSGCInvocationKind gckind,
                    JS::gcreason::Reason reason)
 {
     /* GC shouldn't be running in parallel execution mode */
@@ -6042,7 +6041,7 @@ GCRuntime::collect(bool incremental, int64_t budget, JSGCInvocationKind gckind,
         return;
 #endif
 
-    MOZ_ASSERT_IF(!incremental || budget != SliceBudget::Unlimited, JSGC_INCREMENTAL);
+    MOZ_ASSERT_IF(!incremental || !budget.isUnlimited(), JSGC_INCREMENTAL);
 
     AutoStopVerifyingBarriers av(rt, reason == JS::gcreason::SHUTDOWN_CC ||
                                      reason == JS::gcreason::DESTROY_RUNTIME);
@@ -6109,21 +6108,22 @@ GCRuntime::collect(bool incremental, int64_t budget, JSGCInvocationKind gckind,
 void
 GCRuntime::gc(JSGCInvocationKind gckind, JS::gcreason::Reason reason)
 {
-    collect(false, SliceBudget::Unlimited, gckind, reason);
+    SliceBudget budget;
+    collect(false, budget, gckind, reason);
 }
 
 void
 GCRuntime::gcSlice(JSGCInvocationKind gckind, JS::gcreason::Reason reason, int64_t millis)
 {
-    int64_t budget;
+    SliceBudget budget;
     if (millis)
-        budget = SliceBudget::TimeBudget(millis);
+        budget = SliceBudget(SliceBudget::TimeBudget(millis));
     else if (reason == JS::gcreason::ALLOC_TRIGGER)
-        budget = sliceBudget;
+        budget = SliceBudget(SliceBudget::TimeBudget(sliceBudget));
     else if (schedulingState.inHighFrequencyGCMode() && tunables.isDynamicMarkSliceEnabled())
-        budget = sliceBudget * IGC_MARK_SLICE_MULTIPLIER;
+        budget = SliceBudget(SliceBudget::TimeBudget(sliceBudget * IGC_MARK_SLICE_MULTIPLIER));
     else
-        budget = sliceBudget;
+        budget = SliceBudget(SliceBudget::TimeBudget(sliceBudget));
 
     collect(true, budget, gckind, reason);
 }
@@ -6131,7 +6131,8 @@ GCRuntime::gcSlice(JSGCInvocationKind gckind, JS::gcreason::Reason reason, int64
 void
 GCRuntime::gcFinalSlice(JSGCInvocationKind gckind, JS::gcreason::Reason reason)
 {
-    collect(true, SliceBudget::Unlimited, gckind, reason);
+    SliceBudget budget;
+    collect(true, budget, gckind, reason);
 }
 
 void
@@ -6174,9 +6175,8 @@ ZonesSelected(JSRuntime *rt)
 }
 
 void
-GCRuntime::gcDebugSlice(bool limit, int64_t objCount)
+GCRuntime::gcDebugSlice(SliceBudget &budget)
 {
-    int64_t budget = limit ? SliceBudget::WorkBudget(objCount) : SliceBudget::Unlimited;
     if (!ZonesSelected(rt)) {
         if (JS::IsIncrementalGCInProgress(rt))
             JS::PrepareForIncrementalGC(rt);
@@ -6427,12 +6427,12 @@ GCRuntime::runDebugGC()
 
     PrepareForDebugGC(rt);
 
+    SliceBudget budget;
     if (type == ZealIncrementalRootsThenFinish ||
         type == ZealIncrementalMarkAllThenFinish ||
         type == ZealIncrementalMultipleSlices)
     {
         js::gc::State initialState = incrementalState;
-        int64_t budget;
         if (type == ZealIncrementalMultipleSlices) {
             /*
              * Start with a small slice limit and double it every slice. This
@@ -6443,10 +6443,10 @@ GCRuntime::runDebugGC()
                 incrementalLimit = zealFrequency / 2;
             else
                 incrementalLimit *= 2;
-            budget = SliceBudget::WorkBudget(incrementalLimit);
+            budget = SliceBudget(SliceBudget::WorkBudget(incrementalLimit));
         } else {
             // This triggers incremental GC but is actually ignored by IncrementalMarkSlice.
-            budget = SliceBudget::WorkBudget(1);
+            budget = SliceBudget(SliceBudget::WorkBudget(1));
         }
 
         collect(true, budget, GC_NORMAL, JS::gcreason::DEBUG_GC);
@@ -6461,9 +6461,9 @@ GCRuntime::runDebugGC()
             incrementalLimit = zealFrequency / 2;
         }
     } else if (type == ZealCompactValue) {
-        collect(false, SliceBudget::Unlimited, GC_SHRINK, JS::gcreason::DEBUG_GC);
+        collect(false, budget, GC_SHRINK, JS::gcreason::DEBUG_GC);
     } else {
-        collect(false, SliceBudget::Unlimited, GC_NORMAL, JS::gcreason::DEBUG_GC);
+        collect(false, budget, GC_NORMAL, JS::gcreason::DEBUG_GC);
     }
 
 #endif

From 69f8cfc1a9c5ca408ddfbd63da995a4e0d8fac26 Mon Sep 17 00:00:00 2001
From: Emanuel Hoogeveen <emanuel.hoogeveen@gmail.com>
Date: Wed, 22 Oct 2014 14:13:00 +0200
Subject: [PATCH 094/153] Bug 1084651 - Part 2: Clean up SliceBudget and
 require explicitly choosing between TimeBudget and WorkBudget. r=wmccloskey
 r=mccr8

---
 js/public/SliceBudget.h                       | 40 ++++++++++++------
 js/src/builtin/TestingFunctions.cpp           |  2 +-
 js/src/jsapi-tests/testGCFinalizeCallback.cpp |  4 +-
 js/src/jsapi-tests/testWeakMap.cpp            |  4 +-
 js/src/jsgc.cpp                               | 42 +++++++------------
 xpcom/base/nsCycleCollector.cpp               |  8 ++--
 6 files changed, 53 insertions(+), 47 deletions(-)

diff --git a/js/public/SliceBudget.h b/js/public/SliceBudget.h
index 7c602c5572a..2dfbdacc73e 100644
--- a/js/public/SliceBudget.h
+++ b/js/public/SliceBudget.h
@@ -11,11 +11,25 @@
 
 namespace js {
 
+struct JS_PUBLIC_API(TimeBudget)
+{
+    int64_t budget;
+
+    explicit TimeBudget(int64_t milliseconds) { budget = milliseconds; }
+};
+
+struct JS_PUBLIC_API(WorkBudget)
+{
+    int64_t budget;
+
+    explicit WorkBudget(int64_t work) { budget = work; }
+};
+
 /*
- * This class records how much work has been done in a given collection slice, so that
- * we can return before pausing for too long. Some slices are allowed to run for
- * unlimited time, and others are bounded. To reduce the number of gettimeofday
- * calls, we only check the time every 1000 operations.
+ * This class records how much work has been done in a given collection slice,
+ * so that we can return before pausing for too long. Some slices are allowed
+ * to run for unlimited time, and others are bounded. To reduce the number of
+ * gettimeofday calls, we only check the time every 1000 operations.
  */
 struct JS_PUBLIC_API(SliceBudget)
 {
@@ -25,14 +39,15 @@ struct JS_PUBLIC_API(SliceBudget)
     static const intptr_t CounterReset = 1000;
 
     static const int64_t Unlimited = 0;
-    static int64_t TimeBudget(int64_t millis);
-    static int64_t WorkBudget(int64_t work);
 
-    /* Equivalent to SliceBudget(UnlimitedBudget). */
+    /* Use to create an unlimited budget. */
     SliceBudget();
 
-    /* Instantiate as SliceBudget(Time/WorkBudget(n)). */
-    explicit SliceBudget(int64_t budget);
+    /* Instantiate as SliceBudget(TimeBudget(n)). */
+    explicit SliceBudget(TimeBudget time);
+
+    /* Instantiate as SliceBudget(WorkBudget(n)). */
+    explicit SliceBudget(WorkBudget work);
 
     void reset() {
         deadline = unlimitedDeadline;
@@ -43,8 +58,6 @@ struct JS_PUBLIC_API(SliceBudget)
         counter -= amt;
     }
 
-    bool checkOverBudget();
-
     bool isOverBudget() {
         if (counter >= 0)
             return false;
@@ -55,10 +68,11 @@ struct JS_PUBLIC_API(SliceBudget)
         return deadline == unlimitedDeadline;
     }
 
-private:
+  private:
+    bool checkOverBudget();
+
     static const int64_t unlimitedDeadline = INT64_MAX;
     static const intptr_t unlimitedStartCounter = INTPTR_MAX;
-
 };
 
 } // namespace js
diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctions.cpp
index 89a17af7feb..1a88fd349be 100644
--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@@ -633,7 +633,7 @@ GCSlice(JSContext *cx, unsigned argc, Value *vp)
         uint32_t work = 0;
         if (!ToUint32(cx, args[0], &work))
             return false;
-        budget = SliceBudget(SliceBudget::WorkBudget(work));
+        budget = SliceBudget(WorkBudget(work));
     }
 
     cx->runtime()->gc.gcDebugSlice(budget);
diff --git a/js/src/jsapi-tests/testGCFinalizeCallback.cpp b/js/src/jsapi-tests/testGCFinalizeCallback.cpp
index c8e35e7a702..049d2445622 100644
--- a/js/src/jsapi-tests/testGCFinalizeCallback.cpp
+++ b/js/src/jsapi-tests/testGCFinalizeCallback.cpp
@@ -87,13 +87,13 @@ BEGIN_TEST(testGCFinalizeCallback)
     FinalizeCalls = 0;
     JS_SetGCZeal(cx, 9, 1000000);
     JS::PrepareForFullGC(rt);
-    js::SliceBudget budget(js::SliceBudget::WorkBudget(1));
+    js::SliceBudget budget(js::WorkBudget(1));
     rt->gc.gcDebugSlice(budget);
     CHECK(rt->gc.state() == js::gc::MARK);
     CHECK(rt->gc.isFullGc());
 
     JS::RootedObject global4(cx, createTestGlobal());
-    budget = js::SliceBudget(js::SliceBudget::WorkBudget(1));
+    budget = js::SliceBudget(js::WorkBudget(1));
     rt->gc.gcDebugSlice(budget);
     CHECK(rt->gc.state() == js::gc::NO_INCREMENTAL);
     CHECK(!rt->gc.isFullGc());
diff --git a/js/src/jsapi-tests/testWeakMap.cpp b/js/src/jsapi-tests/testWeakMap.cpp
index 0f85be1bb19..74f05538c97 100644
--- a/js/src/jsapi-tests/testWeakMap.cpp
+++ b/js/src/jsapi-tests/testWeakMap.cpp
@@ -89,7 +89,7 @@ BEGIN_TEST(testWeakMap_keyDelegates)
      * zone to finish marking before the delegate zone.
      */
     CHECK(newCCW(map, delegate));
-    js::SliceBudget budget(js::SliceBudget::WorkBudget(1000000));
+    js::SliceBudget budget(js::WorkBudget(1000000));
     rt->gc.gcDebugSlice(budget);
 #ifdef DEBUG
     CHECK(map->zone()->lastZoneGroupIndex() < delegate->zone()->lastZoneGroupIndex());
@@ -103,7 +103,7 @@ BEGIN_TEST(testWeakMap_keyDelegates)
     /* Check the delegate keeps the entry alive even if the key is not reachable. */
     key = nullptr;
     CHECK(newCCW(map, delegate));
-    budget = js::SliceBudget(js::SliceBudget::WorkBudget(100000));
+    budget = js::SliceBudget(js::WorkBudget(100000));
     rt->gc.gcDebugSlice(budget);
     CHECK(checkSize(map, 1));
 
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index 86a2bef9eed..116b33e0455 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -2930,37 +2930,27 @@ GCRuntime::refillFreeListInGC(Zone *zone, AllocKind thingKind)
     return allocator.arenas.allocateFromArena(zone, thingKind);
 }
 
-/* static */ int64_t
-SliceBudget::TimeBudget(int64_t millis)
-{
-    return millis * PRMJ_USEC_PER_MSEC;
-}
-
-/* static */ int64_t
-SliceBudget::WorkBudget(int64_t work)
-{
-    /* For work = 0 not to mean Unlimited, we subtract 1. */
-    return -work - 1;
-}
-
 SliceBudget::SliceBudget()
 {
     reset();
 }
 
-SliceBudget::SliceBudget(int64_t budget)
+SliceBudget::SliceBudget(TimeBudget time)
 {
-    if (budget == Unlimited) {
+    if (time.budget == Unlimited) {
         reset();
-    } else if (budget > 0) {
-        deadline = PRMJ_Now() + budget;
-        counter = CounterReset;
     } else {
-        deadline = 0;
-        counter = -budget - 1;
+        deadline = PRMJ_Now() + time.budget * PRMJ_USEC_PER_MSEC;
+        counter = CounterReset;
     }
 }
 
+SliceBudget::SliceBudget(WorkBudget work)
+{
+    deadline = 0;
+    counter = work.budget;
+}
+
 bool
 SliceBudget::checkOverBudget()
 {
@@ -6117,13 +6107,13 @@ GCRuntime::gcSlice(JSGCInvocationKind gckind, JS::gcreason::Reason reason, int64
 {
     SliceBudget budget;
     if (millis)
-        budget = SliceBudget(SliceBudget::TimeBudget(millis));
+        budget = SliceBudget(TimeBudget(millis));
     else if (reason == JS::gcreason::ALLOC_TRIGGER)
-        budget = SliceBudget(SliceBudget::TimeBudget(sliceBudget));
+        budget = SliceBudget(TimeBudget(sliceBudget));
     else if (schedulingState.inHighFrequencyGCMode() && tunables.isDynamicMarkSliceEnabled())
-        budget = SliceBudget(SliceBudget::TimeBudget(sliceBudget * IGC_MARK_SLICE_MULTIPLIER));
+        budget = SliceBudget(TimeBudget(sliceBudget * IGC_MARK_SLICE_MULTIPLIER));
     else
-        budget = SliceBudget(SliceBudget::TimeBudget(sliceBudget));
+        budget = SliceBudget(TimeBudget(sliceBudget));
 
     collect(true, budget, gckind, reason);
 }
@@ -6443,10 +6433,10 @@ GCRuntime::runDebugGC()
                 incrementalLimit = zealFrequency / 2;
             else
                 incrementalLimit *= 2;
-            budget = SliceBudget(SliceBudget::WorkBudget(incrementalLimit));
+            budget = SliceBudget(WorkBudget(incrementalLimit));
         } else {
             // This triggers incremental GC but is actually ignored by IncrementalMarkSlice.
-            budget = SliceBudget(SliceBudget::WorkBudget(1));
+            budget = SliceBudget(WorkBudget(1));
         }
 
         collect(true, budget, GC_NORMAL, JS::gcreason::DEBUG_GC);
diff --git a/xpcom/base/nsCycleCollector.cpp b/xpcom/base/nsCycleCollector.cpp
index 3373cbb1822..ba7395459b9 100644
--- a/xpcom/base/nsCycleCollector.cpp
+++ b/xpcom/base/nsCycleCollector.cpp
@@ -3622,7 +3622,9 @@ nsCycleCollector::Collect(ccType aCCType,
         break;
     }
     if (continueSlice) {
-      continueSlice = !aBudget.checkOverBudget();
+      // Force SliceBudget::isOverBudget to check the time.
+      aBudget.step(SliceBudget::CounterReset);
+      continueSlice = !aBudget.isOverBudget();
     }
   } while (continueSlice);
 
@@ -4199,7 +4201,7 @@ nsCycleCollector_collectSlice(int64_t aSliceTime)
 
   SliceBudget budget;
   if (aSliceTime >= 0) {
-    budget = SliceBudget(SliceBudget::TimeBudget(aSliceTime));
+    budget = SliceBudget(js::TimeBudget(aSliceTime));
   }
   data->mCollector->Collect(SliceCC, budget, nullptr);
 }
@@ -4218,7 +4220,7 @@ nsCycleCollector_collectSliceWork(int64_t aSliceWork)
 
   SliceBudget budget;
   if (aSliceWork >= 0) {
-    budget = SliceBudget(SliceBudget::WorkBudget(aSliceWork));
+    budget = SliceBudget(js::WorkBudget(aSliceWork));
   }
   data->mCollector->Collect(SliceCC, budget, nullptr);
 }

From 83b0fcf25164c442b8321c737c7c30edf3d785e3 Mon Sep 17 00:00:00 2001
From: Emanuel Hoogeveen <emanuel.hoogeveen@gmail.com>
Date: Tue, 4 Nov 2014 07:34:00 +0100
Subject: [PATCH 095/153] Bug 1084651 - Part 3: Tighten up the bounds of
 SliceBudget to work as a budget should.  r=wmccloskey

---
 js/public/SliceBudget.h |  4 ++--
 js/src/jsgc.cpp         | 15 ++++++++++-----
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/js/public/SliceBudget.h b/js/public/SliceBudget.h
index 2dfbdacc73e..c45fdf02085 100644
--- a/js/public/SliceBudget.h
+++ b/js/public/SliceBudget.h
@@ -38,7 +38,7 @@ struct JS_PUBLIC_API(SliceBudget)
 
     static const intptr_t CounterReset = 1000;
 
-    static const int64_t Unlimited = 0;
+    static const int64_t Unlimited = -1;
 
     /* Use to create an unlimited budget. */
     SliceBudget();
@@ -59,7 +59,7 @@ struct JS_PUBLIC_API(SliceBudget)
     }
 
     bool isOverBudget() {
-        if (counter >= 0)
+        if (counter > 0)
             return false;
         return checkOverBudget();
     }
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index 116b33e0455..d4d98806a4a 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -1457,7 +1457,7 @@ GCRuntime::setParameter(JSGCParamKey key, uint32_t value)
         setMaxMallocBytes(value);
         break;
       case JSGC_SLICE_TIME_BUDGET:
-        sliceBudget = value;
+        sliceBudget = value ? value : SliceBudget::Unlimited;
         break;
       case JSGC_MARK_STACK_LIMIT:
         setMarkStackLimit(value);
@@ -2937,9 +2937,10 @@ SliceBudget::SliceBudget()
 
 SliceBudget::SliceBudget(TimeBudget time)
 {
-    if (time.budget == Unlimited) {
+    if (time.budget < 0) {
         reset();
     } else {
+        // Note: TimeBudget(0) is equivalent to WorkBudget(CounterReset).
         deadline = PRMJ_Now() + time.budget * PRMJ_USEC_PER_MSEC;
         counter = CounterReset;
     }
@@ -2947,14 +2948,18 @@ SliceBudget::SliceBudget(TimeBudget time)
 
 SliceBudget::SliceBudget(WorkBudget work)
 {
-    deadline = 0;
-    counter = work.budget;
+    if (work.budget < 0) {
+        reset();
+    } else {
+        deadline = 0;
+        counter = work.budget;
+    }
 }
 
 bool
 SliceBudget::checkOverBudget()
 {
-    bool over = PRMJ_Now() > deadline;
+    bool over = PRMJ_Now() >= deadline;
     if (!over)
         counter = CounterReset;
     return over;

From 29b2140ed2f7e2cce695adedafcca8bdf6ae7abe Mon Sep 17 00:00:00 2001
From: Emanuel Hoogeveen <emanuel.hoogeveen@gmail.com>
Date: Tue, 21 Oct 2014 11:50:00 +0200
Subject: [PATCH 096/153] Bug 1084651 - Part 4a: Adjust some tests to preserve
 previous behavior.  r=wmccloskey

---
 js/src/jit-test/tests/auto-regress/bug783421.js | 2 +-
 js/src/jit-test/tests/auto-regress/bug812235.js | 2 +-
 js/src/jit-test/tests/basic/bug817002.js        | 2 +-
 js/src/jit-test/tests/basic/evaluate-worker.js  | 2 +-
 js/src/jit-test/tests/gc/bug-889682-1.js        | 2 +-
 js/src/jit-test/tests/gc/bug-889682-2.js        | 2 +-
 js/src/jit-test/tests/gc/bug-889682-3.js        | 2 +-
 js/src/jit-test/tests/gc/bug-981295.js          | 2 +-
 js/src/tests/js1_8_5/extensions/typedarray.js   | 2 +-
 9 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/js/src/jit-test/tests/auto-regress/bug783421.js b/js/src/jit-test/tests/auto-regress/bug783421.js
index c92a6328f88..920a78f9785 100644
--- a/js/src/jit-test/tests/auto-regress/bug783421.js
+++ b/js/src/jit-test/tests/auto-regress/bug783421.js
@@ -20,7 +20,7 @@ function h(code) {
 h("\
   p=m();\
   gcPreserveCode();\
-  gcslice(7);\
+  gcslice(8);\
 ")
 h("\"\"")
 h("")
diff --git a/js/src/jit-test/tests/auto-regress/bug812235.js b/js/src/jit-test/tests/auto-regress/bug812235.js
index db57efb41bc..e4a355321b2 100644
--- a/js/src/jit-test/tests/auto-regress/bug812235.js
+++ b/js/src/jit-test/tests/auto-regress/bug812235.js
@@ -3,7 +3,7 @@
 //
 gc()
 schedulegc(this)
-gcslice(2)
+gcslice(3)
 function f() {
     this["x"] = this["x"] = {}
 }
diff --git a/js/src/jit-test/tests/basic/bug817002.js b/js/src/jit-test/tests/basic/bug817002.js
index 2eb8fb22032..e6839680bff 100644
--- a/js/src/jit-test/tests/basic/bug817002.js
+++ b/js/src/jit-test/tests/basic/bug817002.js
@@ -4,7 +4,7 @@ evalcx("\
       gcslice = function() { };\
     array = new Uint8Array;\
     t0 = array.subarray();\
-    gcslice(11); \
+    gcslice(12); \
     array.subarray();\
     gc();\
     gc();\
diff --git a/js/src/jit-test/tests/basic/evaluate-worker.js b/js/src/jit-test/tests/basic/evaluate-worker.js
index b827d8aca0d..3c810a43e55 100644
--- a/js/src/jit-test/tests/basic/evaluate-worker.js
+++ b/js/src/jit-test/tests/basic/evaluate-worker.js
@@ -3,7 +3,7 @@
 if (typeof evalInWorker == "undefined")
     quit();
 
-gcslice(10);
+gcslice(11);
 evalInWorker("print('helo world');");
 for (i = 0; i < 100000; i++) {}
 
diff --git a/js/src/jit-test/tests/gc/bug-889682-1.js b/js/src/jit-test/tests/gc/bug-889682-1.js
index ff9c21458da..75b3f4089bc 100644
--- a/js/src/jit-test/tests/gc/bug-889682-1.js
+++ b/js/src/jit-test/tests/gc/bug-889682-1.js
@@ -9,5 +9,5 @@ var recursiveFunctions = [{
         eval(a.text.replace(/@/g, ""))
     }
 })();
-gcslice(2868);
+gcslice(2869);
 Function("v={c:[{x:[[]],N:{x:[{}[d]]}}]}=minorgc(true)")()
diff --git a/js/src/jit-test/tests/gc/bug-889682-2.js b/js/src/jit-test/tests/gc/bug-889682-2.js
index 6539d31eb18..efc47337a22 100644
--- a/js/src/jit-test/tests/gc/bug-889682-2.js
+++ b/js/src/jit-test/tests/gc/bug-889682-2.js
@@ -10,5 +10,5 @@ var recursiveFunctions = [{
         eval(a.text.replace(/@/g, ""))
     }
 })();
-gcslice(2868);
+gcslice(2869);
 Function("v={c:[{x:[[]],N:{x:[{}[d]]}}]}=minorgc(true)")()
diff --git a/js/src/jit-test/tests/gc/bug-889682-3.js b/js/src/jit-test/tests/gc/bug-889682-3.js
index 0bcf58590cd..601c8300a4e 100644
--- a/js/src/jit-test/tests/gc/bug-889682-3.js
+++ b/js/src/jit-test/tests/gc/bug-889682-3.js
@@ -10,5 +10,5 @@ var recursiveFunctions = [{
         eval(a.text.replace(/@/g, ""))
     }
 })();
-gcslice(2868);
+gcslice(2869);
 Function("v={c:[{x:[[]],N:{x:[{}[d]]}}]}=minorgc(true)")()
diff --git a/js/src/jit-test/tests/gc/bug-981295.js b/js/src/jit-test/tests/gc/bug-981295.js
index 80e292c840e..691c06bde90 100644
--- a/js/src/jit-test/tests/gc/bug-981295.js
+++ b/js/src/jit-test/tests/gc/bug-981295.js
@@ -4,6 +4,6 @@ var juneDate = new Date(2000, 5, 20, 0, 0, 0, 0);
 for (var i = 0; i < function(x) myObj(Date.prototype.toString.apply(x)); void i) {
     eval(a.text.replace(/@/g, ""))
 }
-gcslice(2600);
+gcslice(2601);
 function testcase() {}
 new Uint16Array(testcase);
diff --git a/js/src/tests/js1_8_5/extensions/typedarray.js b/js/src/tests/js1_8_5/extensions/typedarray.js
index 35de72944ab..1a6ebfac4ed 100644
--- a/js/src/tests/js1_8_5/extensions/typedarray.js
+++ b/js/src/tests/js1_8_5/extensions/typedarray.js
@@ -203,7 +203,7 @@ function test()
         gc();
         buffer = null;
         views = null;
-        gcslice(2); gcslice(2); gcslice(2); gcslice(2); gcslice(2); gcslice(2); gc();
+        gcslice(3); gcslice(3); gcslice(3); gcslice(3); gcslice(3); gcslice(3); gc();
     }
 
     var buf, buf2;

From 9c1b571d624dc6b1af9c55889fdebc2206580db2 Mon Sep 17 00:00:00 2001
From: Emanuel Hoogeveen <emanuel.hoogeveen@gmail.com>
Date: Tue, 4 Nov 2014 08:17:00 +0100
Subject: [PATCH 097/153] Bug 1084651 - Part 4b: Adjust and clarify some tests
 using gcslice(0).  r=wmccloskey

---
 dom/workers/test/test_promise_resolved_with_string.html | 4 ++--
 js/src/jit-test/tests/auto-regress/bug755639.js         | 2 +-
 js/src/jit-test/tests/auto-regress/bug758164.js         | 2 +-
 js/src/jit-test/tests/auto-regress/bug813029.js         | 4 ++--
 js/src/jit-test/tests/basic/bug754242.js                | 2 +-
 js/src/jit-test/tests/basic/bug767234.js                | 2 +-
 js/src/jit-test/tests/basic/bug782337.js                | 2 +-
 js/src/jit-test/tests/basic/bug808067.js                | 2 +-
 js/src/jit-test/tests/gc/bug-886551-1.js                | 2 +-
 js/src/jit-test/tests/gc/bug-886551-2.js                | 2 +-
 js/src/jit-test/tests/gc/incremental-01.js              | 2 +-
 js/src/jit-test/tests/gc/incremental-02.js              | 2 +-
 js/src/jit-test/tests/gc/multi-02.js                    | 2 +-
 js/src/jit-test/tests/gc/multi-03.js                    | 2 +-
 14 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/dom/workers/test/test_promise_resolved_with_string.html b/dom/workers/test/test_promise_resolved_with_string.html
index b63ddb900d7..28caaaaa820 100644
--- a/dom/workers/test/test_promise_resolved_with_string.html
+++ b/dom/workers/test/test_promise_resolved_with_string.html
@@ -15,12 +15,12 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1027221
     SimpleTest.waitForExplicitFinish();
     var x = "x";
     // Trigger some incremental gc
-    SpecialPowers.Cu.getJSTestingFunctions().gcslice(0);
+    SpecialPowers.Cu.getJSTestingFunctions().gcslice(1);
 
     // Kick off a worker that uses this same atom
     var w = new Worker("data:text/plain,Promise.resolve('x').then(function() { postMessage(1); });");
     // Maybe trigger some more incremental gc
-    SpecialPowers.Cu.getJSTestingFunctions().gcslice(0);
+    SpecialPowers.Cu.getJSTestingFunctions().gcslice(1);
 
     w.onmessage = function() {
       ok(true, "Got here");
diff --git a/js/src/jit-test/tests/auto-regress/bug755639.js b/js/src/jit-test/tests/auto-regress/bug755639.js
index cc6d9fe20be..dc376f69e69 100644
--- a/js/src/jit-test/tests/auto-regress/bug755639.js
+++ b/js/src/jit-test/tests/auto-regress/bug755639.js
@@ -28,7 +28,7 @@ gcPreserveCode();
 try {
   mjitChunkLimit(1);
 } catch(exc1) {}
-gcslice(0);
+gcslice(1);
 m(1);
 gc();
 m(2);
diff --git a/js/src/jit-test/tests/auto-regress/bug758164.js b/js/src/jit-test/tests/auto-regress/bug758164.js
index 4230db3faa8..fa94c520a6b 100644
--- a/js/src/jit-test/tests/auto-regress/bug758164.js
+++ b/js/src/jit-test/tests/auto-regress/bug758164.js
@@ -3,4 +3,4 @@
 //
 
 gc();
-evaluate("gcslice(0);");
+evaluate("gcslice(1);");
diff --git a/js/src/jit-test/tests/auto-regress/bug813029.js b/js/src/jit-test/tests/auto-regress/bug813029.js
index 5fed924689a..34e2145f6d9 100644
--- a/js/src/jit-test/tests/auto-regress/bug813029.js
+++ b/js/src/jit-test/tests/auto-regress/bug813029.js
@@ -5,8 +5,8 @@
 function printBugNumber (num) {
   BUGNUMBER = num;
 }
-gcslice(0)
+gcslice(1)
 schedulegc(this);
-gcslice(1);
+gcslice(2);
 var BUGNUMBER = ("one");
 printBugNumber();
diff --git a/js/src/jit-test/tests/basic/bug754242.js b/js/src/jit-test/tests/basic/bug754242.js
index 8a0895cb12d..58d4e0ee0e2 100644
--- a/js/src/jit-test/tests/basic/bug754242.js
+++ b/js/src/jit-test/tests/basic/bug754242.js
@@ -1,6 +1,6 @@
 var g1 = newGlobal();
 schedulegc(g1);
-gcslice(0);
+gcslice(1);
 function testEq(b) {
     var a = deserialize(serialize(b));
 }
diff --git a/js/src/jit-test/tests/basic/bug767234.js b/js/src/jit-test/tests/basic/bug767234.js
index 44b1323b1a9..0c073d1116d 100644
--- a/js/src/jit-test/tests/basic/bug767234.js
+++ b/js/src/jit-test/tests/basic/bug767234.js
@@ -4,7 +4,7 @@ function gen()
     yield 1;
     local = null;
     gc();
-    gcslice(0);
+    gcslice(0); // Start IGC, but don't mark anything.
     yield 2;
 }
 
diff --git a/js/src/jit-test/tests/basic/bug782337.js b/js/src/jit-test/tests/basic/bug782337.js
index 8e96ee5a4db..2ddb7bcaf09 100644
--- a/js/src/jit-test/tests/basic/bug782337.js
+++ b/js/src/jit-test/tests/basic/bug782337.js
@@ -12,5 +12,5 @@ function recur(n)
 }
 
 validategc(false);
-gcslice(0);
+gcslice(1);
 recur(10);
diff --git a/js/src/jit-test/tests/basic/bug808067.js b/js/src/jit-test/tests/basic/bug808067.js
index cac3a3944ce..74f721ec90c 100644
--- a/js/src/jit-test/tests/basic/bug808067.js
+++ b/js/src/jit-test/tests/basic/bug808067.js
@@ -11,8 +11,8 @@ expect = "generator function foo returns a value";
 actual = (function (j)  {}).message;
 reportCompare(expect, actual, summary + ": 1");
 reportCompare(expect, actual, summary + ": 2");
-gcslice(0);
 gcslice(1);
+gcslice(2);
 gc();
 var strings = [ (0), ];
 for (var i = 0; i < strings.length; i++)
diff --git a/js/src/jit-test/tests/gc/bug-886551-1.js b/js/src/jit-test/tests/gc/bug-886551-1.js
index 59df90fe2c9..b3f2bcd45f8 100644
--- a/js/src/jit-test/tests/gc/bug-886551-1.js
+++ b/js/src/jit-test/tests/gc/bug-886551-1.js
@@ -1,6 +1,6 @@
 if (this.hasOwnProperty('Intl')) {
     gc();
-    gcslice(0);
+    gcslice(1);
     var thisValues = [ "x" ];
     thisValues.forEach(function (value) {
             var format = Intl.DateTimeFormat.call(value);
diff --git a/js/src/jit-test/tests/gc/bug-886551-2.js b/js/src/jit-test/tests/gc/bug-886551-2.js
index 750d8f0d3c3..9381c867d5f 100644
--- a/js/src/jit-test/tests/gc/bug-886551-2.js
+++ b/js/src/jit-test/tests/gc/bug-886551-2.js
@@ -1,5 +1,5 @@
 gc();
-gcslice(0);
+gcslice(1);
 function isClone(a, b) {
         var rmemory = new WeakMap();
             rmemory.set(a,b);
diff --git a/js/src/jit-test/tests/gc/incremental-01.js b/js/src/jit-test/tests/gc/incremental-01.js
index a3ed478faac..d4646c16562 100644
--- a/js/src/jit-test/tests/gc/incremental-01.js
+++ b/js/src/jit-test/tests/gc/incremental-01.js
@@ -23,7 +23,7 @@ function init()
  */
 eval("init()");
 
-gcslice(0);
+gcslice(0); // Start IGC, but don't mark anything.
 selectforgc(objs.root2);
 gcslice(1);
 objs.root2.ptr = objs.root1.ptr;
diff --git a/js/src/jit-test/tests/gc/incremental-02.js b/js/src/jit-test/tests/gc/incremental-02.js
index 4e317a42df9..a2a2c8de85f 100644
--- a/js/src/jit-test/tests/gc/incremental-02.js
+++ b/js/src/jit-test/tests/gc/incremental-02.js
@@ -22,7 +22,7 @@ function init()
  */
 eval("init()");
 
-gcslice(0);
+gcslice(0); // Start IGC, but don't mark anything.
 selectforgc(objs.root);
 gcslice(1);
 delete objs.root.b;
diff --git a/js/src/jit-test/tests/gc/multi-02.js b/js/src/jit-test/tests/gc/multi-02.js
index aae22649aac..56cae455707 100644
--- a/js/src/jit-test/tests/gc/multi-02.js
+++ b/js/src/jit-test/tests/gc/multi-02.js
@@ -4,7 +4,7 @@ var g1 = newGlobal();
 var g2 = newGlobal();
 
 schedulegc(g1);
-gcslice(0);
+gcslice(0); // Start IGC, but don't mark anything.
 schedulegc(g2);
 gcslice(1);
 gcslice();
diff --git a/js/src/jit-test/tests/gc/multi-03.js b/js/src/jit-test/tests/gc/multi-03.js
index aa8c3f4ac11..fd9bd0830a6 100644
--- a/js/src/jit-test/tests/gc/multi-03.js
+++ b/js/src/jit-test/tests/gc/multi-03.js
@@ -5,7 +5,7 @@ var g2 = newGlobal();
 
 schedulegc(g1);
 schedulegc(g2);
-gcslice(0);
+gcslice(0); // Start IGC, but don't mark anything.
 schedulegc(g1);
 gcslice(1);
 gcslice();

From 1b5561e45dbce899d4b0c14f5c6ac2b95eb2b567 Mon Sep 17 00:00:00 2001
From: Emanuel Hoogeveen <emanuel.hoogeveen@gmail.com>
Date: Tue, 21 Oct 2014 11:54:00 +0200
Subject: [PATCH 098/153] Bug 1084651 - Part 5: Simplify Cycle Collector logic
 now that SliceBudget makes more sense. r=mccr8

---
 dom/base/nsJSEnvironment.cpp    | 14 +++++++++-----
 xpcom/base/nsCycleCollector.cpp | 25 +------------------------
 xpcom/base/nsCycleCollector.h   | 10 +++-------
 3 files changed, 13 insertions(+), 36 deletions(-)

diff --git a/dom/base/nsJSEnvironment.cpp b/dom/base/nsJSEnvironment.cpp
index 8d3334bd245..c8ee786b2c9 100644
--- a/dom/base/nsJSEnvironment.cpp
+++ b/dom/base/nsJSEnvironment.cpp
@@ -45,6 +45,7 @@
 
 #include "jsapi.h"
 #include "jswrapper.h"
+#include "js/SliceBudget.h"
 #include "nsIArray.h"
 #include "nsIObjectInputStream.h"
 #include "nsIObjectOutputStream.h"
@@ -1692,24 +1693,24 @@ nsJSContext::RunCycleCollectorSlice()
 
   // Decide how long we want to budget for this slice. By default,
   // use an unlimited budget.
-  int64_t sliceBudget = -1;
+  js::SliceBudget budget;
 
   if (sIncrementalCC) {
     if (gCCStats.mBeginTime.IsNull()) {
       // If no CC is in progress, use the standard slice time.
-      sliceBudget = kICCSliceBudget;
+      budget = js::SliceBudget(js::TimeBudget(kICCSliceBudget));
     } else {
       TimeStamp now = TimeStamp::Now();
 
       // Only run a limited slice if we're within the max running time.
       if (TimeBetween(gCCStats.mBeginTime, now) < kMaxICCDuration) {
         float sliceMultiplier = std::max(TimeBetween(gCCStats.mEndSliceTime, now) / (float)kICCIntersliceDelay, 1.0f);
-        sliceBudget = kICCSliceBudget * sliceMultiplier;
+        budget = js::SliceBudget(js::TimeBudget(kICCSliceBudget * sliceMultiplier));
       }
     }
   }
 
-  nsCycleCollector_collectSlice(sliceBudget);
+  nsCycleCollector_collectSlice(budget);
 
   gCCStats.FinishCycleCollectionSlice();
 }
@@ -1726,7 +1727,10 @@ nsJSContext::RunCycleCollectorWorkSlice(int64_t aWorkBudget)
     js::ProfileEntry::Category::CC);
 
   gCCStats.PrepareForCycleCollectionSlice();
-  nsCycleCollector_collectSliceWork(aWorkBudget);
+
+  js::SliceBudget budget = js::SliceBudget(js::WorkBudget(aWorkBudget));
+  nsCycleCollector_collectSlice(budget);
+
   gCCStats.FinishCycleCollectionSlice();
 }
 
diff --git a/xpcom/base/nsCycleCollector.cpp b/xpcom/base/nsCycleCollector.cpp
index ba7395459b9..b628b202d1f 100644
--- a/xpcom/base/nsCycleCollector.cpp
+++ b/xpcom/base/nsCycleCollector.cpp
@@ -4188,7 +4188,7 @@ nsCycleCollector_collect(nsICycleCollectorListener* aManualListener)
 }
 
 void
-nsCycleCollector_collectSlice(int64_t aSliceTime)
+nsCycleCollector_collectSlice(SliceBudget& budget)
 {
   CollectorData* data = sCollectorData.get();
 
@@ -4199,29 +4199,6 @@ nsCycleCollector_collectSlice(int64_t aSliceTime)
   PROFILER_LABEL("nsCycleCollector", "collectSlice",
                  js::ProfileEntry::Category::CC);
 
-  SliceBudget budget;
-  if (aSliceTime >= 0) {
-    budget = SliceBudget(js::TimeBudget(aSliceTime));
-  }
-  data->mCollector->Collect(SliceCC, budget, nullptr);
-}
-
-void
-nsCycleCollector_collectSliceWork(int64_t aSliceWork)
-{
-  CollectorData* data = sCollectorData.get();
-
-  // We should have started the cycle collector by now.
-  MOZ_ASSERT(data);
-  MOZ_ASSERT(data->mCollector);
-
-  PROFILER_LABEL("nsCycleCollector", "collectSliceWork",
-                 js::ProfileEntry::Category::CC);
-
-  SliceBudget budget;
-  if (aSliceWork >= 0) {
-    budget = SliceBudget(js::WorkBudget(aSliceWork));
-  }
   data->mCollector->Collect(SliceCC, budget, nullptr);
 }
 
diff --git a/xpcom/base/nsCycleCollector.h b/xpcom/base/nsCycleCollector.h
index f517aeeac20..129701b77aa 100644
--- a/xpcom/base/nsCycleCollector.h
+++ b/xpcom/base/nsCycleCollector.h
@@ -15,6 +15,8 @@ template<class T> struct already_AddRefed;
 #include "nsError.h"
 #include "nsID.h"
 
+namespace js { struct SliceBudget; };
+
 namespace mozilla {
 
 class CycleCollectedJSRuntime;
@@ -56,13 +58,7 @@ already_AddRefed<nsICycleCollectorLogSink> nsCycleCollector_createLogSink();
 
 void nsCycleCollector_collect(nsICycleCollectorListener* aManualListener);
 
-// If aSliceTime is negative, the CC will run to completion. Otherwise,
-// aSliceTime will be used as the time budget for the slice, in ms.
-void nsCycleCollector_collectSlice(int64_t aSliceTime);
-
-// If aSliceTime is negative, the CC will run to completion. Otherwise,
-// aSliceTime will be used as the work budget for the slice.
-void nsCycleCollector_collectSliceWork(int64_t aSliceWork);
+void nsCycleCollector_collectSlice(js::SliceBudget& budget);
 
 uint32_t nsCycleCollector_suspectedCount();
 void nsCycleCollector_shutdown();

From 0df8196842047c9814351c5da8f0cea8c8624f2d Mon Sep 17 00:00:00 2001
From: Chris Kitching <ckitching@mozilla.com>
Date: Tue, 4 Nov 2014 21:41:20 +0000
Subject: [PATCH 099/153] Bug 914027: Do not attempt to decode Favicons of
 unsupported types. Fallback on Favicon failure. r=margaret

---
 mobile/android/base/BrowserApp.java           | 49 +---------
 mobile/android/base/Tab.java                  | 94 ++++++++++++++-----
 mobile/android/base/Tabs.java                 | 51 ++++------
 mobile/android/base/favicons/Favicons.java    | 75 +++++++++++++++
 .../android/base/favicons/RemoteFavicon.java  | 89 ++++++++++++++++++
 mobile/android/base/moz.build                 |  1 +
 .../base/toolbar/ToolbarDisplayLayout.java    |  3 +-
 mobile/android/chrome/content/browser.js      |  3 +-
 8 files changed, 255 insertions(+), 110 deletions(-)
 create mode 100644 mobile/android/base/favicons/RemoteFavicon.java

diff --git a/mobile/android/base/BrowserApp.java b/mobile/android/base/BrowserApp.java
index 63d859a172b..0e84c0c71d2 100644
--- a/mobile/android/base/BrowserApp.java
+++ b/mobile/android/base/BrowserApp.java
@@ -270,9 +270,6 @@ public class BrowserApp extends GeckoApp
         Log.d(LOGTAG, "BrowserApp.onTabChanged: " + tab.getId() + ": " + msg);
         switch(msg) {
             case LOCATION_CHANGE:
-                if (Tabs.getInstance().isSelectedTab(tab)) {
-                    maybeCancelFaviconLoad(tab);
-                }
                 // fall through
             case SELECTED:
                 if (Tabs.getInstance().isSelectedTab(tab)) {
@@ -296,16 +293,7 @@ public class BrowserApp extends GeckoApp
                 }
                 break;
             case PAGE_SHOW:
-                loadFavicon(tab);
-                break;
-            case LINK_FAVICON:
-                // If tab is not loading and the favicon is updated, we
-                // want to load the image straight away. If tab is still
-                // loading, we only load the favicon once the page's content
-                // is fully loaded.
-                if (tab.getState() != Tab.STATE_LOADING) {
-                    loadFavicon(tab);
-                }
+                tab.loadFavicon();
                 break;
             case BOOKMARK_ADDED:
                 showBookmarkAddedToast();
@@ -1841,41 +1829,6 @@ public class BrowserApp extends GeckoApp
             && mHomePagerContainer != null && mHomePagerContainer.getVisibility() == View.VISIBLE);
     }
 
-    /* Favicon stuff. */
-    private static OnFaviconLoadedListener sFaviconLoadedListener = new OnFaviconLoadedListener() {
-        @Override
-        public void onFaviconLoaded(String pageUrl, String faviconURL, Bitmap favicon) {
-            // If we failed to load a favicon, we use the default favicon instead.
-            Tabs.getInstance()
-                .updateFaviconForURL(pageUrl,
-                                     (favicon == null) ? Favicons.defaultFavicon : favicon);
-        }
-    };
-
-    private void loadFavicon(final Tab tab) {
-        maybeCancelFaviconLoad(tab);
-
-        final int tabFaviconSize = getResources().getDimensionPixelSize(R.dimen.browser_toolbar_favicon_size);
-
-        int flags = (tab.isPrivate() || tab.getErrorType() != Tab.ErrorType.NONE) ? 0 : LoadFaviconTask.FLAG_PERSIST;
-        int id = Favicons.getSizedFavicon(getContext(), tab.getURL(), tab.getFaviconURL(), tabFaviconSize, flags, sFaviconLoadedListener);
-
-        tab.setFaviconLoadId(id);
-    }
-
-    private void maybeCancelFaviconLoad(Tab tab) {
-        int faviconLoadId = tab.getFaviconLoadId();
-
-        if (Favicons.NOT_LOADING == faviconLoadId) {
-            return;
-        }
-
-        // Cancel load task and reset favicon load state if it wasn't already
-        // in NOT_LOADING state.
-        Favicons.cancelFaviconLoad(faviconLoadId);
-        tab.setFaviconLoadId(Favicons.NOT_LOADING);
-    }
-
     /**
      * Enters editing mode with the current tab's URL. There might be no
      * tabs loaded by the time the user enters editing mode e.g. just after
diff --git a/mobile/android/base/Tab.java b/mobile/android/base/Tab.java
index a126bdf4bad..fd862122e07 100644
--- a/mobile/android/base/Tab.java
+++ b/mobile/android/base/Tab.java
@@ -9,6 +9,7 @@ import java.util.ArrayList;
 import java.util.Collection;
 import java.util.HashMap;
 import java.util.Map;
+import java.util.TreeSet;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
@@ -17,6 +18,10 @@ import org.json.JSONObject;
 import org.mozilla.gecko.db.BrowserContract.Bookmarks;
 import org.mozilla.gecko.db.BrowserDB;
 import org.mozilla.gecko.db.URLMetadata;
+import org.mozilla.gecko.favicons.Favicons;
+import org.mozilla.gecko.favicons.LoadFaviconTask;
+import org.mozilla.gecko.favicons.OnFaviconLoadedListener;
+import org.mozilla.gecko.favicons.RemoteFavicon;
 import org.mozilla.gecko.gfx.Layer;
 import org.mozilla.gecko.util.ThreadUtils;
 
@@ -42,7 +47,9 @@ public class Tab {
     private String mTitle;
     private Bitmap mFavicon;
     private String mFaviconUrl;
-    private int mFaviconSize;
+
+    // The set of all available Favicons for this tab, sorted by attractiveness.
+    final TreeSet<RemoteFavicon> mAvailableFavicons = new TreeSet<>();
     private boolean mHasFeeds;
     private boolean mHasOpenSearch;
     private final SiteIdentity mSiteIdentity;
@@ -365,46 +372,81 @@ public class Tab {
         return mHasTouchListeners;
     }
 
-    public void setFaviconLoadId(int faviconLoadId) {
-        mFaviconLoadId = faviconLoadId;
-    }
+    public synchronized void addFavicon(String faviconURL, int faviconSize, String mimeType) {
+        RemoteFavicon favicon = new RemoteFavicon(faviconURL, faviconSize, mimeType);
 
-    public int getFaviconLoadId() {
-        return mFaviconLoadId;
-    }
-
-    /**
-     * Returns true if the favicon changed.
-     */
-    public boolean updateFavicon(Bitmap favicon) {
-        if (mFavicon == favicon) {
-            return false;
+        // Add this Favicon to the set of available Favicons.
+        synchronized (mAvailableFavicons) {
+            mAvailableFavicons.add(favicon);
         }
-        mFavicon = favicon;
-        return true;
     }
 
-    public synchronized void updateFaviconURL(String faviconUrl, int size) {
-        // If we already have an "any" sized icon, don't update the icon.
-        if (mFaviconSize == -1)
-            return;
+    public void loadFavicon() {
+        // If we have a Favicon explicitly set, load it.
+        if (!mAvailableFavicons.isEmpty()) {
+            RemoteFavicon newFavicon = mAvailableFavicons.first();
 
-        // Only update the favicon if it's bigger than the current favicon.
-        // We use -1 to represent icons with sizes="any".
-        if (size == -1 || size >= mFaviconSize) {
-            mFaviconUrl = faviconUrl;
-            mFaviconSize = size;
+            // If the new Favicon is different, cancel the old load. Else, abort.
+            if (newFavicon.faviconUrl.equals(mFaviconUrl)) {
+                return;
+            }
+
+            Favicons.cancelFaviconLoad(mFaviconLoadId);
+            mFaviconUrl = newFavicon.faviconUrl;
+        } else {
+            // Otherwise, fallback to the default Favicon.
+            mFaviconUrl = null;
         }
+
+        int flags = (isPrivate() || mErrorType != ErrorType.NONE) ? 0 : LoadFaviconTask.FLAG_PERSIST;
+        mFaviconLoadId = Favicons.getSizedFavicon(mAppContext, mUrl, mFaviconUrl, Favicons.browserToolbarFaviconSize, flags,
+                new OnFaviconLoadedListener() {
+                    @Override
+                    public void onFaviconLoaded(String pageUrl, String faviconURL, Bitmap favicon) {
+                        // The tab might be pointing to another URL by the time the
+                        // favicon is finally loaded, in which case we simply ignore it.
+                        if (!pageUrl.equals(mUrl)) {
+                            return;
+                        }
+
+                        // That one failed. Try the next one.
+                        if (favicon == null) {
+                            // If what we just tried to load originated from the set of declared icons..
+                            if (!mAvailableFavicons.isEmpty()) {
+                                // Discard it.
+                                mAvailableFavicons.remove(mAvailableFavicons.first());
+
+                                // Load the next best, if we have one. If not, it'll fall back to the
+                                // default Favicon URL, before giving up.
+                                loadFavicon();
+
+                                return;
+                            }
+
+                            // Total failure: display the default favicon.
+                            favicon = Favicons.defaultFavicon;
+                        }
+
+                        mFavicon = favicon;
+                        mFaviconLoadId = Favicons.NOT_LOADING;
+                        Tabs.getInstance().notifyListeners(Tab.this, Tabs.TabEvents.FAVICON);
+                    }
+                }
+        );
     }
 
     public synchronized void clearFavicon() {
+        // Cancel any ongoing favicon load (if we never finished downloading the old favicon before
+        // we changed page).
+        Favicons.cancelFaviconLoad(mFaviconLoadId);
+
         // Keep the favicon unchanged while entering reader mode
         if (mEnteringReaderMode)
             return;
 
         mFavicon = null;
         mFaviconUrl = null;
-        mFaviconSize = 0;
+        mAvailableFavicons.clear();
     }
 
     public void setHasFeeds(boolean hasFeeds) {
diff --git a/mobile/android/base/Tabs.java b/mobile/android/base/Tabs.java
index 2e15a122ac1..fbac0b21200 100644
--- a/mobile/android/base/Tabs.java
+++ b/mobile/android/base/Tabs.java
@@ -11,6 +11,7 @@ import java.util.List;
 import java.util.concurrent.CopyOnWriteArrayList;
 import java.util.concurrent.atomic.AtomicInteger;
 
+import android.graphics.Bitmap;
 import org.json.JSONException;
 import org.json.JSONObject;
 
@@ -29,7 +30,6 @@ import android.accounts.OnAccountsUpdateListener;
 import android.content.ContentResolver;
 import android.content.Context;
 import android.database.ContentObserver;
-import android.graphics.Bitmap;
 import android.graphics.Color;
 import android.net.Uri;
 import android.os.Handler;
@@ -505,8 +505,20 @@ public class Tabs implements GeckoEventListener {
             } else if (event.equals("DOMTitleChanged")) {
                 tab.updateTitle(message.getString("title"));
             } else if (event.equals("Link:Favicon")) {
-                tab.updateFaviconURL(message.getString("href"), message.getInt("size"));
-                notifyListeners(tab, TabEvents.LINK_FAVICON);
+                // Don't bother if the type isn't one we can decode.
+                if (!Favicons.canDecodeType(message.getString("mime"))) {
+                    return;
+                }
+
+                // Add the favicon to the set of available icons for this tab.
+                tab.addFavicon(message.getString("href"), message.getInt("size"), message.getString("mime"));
+
+                // Load the favicon. If the tab is still loading, we actually do the load once the
+                // page has loaded, in an attempt to prevent the favicon load from having a
+                // detrimental effect on page load time.
+                if (tab.getState() != Tab.STATE_LOADING) {
+                    tab.loadFavicon();
+                }
             } else if (event.equals("Link:Feed")) {
                 tab.setHasFeeds(true);
                 notifyListeners(tab, TabEvents.LINK_FEED);
@@ -535,24 +547,6 @@ public class Tabs implements GeckoEventListener {
         }
     }
 
-    /**
-     * Set the favicon for any tabs loaded with this page URL.
-     */
-    public void updateFaviconForURL(String pageURL, Bitmap favicon) {
-        // The tab might be pointing to another URL by the time the
-        // favicon is finally loaded, in which case we won't find the tab.
-        // See also: Bug 920331.
-        for (Tab tab : mOrder) {
-            String tabURL = tab.getURL();
-            if (pageURL.equals(tabURL)) {
-                tab.setFaviconLoadId(Favicons.NOT_LOADING);
-                if (tab.updateFavicon(favicon)) {
-                    notifyListeners(tab, TabEvents.FAVICON);
-                }
-            }
-        }
-    }
-
     public void refreshThumbnails() {
         final ThumbnailHelper helper = ThumbnailHelper.getInstance();
         ThreadUtils.postToBackgroundThread(new Runnable() {
@@ -595,7 +589,6 @@ public class Tabs implements GeckoEventListener {
         LOCATION_CHANGE,
         MENU_UPDATED,
         PAGE_SHOW,
-        LINK_FAVICON,
         LINK_FEED,
         SECURITY_CHANGE,
         READER_ENABLED,
@@ -839,7 +832,8 @@ public class Tabs implements GeckoEventListener {
         // TODO: surely we could just fetch *any* cached icon?
         if (AboutPages.isBuiltinIconPage(url)) {
             Log.d(LOGTAG, "Setting about: tab favicon inline.");
-            added.updateFavicon(getAboutPageFavicon(url));
+            added.addFavicon(url, Favicons.browserToolbarFaviconSize, "");
+            added.loadFavicon();
         }
 
         return added;
@@ -853,17 +847,6 @@ public class Tabs implements GeckoEventListener {
         return loadUrl(AboutPages.PRIVATEBROWSING, Tabs.LOADURL_NEW_TAB | Tabs.LOADURL_PRIVATE);
     }
 
-    /**
-     * These favicons are only used for the URL bar, so
-     * we fetch with that size.
-     *
-     * This method completes on the calling thread.
-     */
-    private Bitmap getAboutPageFavicon(final String url) {
-        int faviconSize = Math.round(mAppContext.getResources().getDimension(R.dimen.browser_toolbar_favicon_size));
-        return Favicons.getSizedFaviconForPageFromCache(url, faviconSize);
-    }
-
     /**
      * Open the url as a new tab, and mark the selected tab as its "parent".
      *
diff --git a/mobile/android/base/favicons/Favicons.java b/mobile/android/base/favicons/Favicons.java
index 2d3bf1b2013..bfb58abca3c 100644
--- a/mobile/android/base/favicons/Favicons.java
+++ b/mobile/android/base/favicons/Favicons.java
@@ -32,6 +32,7 @@ import java.net.URI;
 import java.net.URISyntaxException;
 import java.util.Arrays;
 import java.util.Collections;
+import java.util.HashSet;
 import java.util.Iterator;
 import java.util.List;
 import java.util.concurrent.ExecutorService;
@@ -65,6 +66,9 @@ public class Favicons {
     // The density-adjusted maximum Favicon dimensions.
     public static int largestFaviconSize;
 
+    // The density-adjusted desired size for a browser-toolbar favicon.
+    public static int browserToolbarFaviconSize;
+
     // Used to prevent multiple-initialisation.
     public static final AtomicBoolean isInitialized = new AtomicBoolean(false);
 
@@ -77,6 +81,57 @@ public class Favicons {
     // doing so is not necessary.
     private static final NonEvictingLruCache<String, String> pageURLMappings = new NonEvictingLruCache<>(NUM_PAGE_URL_MAPPINGS_TO_STORE);
 
+    // Mime types of things we are capable of decoding.
+    private static final HashSet<String> sDecodableMimeTypes = new HashSet<>();
+
+    // Mime types of things we are both capable of decoding and are container formats (May contain
+    // multiple different sizes of image)
+    private static final HashSet<String> sContainerMimeTypes = new HashSet<>();
+    static {
+        // MIME types extracted from http://filext.com - ostensibly all in-use mime types for the
+        // corresponding formats.
+        // ICO
+        sContainerMimeTypes.add("image/vnd.microsoft.icon");
+        sContainerMimeTypes.add("image/ico");
+        sContainerMimeTypes.add("image/icon");
+        sContainerMimeTypes.add("image/x-icon");
+        sContainerMimeTypes.add("text/ico");
+        sContainerMimeTypes.add("application/ico");
+
+        // Add supported container types to the set of supported types.
+        sDecodableMimeTypes.addAll(sContainerMimeTypes);
+
+        // PNG
+        sDecodableMimeTypes.add("image/png");
+        sDecodableMimeTypes.add("application/png");
+        sDecodableMimeTypes.add("application/x-png");
+
+        // GIF
+        sDecodableMimeTypes.add("image/gif");
+
+        // JPEG
+        sDecodableMimeTypes.add("image/jpeg");
+        sDecodableMimeTypes.add("image/jpg");
+        sDecodableMimeTypes.add("image/pipeg");
+        sDecodableMimeTypes.add("image/vnd.swiftview-jpeg");
+        sDecodableMimeTypes.add("application/jpg");
+        sDecodableMimeTypes.add("application/x-jpg");
+
+        // BMP
+        sDecodableMimeTypes.add("application/bmp");
+        sDecodableMimeTypes.add("application/x-bmp");
+        sDecodableMimeTypes.add("application/x-win-bitmap");
+        sDecodableMimeTypes.add("image/bmp");
+        sDecodableMimeTypes.add("image/x-bmp");
+        sDecodableMimeTypes.add("image/x-bitmap");
+        sDecodableMimeTypes.add("image/x-xbitmap");
+        sDecodableMimeTypes.add("image/x-win-bitmap");
+        sDecodableMimeTypes.add("image/x-windows-bitmap");
+        sDecodableMimeTypes.add("image/x-ms-bitmap");
+        sDecodableMimeTypes.add("image/x-ms-bmp");
+        sDecodableMimeTypes.add("image/ms-bmp");
+    }
+
     public static String getFaviconURLForPageURLFromCache(String pageURL) {
         return pageURLMappings.get(pageURL);
     }
@@ -416,6 +471,7 @@ public class Favicons {
         // TODO: Remove this branch when old tablet is removed.
         final int browserToolbarFaviconSizeDimenID = NewTabletUI.isEnabled(context) ?
                 R.dimen.new_tablet_tab_strip_favicon_size : R.dimen.browser_toolbar_favicon_size;
+        browserToolbarFaviconSize = res.getDimensionPixelSize(browserToolbarFaviconSizeDimenID);
 
         faviconsCache = new FaviconCache(FAVICON_CACHE_SIZE_BYTES, largestFaviconSize);
 
@@ -484,6 +540,25 @@ public class Favicons {
         }
     }
 
+    /**
+     * Helper function to determine if we can decode a particular mime type.
+     * @param imgType Mime type to check for decodability.
+     * @return false if the given mime type is certainly not decodable, true if it might be.
+     */
+    public static boolean canDecodeType(String imgType) {
+        return "".equals(imgType) || sDecodableMimeTypes.contains(imgType);
+    }
+
+    /**
+     * Helper function to determine if the provided mime type is that of a format that can contain
+     * multiple image types. At time of writing, the only such type is ICO.
+     * @param mimeType Mime type to check.
+     * @return true if the given mime type is a container type, false otherwise.
+     */
+    public static boolean isContainerType(String mimeType) {
+        return sDecodableMimeTypes.contains(mimeType);
+    }
+
     public static void removeLoadTask(int taskId) {
         synchronized(loadTasks) {
             loadTasks.delete(taskId);
diff --git a/mobile/android/base/favicons/RemoteFavicon.java b/mobile/android/base/favicons/RemoteFavicon.java
new file mode 100644
index 00000000000..978a2a5862c
--- /dev/null
+++ b/mobile/android/base/favicons/RemoteFavicon.java
@@ -0,0 +1,89 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.favicons;
+
+/**
+ * Class to represent a Favicon declared on a webpage which we may or may not have downloaded.
+ * Tab objects maintain a list of these and attempt to load them in descending order of quality
+ * until one works. This enables us to fallback if something fails trying to decode a Favicon.
+ */
+public class RemoteFavicon implements Comparable<RemoteFavicon> {
+    public static final int FAVICON_SIZE_ANY = -1;
+
+    // URL of the Favicon referred to by this object.
+    public String faviconUrl;
+
+    // The size of the Favicon, as given in the <link> tag, if any. Zero if unspecified. -1 if "any".
+    public int declaredSize;
+
+    // Mime type of the Favicon, as given in the link tag.
+    public String mimeType;
+
+    public RemoteFavicon(String faviconURL, int givenSize, String mime) {
+        faviconUrl = faviconURL;
+        declaredSize = givenSize;
+        mimeType = mime;
+    }
+
+    /**
+     * Determine equality of two RemoteFavicons.
+     * Two RemoteFavicons are considered equal if they have the same URL, size, and mime type.
+     * @param o The object to compare to this one.
+     * @return true if o is of type RemoteFavicon and is considered equal to this one, false otherwise.
+     */
+    @Override
+    public boolean equals(Object o) {
+        if (!(o instanceof RemoteFavicon)) {
+            return false;
+        }
+        RemoteFavicon oCast = (RemoteFavicon) o;
+
+        return oCast.faviconUrl.equals(faviconUrl) &&
+               oCast.declaredSize == declaredSize &&
+               oCast.mimeType.equals(mimeType);
+    }
+
+    @Override
+    public int hashCode() {
+        return super.hashCode();
+    }
+
+    /**
+     * Establish ordering on Favicons. Lower value in the partial ordering is a "better" Favicon.
+     * @param obj Object to compare against.
+     * @return -1 if this Favicon is "better" than the other, zero if they are equivalent in quality,
+     *         based on the information here, 1 if the other appears "better" than this one.
+     */
+    @Override
+    public int compareTo(RemoteFavicon obj) {
+        // Size "any" trumps everything else.
+        if (declaredSize == FAVICON_SIZE_ANY) {
+            if (obj.declaredSize == FAVICON_SIZE_ANY) {
+                return 0;
+            }
+
+            return -1;
+        }
+
+        if (obj.declaredSize == FAVICON_SIZE_ANY) {
+            return 1;
+        }
+
+        // Unspecified sizes are "worse".
+        if (declaredSize > obj.declaredSize) {
+            return -1;
+        }
+
+        if (declaredSize == obj.declaredSize) {
+            // If there's no other way to choose, we prefer container types. They *might* contain
+            // an image larger than the size given in the <link> tag.
+            if (Favicons.isContainerType(mimeType)) {
+                return -1;
+            }
+            return 0;
+        }
+        return 1;
+    }
+}
diff --git a/mobile/android/base/moz.build b/mobile/android/base/moz.build
index 1947ca7d5f9..387ac111d14 100644
--- a/mobile/android/base/moz.build
+++ b/mobile/android/base/moz.build
@@ -178,6 +178,7 @@ gbjar.sources += [
     'favicons/Favicons.java',
     'favicons/LoadFaviconTask.java',
     'favicons/OnFaviconLoadedListener.java',
+    'favicons/RemoteFavicon.java',
     'FilePicker.java',
     'FilePickerResultHandler.java',
     'FindInPageBar.java',
diff --git a/mobile/android/base/toolbar/ToolbarDisplayLayout.java b/mobile/android/base/toolbar/ToolbarDisplayLayout.java
index c189e9d2ff7..f1e2286c408 100644
--- a/mobile/android/base/toolbar/ToolbarDisplayLayout.java
+++ b/mobile/android/base/toolbar/ToolbarDisplayLayout.java
@@ -19,6 +19,7 @@ import org.mozilla.gecko.SiteIdentity.SecurityMode;
 import org.mozilla.gecko.Tab;
 import org.mozilla.gecko.animation.PropertyAnimator;
 import org.mozilla.gecko.animation.ViewHelper;
+import org.mozilla.gecko.favicons.Favicons;
 import org.mozilla.gecko.toolbar.BrowserToolbarTabletBase.ForwardButtonAnimation;
 import org.mozilla.gecko.util.StringUtils;
 import org.mozilla.gecko.widget.ThemedLinearLayout;
@@ -178,7 +179,7 @@ public class ToolbarDisplayLayout extends ThemedLinearLayout
             if (Versions.feature16Plus) {
                 mFavicon.setImportantForAccessibility(View.IMPORTANT_FOR_ACCESSIBILITY_NO);
             }
-            mFaviconSize = Math.round(res.getDimension(R.dimen.browser_toolbar_favicon_size));
+            mFaviconSize = Math.round(Favicons.browserToolbarFaviconSize);
         }
 
         mSiteSecurityVisible = (mSiteSecurity.getVisibility() == View.VISIBLE);
diff --git a/mobile/android/chrome/content/browser.js b/mobile/android/chrome/content/browser.js
index 4f84f3724d0..23a6f1c266a 100644
--- a/mobile/android/chrome/content/browser.js
+++ b/mobile/android/chrome/content/browser.js
@@ -4012,7 +4012,8 @@ Tab.prototype = {
             type: "Link:Favicon",
             tabID: this.id,
             href: resolveGeckoURI(target.href),
-            size: maxSize
+            size: maxSize,
+            mime: target.getAttribute("type") || ""
           };
           Messaging.sendRequest(json);
         } else if (list.indexOf("[alternate]") != -1 && aEvent.type == "DOMLinkAdded") {

From 76e504fd501d291b5ec9dc6b38f99ec87a04f36a Mon Sep 17 00:00:00 2001
From: Margaret Leibovic <margaret.leibovic@gmail.com>
Date: Tue, 4 Nov 2014 14:00:50 -0800
Subject: [PATCH 100/153] Bug 1093708 - backout 92713f2cea3a for bustage

---
 mobile/android/base/Makefile.in | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mobile/android/base/Makefile.in b/mobile/android/base/Makefile.in
index e168594f927..32555de9d0b 100644
--- a/mobile/android/base/Makefile.in
+++ b/mobile/android/base/Makefile.in
@@ -372,7 +372,7 @@ $(1): $$(call mkdir_deps,$(filter-out ./,$(dir $(3) $(4) $(5)))) $(2)
 		-F $(3) \
 		-J $(4) \
 		--output-text-symbols $(5) \
-		$(if $(MOZ_ANDROID_RESOURCE_CONSTRAINED),-c mdpi,hdpi,) \
+		$(if $(MOZ_ANDROID_RESOURCE_CONSTRAINED),-c hdpi,) \
 		--ignore-assets "$$(ANDROID_AAPT_IGNORE)"
 endef
 

From 4fede59757d5cb61dbd713e2ee265cb946d7cd04 Mon Sep 17 00:00:00 2001
From: Gijs Kruitbosch <gijskruitbosch@gmail.com>
Date: Tue, 4 Nov 2014 19:11:53 +0000
Subject: [PATCH 101/153] Bug 1080801 - adjust more comments in
 browser/base/content/test/general/browser.ini, rs=comments-only DONTBUILD
 because only comments are changed

--HG--
extra : rebase_source : 477f0d9660bf5a81b3caceba27a0a2c956b451f5
---
 browser/base/content/test/general/browser.ini | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/browser/base/content/test/general/browser.ini b/browser/base/content/test/general/browser.ini
index 23a955a4e8e..2795fadfc00 100644
--- a/browser/base/content/test/general/browser.ini
+++ b/browser/base/content/test/general/browser.ini
@@ -212,7 +212,7 @@ skip-if = e10s # Bug 1093373 - relies on browser.sessionHistory
 [browser_bug561623.js]
 skip-if = e10s
 [browser_bug561636.js]
-skip-if = e10s # Bug 691601 - no form submit observers
+skip-if = e10s # Bug 1093677 - automated form submission from the test doesn't seem to quite work yet
 [browser_bug562649.js]
 skip-if = e10s # Bug 940195 - XULBrowserWindow.isBusy is false as a remote tab starts loading
 [browser_bug563588.js]
@@ -234,7 +234,7 @@ skip-if = e10s # Bug ?????? - test directly manipulates content
 [browser_bug581242.js]
 skip-if = e10s # Bug 930863 - pageshow issues ("TypeError: charset is undefined" in pageshow listener, as document is null)
 [browser_bug581253.js]
-skip-if = e10s # Bug 930863 - pageshow issues ("TypeError: charset is undefined" in pageshow listener, as document is null)
+skip-if = e10s # Bug 1093756 - can't bookmark the data: url in e10s somehow
 [browser_bug581947.js]
 skip-if = e10s
 [browser_bug585558.js]
@@ -245,7 +245,7 @@ skip-if = e10s
 skip-if = e10s # Bug 653065 - Make the lightweight theme web installer ready for e10s
 [browser_bug594131.js]
 [browser_bug595507.js]
-skip-if = e10s # Bug 691601 - no form submit observers
+skip-if = e10s # Bug 1093677 - automated form submission from the test doesn't seem to quite work yet
 [browser_bug596687.js]
 [browser_bug597218.js]
 [browser_bug609700.js]

From e5058b878cc4ba314c2a712e5dc4f4d002e585fd Mon Sep 17 00:00:00 2001
From: Gijs Kruitbosch <gijskruitbosch@gmail.com>
Date: Tue, 4 Nov 2014 15:33:34 +0000
Subject: [PATCH 102/153] Bug 1080801 - re-enable popupnotification tests that
 actually work in e10s, r=mconley

---
 browser/base/content/test/general/browser.ini | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/browser/base/content/test/general/browser.ini b/browser/base/content/test/general/browser.ini
index 2795fadfc00..f1b1d7e47d0 100644
--- a/browser/base/content/test/general/browser.ini
+++ b/browser/base/content/test/general/browser.ini
@@ -292,7 +292,6 @@ skip-if = e10s # Bug 1093373 - relies on browser.sessionHistory
 [browser_bug880101.js]
 [browser_bug882977.js]
 [browser_bug902156.js]
-skip-if = e10s
 [browser_bug906190.js]
 skip-if = buildapp == "mulet" || e10s # Bug 1093642 - test manipulates content and relies on content focus
 [browser_bug970746.js]
@@ -309,7 +308,6 @@ skip-if = os == "mac" || e10s # bug 967013, bug 926729
 [browser_ctrlTab.js]
 skip-if = e10s # Bug ????? - thumbnail captures need e10s love (tabPreviews_capture fails with Argument 1 of CanvasRenderingContext2D.drawWindow does not implement interface Window.)
 [browser_customize_popupNotification.js]
-skip-if = e10s
 [browser_datareporting_notification.js]
 run-if = datareporting
 [browser_devedition.js]
@@ -359,7 +357,6 @@ skip-if = e10s # Bug 921952 - Content:Click event issues
 [browser_minimize.js]
 skip-if = e10s # Bug ?????? - test directly manipulates content (TypeError: gBrowser.docShell is null)
 [browser_mixedcontent_securityflags.js]
-skip-if = e10s # Bug ?????? - test directly manipulates content ("cannot ipc non-cpow object")
 [browser_notification_tab_switching.js]
 skip-if = buildapp == 'mulet' || e10s # Bug ?????? - uncaught exception - Error: cannot ipc non-cpow object at chrome://mochitests/content/browser/browser/base/content/test/general/browser_notification_tab_switching.js:32
 [browser_offlineQuotaNotification.js]
@@ -464,7 +461,6 @@ skip-if = e10s # Bug ?????? - obscure non-windows child process crashes on try
 [browser_urlbarRevert.js]
 skip-if = e10s # Bug ?????? - ESC reverted the location bar value - Got foobar, expected example.com
 [browser_urlbarSearchSingleWordNotification.js]
-skip-if = e10s
 [browser_urlbarStop.js]
 skip-if = e10s # Bug ????? - test calls gBrowser.contentWindow.stop
 [browser_urlbarTrimURLs.js]

From 2349425c5390c4d8421cac36d6258f265a723f93 Mon Sep 17 00:00:00 2001
From: Gijs Kruitbosch <gijskruitbosch@gmail.com>
Date: Tue, 4 Nov 2014 16:00:29 +0000
Subject: [PATCH 103/153] Bug 1080801 - about:newtab session history stuff
 works in e10s now so enable the test, r=Mossop

---
 browser/base/content/test/general/browser.ini | 1 -
 1 file changed, 1 deletion(-)

diff --git a/browser/base/content/test/general/browser.ini b/browser/base/content/test/general/browser.ini
index f1b1d7e47d0..8c00cf05914 100644
--- a/browser/base/content/test/general/browser.ini
+++ b/browser/base/content/test/general/browser.ini
@@ -270,7 +270,6 @@ skip-if = e10s # Bug ?????? - test directly manipulates content (doc.querySelect
 [browser_bug719271.js]
 skip-if = e10s # Bug 1056146 - zoom tests use FullZoomHelper and break in e10s
 [browser_bug724239.js]
-skip-if = e10s # Bug 1077738
 [browser_bug734076.js]
 skip-if = e10s # Bug 1093155 - tries to use context menu from browser-chrome and gets in a mess when in e10s mode
 [browser_bug735471.js]

From d0b91ed9f65ea662682167be5956a2f1e096142b Mon Sep 17 00:00:00 2001
From: Gijs Kruitbosch <gijskruitbosch@gmail.com>
Date: Thu, 30 Oct 2014 13:09:54 +0000
Subject: [PATCH 104/153] Bug 1062096 - browser_aboutHome should use a fake
 search engine instead of google to test FHR reporting, r=adw

---
 .../content/test/general/browser_aboutHome.js | 28 +++++++++++++++++--
 1 file changed, 25 insertions(+), 3 deletions(-)

diff --git a/browser/base/content/test/general/browser_aboutHome.js b/browser/base/content/test/general/browser_aboutHome.js
index 3658b89bf56..5acdb0fac8d 100644
--- a/browser/base/content/test/general/browser_aboutHome.js
+++ b/browser/base/content/test/general/browser_aboutHome.js
@@ -102,7 +102,7 @@ let gTests = [
   desc: "Check that performing a search fires a search event and records to " +
         "Firefox Health Report.",
   setup: function () { },
-  run: function () {
+  run: function* () {
     // Skip this test on Linux.
     if (navigator.platform.indexOf("Linux") == 0) {
       return Promise.resolve();
@@ -116,10 +116,19 @@ let gTests = [
       return Promise.resolve();
     }
 
+    let engine = yield promiseNewEngine("searchSuggestionEngine.xml");
+    // Make this actually work in healthreport by giving it an ID:
+    engine.wrappedJSObject._identifier = 'org.mozilla.testsearchsuggestions';
+
+    let promise = promiseBrowserAttributes(gBrowser.selectedTab);
+    Services.search.currentEngine = engine;
+    yield promise;
+
     let numSearchesBefore = 0;
     let searchEventDeferred = Promise.defer();
     let doc = gBrowser.contentDocument;
     let engineName = doc.documentElement.getAttribute("searchEngineName");
+    is(engine.name, engineName, "Engine name in DOM should match engine we just added");
     let mm = gBrowser.selectedTab.linkedBrowser.messageManager;
 
     mm.loadFrameScript(TEST_CONTENT_HELPER, false);
@@ -149,7 +158,16 @@ let gTests = [
                       uri.spec;
     let loadPromise = waitForDocLoadAndStopIt(expectedURL);
 
-    return Promise.all([searchEventDeferred.promise, loadPromise]);
+    try {
+      yield Promise.all([searchEventDeferred.promise, loadPromise]);
+    } catch (ex) {
+      Cu.reportError(ex);
+      ok(false, "An error occurred waiting for the search to be performed: " + ex);
+    } finally {
+      try {
+        Services.search.removeEngine(engine);
+      } catch (ex) {}
+    }
   }
 },
 
@@ -656,7 +674,11 @@ function promiseNewEngine(basename) {
   Services.search.addEngine(url, Ci.nsISearchEngine.TYPE_MOZSEARCH, "", false, {
     onSuccess: function (engine) {
       info("Search engine added: " + basename);
-      registerCleanupFunction(() => Services.search.removeEngine(engine));
+      registerCleanupFunction(() => {
+        try {
+          Services.search.removeEngine(engine);
+        } catch (ex) { /* Can't remove the engine more than once */ }
+      });
       addDeferred.resolve(engine);
     },
     onError: function (errCode) {

From 769f5a80cb9471856c23c579362fb9af954ba2f3 Mon Sep 17 00:00:00 2001
From: Gijs Kruitbosch <gijskruitbosch@gmail.com>
Date: Wed, 5 Nov 2014 00:29:38 +0000
Subject: [PATCH 105/153] Bug 1080801 - update urlbar test comments,
 rs=comment-only

---
 browser/base/content/test/general/browser.ini | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/browser/base/content/test/general/browser.ini b/browser/base/content/test/general/browser.ini
index 8c00cf05914..b8c55f65921 100644
--- a/browser/base/content/test/general/browser.ini
+++ b/browser/base/content/test/general/browser.ini
@@ -452,16 +452,16 @@ skip-if = e10s # Bug ?????? - test uses chrome windowMediator to try and see ale
 [browser_urlHighlight.js]
 skip-if = e10s
 [browser_urlbarAutoFillTrimURLs.js]
-skip-if = e10s
+skip-if = e10s # Bug 1093941 - Waits indefinitely for onSearchComplete
 [browser_urlbarCopying.js]
 skip-if = e10s # Bug 1069757 - browser_urlbarCopying.js needs e10s love.
 [browser_urlbarEnter.js]
-skip-if = e10s # Bug ?????? - obscure non-windows child process crashes on try
+skip-if = e10s # Bug 1093941 - used to cause obscure non-windows child process crashes on try
 [browser_urlbarRevert.js]
-skip-if = e10s # Bug ?????? - ESC reverted the location bar value - Got foobar, expected example.com
+skip-if = e10s # Bug 1093941 - ESC reverted the location bar value - Got foobar, expected example.com
 [browser_urlbarSearchSingleWordNotification.js]
 [browser_urlbarStop.js]
-skip-if = e10s # Bug ????? - test calls gBrowser.contentWindow.stop
+skip-if = e10s # Bug 1093941 - test calls gBrowser.contentWindow.stop
 [browser_urlbarTrimURLs.js]
 skip-if = e10s
 [browser_urlbar_search_healthreport.js]

From 8502e8ba87368a3800694d96e2b8bc0e488930e8 Mon Sep 17 00:00:00 2001
From: Richard Newman <rnewman@mozilla.com>
Date: Tue, 4 Nov 2014 16:55:34 -0800
Subject: [PATCH 106/153] Bug 1093886 - Respect places.history.enabled to
 disable nsAndroidHistory. r=mfinkle

---
 .../components/build/nsAndroidHistory.cpp     | 24 +++++++++++++++++++
 .../components/build/nsAndroidHistory.h       |  5 ++++
 2 files changed, 29 insertions(+)

diff --git a/mobile/android/components/build/nsAndroidHistory.cpp b/mobile/android/components/build/nsAndroidHistory.cpp
index 6ee73a48963..9e064d19e2f 100644
--- a/mobile/android/components/build/nsAndroidHistory.cpp
+++ b/mobile/android/components/build/nsAndroidHistory.cpp
@@ -10,8 +10,14 @@
 #include "mozilla/Services.h"
 #include "nsIObserverService.h"
 
+#include "mozilla/Preferences.h"
+
 #define NS_LINK_VISITED_EVENT_TOPIC "link-visited"
 
+// We copy Places here.
+// Note that we don't yet observe this pref at runtime.
+#define PREF_HISTORY_ENABLED "places.history.enabled"
+
 using namespace mozilla;
 using mozilla::dom::Link;
 
@@ -33,7 +39,9 @@ nsAndroidHistory::GetSingleton()
 }
 
 nsAndroidHistory::nsAndroidHistory()
+  : mHistoryEnabled(true)
 {
+  LoadPrefs();
 }
 
 NS_IMETHODIMP
@@ -105,6 +113,16 @@ nsAndroidHistory::AppendToRecentlyVisitedURIs(nsIURI* aURI) {
   }
 }
 
+bool
+nsAndroidHistory::ShouldRecordHistory() {
+  return mHistoryEnabled;
+}
+
+void
+nsAndroidHistory::LoadPrefs() {
+  mHistoryEnabled = Preferences::GetBool(PREF_HISTORY_ENABLED, true);
+}
+
 inline bool
 nsAndroidHistory::IsRecentlyVisitedURI(nsIURI* aURI) {
   bool equals = false;
@@ -266,6 +284,12 @@ nsAndroidHistory::CanAddURI(nsIURI* aURI, bool* canAdd)
   NS_ENSURE_ARG(aURI);
   NS_ENSURE_ARG_POINTER(canAdd);
 
+  // See if we're disabled.
+  if (!ShouldRecordHistory()) {
+    *canAdd = false;
+    return NS_OK;
+  }
+
   nsAutoCString scheme;
   nsresult rv = aURI->GetScheme(scheme);
   NS_ENSURE_SUCCESS(rv, rv);
diff --git a/mobile/android/components/build/nsAndroidHistory.h b/mobile/android/components/build/nsAndroidHistory.h
index ab5a957489e..2def996ecfb 100644
--- a/mobile/android/components/build/nsAndroidHistory.h
+++ b/mobile/android/components/build/nsAndroidHistory.h
@@ -41,9 +41,14 @@ private:
 
   static nsAndroidHistory* sHistory;
 
+  // Will mimic the value of the places.history.enabled preference.
+  bool mHistoryEnabled;
+
   nsDataHashtable<nsStringHashKey, nsTArray<mozilla::dom::Link *> *> mListeners;
   nsTPriorityQueue<nsString> mPendingURIs;
 
+  void LoadPrefs();
+  bool ShouldRecordHistory();
   nsresult CanAddURI(nsIURI* aURI, bool* canAdd);
 
   /**

From 724f4e5d8fe04719139ff6ddc6af77fcc3ceb307 Mon Sep 17 00:00:00 2001
From: Richard Newman <rnewman@mozilla.com>
Date: Tue, 4 Nov 2014 13:23:16 -0800
Subject: [PATCH 107/153] Bug 1093708 - Include mdpi assets in constrained
 builds. r=nalexander

---
 mobile/android/base/Makefile.in | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/mobile/android/base/Makefile.in b/mobile/android/base/Makefile.in
index 32555de9d0b..146d7349e69 100644
--- a/mobile/android/base/Makefile.in
+++ b/mobile/android/base/Makefile.in
@@ -356,6 +356,8 @@ extra_packages := $(subst $(NULL) ,:,$(strip $(extra_packages)))
 # thinking aapt's outputs are stale.  This is safe because Make
 # removes the target file if any recipe command fails.
 
+CONSTRAINED_AAPT_CONFIGURATIONS := mdpi,hdpi
+
 define aapt_command
 $(1): $$(call mkdir_deps,$(filter-out ./,$(dir $(3) $(4) $(5)))) $(2)
 	@$$(TOUCH) $$@
@@ -372,7 +374,7 @@ $(1): $$(call mkdir_deps,$(filter-out ./,$(dir $(3) $(4) $(5)))) $(2)
 		-F $(3) \
 		-J $(4) \
 		--output-text-symbols $(5) \
-		$(if $(MOZ_ANDROID_RESOURCE_CONSTRAINED),-c hdpi,) \
+		$(if $(MOZ_ANDROID_RESOURCE_CONSTRAINED),-c $(CONSTRAINED_AAPT_CONFIGURATIONS),) \
 		--ignore-assets "$$(ANDROID_AAPT_IGNORE)"
 endef
 

From 4aa289b3f396da0c5d02d2ef433bcbecf8ee753c Mon Sep 17 00:00:00 2001
From: Drew Willcoxon <adw@mozilla.com>
Date: Tue, 4 Nov 2014 17:18:56 -0800
Subject: [PATCH 108/153] Bug 1020156 - Forward URL parameters from
 about:accounts to the remotely hosted page. r=markh

---
 .../content/aboutaccounts/aboutaccounts.js    | 74 ++++++++++---------
 .../test/general/browser_aboutAccounts.js     | 32 ++++++++
 2 files changed, 72 insertions(+), 34 deletions(-)

diff --git a/browser/base/content/aboutaccounts/aboutaccounts.js b/browser/base/content/aboutaccounts/aboutaccounts.js
index ecb480f117d..c18ced010c3 100644
--- a/browser/base/content/aboutaccounts/aboutaccounts.js
+++ b/browser/base/content/aboutaccounts/aboutaccounts.js
@@ -18,6 +18,8 @@ Cu.import("resource://services-sync/util.js");
 const PREF_LAST_FXA_USER = "identity.fxaccounts.lastSignedInUserHash";
 const PREF_SYNC_SHOW_CUSTOMIZATION = "services.sync.ui.showCustomizationDialog";
 
+const ACTION_URL_PARAM = "action";
+
 const OBSERVER_TOPICS = [
   fxAccountsCommon.ONVERIFIED_NOTIFICATION,
   fxAccountsCommon.ONLOGOUT_NOTIFICATION,
@@ -96,7 +98,7 @@ function shouldAllowRelink(acctName) {
 let wrapper = {
   iframe: null,
 
-  init: function (url, entryPoint) {
+  init: function (url, urlParams) {
     let weave = Cc["@mozilla.org/weave/service;1"]
                   .getService(Ci.nsISupports)
                   .wrappedJSObject;
@@ -116,14 +118,14 @@ let wrapper = {
     let iframe = document.getElementById("remote");
     this.iframe = iframe;
     iframe.addEventListener("load", this);
-    try {
-      if (entryPoint) {
-        url += (url.indexOf("?") >= 0 ? "&" : "?") + entryPoint;
-      }
-      iframe.src = url;
-    } catch (e) {
-      error("Couldn't init Firefox Account wrapper: " + e.message);
+
+    // Ideally we'd just merge urlParams with new URL(url).searchParams, but our
+    // URLSearchParams implementation doesn't support iteration (bug 1085284).
+    let urlParamStr = urlParams.toString();
+    if (urlParamStr) {
+      url += (url.contains("?") ? "&" : "?") + urlParamStr;
     }
+    iframe.src = url;
   },
 
   handleEvent: function (evt) {
@@ -295,46 +297,49 @@ function init() {
     if (window.closed) {
       return;
     }
-    // If the url contains an entrypoint query parameter, extract it into a variable
-    // to append it to the accounts URI resource.
-    // Works for the following cases:
-    // - about:accounts?entrypoint="abouthome"
-    // - about:accounts?entrypoint=abouthome&action=signup
-    let entryPointQParam = "entrypoint=";
-    let entryPointPos = window.location.href.indexOf(entryPointQParam);
-    let entryPoint = "";
-    if (entryPointPos >= 0) {
-      entryPoint = window.location.href.substring(entryPointPos).split("&")[0];
-    }
-    if (window.location.href.contains("action=signin")) {
+
+    // Ideally we'd use new URL(document.URL).searchParams, but for about: URIs,
+    // searchParams is empty.
+    let urlParams = new URLSearchParams(document.URL.split("?")[1] || "");
+    let action = urlParams.get(ACTION_URL_PARAM);
+    urlParams.delete(ACTION_URL_PARAM);
+
+    switch (action) {
+    case "signin":
       if (user) {
         // asking to sign-in when already signed in just shows manage.
         show("stage", "manage");
       } else {
         show("remote");
-        wrapper.init(fxAccounts.getAccountsSignInURI(), entryPoint);
+        wrapper.init(fxAccounts.getAccountsSignInURI(), urlParams);
       }
-    } else if (window.location.href.contains("action=signup")) {
+      break;
+    case "signup":
       if (user) {
         // asking to sign-up when already signed in just shows manage.
         show("stage", "manage");
       } else {
         show("remote");
-        wrapper.init(fxAccounts.getAccountsSignUpURI(), entryPoint);
+        wrapper.init(fxAccounts.getAccountsSignUpURI(), urlParams);
       }
-    } else if (window.location.href.contains("action=reauth")) {
+      break;
+    case "reauth":
       // ideally we would only show this when we know the user is in a
       // "must reauthenticate" state - but we don't.
       // As the email address will be included in the URL returned from
       // promiseAccountsForceSigninURI, just always show it.
       fxAccounts.promiseAccountsForceSigninURI().then(url => {
         show("remote");
-        wrapper.init(url, entryPoint);
+        wrapper.init(url, urlParams);
       });
-    } else if (window.location.href.contains("action=migrateToDevEdition") &&
-               user == null) {
-      migrateToDevEdition(user, entryPoint);
-    } else {
+      break;
+    case "migrateToDevEdition":
+      if (user == null) {
+        migrateToDevEdition(user, urlParams);
+        break;
+      }
+      // else, fall through
+    default:
       // No action specified, or migration request when we already have a user.
       if (user) {
         show("stage", "manage");
@@ -343,8 +348,9 @@ function init() {
       } else {
         show("stage", "intro");
         // load the remote frame in the background
-        wrapper.init(fxAccounts.getAccountsSignUpURI(), entryPoint);
+        wrapper.init(fxAccounts.getAccountsSignUpURI(), urlParams);
       }
+      break;
     }
   });
 }
@@ -376,7 +382,7 @@ function show(id, childId) {
 }
 
 // Migrate sync data from the default profile to the dev-edition profile.
-function migrateToDevEdition(user, entryPoint) {
+function migrateToDevEdition(user, urlParams) {
   let migrateSyncCreds = false;
   try {
     migrateSyncCreds = Services.prefs.getBoolPref("identity.fxaccounts.migrateToDevEdition");
@@ -390,13 +396,13 @@ function migrateToDevEdition(user, entryPoint) {
     }).then(() => {
       return fxAccounts.promiseAccountsForceSigninURI().then(url => {
         show("remote");
-        wrapper.init(url, entryPoint);
+        wrapper.init(url, urlParams);
       });
     }).then(null, error => {
       log("Failed to migrate FX Account: " + error);
       show("stage", "intro");
       // load the remote frame in the background
-      wrapper.init(fxAccounts.getAccountsSignUpURI(), entryPoint);
+      wrapper.init(fxAccounts.getAccountsSignUpURI(), urlParams);
     }).then(() => {
       // Reset the pref after migration.
       Services.prefs.setBoolPref("identity.fxaccounts.migrateToDevEdition", false);
@@ -404,7 +410,7 @@ function migrateToDevEdition(user, entryPoint) {
   } else {
     show("stage", "intro");
     // load the remote frame in the background
-    wrapper.init(fxAccounts.getAccountsSignUpURI(), entryPoint);
+    wrapper.init(fxAccounts.getAccountsSignUpURI(), urlParams);
   }
 }
 
diff --git a/browser/base/content/test/general/browser_aboutAccounts.js b/browser/base/content/test/general/browser_aboutAccounts.js
index 58502d7e41b..35ea736df46 100644
--- a/browser/base/content/test/general/browser_aboutAccounts.js
+++ b/browser/base/content/test/general/browser_aboutAccounts.js
@@ -331,6 +331,38 @@ let gTests = [
     is(url, sign_up_url + "&entrypoint=abouthome", "entrypoint=abouthome got the expected URL");
   },
 },
+{
+  desc: "about:accounts URL params should be copied to remote URL params " +
+        "when remote URL has no URL params, except for 'action'",
+  teardown() {
+    gBrowser.removeCurrentTab();
+  },
+  run: function* () {
+    let signupURL = "https://example.com/";
+    setPref("identity.fxaccounts.remote.signup.uri", signupURL);
+    let queryStr = "email=foo%40example.com&foo=bar&baz=quux";
+    let [tab, url] =
+      yield promiseNewTabWithIframeLoadEvent("about:accounts?" + queryStr +
+                                             "&action=action");
+    is(url, signupURL + "?" + queryStr, "URL params are copied to signup URL");
+  },
+},
+{
+  desc: "about:accounts URL params should be copied to remote URL params " +
+        "when remote URL already has some URL params, except for 'action'",
+  teardown() {
+    gBrowser.removeCurrentTab();
+  },
+  run: function* () {
+    let signupURL = "https://example.com/?param";
+    setPref("identity.fxaccounts.remote.signup.uri", signupURL);
+    let queryStr = "email=foo%40example.com&foo=bar&baz=quux";
+    let [tab, url] =
+      yield promiseNewTabWithIframeLoadEvent("about:accounts?" + queryStr +
+                                             "&action=action");
+    is(url, signupURL + "&" + queryStr, "URL params are copied to signup URL");
+  },
+},
 ]; // gTests
 
 function test()

From fe371234593c41ad67896bae748abca0db8832b5 Mon Sep 17 00:00:00 2001
From: Erik Vold <evold@mozilla.com>
Date: Tue, 4 Nov 2014 17:19:37 -0800
Subject: [PATCH 109/153] Bug 1092879 - Preferences.jsm MAX_INT does useless
 math r=gavin

---
 toolkit/modules/Preferences.jsm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/toolkit/modules/Preferences.jsm b/toolkit/modules/Preferences.jsm
index efc044f161c..b18e82c5fbc 100644
--- a/toolkit/modules/Preferences.jsm
+++ b/toolkit/modules/Preferences.jsm
@@ -15,7 +15,7 @@ Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 // The range of valid values is narrower than the range of valid JS values
 // because the native preferences code treats integers as NSPR PRInt32s,
 // which are 32-bit signed integers on all platforms.
-const MAX_INT = Math.pow(2, 31) - 1;
+const MAX_INT = 0x7FFFFFFF; // Math.pow(2, 31) - 1
 const MIN_INT = -MAX_INT;
 
 this.Preferences =

From 7126ef3bf734331ff3165cd0af046947c030ee09 Mon Sep 17 00:00:00 2001
From: Matthew Noorenberghe <mozilla@noorenberghe.ca>
Date: Tue, 4 Nov 2014 16:44:41 -0800
Subject: [PATCH 110/153] Bug 1091260 - Badge the Browser Toolbox dock icon on
 OS X to differentiate it from the main process. r=jryans,fitzgen

--HG--
extra : rebase_source : 3ea5114858053c862564a1efea2004406e0863d9
---
 .../framework/toolbox-process-window.js       | 31 +++++++++++++++++++
 browser/devtools/jar.mn                       |  2 +-
 2 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/browser/devtools/framework/toolbox-process-window.js b/browser/devtools/framework/toolbox-process-window.js
index 556d5db574d..10f96280cb6 100644
--- a/browser/devtools/framework/toolbox-process-window.js
+++ b/browser/devtools/framework/toolbox-process-window.js
@@ -92,6 +92,37 @@ function onNewToolbox(toolbox) {
 function bindToolboxHandlers() {
   gToolbox.once("destroyed", quitApp);
   window.addEventListener("unload", onUnload);
+
+#ifdef XP_MACOSX
+  // Badge the dock icon to differentiate this process from the main application process.
+  updateBadgeText(false);
+
+  // Check if the debugger panel is already loaded otherwise listen for it to be.
+  if (gToolbox.getPanel("jsdebugger")) {
+    setupThreadListeners(gToolbox.getPanel("jsdebugger"));
+  } else {
+    gToolbox.once("jsdebugger-ready", (e, panel) => setupThreadListeners(panel));
+  }
+#endif
+}
+
+function setupThreadListeners(panel) {
+  updateBadgeText(panel._controller.activeThread.state == "paused");
+
+  let onPaused = updateBadgeText.bind(null, true);
+  let onResumed = updateBadgeText.bind(null, false);
+  panel.target.on("thread-paused", onPaused);
+  panel.target.on("thread-resumed", onResumed);
+
+  panel.once("destroyed", () => {
+    panel.off("thread-paused", onPaused);
+    panel.off("thread-resumed", onResumed);
+  });
+}
+
+function updateBadgeText(paused) {
+  let dockSupport = Cc["@mozilla.org/widget/macdocksupport;1"].getService(Ci.nsIMacDockSupport);
+  dockSupport.badgeText = paused ? "▐▐ " : " ▶";
 }
 
 function onUnload() {
diff --git a/browser/devtools/jar.mn b/browser/devtools/jar.mn
index 0ccd0038ff4..0e1fdb5d618 100644
--- a/browser/devtools/jar.mn
+++ b/browser/devtools/jar.mn
@@ -102,7 +102,7 @@ browser.jar:
     content/browser/devtools/framework/toolbox.xul                     (framework/toolbox.xul)
     content/browser/devtools/framework/options-panel.css               (framework/options-panel.css)
     content/browser/devtools/framework/toolbox-process-window.xul      (framework/toolbox-process-window.xul)
-    content/browser/devtools/framework/toolbox-process-window.js       (framework/toolbox-process-window.js)
+*   content/browser/devtools/framework/toolbox-process-window.js       (framework/toolbox-process-window.js)
     content/browser/devtools/inspector/inspector.xul                   (inspector/inspector.xul)
     content/browser/devtools/inspector/inspector.css                   (inspector/inspector.css)
     content/browser/devtools/connect.xhtml                             (framework/connect/connect.xhtml)

From bfa438165b973c518d84e88a81359855d4e64943 Mon Sep 17 00:00:00 2001
From: Matthew Noorenberghe <mozilla@noorenberghe.ca>
Date: Tue, 4 Nov 2014 17:59:31 -0800
Subject: [PATCH 111/153] No bug - Stop pre-processing aboutWelcomeBack.xhtml.
 r=me

---
 browser/components/migration/jar.mn | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/browser/components/migration/jar.mn b/browser/components/migration/jar.mn
index 0e4d79837a5..23137ba7c5e 100644
--- a/browser/components/migration/jar.mn
+++ b/browser/components/migration/jar.mn
@@ -5,4 +5,4 @@
 browser.jar:
 *  content/browser/migration/migration.xul                    (content/migration.xul)
    content/browser/migration/migration.js                     (content/migration.js)
-*  content/browser/aboutWelcomeBack.xhtml                     (content/aboutWelcomeBack.xhtml)
+   content/browser/aboutWelcomeBack.xhtml                     (content/aboutWelcomeBack.xhtml)

From 8872f8c5bbf3f93cb29eb222f9aa125a4f08f038 Mon Sep 17 00:00:00 2001
From: Wes Kocher <wkocher@mozilla.com>
Date: Tue, 4 Nov 2014 19:06:45 -0800
Subject: [PATCH 112/153] Backed out changeset ec34b5a1552c (bug 1091260) for
 bc1 orange

---
 .../framework/toolbox-process-window.js       | 31 -------------------
 browser/devtools/jar.mn                       |  2 +-
 2 files changed, 1 insertion(+), 32 deletions(-)

diff --git a/browser/devtools/framework/toolbox-process-window.js b/browser/devtools/framework/toolbox-process-window.js
index 10f96280cb6..556d5db574d 100644
--- a/browser/devtools/framework/toolbox-process-window.js
+++ b/browser/devtools/framework/toolbox-process-window.js
@@ -92,37 +92,6 @@ function onNewToolbox(toolbox) {
 function bindToolboxHandlers() {
   gToolbox.once("destroyed", quitApp);
   window.addEventListener("unload", onUnload);
-
-#ifdef XP_MACOSX
-  // Badge the dock icon to differentiate this process from the main application process.
-  updateBadgeText(false);
-
-  // Check if the debugger panel is already loaded otherwise listen for it to be.
-  if (gToolbox.getPanel("jsdebugger")) {
-    setupThreadListeners(gToolbox.getPanel("jsdebugger"));
-  } else {
-    gToolbox.once("jsdebugger-ready", (e, panel) => setupThreadListeners(panel));
-  }
-#endif
-}
-
-function setupThreadListeners(panel) {
-  updateBadgeText(panel._controller.activeThread.state == "paused");
-
-  let onPaused = updateBadgeText.bind(null, true);
-  let onResumed = updateBadgeText.bind(null, false);
-  panel.target.on("thread-paused", onPaused);
-  panel.target.on("thread-resumed", onResumed);
-
-  panel.once("destroyed", () => {
-    panel.off("thread-paused", onPaused);
-    panel.off("thread-resumed", onResumed);
-  });
-}
-
-function updateBadgeText(paused) {
-  let dockSupport = Cc["@mozilla.org/widget/macdocksupport;1"].getService(Ci.nsIMacDockSupport);
-  dockSupport.badgeText = paused ? "▐▐ " : " ▶";
 }
 
 function onUnload() {
diff --git a/browser/devtools/jar.mn b/browser/devtools/jar.mn
index 0e1fdb5d618..0ccd0038ff4 100644
--- a/browser/devtools/jar.mn
+++ b/browser/devtools/jar.mn
@@ -102,7 +102,7 @@ browser.jar:
     content/browser/devtools/framework/toolbox.xul                     (framework/toolbox.xul)
     content/browser/devtools/framework/options-panel.css               (framework/options-panel.css)
     content/browser/devtools/framework/toolbox-process-window.xul      (framework/toolbox-process-window.xul)
-*   content/browser/devtools/framework/toolbox-process-window.js       (framework/toolbox-process-window.js)
+    content/browser/devtools/framework/toolbox-process-window.js       (framework/toolbox-process-window.js)
     content/browser/devtools/inspector/inspector.xul                   (inspector/inspector.xul)
     content/browser/devtools/inspector/inspector.css                   (inspector/inspector.css)
     content/browser/devtools/connect.xhtml                             (framework/connect/connect.xhtml)

From 8073b76b5589bbcfd7ec583a8ac138c97f8fbcba Mon Sep 17 00:00:00 2001
From: Dave Townsend <dtownsend@oxymoronical.com>
Date: Tue, 4 Nov 2014 19:20:52 -0800
Subject: [PATCH 113/153] Bug 1084558: Switch the web installer interfaces to
 use browsers instead of DOM windows. r=Unfocused

---
 browser/base/content/browser-addons.js        | 15 +----
 browser/base/content/urlbarBindings.xml       |  3 +-
 mobile/android/chrome/content/browser.js      |  3 +-
 mobile/android/components/XPIDialogService.js |  4 +-
 toolkit/mozapps/extensions/AddonManager.jsm   | 32 +++++------
 toolkit/mozapps/extensions/addonManager.js    | 23 ++------
 .../mozapps/extensions/amContentHandler.js    |  5 +-
 .../extensions/amIWebInstallListener.idl      | 34 +++++------
 .../mozapps/extensions/amIWebInstaller.idl    | 11 ++--
 .../mozapps/extensions/amInstallTrigger.js    |  6 +-
 .../extensions/amWebInstallListener.js        | 57 +++++++++----------
 .../mozapps/extensions/content/extensions.js  | 10 +++-
 .../extensions/internal/XPIProvider.jsm       | 32 +++++------
 .../test/browser/browser_bug567127.js         |  5 +-
 .../test/browser/browser_dragdrop.js          |  5 +-
 .../extensions/test/xpinstall/browser.ini     |  2 +-
 .../test/xpinstall/browser_bug645699.js       |  6 +-
 .../test/xpinstall/browser_httphash6.js       |  2 +-
 .../test/xpinstall/browser_switchtab.js       | 49 ++++++++++++++++
 .../test/xpinstall/browser_whitelist.js       |  6 +-
 .../test/xpinstall/browser_whitelist2.js      |  6 +-
 .../test/xpinstall/browser_whitelist4.js      |  6 +-
 .../test/xpinstall/browser_whitelist5.js      |  6 +-
 .../test/xpinstall/browser_whitelist6.js      |  6 +-
 24 files changed, 168 insertions(+), 166 deletions(-)
 create mode 100644 toolkit/mozapps/extensions/test/xpinstall/browser_switchtab.js

diff --git a/browser/base/content/browser-addons.js b/browser/base/content/browser-addons.js
index 542f62f7ff1..fecfc32b90f 100644
--- a/browser/base/content/browser-addons.js
+++ b/browser/base/content/browser-addons.js
@@ -32,20 +32,9 @@ const gXPInstallObserver = {
   {
     var brandBundle = document.getElementById("bundle_brand");
     var installInfo = aSubject.QueryInterface(Components.interfaces.amIWebInstallInfo);
-    var winOrBrowser = installInfo.originator;
+    var browser = installInfo.browser;
 
-    var browser;
-    try {
-      var shell = winOrBrowser.QueryInterface(Components.interfaces.nsIDOMWindow)
-                              .QueryInterface(Components.interfaces.nsIInterfaceRequestor)
-                              .getInterface(Components.interfaces.nsIWebNavigation)
-                              .QueryInterface(Components.interfaces.nsIDocShell);
-      browser = this._getBrowser(shell);
-    } catch (e) {
-      browser = winOrBrowser;
-    }
-    // Note that the above try/catch will pass through dead object proxies and
-    // other degenerate objects. Make sure the browser is bonafide.
+    // Make sure the browser is still alive.
     if (!browser || gBrowser.browsers.indexOf(browser) == -1)
       return;
 
diff --git a/browser/base/content/urlbarBindings.xml b/browser/base/content/urlbarBindings.xml
index 6cf6c8723a4..2ff749fb0bf 100644
--- a/browser/base/content/urlbarBindings.xml
+++ b/browser/base/content/urlbarBindings.xml
@@ -1180,7 +1180,6 @@
           // Cache these as cancelling the installs will remove this
           // notification which will drop these references
           let browser = this.notification.browser;
-          let contentWindow = this.notification.options.contentWindow;
           let sourceURI = this.notification.options.sourceURI;
 
           let installs = this.notification.options.installs;
@@ -1206,7 +1205,7 @@
             callback: function() {
               let weblistener = Cc["@mozilla.org/addons/web-install-listener;1"].
                                 getService(Ci.amIWebInstallListener);
-              if (weblistener.onWebInstallRequested(contentWindow, sourceURI,
+              if (weblistener.onWebInstallRequested(browser, sourceURI,
                                                     installs, installs.length)) {
                 installs.forEach(function(aInstall) {
                   aInstall.install();
diff --git a/mobile/android/chrome/content/browser.js b/mobile/android/chrome/content/browser.js
index 23a6f1c266a..74535d8ca33 100644
--- a/mobile/android/chrome/content/browser.js
+++ b/mobile/android/chrome/content/browser.js
@@ -6020,8 +6020,7 @@ var XPInstallObserver = {
         break;
       case "addon-install-blocked":
         let installInfo = aSubject.QueryInterface(Ci.amIWebInstallInfo);
-        let win = installInfo.originator;
-        let tab = BrowserApp.getTabForWindow(win.top);
+        let tab = BrowserApp.getTabForBrowser(installInfo.browser);
         if (!tab)
           return;
 
diff --git a/mobile/android/components/XPIDialogService.js b/mobile/android/components/XPIDialogService.js
index 88a8821eac8..3d180e63bb1 100644
--- a/mobile/android/components/XPIDialogService.js
+++ b/mobile/android/components/XPIDialogService.js
@@ -18,7 +18,7 @@ WebInstallPrompt.prototype = {
   classID: Components.ID("{c1242012-27d8-477e-a0f1-0b098ffc329b}"),
   QueryInterface: XPCOMUtils.generateQI([Ci.amIWebInstallPrompt]),
 
-  confirm: function(aWindow, aURL, aInstalls) {
+  confirm: function(aBrowser, aURL, aInstalls) {
     let bundle = Services.strings.createBundle("chrome://browser/locale/browser.properties");
 
     let prompt = Services.prompt;
@@ -27,7 +27,7 @@ WebInstallPrompt.prototype = {
     let button = bundle.GetStringFromName("addonsConfirmInstall.install");
 
     aInstalls.forEach(function(install) {
-      let result = (prompt.confirmEx(aWindow, title, install.name, flags, button, null, null, null, {value: false}) == 0);
+      let result = (prompt.confirmEx(aBrowser.contentWindow, title, install.name, flags, button, null, null, null, {value: false}) == 0);
       if (result)
         install.install();
       else
diff --git a/toolkit/mozapps/extensions/AddonManager.jsm b/toolkit/mozapps/extensions/AddonManager.jsm
index 2def0b4769d..8d9dcf724ea 100644
--- a/toolkit/mozapps/extensions/AddonManager.jsm
+++ b/toolkit/mozapps/extensions/AddonManager.jsm
@@ -1628,7 +1628,7 @@ var AddonManagerInternal = {
    */
   getInstallForURL: function AMI_getInstallForURL(aUrl, aCallback, aMimetype,
                                                   aHash, aName, aIcons,
-                                                  aVersion, aLoadGroup) {
+                                                  aVersion, aBrowser) {
     if (!gStarted)
       throw Components.Exception("AddonManager is not initialized",
                                  Cr.NS_ERROR_NOT_INITIALIZED);
@@ -1667,15 +1667,15 @@ var AddonManagerInternal = {
       throw Components.Exception("aVersion must be a string or null",
                                  Cr.NS_ERROR_INVALID_ARG);
 
-    if (aLoadGroup && (!(aLoadGroup instanceof Ci.nsILoadGroup)))
-      throw Components.Exception("aLoadGroup must be a nsILoadGroup or null",
+    if (aBrowser && (!(aBrowser instanceof Ci.nsIDOMElement)))
+      throw Components.Exception("aBrowser must be a nsIDOMElement or null",
                                  Cr.NS_ERROR_INVALID_ARG);
 
     let providers = this.providers.slice(0);
     for (let provider of providers) {
       if (callProvider(provider, "supportsMimetype", false, aMimetype)) {
         callProviderAsync(provider, "getInstallForURL",
-                          aUrl, aHash, aName, aIcons, aVersion, aLoadGroup,
+                          aUrl, aHash, aName, aIcons, aVersion, aBrowser,
                           function  getInstallForURL_safeCall(aInstall) {
           safeCall(aCallback, aInstall);
         });
@@ -1878,15 +1878,15 @@ var AddonManagerInternal = {
    *
    * @param  aMimetype
    *         The mimetype of add-ons being installed
-   * @param  aSource
-   *         The optional nsIDOMWindow that started the installs
+   * @param  aBrowser
+   *         The optional browser element that started the installs
    * @param  aURI
    *         The optional nsIURI that started the installs
    * @param  aInstalls
    *         The array of AddonInstalls to be installed
    */
   installAddonsFromWebpage: function AMI_installAddonsFromWebpage(aMimetype,
-                                                                  aSource,
+                                                                  aBrowser,
                                                                   aURI,
                                                                   aInstalls) {
     if (!gStarted)
@@ -1897,8 +1897,8 @@ var AddonManagerInternal = {
       throw Components.Exception("aMimetype must be a non-empty string",
                                  Cr.NS_ERROR_INVALID_ARG);
 
-    if (aSource && !(aSource instanceof Ci.nsIDOMWindow) && !(aSource instanceof Ci.nsIDOMNode))
-      throw Components.Exception("aSource must be a nsIDOMWindow, a XUL element, or null",
+    if (aBrowser && !(aBrowser instanceof Ci.nsIDOMElement))
+      throw Components.Exception("aSource must be a nsIDOMElement, or null",
                                  Cr.NS_ERROR_INVALID_ARG);
 
     if (aURI && !(aURI instanceof Ci.nsIURI))
@@ -1922,18 +1922,18 @@ var AddonManagerInternal = {
                         getService(Ci.amIWebInstallListener);
 
       if (!this.isInstallEnabled(aMimetype, aURI)) {
-        weblistener.onWebInstallDisabled(aSource, aURI, aInstalls,
+        weblistener.onWebInstallDisabled(aBrowser, aURI, aInstalls,
                                          aInstalls.length);
       }
       else if (!this.isInstallAllowed(aMimetype, aURI)) {
-        if (weblistener.onWebInstallBlocked(aSource, aURI, aInstalls,
+        if (weblistener.onWebInstallBlocked(aBrowser, aURI, aInstalls,
                                             aInstalls.length)) {
           aInstalls.forEach(function(aInstall) {
             aInstall.install();
           });
         }
       }
-      else if (weblistener.onWebInstallRequested(aSource, aURI, aInstalls,
+      else if (weblistener.onWebInstallRequested(aBrowser, aURI, aInstalls,
                                                    aInstalls.length)) {
         aInstalls.forEach(function(aInstall) {
           aInstall.install();
@@ -2720,9 +2720,9 @@ this.AddonManager = {
 
   getInstallForURL: function AM_getInstallForURL(aUrl, aCallback, aMimetype,
                                                  aHash, aName, aIcons,
-                                                 aVersion, aLoadGroup) {
+                                                 aVersion, aBrowser) {
     AddonManagerInternal.getInstallForURL(aUrl, aCallback, aMimetype, aHash,
-                                          aName, aIcons, aVersion, aLoadGroup);
+                                          aName, aIcons, aVersion, aBrowser);
   },
 
   getInstallForFile: function AM_getInstallForFile(aFile, aCallback, aMimetype) {
@@ -2787,9 +2787,9 @@ this.AddonManager = {
     return AddonManagerInternal.isInstallAllowed(aType, aUri);
   },
 
-  installAddonsFromWebpage: function AM_installAddonsFromWebpage(aType, aSource,
+  installAddonsFromWebpage: function AM_installAddonsFromWebpage(aType, aBrowser,
                                                                  aUri, aInstalls) {
-    AddonManagerInternal.installAddonsFromWebpage(aType, aSource, aUri, aInstalls);
+    AddonManagerInternal.installAddonsFromWebpage(aType, aBrowser, aUri, aInstalls);
   },
 
   addManagerListener: function AM_addManagerListener(aListener) {
diff --git a/toolkit/mozapps/extensions/addonManager.js b/toolkit/mozapps/extensions/addonManager.js
index 1983e7cfdeb..3a3da98260b 100644
--- a/toolkit/mozapps/extensions/addonManager.js
+++ b/toolkit/mozapps/extensions/addonManager.js
@@ -74,7 +74,7 @@ amManager.prototype = {
    * @see amIWebInstaller.idl
    */
   installAddonsFromWebpage: function AMC_installAddonsFromWebpage(aMimetype,
-                                                                  aOriginator,
+                                                                  aBrowser,
                                                                   aReferer, aUris,
                                                                   aHashes, aNames,
                                                                   aIcons, aCallback) {
@@ -87,21 +87,10 @@ amManager.prototype = {
       retval = false;
     }
 
-    let loadGroup = null;
-
-    try {
-      loadGroup = aOriginator.QueryInterface(Ci.nsIDOMWindow)
-                             .QueryInterface(Ci.nsIInterfaceRequestor)
-                             .getInterface(Ci.nsIWebNavigation)
-                             .QueryInterface(Ci.nsIDocumentLoader).loadGroup;
-    }
-    catch (e) {
-    }
-
     let installs = [];
     function buildNextInstall() {
       if (aUris.length == 0) {
-        AddonManager.installAddonsFromWebpage(aMimetype, aOriginator, aReferer, installs);
+        AddonManager.installAddonsFromWebpage(aMimetype, aBrowser, aReferer, installs);
         return;
       }
       let uri = aUris.shift();
@@ -144,7 +133,7 @@ amManager.prototype = {
           aCallback.onInstallEnded(uri, UNSUPPORTED_TYPE);
         }
         buildNextInstall();
-      }, aMimetype, aHashes.shift(), aNames.shift(), aIcons.shift(), null, loadGroup);
+      }, aMimetype, aHashes.shift(), aNames.shift(), aIcons.shift(), null, aBrowser);
     }
     buildNextInstall();
 
@@ -183,12 +172,8 @@ amManager.prototype = {
           };
         }
 
-        // If aMessage.objects.window exists, then we're same-process and we
-        // can target any modal prompts more correctly. Otherwise, we use the
-        // browser element for the remote browser as the best bet.
-        let originator = aMessage.objects.window || aMessage.target;
         return this.installAddonsFromWebpage(payload.mimetype,
-          originator, referer, payload.uris, payload.hashes,
+          aMessage.target, referer, payload.uris, payload.hashes,
           payload.names, payload.icons, callback);
       }
     }
diff --git a/toolkit/mozapps/extensions/amContentHandler.js b/toolkit/mozapps/extensions/amContentHandler.js
index e5c65d9590a..74f682ca54d 100644
--- a/toolkit/mozapps/extensions/amContentHandler.js
+++ b/toolkit/mozapps/extensions/amContentHandler.js
@@ -66,9 +66,12 @@ amContentHandler.prototype = {
                                                 Ci.nsIURI);
       }
 
+      let browser = window.QueryInterface(Ci.nsIInterfaceRequestor)
+                          .getInterface(Ci.nsIDocShell)
+                          .chromeEventHandler;
       let manager = Cc["@mozilla.org/addons/integration;1"].
                     getService(Ci.amIWebInstaller);
-      manager.installAddonsFromWebpage(aMimetype, window, referer, [uri.spec],
+      manager.installAddonsFromWebpage(aMimetype, browser, referer, [uri.spec],
                                        [null], [null], [null], null, 1);
     }
   },
diff --git a/toolkit/mozapps/extensions/amIWebInstallListener.idl b/toolkit/mozapps/extensions/amIWebInstallListener.idl
index e12f1fda050..33adf75c445 100644
--- a/toolkit/mozapps/extensions/amIWebInstallListener.idl
+++ b/toolkit/mozapps/extensions/amIWebInstallListener.idl
@@ -4,7 +4,7 @@
 
 #include "nsISupports.idl"
 
-interface nsIDOMWindow;
+interface nsIDOMElement;
 interface nsIURI;
 interface nsIVariant;
 
@@ -13,10 +13,10 @@ interface nsIVariant;
  * amIWebInstallListener to communicate with the running application and allow
  * it to warn the user about blocked installs and start the installs running.
  */
-[scriptable, uuid(502f206a-c6b4-4e98-b442-e335792e2594)]
+[scriptable, uuid(fa0b47a3-f819-47ac-bc66-4bd1d7f67b1d)]
 interface amIWebInstallInfo : nsISupports
 {
-  readonly attribute nsISupports originator;
+  readonly attribute nsIDOMElement browser;
   readonly attribute nsIURI originatingURI;
   readonly attribute nsIVariant installs;
 
@@ -32,14 +32,14 @@ interface amIWebInstallInfo : nsISupports
  * dialog when add-ons are ready to install and uses the observer service to
  * notify when installations are blocked.
  */
-[scriptable, uuid(a5503979-89c8-441e-9e4a-321df379c172)]
+[scriptable, uuid(d9240d4b-6b3a-4cad-b402-de6c93337e0c)]
 interface amIWebInstallListener : nsISupports
 {
   /**
    * Called when installation by websites is currently disabled.
    *
-   * @param  aOriginator
-   *         The window or browser that triggered the installs
+   * @param  aBrowser
+   *         The browser that triggered the installs
    * @param  aUri
    *         The URI of the site that triggered the installs
    * @param  aInstalls
@@ -47,7 +47,7 @@ interface amIWebInstallListener : nsISupports
    * @param  aCount
    *         The number of AddonInstalls
    */
-  void onWebInstallDisabled(in nsISupports aOriginator, in nsIURI aUri,
+  void onWebInstallDisabled(in nsIDOMElement aBrowser, in nsIURI aUri,
                             [array, size_is(aCount)] in nsIVariant aInstalls,
                             [optional] in uint32_t aCount);
 
@@ -55,8 +55,8 @@ interface amIWebInstallListener : nsISupports
    * Called when the website is not allowed to directly prompt the user to
    * install add-ons.
    *
-   * @param  aWindow
-   *         The window or browser that triggered the installs
+   * @param  aBrowser
+   *         The browser that triggered the installs
    * @param  aUri
    *         The URI of the site that triggered the installs
    * @param  aInstalls
@@ -65,15 +65,15 @@ interface amIWebInstallListener : nsISupports
    *         The number of AddonInstalls
    * @return true if the caller should start the installs
    */
-  boolean onWebInstallBlocked(in nsISupports aOriginator, in nsIURI aUri,
+  boolean onWebInstallBlocked(in nsIDOMElement aBrowser, in nsIURI aUri,
                               [array, size_is(aCount)] in nsIVariant aInstalls,
                               [optional] in uint32_t aCount);
 
   /**
    * Called when a website wants to ask the user to install add-ons.
    *
-   * @param  aWindow
-   *         The window or browser that triggered the installs
+   * @param  aBrowser
+   *         The browser that triggered the installs
    * @param  aUri
    *         The URI of the site that triggered the installs
    * @param  aInstalls
@@ -82,7 +82,7 @@ interface amIWebInstallListener : nsISupports
    *         The number of AddonInstalls
    * @return true if the caller should start the installs
    */
-  boolean onWebInstallRequested(in nsISupports aOriginator, in nsIURI aUri,
+  boolean onWebInstallRequested(in nsIDOMElement aBrowser, in nsIURI aUri,
                                 [array, size_is(aCount)] in nsIVariant aInstalls,
                                 [optional] in uint32_t aCount);
 };
@@ -92,14 +92,14 @@ interface amIWebInstallListener : nsISupports
  * amIWebInstallInfo to display a confirmation UI to the user before running
  * installs.
  */
-[scriptable, uuid(c5529918-4291-4b56-bd46-e9268900f2a3)]
+[scriptable, uuid(386906f1-4d18-45bf-bc81-5dcd68e42c3b)]
 interface amIWebInstallPrompt : nsISupports
 {
   /**
    * Get a confirmation that the user wants to start the installs.
    *
-   * @param  aWindow
-   *         The window that triggered the installs
+   * @param  aBrowser
+   *         The browser that triggered the installs
    * @param  aUri
    *         The URI of the site that triggered the installs
    * @param  aInstalls
@@ -107,7 +107,7 @@ interface amIWebInstallPrompt : nsISupports
    * @param  aCount
    *         The number of AddonInstalls
    */
-  void confirm(in nsIDOMWindow aWindow, in nsIURI aUri,
+  void confirm(in nsIDOMElement aBrowser, in nsIURI aUri,
                [array, size_is(aCount)] in nsIVariant aInstalls,
                [optional] in uint32_t aCount);
 };
diff --git a/toolkit/mozapps/extensions/amIWebInstaller.idl b/toolkit/mozapps/extensions/amIWebInstaller.idl
index 37d525776f2..6c5ebca67c3 100644
--- a/toolkit/mozapps/extensions/amIWebInstaller.idl
+++ b/toolkit/mozapps/extensions/amIWebInstaller.idl
@@ -4,7 +4,7 @@
 
 #include "nsISupports.idl"
 
-interface nsIDOMWindow;
+interface nsIDOMElement;
 interface nsIVariant;
 interface nsIURI;
 
@@ -32,7 +32,7 @@ interface amIInstallCallback : nsISupports
 /**
  * This interface is used to allow webpages to start installing add-ons.
  */
-[scriptable, uuid(8565a9c7-daf9-4af5-aae0-b272afcbccaa)]
+[scriptable, uuid(658d6c09-15e0-4688-bee8-8551030472a9)]
 interface amIWebInstaller : nsISupports
 {
   /**
@@ -51,9 +51,8 @@ interface amIWebInstaller : nsISupports
    *
    * @param  aMimetype
    *         The mimetype for the add-ons
-   * @param  aOriginator
-   *         If not e10s, the window installing the add-ons, otherwise the
-   *         browser installing the add-ons.
+   * @param  aBrowser
+   *         The browser installing the add-ons.
    * @param  aReferer
    *         The URI for the webpage installing the add-ons
    * @param  aUris
@@ -72,7 +71,7 @@ interface amIWebInstaller : nsISupports
    * @return true if the installation was successfully started
    */
   boolean installAddonsFromWebpage(in AString aMimetype,
-                                   in nsISupports aOriginator,
+                                   in nsIDOMElement aBrowser,
                                    in nsIURI aReferer,
                                    [array, size_is(aInstallCount)] in wstring aUris,
                                    [array, size_is(aInstallCount)] in wstring aHashes,
diff --git a/toolkit/mozapps/extensions/amInstallTrigger.js b/toolkit/mozapps/extensions/amInstallTrigger.js
index d3110b74b71..5a3d6c7aab4 100644
--- a/toolkit/mozapps/extensions/amInstallTrigger.js
+++ b/toolkit/mozapps/extensions/amInstallTrigger.js
@@ -80,11 +80,7 @@ RemoteMediator.prototype = {
     installs.referer = referer;
     installs.callbackID = callbackID;
 
-    let objects = { window: null };
-    if (Services.appinfo.processType === Ci.nsIXULRuntime.PROCESS_TYPE_DEFAULT)
-      objects.window = window;
-
-    return messageManager.sendSyncMessage(MSG_INSTALL_ADDONS, installs, objects)[0];
+    return messageManager.sendSyncMessage(MSG_INSTALL_ADDONS, installs)[0];
   },
 
   _addCallback: function(callback, urls) {
diff --git a/toolkit/mozapps/extensions/amWebInstallListener.js b/toolkit/mozapps/extensions/amWebInstallListener.js
index cf3e9789221..45fed0582e7 100644
--- a/toolkit/mozapps/extensions/amWebInstallListener.js
+++ b/toolkit/mozapps/extensions/amWebInstallListener.js
@@ -20,6 +20,8 @@ Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/AddonManager.jsm");
 Cu.import("resource://gre/modules/Services.jsm");
 
+XPCOMUtils.defineLazyModuleGetter(this, "PromptUtils", "resource://gre/modules/SharedPromptUtils.jsm");
+
 const URI_XPINSTALL_DIALOG = "chrome://mozapps/content/xpinstall/xpinstallConfirm.xul";
 
 // Installation can begin from any of these states
@@ -37,9 +39,9 @@ const LOGGER_ID = "addons.weblistener";
 // (Requires AddonManager.jsm)
 let logger = Log.repository.getLogger(LOGGER_ID);
 
-function notifyObservers(aTopic, aOriginator, aUri, aInstalls) {
+function notifyObservers(aTopic, aBrowser, aUri, aInstalls) {
   let info = {
-    originator: aOriginator,
+    browser: aBrowser,
     originatingURI: aUri,
     installs: aInstalls,
 
@@ -52,20 +54,20 @@ function notifyObservers(aTopic, aOriginator, aUri, aInstalls) {
  * Creates a new installer to monitor downloads and prompt to install when
  * ready
  *
- * @param  aOriginator
- *         The window or browser that started the installations
+ * @param  aBrowser
+ *         The browser that started the installations
  * @param  aUrl
  *         The URL that started the installations
  * @param  aInstalls
  *         An array of AddonInstalls
  */
-function Installer(aOriginator, aUrl, aInstalls) {
-  this.originator = aOriginator;
+function Installer(aBrowser, aUrl, aInstalls) {
+  this.browser = aBrowser;
   this.url = aUrl;
   this.downloads = aInstalls;
   this.installed = [];
 
-  notifyObservers("addon-install-started", aOriginator, aUrl, aInstalls);
+  notifyObservers("addon-install-started", aBrowser, aUrl, aInstalls);
 
   aInstalls.forEach(function(aInstall) {
     aInstall.addListener(this);
@@ -79,7 +81,7 @@ function Installer(aOriginator, aUrl, aInstalls) {
 }
 
 Installer.prototype = {
-  originator: null,
+  browser: null,
   downloads: null,
   installed: null,
   isDownloading: true,
@@ -145,29 +147,20 @@ Installer.prototype = {
           aInstall.cancel();
         }
       }, this);
-      notifyObservers("addon-install-failed", this.originator, this.url, failed);
+      notifyObservers("addon-install-failed", this.browser, this.url, failed);
     }
 
     // If none of the downloads were successful then exit early
     if (this.downloads.length == 0)
       return;
 
-    let parentWindow = null;
-    try {
-      parentWindow = this.originator.QueryInterface(Ci.nsIDOMWindow);
-    } catch (e) {
-      // If we're remote, then originator will be a browser. In that case,
-      // we're showing our dialog on behalf of a content process and passing
-      // null is the best we can do for now.
-    }
-
     // Check for a custom installation prompt that may be provided by the
     // applicaton
     if ("@mozilla.org/addons/web-install-prompt;1" in Cc) {
       try {
         let prompt = Cc["@mozilla.org/addons/web-install-prompt;1"].
                      getService(Ci.amIWebInstallPrompt);
-        prompt.confirm(parentWindow, this.url, this.downloads, this.downloads.length);
+        prompt.confirm(this.browser, this.url, this.downloads, this.downloads.length);
         return;
       }
       catch (e) {}
@@ -183,16 +176,22 @@ Installer.prototype = {
             getService(Ci.nsITelemetry).
             getHistogramById("SECURITY_UI").
             add(Ci.nsISecurityUITelemetry.WARNING_CONFIRM_ADDON_INSTALL);
+      let parentWindow = null;
+      if (this.browser) {
+        parentWindow = this.browser.ownerDocument.defaultView;
+        PromptUtils.fireDialogEvent(parentWindow, "DOMWillOpenModalDialog", this.browser);
+      }
       Services.ww.openWindow(parentWindow, URI_XPINSTALL_DIALOG,
                              null, "chrome,modal,centerscreen", args);
     } catch (e) {
+      logger.warn("Exception showing install confirmation dialog", e);
       this.downloads.forEach(function(aInstall) {
         aInstall.removeListener(this);
         // Cancel the installs, as currently there is no way to make them fail
         // from here.
         aInstall.cancel();
       }, this);
-      notifyObservers("addon-install-cancelled", this.originator, this.url,
+      notifyObservers("addon-install-cancelled", this.browser, this.url,
                       this.downloads);
     }
   },
@@ -219,10 +218,10 @@ Installer.prototype = {
     this.downloads = null;
 
     if (failed.length > 0)
-      notifyObservers("addon-install-failed", this.originator, this.url, failed);
+      notifyObservers("addon-install-failed", this.browser, this.url, failed);
 
     if (this.installed.length > 0)
-      notifyObservers("addon-install-complete", this.originator, this.url, this.installed);
+      notifyObservers("addon-install-complete", this.browser, this.url, this.installed);
     this.installed = null;
   },
 
@@ -273,9 +272,9 @@ extWebInstallListener.prototype = {
   /**
    * @see amIWebInstallListener.idl
    */
-  onWebInstallDisabled: function extWebInstallListener_onWebInstallDisabled(aOriginator, aUri, aInstalls) {
+  onWebInstallDisabled: function extWebInstallListener_onWebInstallDisabled(aBrowser, aUri, aInstalls) {
     let info = {
-      originator: aOriginator,
+      browser: aBrowser,
       originatingURI: aUri,
       installs: aInstalls,
 
@@ -287,14 +286,14 @@ extWebInstallListener.prototype = {
   /**
    * @see amIWebInstallListener.idl
    */
-  onWebInstallBlocked: function extWebInstallListener_onWebInstallBlocked(aOriginator, aUri, aInstalls) {
+  onWebInstallBlocked: function extWebInstallListener_onWebInstallBlocked(aBrowser, aUri, aInstalls) {
     let info = {
-      originator: aOriginator,
+      browser: aBrowser,
       originatingURI: aUri,
       installs: aInstalls,
 
       install: function onWebInstallBlocked_install() {
-        new Installer(this.originator, this.originatingURI, this.installs);
+        new Installer(this.browser, this.originatingURI, this.installs);
       },
 
       QueryInterface: XPCOMUtils.generateQI([Ci.amIWebInstallInfo])
@@ -307,8 +306,8 @@ extWebInstallListener.prototype = {
   /**
    * @see amIWebInstallListener.idl
    */
-  onWebInstallRequested: function extWebInstallListener_onWebInstallRequested(aOriginator, aUri, aInstalls) {
-    new Installer(aOriginator, aUri, aInstalls);
+  onWebInstallRequested: function extWebInstallListener_onWebInstallRequested(aBrowser, aUri, aInstalls) {
+    new Installer(aBrowser, aUri, aInstalls);
 
     // We start the installs ourself
     return false;
diff --git a/toolkit/mozapps/extensions/content/extensions.js b/toolkit/mozapps/extensions/content/extensions.js
index 34b6a37cc65..625fc4fd8de 100644
--- a/toolkit/mozapps/extensions/content/extensions.js
+++ b/toolkit/mozapps/extensions/content/extensions.js
@@ -243,6 +243,12 @@ function getMainWindow() {
                .getInterface(Ci.nsIDOMWindow);
 }
 
+function getBrowserElement() {
+  return window.QueryInterface(Ci.nsIInterfaceRequestor)
+               .getInterface(Ci.nsIDocShell)
+               .chromeEventHandler;
+}
+
 /**
  * Obtain the DOMWindow that can open a preferences pane.
  *
@@ -1215,7 +1221,7 @@ var gViewController = {
             if (installs.length > 0) {
               // Display the normal install confirmation for the installs
               AddonManager.installAddonsFromWebpage("application/x-xpinstall",
-                                                    window, null, installs);
+                                                    getBrowserElement(), null, installs);
             }
             return;
           }
@@ -3613,7 +3619,7 @@ var gDragDrop = {
         if (installs.length > 0) {
           // Display the normal install confirmation for the installs
           AddonManager.installAddonsFromWebpage("application/x-xpinstall",
-                                                window, null, installs);
+                                                getBrowserElement(), null, installs);
         }
         return;
       }
diff --git a/toolkit/mozapps/extensions/internal/XPIProvider.jsm b/toolkit/mozapps/extensions/internal/XPIProvider.jsm
index b9de7bce951..7119778b4f0 100644
--- a/toolkit/mozapps/extensions/internal/XPIProvider.jsm
+++ b/toolkit/mozapps/extensions/internal/XPIProvider.jsm
@@ -3750,16 +3750,16 @@ this.XPIProvider = {
    *         Icon URLs for the install
    * @param  aVersion
    *         A version for the install
-   * @param  aLoadGroup
-   *         An nsILoadGroup to associate requests with
+   * @param  aBrowser
+   *         The browser performing the install
    * @param  aCallback
    *         A callback to pass the AddonInstall to
    */
   getInstallForURL: function XPI_getInstallForURL(aUrl, aHash, aName, aIcons,
-                                                  aVersion, aLoadGroup, aCallback) {
+                                                  aVersion, aBrowser, aCallback) {
     AddonInstall.createDownload(function getInstallForURL_createDownload(aInstall) {
       aCallback(aInstall.wrapper);
-    }, aUrl, aHash, aName, aIcons, aVersion, aLoadGroup);
+    }, aUrl, aHash, aName, aIcons, aVersion, aBrowser);
   },
 
   /**
@@ -4755,13 +4755,13 @@ function getHashStringForCrypto(aCrypto) {
  *         An optional nsIURI of release notes for the add-on
  * @param  aExistingAddon
  *         The add-on this install will update if known
- * @param  aLoadGroup
- *         The nsILoadGroup to associate any requests with
+ * @param  aBrowser
+ *         The browser performing the install
  * @throws if the url is the url of a local file and the hash does not match
  *         or the add-on does not contain an valid install manifest
  */
 function AddonInstall(aInstallLocation, aUrl, aHash, aReleaseNotesURI,
-                      aExistingAddon, aLoadGroup) {
+                      aExistingAddon, aBrowser) {
   this.wrapper = new AddonInstallWrapper(this);
   this.installLocation = aInstallLocation;
   this.sourceURI = aUrl;
@@ -4774,16 +4774,12 @@ function AddonInstall(aInstallLocation, aUrl, aHash, aReleaseNotesURI,
     };
   }
   this.hash = this.originalHash;
-  this.loadGroup = aLoadGroup;
+  this.browser = aBrowser;
   this.listeners = [];
   this.icons = {};
   this.existingAddon = aExistingAddon;
   this.error = 0;
-  if (aLoadGroup)
-    this.window = aLoadGroup.notificationCallbacks
-                            .getInterface(Ci.nsIDOMWindow);
-  else
-    this.window = null;
+  this.window = aBrowser ? aBrowser.contentWindow : null;
 
   // Giving each instance of AddonInstall a reference to the logger.
   this.logger = logger;
@@ -4796,7 +4792,7 @@ AddonInstall.prototype = {
   crypto: null,
   originalHash: null,
   hash: null,
-  loadGroup: null,
+  browser: null,
   badCertHandler: null,
   listeners: null,
   restartDownload: false,
@@ -5920,15 +5916,15 @@ AddonInstall.createInstall = function AI_createInstall(aCallback, aFile) {
  *         An icon URLs for the add-on
  * @param  aVersion
  *         A version for the add-on
- * @param  aLoadGroup
- *         An nsILoadGroup to associate the download with
+ * @param  aBrowser
+ *         The browser performing the install
  */
 AddonInstall.createDownload = function AI_createDownload(aCallback, aUri, aHash, aName, aIcons,
-                                       aVersion, aLoadGroup) {
+                                       aVersion, aBrowser) {
   let location = XPIProvider.installLocationsByName[KEY_APP_PROFILE];
   let url = NetUtil.newURI(aUri);
 
-  let install = new AddonInstall(location, url, aHash, null, null, aLoadGroup);
+  let install = new AddonInstall(location, url, aHash, null, null, aBrowser);
   if (url instanceof Ci.nsIFileURL)
     install.initLocalInstall(aCallback);
   else
diff --git a/toolkit/mozapps/extensions/test/browser/browser_bug567127.js b/toolkit/mozapps/extensions/test/browser/browser_bug567127.js
index 224616982ec..11e70421821 100644
--- a/toolkit/mozapps/extensions/test/browser/browser_bug567127.js
+++ b/toolkit/mozapps/extensions/test/browser/browser_bug567127.js
@@ -73,7 +73,10 @@ WindowOpenListener.prototype = {
 var gInstallNotificationObserver = {
   observe: function(aSubject, aTopic, aData) {
     var installInfo = aSubject.QueryInterface(Ci.amIWebInstallInfo);
-    isnot(installInfo.originator, null, "Notification should have non-null originator");
+    if (gTestInWindow)
+      is(installInfo.browser, null, "Notification should have a null browser");
+    else
+      isnot(installInfo.browser, null, "Notification should have non-null browser");
     gSawInstallNotification = true;
     Services.obs.removeObserver(this, "addon-install-started");
   }
diff --git a/toolkit/mozapps/extensions/test/browser/browser_dragdrop.js b/toolkit/mozapps/extensions/test/browser/browser_dragdrop.js
index c91ab27ea57..1df288323ef 100644
--- a/toolkit/mozapps/extensions/test/browser/browser_dragdrop.js
+++ b/toolkit/mozapps/extensions/test/browser/browser_dragdrop.js
@@ -79,7 +79,10 @@ var gSawInstallNotification = false;
 var gInstallNotificationObserver = {
   observe: function(aSubject, aTopic, aData) {
     var installInfo = aSubject.QueryInterface(Ci.amIWebInstallInfo);
-    isnot(installInfo.originator, null, "Notification should have non-null originator");
+    if (gTestInWindow)
+      is(installInfo.browser, null, "Notification should have a null browser");
+    else
+      isnot(installInfo.browser, null, "Notification should have non-null browser");
     gSawInstallNotification = true;
     Services.obs.removeObserver(this, "addon-install-started");
   }
diff --git a/toolkit/mozapps/extensions/test/xpinstall/browser.ini b/toolkit/mozapps/extensions/test/xpinstall/browser.ini
index b9f18e39df9..0ee3b329c8f 100644
--- a/toolkit/mozapps/extensions/test/xpinstall/browser.ini
+++ b/toolkit/mozapps/extensions/test/xpinstall/browser.ini
@@ -64,7 +64,6 @@ skip-if = true # Bug 1084646
 [browser_httphash4.js]
 [browser_httphash5.js]
 [browser_httphash6.js]
-skip-if = e10s # Bug 1084558
 [browser_installchrome.js]
 [browser_localfile.js]
 skip-if = e10s # Bug 1082764
@@ -86,6 +85,7 @@ skip-if = e10s # bug 1082764
 [browser_signed_url.js]
 skip-if = e10s # bug 1082764
 [browser_softwareupdate.js]
+[browser_switchtab.js]
 [browser_trigger_redirect.js]
 [browser_unsigned_trigger.js]
 [browser_unsigned_trigger_iframe.js]
diff --git a/toolkit/mozapps/extensions/test/xpinstall/browser_bug645699.js b/toolkit/mozapps/extensions/test/xpinstall/browser_bug645699.js
index ed396602fd3..a5c188c0387 100644
--- a/toolkit/mozapps/extensions/test/xpinstall/browser_bug645699.js
+++ b/toolkit/mozapps/extensions/test/xpinstall/browser_bug645699.js
@@ -16,11 +16,7 @@ function test() {
 }
 
 function allow_blocked(installInfo) {
-  // installInfo.originator is different depending on whether we are in e10s(!)
-  if (gMultiProcessBrowser)
-    is(installInfo.originator, gBrowser.selectedBrowser, "Install should have been triggered by the right browser");
-  else
-    is(installInfo.originator, gBrowser.contentWindow, "Install should have been triggered by the right window");
+  is(installInfo.browser, gBrowser.selectedBrowser, "Install should have been triggered by the right browser");
   is(installInfo.originatingURI.spec, gBrowser.currentURI.spec, "Install should have been triggered by the right uri");
   return false;
 }
diff --git a/toolkit/mozapps/extensions/test/xpinstall/browser_httphash6.js b/toolkit/mozapps/extensions/test/xpinstall/browser_httphash6.js
index 5516805da77..5244fefefc3 100644
--- a/toolkit/mozapps/extensions/test/xpinstall/browser_httphash6.js
+++ b/toolkit/mozapps/extensions/test/xpinstall/browser_httphash6.js
@@ -64,7 +64,7 @@ function finish_failed_download() {
 
   // Restart the install as a regular webpage install so the harness tracks it
   AddonManager.installAddonsFromWebpage("application/x-xpinstall",
-                                        gBrowser.contentWindow,
+                                        gBrowser.selectedBrowser,
                                         gBrowser.currentURI, [gInstall]);
 }
 
diff --git a/toolkit/mozapps/extensions/test/xpinstall/browser_switchtab.js b/toolkit/mozapps/extensions/test/xpinstall/browser_switchtab.js
new file mode 100644
index 00000000000..9672de9bd35
--- /dev/null
+++ b/toolkit/mozapps/extensions/test/xpinstall/browser_switchtab.js
@@ -0,0 +1,49 @@
+// ----------------------------------------------------------------------------
+// Tests installing an unsigned add-on through an InstallTrigger call in web
+// content.
+let expectedTab = null;
+
+function test() {
+  Harness.installConfirmCallback = confirm_install;
+  Harness.installEndedCallback = install_ended;
+  Harness.installsCompletedCallback = finish_test;
+  Harness.setup();
+
+  var pm = Services.perms;
+  pm.add(makeURI("http://example.com/"), "install", pm.ALLOW_ACTION);
+
+  var triggers = encodeURIComponent(JSON.stringify({
+    "Unsigned XPI": {
+      URL: TESTROOT + "unsigned.xpi",
+      IconURL: TESTROOT + "icon.png",
+      toString: function() { return this.URL; }
+    }
+  }));
+  expectedTab = gBrowser.addTab();
+  expectedTab.linkedBrowser.loadURI(TESTROOT + "installtrigger.html?" + triggers);
+}
+
+function confirm_install(window) {
+  var items = window.document.getElementById("itemList").childNodes;
+  is(items.length, 1, "Should only be 1 item listed in the confirmation dialog");
+  is(items[0].name, "XPI Test", "Should have seen the name");
+  is(items[0].url, TESTROOT + "unsigned.xpi", "Should have listed the correct url for the item");
+  is(items[0].icon, TESTROOT + "icon.png", "Should have listed the correct icon for the item");
+  is(items[0].signed, "false", "Should have listed the item as unsigned");
+
+  is(gBrowser.selectedTab, expectedTab, "Should have switched to the installing tab.");
+  return true;
+}
+
+function install_ended(install, addon) {
+  install.cancel();
+}
+
+function finish_test(count) {
+  is(count, 1, "1 Add-on should have been successfully installed");
+
+  Services.perms.remove("example.com", "install");
+
+  gBrowser.removeTab(expectedTab);
+  Harness.finish();
+}
diff --git a/toolkit/mozapps/extensions/test/xpinstall/browser_whitelist.js b/toolkit/mozapps/extensions/test/xpinstall/browser_whitelist.js
index 31e44b95dff..448ce3a5cea 100644
--- a/toolkit/mozapps/extensions/test/xpinstall/browser_whitelist.js
+++ b/toolkit/mozapps/extensions/test/xpinstall/browser_whitelist.js
@@ -17,11 +17,7 @@ function test() {
 }
 
 function allow_blocked(installInfo) {
-  // installInfo.originator is different depending on whether we are in e10s(!)
-  if (gMultiProcessBrowser)
-    is(installInfo.originator, gBrowser.selectedBrowser, "Install should have been triggered by the right browser");
-  else
-    is(installInfo.originator, gBrowser.contentWindow, "Install should have been triggered by the right window");
+  is(installInfo.browser, gBrowser.selectedBrowser, "Install should have been triggered by the right browser");
   is(installInfo.originatingURI.spec, gBrowser.currentURI.spec, "Install should have been triggered by the right uri");
   return true;
 }
diff --git a/toolkit/mozapps/extensions/test/xpinstall/browser_whitelist2.js b/toolkit/mozapps/extensions/test/xpinstall/browser_whitelist2.js
index 9d60ddc6666..168a31ef3e9 100644
--- a/toolkit/mozapps/extensions/test/xpinstall/browser_whitelist2.js
+++ b/toolkit/mozapps/extensions/test/xpinstall/browser_whitelist2.js
@@ -18,11 +18,7 @@ function test() {
 }
 
 function allow_blocked(installInfo) {
-  // installInfo.originator is different depending on whether we are in e10s(!)
-  if (gMultiProcessBrowser)
-    is(installInfo.originator, gBrowser.selectedBrowser, "Install should have been triggered by the right browser");
-  else
-    is(installInfo.originator, gBrowser.contentWindow, "Install should have been triggered by the right window");
+  is(installInfo.browser, gBrowser.selectedBrowser, "Install should have been triggered by the right browser");
   is(installInfo.originatingURI.spec, gBrowser.currentURI.spec, "Install should have been triggered by the right uri");
   return false;
 }
diff --git a/toolkit/mozapps/extensions/test/xpinstall/browser_whitelist4.js b/toolkit/mozapps/extensions/test/xpinstall/browser_whitelist4.js
index e94d6b5c783..59d51350bba 100644
--- a/toolkit/mozapps/extensions/test/xpinstall/browser_whitelist4.js
+++ b/toolkit/mozapps/extensions/test/xpinstall/browser_whitelist4.js
@@ -17,11 +17,7 @@ function test() {
 }
 
 function allow_blocked(installInfo) {
-  // installInfo.originator is different depending on whether we are in e10s(!)
-  if (gMultiProcessBrowser)
-    is(installInfo.originator, gBrowser.selectedBrowser, "Install should have been triggered by the right browser");
-  else
-    is(installInfo.originator, gBrowser.contentWindow, "Install should have been triggered by the right window");
+  is(installInfo.browser, gBrowser.selectedBrowser, "Install should have been triggered by the right browser");
   is(installInfo.originatingURI.spec, TESTROOT2 + "test.html", "Install should have been triggered by the right uri");
   return false;
 }
diff --git a/toolkit/mozapps/extensions/test/xpinstall/browser_whitelist5.js b/toolkit/mozapps/extensions/test/xpinstall/browser_whitelist5.js
index 5267fc1caa0..97448d803a2 100644
--- a/toolkit/mozapps/extensions/test/xpinstall/browser_whitelist5.js
+++ b/toolkit/mozapps/extensions/test/xpinstall/browser_whitelist5.js
@@ -12,11 +12,7 @@ function test() {
 }
 
 function allow_blocked(installInfo) {
-  // installInfo.originator is different depending on whether we are in e10s(!)
-  if (gMultiProcessBrowser)
-    is(installInfo.originator, gBrowser.selectedBrowser, "Install should have been triggered by the right browser");
-  else
-    is(installInfo.originator, gBrowser.contentWindow, "Install should have been triggered by the right window");
+  is(installInfo.browser, gBrowser.selectedBrowser, "Install should have been triggered by the right browser");
   is(installInfo.originatingURI.spec, gBrowser.currentURI.spec, "Install should have been triggered by the right uri");
   return false;
 }
diff --git a/toolkit/mozapps/extensions/test/xpinstall/browser_whitelist6.js b/toolkit/mozapps/extensions/test/xpinstall/browser_whitelist6.js
index 79d1f5c0bdf..f2f3641e4e0 100644
--- a/toolkit/mozapps/extensions/test/xpinstall/browser_whitelist6.js
+++ b/toolkit/mozapps/extensions/test/xpinstall/browser_whitelist6.js
@@ -12,11 +12,7 @@ function test() {
 }
 
 function allow_blocked(installInfo) {
-  // installInfo.originator is different depending on whether we are in e10s(!)
-  if (gMultiProcessBrowser)
-    is(installInfo.originator, gBrowser.selectedBrowser, "Install should have been triggered by the right browser");
-  else
-    is(installInfo.originator, gBrowser.contentWindow, "Install should have been triggered by the right window");
+  is(installInfo.browser, gBrowser.selectedBrowser, "Install should have been triggered by the right browser");
   is(installInfo.originatingURI.spec, gBrowser.currentURI.spec, "Install should have been triggered by the right uri");
   return false;
 }

From cf6162c4158b85cf654eb2ccf5f39a0c77096f2f Mon Sep 17 00:00:00 2001
From: Mike Conley <mconley@mozilla.com>
Date: Tue, 4 Nov 2014 11:16:47 -0500
Subject: [PATCH 114/153] Bug 1085622 - Fix E10S_TESTING_ONLY define so that it
 only ever applies when E10S_TESTING_ONLY config is true. r=ally,glandium.

We were defining the E10S_TESTING_ONLY build-time define with the value of the E10S_TESTING_ONLY config variable,
regardless of the value of E10S_TESTING_ONLY. Even if E10S_TESTING_ONLY in configure was blank, we'd still define
E10S_TESTING_ONLY, which resulted in E10S_TESTING_ONLY ifdef'd code to be included when we didn't want it to.

We now only ever define E10S_TESTING_ONLY iff NIGHTLY_BUILD is defined, and we do it globally.

This also fixes a busted E10S_TESTING_ONLY ifdef that didn't have an endif.

--HG--
extra : amend_source : 9c8fe8db110765272fa666a5c118d388f87c23d7
---
 browser/base/content/browser.js                     | 7 ++-----
 browser/base/content/tabbrowser.xml                 | 1 +
 browser/base/moz.build                              | 2 +-
 browser/components/customizableui/moz.build         | 2 --
 browser/components/moz.build                        | 2 --
 browser/components/preferences/in-content/moz.build | 2 +-
 browser/themes/linux/moz.build                      | 2 --
 browser/themes/osx/moz.build                        | 2 --
 browser/themes/windows/moz.build                    | 2 --
 configure.in                                        | 3 ++-
 10 files changed, 7 insertions(+), 18 deletions(-)

diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index 172b9f9aaa8..2a3e68a835f 100644
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -1194,7 +1194,9 @@ var gBrowserInit = {
     BrowserOffline.init();
     OfflineApps.init();
     IndexedDBPromptHelper.init();
+#ifdef E10S_TESTING_ONLY
     gRemoteTabsUI.init();
+#endif
 
     // Initialize the full zoom setting.
     // We do this before the session restore service gets initialized so we can
@@ -7315,14 +7317,9 @@ let gRemoteTabsUI = {
 
     let newRemoteWindow = document.getElementById("menu_newRemoteWindow");
     let newNonRemoteWindow = document.getElementById("menu_newNonRemoteWindow");
-#ifdef E10S_TESTING_ONLY
     let autostart = Services.appinfo.browserTabsRemoteAutostart;
     newRemoteWindow.hidden = autostart;
     newNonRemoteWindow.hidden = !autostart;
-#else
-    newRemoteWindow.hidden = true;
-    newNonRemoteWindow.hidden = true;
-#endif
   }
 };
 
diff --git a/browser/base/content/tabbrowser.xml b/browser/base/content/tabbrowser.xml
index 1aa171bba64..fce2ed6b3e2 100644
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@@ -2594,6 +2594,7 @@
           ]]>
         </body>
       </method>
+#endif
 
       <method name="moveTabTo">
         <parameter name="aTab"/>
diff --git a/browser/base/moz.build b/browser/base/moz.build
index b1aa9251b37..6eb11029015 100644
--- a/browser/base/moz.build
+++ b/browser/base/moz.build
@@ -24,7 +24,7 @@ BROWSER_CHROME_MANIFESTS += [
 ]
 
 DEFINES['MOZ_APP_VERSION'] = CONFIG['MOZ_APP_VERSION']
-DEFINES['E10S_TESTING_ONLY'] = CONFIG['E10S_TESTING_ONLY']
+
 DEFINES['APP_LICENSE_BLOCK'] = '%s/content/overrides/app-license.html' % SRCDIR
 
 if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('windows', 'gtk2', 'gtk3', 'cocoa'):
diff --git a/browser/components/customizableui/moz.build b/browser/components/customizableui/moz.build
index 8d490b611a8..e2191997f35 100644
--- a/browser/components/customizableui/moz.build
+++ b/browser/components/customizableui/moz.build
@@ -15,8 +15,6 @@ EXTRA_JS_MODULES += [
     'ScrollbarSampler.jsm',
 ]
 
-DEFINES['E10S_TESTING_ONLY'] = CONFIG['E10S_TESTING_ONLY']
-
 if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('windows', 'cocoa'):
     DEFINES['CAN_DRAW_IN_TITLEBAR'] = 1
 
diff --git a/browser/components/moz.build b/browser/components/moz.build
index f0eb890d82c..8eb43057001 100644
--- a/browser/components/moz.build
+++ b/browser/components/moz.build
@@ -43,8 +43,6 @@ EXTRA_JS_MODULES += [
     'distribution.js',
 ]
 
-DEFINES['E10S_TESTING_ONLY'] = CONFIG['E10S_TESTING_ONLY']
-
 BROWSER_CHROME_MANIFESTS += [
     'test/browser.ini'
 ]
diff --git a/browser/components/preferences/in-content/moz.build b/browser/components/preferences/in-content/moz.build
index 5a6a1a9f2aa..46a2a0b171d 100644
--- a/browser/components/preferences/in-content/moz.build
+++ b/browser/components/preferences/in-content/moz.build
@@ -4,7 +4,7 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-for var in ('MOZ_APP_NAME', 'MOZ_MACBUNDLE_NAME', 'E10S_TESTING_ONLY'):
+for var in ('MOZ_APP_NAME', 'MOZ_MACBUNDLE_NAME'):
     DEFINES[var] = CONFIG[var]
 
 if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('windows', 'gtk2', 'cocoa'):
diff --git a/browser/themes/linux/moz.build b/browser/themes/linux/moz.build
index 492ddbe2bb9..94be7e3a86e 100644
--- a/browser/themes/linux/moz.build
+++ b/browser/themes/linux/moz.build
@@ -6,6 +6,4 @@
 
 DIRS += ['communicator']
 
-DEFINES['E10S_TESTING_ONLY'] = CONFIG['E10S_TESTING_ONLY']
-
 JAR_MANIFESTS += ['jar.mn']
diff --git a/browser/themes/osx/moz.build b/browser/themes/osx/moz.build
index 492ddbe2bb9..94be7e3a86e 100644
--- a/browser/themes/osx/moz.build
+++ b/browser/themes/osx/moz.build
@@ -6,6 +6,4 @@
 
 DIRS += ['communicator']
 
-DEFINES['E10S_TESTING_ONLY'] = CONFIG['E10S_TESTING_ONLY']
-
 JAR_MANIFESTS += ['jar.mn']
diff --git a/browser/themes/windows/moz.build b/browser/themes/windows/moz.build
index 492ddbe2bb9..94be7e3a86e 100644
--- a/browser/themes/windows/moz.build
+++ b/browser/themes/windows/moz.build
@@ -6,6 +6,4 @@
 
 DIRS += ['communicator']
 
-DEFINES['E10S_TESTING_ONLY'] = CONFIG['E10S_TESTING_ONLY']
-
 JAR_MANIFESTS += ['jar.mn']
diff --git a/configure.in b/configure.in
index 9d8edbb9f84..ceb4cdabdb0 100644
--- a/configure.in
+++ b/configure.in
@@ -3569,8 +3569,9 @@ dnl ========================================================
 dnl Multiprocess Firefox Nightly Testing UI
 dnl To be removed in Bug 1003313
 dnl ========================================================
-if test -z "$NIGHTLY_BUILD"; then
+if test -n "$NIGHTLY_BUILD"; then
     E10S_TESTING_ONLY=1
+    AC_DEFINE(E10S_TESTING_ONLY)
 fi
 
 AC_SUBST(E10S_TESTING_ONLY)

From db7c043be6ae40003aa4396621411e831f8fe470 Mon Sep 17 00:00:00 2001
From: Nick Alexander <nalexander@mozilla.com>
Date: Tue, 4 Nov 2014 20:03:15 -0800
Subject: [PATCH 115/153] Bug 1084088 - Use regular home tab background color
 in Synced Tabs client. r=antlam

---
 mobile/android/base/resources/values/styles.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mobile/android/base/resources/values/styles.xml b/mobile/android/base/resources/values/styles.xml
index 471a611db76..25359454b24 100644
--- a/mobile/android/base/resources/values/styles.xml
+++ b/mobile/android/base/resources/values/styles.xml
@@ -611,7 +611,7 @@
     <style name="Widget.RemoteTabsItemView" parent="Widget.TwoLinePageRow"/>
 
     <style name="Widget.RemoteTabsClientView" parent="Widget.TwoLinePageRow">
-        <item name="android:background">#fff5f7f9</item>
+        <item name="android:background">@color/background_light</item>
     </style>
 
     <style name="Widget.RemoteTabsListView" parent="Widget.HomeListView">

From 38219c73762da48fdbeb5f38be08e2c4889fc997 Mon Sep 17 00:00:00 2001
From: Dave Townsend <dtownsend@oxymoronical.com>
Date: Tue, 4 Nov 2014 20:16:47 -0800
Subject: [PATCH 116/153] Bug 1094017: Component registrar shim doesn't support
 null contract IDs. r=Unfocused

---
 toolkit/components/addoncompat/RemoteAddonsParent.jsm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/toolkit/components/addoncompat/RemoteAddonsParent.jsm b/toolkit/components/addoncompat/RemoteAddonsParent.jsm
index 7b14a0e2bf0..629525229f6 100644
--- a/toolkit/components/addoncompat/RemoteAddonsParent.jsm
+++ b/toolkit/components/addoncompat/RemoteAddonsParent.jsm
@@ -257,7 +257,7 @@ let ComponentRegistrarInterposition = new Interposition("ComponentRegistrarInter
 
 ComponentRegistrarInterposition.methods.registerFactory =
   function(addon, target, class_, className, contractID, factory) {
-    if (contractID.startsWith("@mozilla.org/network/protocol/about;1?")) {
+    if (contractID && contractID.startsWith("@mozilla.org/network/protocol/about;1?")) {
       AboutProtocolParent.registerFactory(class_, className, contractID, factory);
     }
 

From 8aaf2a007ec36902f603faba3e0695742b8bf1ba Mon Sep 17 00:00:00 2001
From: Dave Townsend <dtownsend@oxymoronical.com>
Date: Tue, 4 Nov 2014 23:28:55 -0800
Subject: [PATCH 117/153] Bug 1082764: Use the correct referrer when the
 content handler catches an XPI install in e10s. r=Unfocused

---
 toolkit/mozapps/extensions/addonManager.js    |  3 +-
 .../mozapps/extensions/amContentHandler.js    | 52 ++++++++-----------
 .../extensions/test/xpinstall/browser.ini     |  7 ---
 3 files changed, 25 insertions(+), 37 deletions(-)

diff --git a/toolkit/mozapps/extensions/addonManager.js b/toolkit/mozapps/extensions/addonManager.js
index 3a3da98260b..9ae80f2a47e 100644
--- a/toolkit/mozapps/extensions/addonManager.js
+++ b/toolkit/mozapps/extensions/addonManager.js
@@ -152,7 +152,8 @@ amManager.prototype = {
    */
   receiveMessage: function AMC_receiveMessage(aMessage) {
     let payload = aMessage.data;
-    let referer = Services.io.newURI(payload.referer, null, null);
+    let referer = payload.referer ? Services.io.newURI(payload.referer, null, null)
+                                  : null;
 
     switch (aMessage.name) {
       case MSG_INSTALL_ENABLED:
diff --git a/toolkit/mozapps/extensions/amContentHandler.js b/toolkit/mozapps/extensions/amContentHandler.js
index 74f682ca54d..8c880d4ea01 100644
--- a/toolkit/mozapps/extensions/amContentHandler.js
+++ b/toolkit/mozapps/extensions/amContentHandler.js
@@ -9,6 +9,7 @@ const Ci = Components.interfaces;
 const Cr = Components.results;
 
 const XPI_CONTENT_TYPE = "application/x-xpinstall";
+const MSG_INSTALL_ADDONS = "WebInstallerInstallAddonsFromWebpage";
 
 Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
 
@@ -42,38 +43,31 @@ amContentHandler.prototype = {
     if (callbacks)
       window = callbacks.getInterface(Ci.nsIDOMWindow);
 
+    let referer = null;
+    if (aRequest instanceof Ci.nsIPropertyBag2) {
+      referer = aRequest.getPropertyAsInterface("docshell.internalReferrer",
+                                                Ci.nsIURI);
+    }
+
+    if (!referer && aRequest instanceof Ci.nsIHttpChannel)
+      referer = aRequest.referrer;
+
     aRequest.cancel(Cr.NS_BINDING_ABORTED);
 
-    let appinfo = Cc["@mozilla.org/xre/app-info;1"].
-                  getService(Ci.nsIXULRuntime);
-    if (appinfo.processType == Ci.nsIXULRuntime.PROCESS_TYPE_CONTENT) {
-      try {
-        if (!window.InstallTrigger) 
-          window = window.wrappedJSObject;
-  
-        if (window.InstallTrigger)
-          window.InstallTrigger.startSoftwareUpdate(uri.spec);
-        else
-          this.log("Window does not have an InstallTrigger");
-      } catch(ex) {
-        this.log(ex);
-      }
-    }
-    else {
-      let referer = null;
-      if (aRequest instanceof Ci.nsIPropertyBag2) {
-        referer = aRequest.getPropertyAsInterface("docshell.internalReferrer",
-                                                Ci.nsIURI);
-      }
+    let messageManager = window.QueryInterface(Ci.nsIInterfaceRequestor)
+                               .getInterface(Ci.nsIDocShell)
+                               .QueryInterface(Ci.nsIInterfaceRequestor)
+                               .getInterface(Ci.nsIContentFrameMessageManager);
 
-      let browser = window.QueryInterface(Ci.nsIInterfaceRequestor)
-                          .getInterface(Ci.nsIDocShell)
-                          .chromeEventHandler;
-      let manager = Cc["@mozilla.org/addons/integration;1"].
-                    getService(Ci.amIWebInstaller);
-      manager.installAddonsFromWebpage(aMimetype, browser, referer, [uri.spec],
-                                       [null], [null], [null], null, 1);
-    }
+    messageManager.sendAsyncMessage(MSG_INSTALL_ADDONS, {
+      uris: [uri.spec],
+      hashes: [null],
+      names: [null],
+      icons: [null],
+      mimetype: XPI_CONTENT_TYPE,
+      referer: referer ? referer.spec : null,
+      callbackID: -1
+    });
   },
 
   classID: Components.ID("{7beb3ba8-6ec3-41b4-b67c-da89b8518922}"),
diff --git a/toolkit/mozapps/extensions/test/xpinstall/browser.ini b/toolkit/mozapps/extensions/test/xpinstall/browser.ini
index 0ee3b329c8f..246b861ff16 100644
--- a/toolkit/mozapps/extensions/test/xpinstall/browser.ini
+++ b/toolkit/mozapps/extensions/test/xpinstall/browser.ini
@@ -66,13 +66,10 @@ skip-if = true # Bug 1084646
 [browser_httphash6.js]
 [browser_installchrome.js]
 [browser_localfile.js]
-skip-if = e10s # Bug 1082764
 [browser_localfile2.js]
 [browser_localfile3.js]
-skip-if = e10s # Bug 1082764
 [browser_localfile4.js]
 [browser_multipackage.js]
-skip-if = e10s # bug 1082764
 [browser_navigateaway.js]
 [browser_navigateaway2.js]
 [browser_offline.js]
@@ -83,7 +80,6 @@ skip-if = e10s # bug 1082764
 [browser_signed_trigger.js]
 [browser_signed_untrusted.js]
 [browser_signed_url.js]
-skip-if = e10s # bug 1082764
 [browser_softwareupdate.js]
 [browser_switchtab.js]
 [browser_trigger_redirect.js]
@@ -91,13 +87,10 @@ skip-if = e10s # bug 1082764
 [browser_unsigned_trigger_iframe.js]
 skip-if = buildapp == "mulet"
 [browser_unsigned_url.js]
-skip-if = e10s # bug 1082764
 [browser_whitelist.js]
 [browser_whitelist2.js]
 [browser_whitelist3.js]
-skip-if = e10s # bug 1082764
 [browser_whitelist4.js]
-skip-if = e10s # bug 1082764
 [browser_whitelist5.js]
 [browser_whitelist6.js]
 [browser_whitelist7.js]

From dc90f4ac449a219b9206bdde24855a45bbc173e6 Mon Sep 17 00:00:00 2001
From: Dave Townsend <dtownsend@oxymoronical.com>
Date: Tue, 4 Nov 2014 23:29:15 -0800
Subject: [PATCH 118/153] Bug 1082871: Pass the login manager the browser
 performing the install. r=unfocused

---
 toolkit/mozapps/extensions/internal/XPIProvider.jsm | 13 +++++++++++--
 .../mozapps/extensions/test/xpinstall/browser.ini   |  1 -
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/toolkit/mozapps/extensions/internal/XPIProvider.jsm b/toolkit/mozapps/extensions/internal/XPIProvider.jsm
index 7119778b4f0..83711f9e0f9 100644
--- a/toolkit/mozapps/extensions/internal/XPIProvider.jsm
+++ b/toolkit/mozapps/extensions/internal/XPIProvider.jsm
@@ -5850,9 +5850,18 @@ AddonInstall.prototype = {
 
   getInterface: function AI_getInterface(iid) {
     if (iid.equals(Ci.nsIAuthPrompt2)) {
-      var factory = Cc["@mozilla.org/prompter;1"].
+      let win = this.window;
+      if (!win && this.browser)
+        win = this.browser.ownerDocument.defaultView;
+
+      let factory = Cc["@mozilla.org/prompter;1"].
                     getService(Ci.nsIPromptFactory);
-      return factory.getPrompt(this.window, Ci.nsIAuthPrompt);
+      let prompt = factory.getPrompt(win, Ci.nsIAuthPrompt2);
+
+      if (this.browser && this.browser.isRemoteBrowser && prompt instanceof Ci.nsILoginManagerPrompter)
+        prompt.setE10sData(this.browser, null);
+
+      return prompt;
     }
     else if (iid.equals(Ci.nsIChannelEventSink)) {
       return this;
diff --git a/toolkit/mozapps/extensions/test/xpinstall/browser.ini b/toolkit/mozapps/extensions/test/xpinstall/browser.ini
index 246b861ff16..8bb08e4a180 100644
--- a/toolkit/mozapps/extensions/test/xpinstall/browser.ini
+++ b/toolkit/mozapps/extensions/test/xpinstall/browser.ini
@@ -33,7 +33,6 @@ support-files =
 [browser_auth2.js]
 [browser_auth3.js]
 [browser_auth4.js]
-skip-if = e10s # Bug 1082871
 [browser_badargs.js]
 [browser_badargs2.js]
 [browser_badhash.js]

From 769d64f5412d50c20ff89734661248372a19ca58 Mon Sep 17 00:00:00 2001
From: Irakli Gozalishvili <rFobic@gmail.com>
Date: Tue, 4 Nov 2014 23:31:29 -0800
Subject: [PATCH 119/153] Bug 1094068: Creating sandbox with expanded
 principals causes an exception. r=Mossop

---
 toolkit/components/addoncompat/RemoteAddonsParent.jsm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/toolkit/components/addoncompat/RemoteAddonsParent.jsm b/toolkit/components/addoncompat/RemoteAddonsParent.jsm
index 629525229f6..701ce5f9a6a 100644
--- a/toolkit/components/addoncompat/RemoteAddonsParent.jsm
+++ b/toolkit/components/addoncompat/RemoteAddonsParent.jsm
@@ -651,7 +651,7 @@ ComponentsUtilsInterposition.methods.Sandbox =
                typeof(principals) == "object" &&
                "every" in principals &&
                principals.length &&
-               principals.every(e => Cu.isCrossProcessWrapper(e) && e instanceof Ci.nsIDOMWindow)) {
+               principals.every(e instanceof Ci.nsIDOMWindow && e => Cu.isCrossProcessWrapper(e))) {
       let chromeGlobal = chromeGlobalForContentWindow(principals[0]);
 
       // The principals we pass to the content process must use an

From ce307c1a60c6c425a1ef88e6012d3ce9f92ea506 Mon Sep 17 00:00:00 2001
From: Dave Townsend <dtownsend@oxymoronical.com>
Date: Wed, 5 Nov 2014 00:02:13 -0800
Subject: [PATCH 120/153] Bug 1094068: Typo bustage fix.

---
 toolkit/components/addoncompat/RemoteAddonsParent.jsm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/toolkit/components/addoncompat/RemoteAddonsParent.jsm b/toolkit/components/addoncompat/RemoteAddonsParent.jsm
index 701ce5f9a6a..861833061d2 100644
--- a/toolkit/components/addoncompat/RemoteAddonsParent.jsm
+++ b/toolkit/components/addoncompat/RemoteAddonsParent.jsm
@@ -651,7 +651,7 @@ ComponentsUtilsInterposition.methods.Sandbox =
                typeof(principals) == "object" &&
                "every" in principals &&
                principals.length &&
-               principals.every(e instanceof Ci.nsIDOMWindow && e => Cu.isCrossProcessWrapper(e))) {
+               principals.every(e => e instanceof Ci.nsIDOMWindow && Cu.isCrossProcessWrapper(e))) {
       let chromeGlobal = chromeGlobalForContentWindow(principals[0]);
 
       // The principals we pass to the content process must use an

From e3f7986ae45fb2078be9e7d9ff16738c9572c5e0 Mon Sep 17 00:00:00 2001
From: Mahdi Dibaiee <mdibaiee@aol.com>
Date: Tue, 4 Nov 2014 08:36:00 +0100
Subject: [PATCH 121/153] Bug 684096 - "The webconsole should display column
 numbers in addition to line numbers". r=past

---
 browser/devtools/webconsole/console-output.js | 11 ++-
 browser/devtools/webconsole/test/browser.ini  |  2 +
 .../test/browser_webconsole_column_numbers.js | 48 ++++++++++++
 .../webconsole/test/test-console-column.html  | 17 ++++
 .../test/test-repeated-messages.html          |  5 +-
 browser/devtools/webconsole/webconsole.js     | 78 +++++++++++--------
 6 files changed, 124 insertions(+), 37 deletions(-)
 create mode 100644 browser/devtools/webconsole/test/browser_webconsole_column_numbers.js
 create mode 100644 browser/devtools/webconsole/test/test-console-column.html

diff --git a/browser/devtools/webconsole/console-output.js b/browser/devtools/webconsole/console-output.js
index 636da69fe06..e8722c9ca74 100644
--- a/browser/devtools/webconsole/console-output.js
+++ b/browser/devtools/webconsole/console-output.js
@@ -943,14 +943,16 @@ Messages.Simple.prototype = Heritage.extend(Messages.BaseMessage.prototype,
       return null;
     }
 
-    let {url, line} = this.location;
+    let {url, line, column} = this.location;
     if (IGNORED_SOURCE_URLS.indexOf(url) != -1) {
       return null;
     }
 
     // The ConsoleOutput owner is a WebConsoleFrame instance from webconsole.js.
     // TODO: move createLocationNode() into this file when bug 778766 is fixed.
-    return this.output.owner.createLocationNode(url, line);
+    return this.output.owner.createLocationNode({url: url,
+                                                 line: line,
+                                                 column: column});
   },
 }); // Messages.Simple.prototype
 
@@ -1250,6 +1252,7 @@ Messages.ConsoleGeneric = function(packet)
     location: {
       url: packet.filename,
       line: packet.lineNumber,
+      column: packet.columnNumber
     },
   };
 
@@ -3446,8 +3449,8 @@ Widgets.Stacktrace.prototype = Heritage.extend(Widgets.BaseWidget.prototype,
       fn.textContent = l10n.getStr("stacktrace.anonymousFunction");
     }
 
-    let location = this.output.owner.createLocationNode(frame.filename,
-                                                        frame.lineNumber,
+    let location = this.output.owner.createLocationNode({url: frame.filename,
+                                                        line: frame.lineNumber},
                                                         "jsdebugger");
 
     // .devtools-monospace sets font-size to 80%, however .body already has
diff --git a/browser/devtools/webconsole/test/browser.ini b/browser/devtools/webconsole/test/browser.ini
index 74ae6af532c..765aa1d931e 100644
--- a/browser/devtools/webconsole/test/browser.ini
+++ b/browser/devtools/webconsole/test/browser.ini
@@ -82,6 +82,7 @@ support-files =
   test-console-output-04.html
   test-console-output-dom-elements.html
   test-console-output-events.html
+  test-console-column.html
   test-consoleiframes.html
   test-data.json
   test-data.json^headers^
@@ -324,3 +325,4 @@ skip-if = buildapp == 'mulet'
 [browser_webconsole_autocomplete_crossdomain_iframe.js]
 [browser_webconsole_console_custom_styles.js]
 [browser_webconsole_console_api_stackframe.js]
+[browser_webconsole_column_numbers.js]
diff --git a/browser/devtools/webconsole/test/browser_webconsole_column_numbers.js b/browser/devtools/webconsole/test/browser_webconsole_column_numbers.js
new file mode 100644
index 00000000000..2912950da93
--- /dev/null
+++ b/browser/devtools/webconsole/test/browser_webconsole_column_numbers.js
@@ -0,0 +1,48 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/
+ */
+
+ // Check if console provides the right column number alongside line number
+
+const TEST_URI = "http://example.com/browser/browser/devtools/webconsole/test/test-console-column.html";
+
+let hud;
+
+function test() {
+  addTab(TEST_URI);
+  browser.addEventListener("load", function onLoad() {
+    browser.removeEventListener("load", onLoad, true);
+    openConsole(null, consoleOpened);
+  }, true);
+}
+
+function consoleOpened(aHud) {
+  hud = aHud;
+
+  waitForMessages({
+    webconsole: hud,
+    messages: [{
+      text: 'Error Message',
+      category: CATEGORY_WEBDEV,
+      severity: SEVERITY_ERROR
+    }]
+  }).then(testLocationColumn);
+}
+
+function testLocationColumn() {
+  let messages = hud.outputNode.children;
+  let expected = ['6:6', '6:38', '7:8', '8:10', '9:8', '10:6'];
+
+  let valid = true;
+
+  for(let i = 0, len = messages.length; i < len; i++) {
+    let msg = messages[i].textContent;
+
+    is(!msg.contains(expected[i]), true, 'Found expected line:column of ' + expected[i])
+  }
+
+  is(valid, true, 'column numbers match expected results');
+
+  finishTest();
+}
\ No newline at end of file
diff --git a/browser/devtools/webconsole/test/test-console-column.html b/browser/devtools/webconsole/test/test-console-column.html
new file mode 100644
index 00000000000..ff9cc81e10e
--- /dev/null
+++ b/browser/devtools/webconsole/test/test-console-column.html
@@ -0,0 +1,17 @@
+<!DOCTYPE HTML>
+<html dir="ltr" xml:lang="en-US" lang="en-US">
+  <head>
+    <!-- Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/ -->
+    <meta charset="utf-8">
+    <title>Console test</title>
+
+    <script type="text/javascript">
+      console.info("INLINE SCRIPT:"); console.log('Further');
+        console.warn("I'm warning you, he will eat up all yr bacon.");
+          console.error("Error Message");
+        console.log('Rainbooooww');
+      console.log('NYAN CATZ');
+    </script>
+  </head>
+</html>
diff --git a/browser/devtools/webconsole/test/test-repeated-messages.html b/browser/devtools/webconsole/test/test-repeated-messages.html
index 5bbc8fd5abc..97f5482e469 100644
--- a/browser/devtools/webconsole/test/test-repeated-messages.html
+++ b/browser/devtools/webconsole/test/test-repeated-messages.html
@@ -5,7 +5,10 @@
     <title>Test for bugs 720180, 800510 and 865288</title>
     <script>
       function testConsole() {
-        console.log("foo repeat"); console.log("foo repeat");
+        // same line and column number
+        for(var i = 0; i < 2; i++) {
+          console.log("foo repeat");
+        }
         console.log("foo repeat"); console.error("foo repeat");
       }
       function testConsoleObjects() {
diff --git a/browser/devtools/webconsole/webconsole.js b/browser/devtools/webconsole/webconsole.js
index d8e0f584a72..baf94930af5 100644
--- a/browser/devtools/webconsole/webconsole.js
+++ b/browser/devtools/webconsole/webconsole.js
@@ -1359,9 +1359,19 @@ WebConsoleFrame.prototype = {
   {
     // Warnings and legacy strict errors become warnings; other types become
     // errors.
-    let severity = SEVERITY_ERROR;
+    let severity = 'error';
     if (aScriptError.warning || aScriptError.strict) {
-      severity = SEVERITY_WARNING;
+      severity = 'warning';
+    }
+
+    let category = 'js';
+    switch(aCategory) {
+      case CATEGORY_CSS:
+        category = 'css';
+        break;
+      case CATEGORY_SECURITY:
+        category = 'security';
+        break;
     }
 
     let objectActors = new Set();
@@ -1379,21 +1389,27 @@ WebConsoleFrame.prototype = {
       errorMessage = errorMessage.initial;
     }
 
-    let node = this.createMessageNode(aCategory, severity,
-                                      errorMessage,
-                                      aScriptError.sourceName,
-                                      aScriptError.lineNumber, null, null,
-                                      aScriptError.timeStamp);
+    // Create a new message
+    let msg = new Messages.Simple(errorMessage, {
+      location: {
+        url: aScriptError.sourceName,
+        line: aScriptError.lineNumber,
+        column: aScriptError.columnNumber
+      },
+      category: category,
+      severity: severity,
+      timestamp: aScriptError.timeStamp,
+      private: aScriptError.private,
+      filterDuplicates: true
+    });
+
+    let node = msg.init(this.output).render().element;
 
     // Select the body of the message node that is displayed in the console
     let msgBody = node.getElementsByClassName("message-body")[0];
     // Add the more info link node to messages that belong to certain categories
     this.addMoreInfoLink(msgBody, aScriptError);
 
-    if (aScriptError.private) {
-      node.setAttribute("private", true);
-    }
-
     if (objectActors.size > 0) {
       node._objectActors = objectActors;
     }
@@ -2561,7 +2577,8 @@ WebConsoleFrame.prototype = {
     // right side of the message, if applicable.
     let locationNode;
     if (aSourceURL && IGNORED_SOURCE_URLS.indexOf(aSourceURL) == -1) {
-      locationNode = this.createLocationNode(aSourceURL, aSourceLine);
+      locationNode = this.createLocationNode({url: aSourceURL,
+                                              line: aSourceLine});
     }
 
     node.appendChild(timestampNode);
@@ -2604,11 +2621,8 @@ WebConsoleFrame.prototype = {
    * Creates the anchor that displays the textual location of an incoming
    * message.
    *
-   * @param string aSourceURL
-   *        The URL of the source file responsible for the error.
-   * @param number aSourceLine [optional]
-   *        The line number on which the error occurred. If zero or omitted,
-   *        there is no line number associated with this message.
+   * @param object aLocation
+   *        An object containing url, line and column number of the message source (destructured).
    * @param string aTarget [optional]
    *        Tells which tool to open the link with, on click. Supported tools:
    *        jsdebugger, styleeditor, scratchpad.
@@ -2616,10 +2630,10 @@ WebConsoleFrame.prototype = {
    *         The new anchor element, ready to be added to the message node.
    */
   createLocationNode:
-  function WCF_createLocationNode(aSourceURL, aSourceLine, aTarget)
+  function WCF_createLocationNode({url, line, column}, aTarget)
   {
-    if (!aSourceURL) {
-      aSourceURL = "";
+    if (!url) {
+      url = "";
     }
     let locationNode = this.document.createElementNS(XHTML_NS, "a");
     let filenameNode = this.document.createElementNS(XHTML_NS, "span");
@@ -2630,13 +2644,13 @@ WebConsoleFrame.prototype = {
     let fullURL;
     let isScratchpad = false;
 
-    if (/^Scratchpad\/\d+$/.test(aSourceURL)) {
-      filename = aSourceURL;
-      fullURL = aSourceURL;
+    if (/^Scratchpad\/\d+$/.test(url)) {
+      filename = url;
+      fullURL = url;
       isScratchpad = true;
     }
     else {
-      fullURL = aSourceURL.split(" -> ").pop();
+      fullURL = url.split(" -> ").pop();
       filename = WebConsoleUtils.abbreviateSourceURL(fullURL);
     }
 
@@ -2649,27 +2663,27 @@ WebConsoleFrame.prototype = {
     if (aTarget) {
       locationNode.target = aTarget;
     }
-    locationNode.setAttribute("title", aSourceURL);
+    locationNode.setAttribute("title", url);
     locationNode.className = "message-location theme-link devtools-monospace";
 
     // Make the location clickable.
     let onClick = () => {
       let target = locationNode.target;
       if (target == "scratchpad" || isScratchpad) {
-        this.owner.viewSourceInScratchpad(aSourceURL);
+        this.owner.viewSourceInScratchpad(url);
         return;
       }
 
       let category = locationNode.parentNode.category;
       if (target == "styleeditor" || category == CATEGORY_CSS) {
-        this.owner.viewSourceInStyleEditor(fullURL, aSourceLine);
+        this.owner.viewSourceInStyleEditor(fullURL, line);
       }
       else if (target == "jsdebugger" ||
                category == CATEGORY_JS || category == CATEGORY_WEBDEV) {
-        this.owner.viewSourceInDebugger(fullURL, aSourceLine);
+        this.owner.viewSourceInDebugger(fullURL, line);
       }
       else {
-        this.owner.viewSource(fullURL, aSourceLine);
+        this.owner.viewSource(fullURL, line);
       }
     };
 
@@ -2677,12 +2691,12 @@ WebConsoleFrame.prototype = {
       this._addMessageLinkCallback(locationNode, onClick);
     }
 
-    if (aSourceLine) {
+    if (line) {
       let lineNumberNode = this.document.createElementNS(XHTML_NS, "span");
       lineNumberNode.className = "line-number";
-      lineNumberNode.textContent = ":" + aSourceLine;
+      lineNumberNode.textContent = ":" + line + (column >= 0 ? ":" + column : "");
       locationNode.appendChild(lineNumberNode);
-      locationNode.sourceLine = aSourceLine;
+      locationNode.sourceLine = line;
     }
 
     return locationNode;

From 2370e9d5d3b7f69ef6cd8536d08865cecaf1f395 Mon Sep 17 00:00:00 2001
From: Paul Rouget <paul@mozilla.com>
Date: Tue, 4 Nov 2014 08:54:00 +0100
Subject: [PATCH 122/153] Bug 1063206 - better toolbox button for webide.
 r=jryans

---
 browser/devtools/webide/themes/icons.png | Bin 29618 -> 25476 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)

diff --git a/browser/devtools/webide/themes/icons.png b/browser/devtools/webide/themes/icons.png
index d09c7b5deece58f3f7ad90135b6da8d07b8e267c..0babd45c326ffe44e3b9b132c149900ca5b416fd 100644
GIT binary patch
literal 25476
zcmY(q1ymeOur|E7J6YV_Jp^|P5Zso<A-H>RcZVe;K+pt&`{M5I?hq_Mkl^xd-h2Q5
zoXgoWbk|frRn^tq(^EAaqy9kw3!M}l003YqDavXB0Pvgu0316iGK{ik_f81_uuxW#
zmD2WE`JH2=qJ2a$khH!I43U~dT`{T+#N}Fu`@UdMBajDQSYR`sEG2u)B(f9VQo3SA
z#AU~|GNmTySesI@jKSp)OVs$0PG?V<KRi7?mX_NGeJIM*Q@W7H(RoAsU_4$(3@I{8
z=&jYmQ!3L~HpxU98qqn|`Te96O*pRfM^+SUa`hC<zL1itGN$dhO&xj!SL)Y=w5%+H
z*dqPqsH<@qFIGnUy2MOch}X9N74EWC0ijf8@feH@Yd`dgAf@C=C!h$xi_|t?W+jOx
zE0uze<}PAoCaO#3`|v}{(#on~yT&f1o_%Oy;%sPil)%Sd7<MzYRxP*2@m`z$AjhfK
zeV*3VAo=%`MwH_yNlJPEyiuyb5Q!|cW3-Mm6mTSo=mz?y?T){7F*=@BQBOfm2CJ+J
z-g2GY{Lhi6Cw~o1O<HsejQ*7d`vBa8dg5XRF(#%Tqx)_#My*~kSY&Te$*&|qtXf|F
zoO3v&{cGpX8uZS0F*q|Rz{2_>ri0gd`?C$M2+#tx!>ah~et%ddE1p?2j+CBC5uMTZ
zt51Z|s5JE0#r-5JMrZ`y@iRM^r<LI`zYW?yd5$zXuKHV9S@oQH#T69L);O)Ve25-c
z)p$R;v$h7VfI{_i&$qh6;18Uo)XX&}O4E`0P40dL_^1^Hb{dYY>#?O?l?l^OX?QYN
zQJ6TaUc0M`xu_OVp5tAKx3P5?U;AQw!oP5PZ*E>NNl%i4+EQT7Q$RAAnVr2>(3%EQ
zE4(kO9*Soc8~KiDDa5s(n!`!<a{<i+nwP0%60Uj5<~i3=le0<Y;4WSiHU++j_Zi_5
z&rwJ?d%QXbA`L?Juw~)mB8tMH0=}zq_VMwd`!w^nauw$rAv<g5LdL^%u%g(#ddcG}
zJvEhBa&iRT`%%r+UnbZkD95rZN~%RKTU_R)KNfx@#CIOsIXiQG=Ce-pjVeNs(vxME
zLykXCQdRx?_vU7VGXhr{HHN6@bNI3W&uL%D^tFns?V(PREt5P}?C95_*xcM)j$}-U
zJ-PQ$oK(rl;zL8Jw(m!I$Liv@W~SI|yRDna(jm^Y&fzU9e%~An_DXMMjEg)DMHm~$
zI}gL+*|Waav)8@JCaKAskK;#GK2~@(KT2t7UD@q?R?ssvTm=rrZPIfEptgMP=e6vk
z=kTWCsA~DotsTX3-?26DGPm_x8)j&=qDrDiUB;FOQi&9-tq*jEl&cm`=KEzvFf1)m
zH7|{cZ4DA{6OP<@ajEWGA8*gkiOI>w27NQ>oIkgMTIHKKulcXP2a2NJ9}?VzEk;yq
z>B%Ig-u5Vtx?$cXE{~G_@q5+;@rrs<ylh`6wSqvP#_vT%*I)LmP^A{r*%b!jJFS~m
zMOs>0t%!<YeWvJdLW%wjU6~UnBI$RQqVd^Ua~;KHfs}DkxTL&?FG)nUzXiUnL37~q
zgSC`xO7{V@%68@B)sEAd-7)d<OXUx#ur@`ska$UBaf*m+m8FPXHb=vtt1;sR=9%mD
zFR===y?)Pu3Y&G+MvGM@n@)Ah{Aq3Rw1;1kGluxm>eo609&bLr$Dj#Meg{Q~i$`#!
zeWRhM4AAJ^43irOd6yE)T*MHpvP2i|gW+qEN%Z^kHQ7Fr+a+OYZ4W(%!8>uMbl}ql
z0$84<%eUhVXzj;w>gA5(vD%}L;z%?nLt{l}Ai9!)St^8GaTL0~9)ByAI#b(c_`212
zvuNv$v|kMKnHt`*6*UHlV27H{Jj&;+6r*$?Y}oUqZtYW=X|R4zh6u~*6D|{cOfiX(
z`-DPo*+tK_o1AfuSj<3V;vT300<r#~B>6q(K~}V{ilp+RY(lV}Zhci0;F}_C{+g$B
zm<n%@Vsw}Fwf3}*$jckUc<>C<%Z8h77RxpUTGrU;rJ$)f6Rc!Bfajs)mO?bJ$U`^F
zQOqzW2b+3h{L*zSK)J8dATaQK-0!S2+Rc>}5Go0Y=%?$F^vv~E@3;gqL2;A1kE;9M
zRlgdO79)M@uEM!HMySc}7fY?=T17^mZ5Kp7&`VSls%dqOPCvE&#^ij*bM}0>nt5|+
zC{0Ah!m)uYf$U#+*5YxbNz=h9W|NwEpvZ7JL(dV2c{jrOpL4SOeHH5zLGX$LgqczN
zaWJ1)%2p2ry%}!vz50$J!quBh#KP=%^E>7C({ihKm4D#g5MIcl-}!p$tx?;i8F-EE
z^g+h{8^$Fsrf*8BIhXSr*0aCn5^Ib__5Qr{z)xhKoIS-8n@@K7<2Z*#s{?In4-wkO
z$H!~qW?;Us9Kio#R>Pb){7IUR9oUc8Px~rhsiUQ(g|}xZo0(}bm^kc=we6}1;tyaP
zXoD)Ode+FXeHwJPungR{NYNFFb;kO;%|sc*%MPTpo#Q63Fj$PhAd3AsnJdN{Q*ZO2
zg8AQ65PkZVA1o)rF~R+6&1^dTA&zfBt^@W*oXYz>ZZw8~sR+8|YoZR?P}tB6?OXZV
z`YWpc+{bX>*EdoEjKDi^>}c!8fVg7ZzR|(tH?GLGc#>iygth=pkhIaiCmAL%lQgcV
zAMcm_gaA+}t~XRp9Pa*RzD!S<`|47*vzt8d=Fwk#6zJ`~c>gJAcy$B9^sw$ZE0*y5
z*E`bKaIx9_;5|M*e(qruH*_^=Qppzf#KITcnQ=-@_9{Y0>w7nA4$SmQ3$LfsQKU}I
z0+tcov*}f)n=39xh0IHfn%IKZD$X8uK;E_k-J6eguTO^!-Z^4^joO_Fulu8!|GOTD
z8nOPAUyHVTclP;v+Z;1;5BUGoVTPd6e56g!v}1Vx@A_}qrJ<MiE!FG_k~04JZ@~*s
zwjGM&TcdE}NF_Q*_a0*S*Cytovc*aHeb1)OV#U8E;o)@e+SnLlMx|X#bEUyx^nZ_E
z#dnNZuG6^6R_3WBL<#>qAD*lj=^jA?cLk1%=xy#v1{{E3L|pt)3Da^ZUcwWeSA+pl
zdYONXQDZcX$=?&RrxHcM8tw&s8yg#|qP9=|W@T-?IWjy<GCn%`h;peW8W?XOc)gh1
z@Zk4`m*D05k2f%OdhCdOlix=6>N<;W#1mgiQNaxj-HpPYsUK9oeqQh*gp)$@jiKE^
z2&0aT#_`XmmM^UNt{rjb@aN0t1r`53yV#_}0c8TJ!V3*5NB^l0?1cgYE7V^8mL*@-
zoh!B{z-s6F8}5jonymx)?AvndCO4wmCpS)3?JL^7ojg3Qt<liXSOo-h63B%#tt>4|
zYAgm*|D0c6dvqw+_Vo5v;f72jzN}SN$;rwxt5V~lB8CDqog~5;_Q#TGWabX13y;D<
z0=6^s0#+l00*)*E0s#*mz^7mK&CSi(l|ipBi5&rtjf;pcE0vwZ!X72>KYRf0(Bjrh
zMy)0pNDI8=Q2(+C$uoEanL9ZAHma@M+uJKC)%x)>i_iL}ko&I^*vR|od-banw*A0=
zG1AvBVN}a4udS<7Gim=M0AjJ4MO2*!Qc%-?2=dgviB}QWX1#NzHJAv8q9TqbK%vk<
z%hc~A)E`5wr?VbyLtnp|%aE-FyJ@{JUK?Kre(7>p#f}*LK{<F-$6&QkZlIzoskw$8
zjbUh%hpD#S=F4ZyGLJE%OF&$4%bAR+U&i_ei>mk??L#ilS<RF)xHZD>8}<07A_|Nn
z%i#KSVI_=}^mYG=>cmfyUb6D?!s<AYNCYM*xwkFx%>jGal&6L0-X6sDebY1xP(&>7
zp(JH37?fw*8-=5He}6BEKrUcMct6{Dwpg{P>mR+&FBJ#RgCl4&fV}_9Tl!q?{0Ev!
za}+WTrN8qU)b%%VC_}_h3|G<qUWH*3GF!1R;f#4n$Ep->UNlbVXVC&Bk^v!Wa=f6)
ztgI~dyYWTt8x2ygzgt;R>I07{3ZzAjbVXLpY_?LZu7Myngq<JcF)=axHw0OH^mmmy
znwqK7lFiaa{dNh|HeK)viYtb!mQbSzOe1HN$o5j{nYX1|dpfMlKe=@Y^vMqEMUxA5
zFH~?p+6tKWp*}EE<ymmjrTt{I!866(d&|ts{6}#6w&yX1WQ|(!qQ9>%J4AZ-Q+P(d
z-i%v8W8>S(kosth#oN3C^10j1nBcC|u|32z-o<ycPEjO$AFH>T_;RCXsX4@YCuwnL
zPv&JqsU1CvtoEzTdcjH<4JKvuoEH}tvKxtMI+OA2hK=k=1IV~}@)a~Ry{vQIOuu=J
zJ}kr{_~sWj{mlD}U(=#bacDCkm4=Gx{j04_^sH@;2ll4mBeP=yLPqWJV0{}z5XjZ`
z4VP&50;l;iYO))@G)TO(tSs(tM18WM4A=*Z!`0*H+Cy?3FQ&MZifP`{CrzbLROP+4
z%da>(xn+QzEpM!1YT7Oo&zn07fToYECqs0V!GD^j!vCthFD2%yh3%xJ9|kmT6F8A@
zDC&&FzILv92-UG-6RixKYHTVSvM5hfV0-WfF#W=gpBQB$?dm%UE7HLte8n$B`-1f+
zNsH{RV(U2^N?Z@<a`Q!c9<sj0ouTBD1PS*Ry8<iM*|Z@MCqg)!aaG{3Tq)*~iJYRI
z<SmjPZ@yef=Q@OhSnY6vY5mq<YN>)Hg%8`+Y#38AGBRQxXuJ(=Esh+rGJZbx8GRqU
zA1+cYZ7gs9X}$2Z_>1IhI23x`R%bo=tDCTn=msv0iZE;sg_t>a9&vmg7|7-$LBok0
zoOKUi*3xw8NQD$)740KYDUJ$m54=Mu?&TCs7Z{4|!wtFx>B}xjW3t6$=2^Q#<oAYs
z>EvS`0V~59^@xbB-H7x2`I75DXmM&k2z&sWavbH>t$PS@sg@|pQBrfhkp`E;`lgCP
zkLopaSyfDB%Zm7&rSErKq7am>cJ;*N7CkxiTlRiEa#(+KAkDZ@#)hu9e7<019W^g1
z#xiGpoAwvMQw3=5tjp1EsCX{!#`Z~2IJC@2DGry2h7&$W7jn2&e}H(-7J`%EeJ%Sm
z+Q}WPl5q#S7y63C4#%`@_h+Tbbh^#&{&JtNcrGb`o+BtEm6{E}X2ObKl~em!z+P;C
z+H2VqY?to;&S;akmHF9XNL63;<$dU;$&|nvo%sy&y%Y)kL@jKca>cuAt(_a}G>sg(
z;9_B6!GERgliNbJwY6<9UX%SGD4UT~RE(iJ26kcKm=IN8aKu0oRSWl1IjD72(>G;d
zG`~|z{>t(7ts^US8ASZ>>f!GR+M73T>ZAbPy`S8voJ5=#$Y?mF!H9w7><lk*(J&*^
zBs+b6$9+Yud){OzUh$>j*hIE%M%|Yj`J7Q(HXk`s8y#1|bVJsR6S|#JpC`Ul99DBQ
zTCAK2*=Y54PR7uPiM)=u{<yvApKxx{>cxTQ+ks_%2iW@$TM9Px{xcyuPAQ&*?-x&c
zp59KV2U9!qiM1q%vpE&`EDL{2X-HFv<W$>>n)>&UlC~CZM#^$ZLrW`dPExUlMvOZD
ztQ-Vg0M6iDA}A7yg|*!l<Z?_aRMQ@o#$a6j`2enshPJ(W^f4$$$8|;5@>9Led>}w|
ztzmR6z53`H;#Tyjc>QOb5>Knfg4t5)OKoob;Ug8HS`HFemc%6{rFfCfR;v1Pu>_|T
z!^{_XM*a#*#XK)uFqvVQ6-YG4;^^se!E*DB6esSR-VXl5CFi_=ch!;Gr;pC$&Sae?
zFqy%%{3NfTBr|fD9cW)9qvQGk_^&MBpT<fOs1j)bh}oQrDG(PGfH(r&r7TFl1T)=}
zW-3$Mg6%~)_oh!uthN~G_U+qbNN#c?V`yLylH3H`<j^dB0HRY<JGFh=z686Ue0bBt
z;0WhSU=5y;W#MD>UT0J0jTxHKdR{02ge+}OkkHYTNZ2dtOH)3pCIPGurg&8QJGa;|
zK$S|?L84V?;ZS`<>OZSfIBg4TYZYz6$kzMGv?Ws2tq8ghj6*?wI8%m|=+&NPl(9yD
ziCjAT{(Fc~lV>m*fq~&qQblFKG+>U&@dRb9ELAgXbB=Bvx?o<Yfzlx)6FTpJ{adHr
zcl?V$#K!Tn_Fp0vJa@Lm$iz>Jc)~jrGWe-4hJ)U<P0qPGuF)eY?$_nm2qQDvPZ-EX
z8^UB^*!`WNeSmBG6;WlF%g|iXA&_4oZFkZ)%~jMKS--P>_m1>D4`jaKw2Y86xCa3c
zWSxjmBMjM46)EQDPmhm}X+CC<4is4l&*0kx$Oe&m@Sx>zg$D%d?yR3)9ZWW5rl*V2
z^!N9B&2eEI_gRpt=$<Yye4-hmI=~n%oXw-@r}yZXQf@vkk2k!|7jqh>8QNyrpJ(-R
z7#1I*^jqsefZo(_jt?qcDfs<<TEF2OuHwRs{W5wleaRoftjuLD{L<fiMXwUeUsnF#
zk`R*k^XJbE>NhwE`m8)xR<$@iJENS{Pnd+039wga38JnAh$)or7;orzB{sAJ$gck<
zQuEk1E%r%(!WQjN9NrBNgH}<5^U4P^4lQZig`_59O~)lCdfP63yX<I7jlE~;2hGe7
zL<+jZtY&N$`_?@e+~=hTE|pg3{NX@yUY5A~nkT$ZrImv*Q98jl(TZM4rT6?^97JL4
z;qvzu13TxC|8G4fR&JIT$aCabahX>lc-4mNLsp<N(qAq&8+Z)}a^Ih2Dq^4Py7w_b
zcsuxqAw?8s@)A)?goOe92kYRJNG3$}6{~tyc?@-G7a=r@NW)Qr%9Ne*)__MZehwBv
zDG*R*IThY36%u?-SDhN(Jzj@nnXDJuLwZ(!c@&|Dl{D`{m%=vdD2%x8CcM{goBYCB
zNo3X5!oben;BUgL7{_sS8w=s}mUVF)%ntjxi#SMNKDvSuS|=BgxK{39;Y~Xp7(faZ
z={h<bqa%Y45c%QU@*usiLaRzWG86n6YwLd;fhk@?QuKuRF@NH7{4d-IGQO=&F`qxw
z*?JR*%<7qJ+^gQothlSvz|5TYrIm~;ws`5~Y_>JBR5Ypfe=L7FVa<$o@wJ0~lEY9n
znf`YPqujue5RD@#anDe$t4Cr4SgySOtgYq!n(h@$mGdV*s*u1(PS?O-S!Ly0zo|&O
zbdg+BN{&vnvdB;pHP1MG0JV|f{{nJQzJ~69^CZ@GE8+-;)&mc5V4LV^PvsXzqP~XY
zjIHgTI%U7uiUS80AOPew96iy#rayfLLn(9;0!tqlG&D5$H+-T`xw%|Q6{+x0;SCIq
zcTI4IhB{`VqoYB#7&M$O$YD`bZ<S5prkSh)2A!HF?Uwc%+JReLpVgxtJPfI*DZR(~
zZnv_|#x0SO`Bo9(%b1nNXoXyeq>KbmZB)`4ad&pqxP9)->V7ALx5d<Ji;yQ`7HbD7
zT93m^w!aLnAG3n#b}pNz^VTBY#S+6Fl(6~0*Rue;s~QGB?!#W6M@g||<C6d3aB;id
z<?Fd3m+q1n!(*B6fK~f;;t_hq7_X_>U-fG(hc6!<9^mFAsNas$N+#DC?u6Eabqr4m
zNNEL5Dr{HkEfqsG^7+$s`OtoMy79j&1tZ}Y%tEQLisupGgVZ4t1YjxsL&AloBkhGq
zlF><;xBohz!ZaBN!M52UvfeaftoIF@F8d19br;i=?d6r_L7D^gy%^ea<jM6Uv?*Z*
z7R0cTlzBbGx{pNGkA|*YSh{w%2ib=*%J}<>ayiR`@%m4oZ(#d5m<};pW^dZsgs%5<
z^x>Z?(N#Bpv-)G*zQdXsfzsLdT9r~ca1&p3C6HL}-(MYQks<E|CUYy2{ijiIy+=Qz
z@%%?6WnbTW_(C@3@)e2dDCLA7#6)X_pWiLVw8jLt>%ZF~v25;|ZBo2thFPf6^VX^9
znEyHc)4t%K7(@m}gh{$Gxv7+B{CS-C&FVOQB(LgkM#*xz3emvOFMP+6;sE5{8?~q-
zR)bnbd6Wzq42z*J@e6ad7HE-H;Z$bf*l1H*D@RoL>Zr_Gd@(fk#6c>hgfl`)zHgLW
zIV#oyIyTp4!C(DWZ=D{EH(Q_mQ`I&CZga1U{U&`6{LgOvJ2z!i#w~4UzwEMH3f~a=
zKK|M6?Q{`2l=e)Y#hP9M5_0;|fX>2g?!6VK%?m?Dx>vgmw#fekR%=hP{k@AiYcTjo
zijWoZN|}y>;_Dy_)h0Esl`W7rNMI@|j!ze$(Ww3n)q)<+K{x5F)FHdrDeJ>C!a(VA
zMX2fE*?Oy9OHM6(8&TUdE+OYV9q267=6>pIDc))#T@K^nRlq@B?*N?ugr<o|=>-aX
zTh<4qeF2JK@)*!+^tOa#F#_CFM-&YR@FUpNXcK}4{}bZ1k|ZJvWKzal5QfU+c+)6p
zw<{=3&U$_d?P2JY9c|)P%Ee*<A=7{Y1@W<Di!k4va-qO`N63%77}Hm^_2Uv8t*R<s
z3q}tK9IbxYMgGc|=ruC$4*hObR6du|V*76Y?Rfcyn0|fbEDOjR`{?=gc&ubibcIE4
za{CJ;rB+knm^8FH&5DsOf|Qihp-8<)AS!6~pLv4SL1YE{7SX`d)x+H*`Z%&BSeQ##
zuf7j61vrr{#7AT{i6A8+vp6^RZfXCnDH0VcI@L^H-9v~fU7W4cTjE&2@WXN5S)LLe
zE<<lk#<|EvWRZFWXUz&h;GBJ9_MFtZlnky{?U;Je6sL0$uIet#ckH0ENE;y{`TDLO
zR;DKl74|G3#>OV>vt5n5<~t6#Ri@WTdbB*6o{vnrCvOH^$YQz917cuc9hogGBKx$O
zhc}zAi!6a>7!0y#8$rj);JW>K>|?j#=+AA#_+e2AgrpF~e61fJeCZ<2rW8?OT`VCt
zDu&BpWX8d<+URH~GtJ90BrXfv!h*u~X-Vv#&Kka-adB}4QJnVIFoK7g*H+anI_FfE
zS#C2Ga&{yz-}Q507Awq28KD#PIM-rQv4l(Q_vOn(*%7nIZsXHT^IA_A$Q|^?0@Xk-
z@G>f>GBPq(xS@|U17w@7s5mO5xfrl`E>km(KUO)M^X}5_XnjGP`RFE)20ymO%2@-7
zn=ewHKsb|Qz~Bl|E1FV`%ySubo_6Ds9gRpX*bhqOPb{!<%Zz*Lu%w>EOiL2vA7JF7
zN})hwY>eN{gBGxb?7#5ARZ*^>`^v{;yk^iFJQVBlPgz=UR6~li&qIo0J~9mVmgJwh
zc++lFvdV(F^u5uLGFT2ndzyFss!HW8y*>9p4o)>Yh0Sw+SbCl1F#eD7aurBIEYnVW
zLh+AXT<Mkblsbhcn?3i<zJ_zR-}x>ymwCPBe}L}g^62x6i_YdnxDm>PG->#<qd`5f
z5LmjXqQGYOvkOZq79$Vx-(5IX^|mFWUwEgq*sb>6hO;)WB&G=E?0OJRqo3a*f)U6V
zj<ogkMB<3JDA`$9d^I3R?{3tgxI#;2?J3g4*@mJi(m1@D(LD_21;v2j{fXE*8vjNQ
z7D9qd5b^ZwAOXiS2M32*Yk}2w8eRtDz^S#hC-xONS*tuBsiKq{y*(dSYFREi@WZ6d
zrb72}U{-SXw+sm61<CvXo&7DTdBWsW<6oywG47u#YHMdgeD0Z9caWsTM8r9VLJgmu
z8m=Q?8@$g_nSZ{qhtWlR$Q3o{SENBFA~1`#V9K4-sn6RCs)dF41=iQsB|<t!?6M#G
z6xx=uiJmLJ>5<4O4@8WPn`Vj1O6kYu{h??zO_@gFtS|gfuA`&VGKXLvgPO&LTVk|@
zM1E^gC%G<)JJG%}NE6FHM%2U1t?=ey_-|}%Yz8B3Fqa<HOOv`#YjymBwWjP-Ojy9h
zLFIQ2@J_;W;+z1Y8Ph1Wdzmacg{aRI8H<M?T?8|jwvF#h$n_6ltj)z)7OmNMbz3};
z!#t*~)_OAc4I#&JSnHq`JbVGxPCt5l7d1R8v7=UfM!0HOa)^#<jD;A=MJe!YdV?;c
zD~8nkP`J`LC4sAum(sl4nZRCCcn8VqZ*IP^{fO?kPKBe~WVR=@v1V;sUOa>Y<hNi@
z{UBLJgKAGpPQemRb<s)8!f)l6Qm38f5)P*@##Iq!4a*Gm;t#_IQe=BRTpua81lHRe
zt-{i5716*4Un?S~mWXhD<2{<u-79>X5UH;*Zw&g;%7@;Qp9q0xV~DK=m6`9XEG%}B
zy&c+mWf6xhdEv}95>?qAr>ZKFuQ*da9iY4k(bPRwG)kitKW+cw^GC3%VNkDamWhlR
z`10@#mw`&?!kWvlreN^hkHw<+^bBFmMci<}M{$z!(_CpHf7%EriXsGXb;a=Y2kl@9
zg2+pUWnU0R0B^S$EuloDLIR493By5qfz|8F^C%1GyLOvDib~f(u?D#pjily>f=IU>
z55CY_YQaf6n2Kz%w{HA$B}<RggMn6ELIls0c&xh6t#@~Rs69rj{y5)f&i<Y(zD^Uc
zT+?9>EThO;P%sV^1?&vJp+(eTyrjH;r0w84GyMEC7X>GdbFl4ykDATZ8M5fsb{-0C
zD%ihTSkPqyeIzy?+2S-|N~93EaYr2uGF4JsVU|n}SF4Vh6kC~|uIX!#oJ=(LGS|~i
z_w5gTx;cGLwm28yh!fWIF4)w%yGEhwK^pAdl);6+jrwd_G&R@j>HlGmTUj-{#`}DO
z$@GOX^@n{laRPbBW?aWkJ31-mMkWsVyK2na9hz83_NDK1jLYso!e3knRa|iQhP*ik
zTEhV;VmT_%=&g5QKmJze5%3r1i^NUGP|Yx|xmvpjE!bu3kj8wC>e;^<u`Mk{T5AIs
zA;fMB435C-e7*Ye<x6gqVl%R}93G3XzRZ~Z;6$9GqoZ0&!TwvBJy89$KR1u4=+hqv
zhhc8_%z$hCHo$oP8`1*7g{Ov@d1h?e3m2_^G5fK9$f6*PrJm2jEBMcVEirfUn*;wn
z8?z2zD0Q?4jX5H_v$Jy$zS^onji?t|3X_b_=|Eo-4t9$~vCZ%^z2_E!t_!%$=VCA#
z)ez%kbQG74$y7=R1@D369RNGzTbL2<&vPXbJW(+*u{g2N{XiE+1Z3XhZ0D<1ZW9bC
zT-oRtE^J7WnP<y9?)_9E&mX@=j@dnF7tTz01$boMvuvuMC+Ex^toFpq3%#^RYSd6g
z3fd2AF=d410Oc;B7H!GB!dY85ADnkM{#}lX5l*Y(dk;6`-lKhoh!69@aO`*te5cv3
zWfBx+Y{oD0ZeFKkVr~wop)eq7Mq+ODFAe83|J6{*xJ`4e>TbjkrEp<C3%JD5hAp<O
z6vAc%6%m%T@e>rgZoMu#7B`fkJ@@~3;-euSr_j2MtEsW3XE23nmN0<C|KXzQ1-}#j
zT~A&(W?_q(xdAYnu@#cf8pQk$xQ}=t{bTjSeoC-g1EXBLnW`=F378U%S<fD(M)Yf)
zGl~Fyk126vO)wJs96Yc(IHDmK$R3ZxZkiADdX>Q;NKNheSZjGDI_#ardn?EfSgeXZ
zi&7p9#{f*>b1FMHt-Zv#7?`{7dTql4$a@(~o+jP+z?c11$v_wZl?WgS{qF+!Kjj`d
zC;;$37bE~KXV3qC0R+3?aRR!odWzZmBL^zH|Mx$P;a#}0XS0_V8~Av%fe!{<A3mx%
zF&ouu#d4qo1M}`>Xcwys;0DjE@_luI15EVn>%^oAEDU~6gOYHDkCx#x*q0}%GP&}3
z000ah-na2PC#kL@{eLA2*mo>lLB1G#105p+`kQb7Q6;pD^ATM*1b`@weq`^WOvC=t
z5{!I!Qb4{sa(?ggYa9dcM{k-}uPXdlPtkr5$L|10CP&hL0q1XizIu8yj#3znvxDG_
z%sd5ODw*+BA2UOlMUi==7`&(Xo{d_)AD$+oPcpt_o|+cDm^m|c&6yN814+rACHZ|l
zn7w51HQQ;7SLrLo8mHmID+7~?SLbrz`u5{5!2=P#e_5`f0NhOV@MP^3Tyk-f|1x72
z?O{W#bZ_aSCiVYIaDn?7#A>}5VsG}npT+3@OK|y^`4$B+$KF_#yZ@KQ>i@4{_|AVf
zQSzCaFwFwwl}q-c9jaC{qR){3!|~5uH<!3mA^OMErv--etAi6s|0Tg_2>+wi`!RF=
ztL8)hOSY+l|7FdjUH`ZGA2zH?bDA|F_TAb0#>fZwnkeJJk4od(P3|0RoZ~m4f2P8<
zc0QtSd_a2lk#6U0BiD9Az%M_Ww2_+SkBLXLu^2QJ@oesYH#>e;?2yz*Wk1IzT5O3q
z;!1-I_1&_cGqc@s47hU3-7ea%Bkl&z@n6H&NtXufSFgox-K};Ma|n2m2B^{E3J=Dl
z6*ePg62D~|+T!Blv~f8>y2jj7)4iqrEgIwehD2W9J&dh}D_xp};o{rd9v!Qg_>b|K
z7v2r%D9-HB;eWmfL%f_+zRb2$$~7ztaSY)2Gjh8_)+&?z9LGk{{?YTTV!?am6zjdm
z9m<=^`tD90Z4v}qG@2PK>75YgCp~=jHkxjvP9@U?B$cA5K9L74R~*jvm~Q>}m<3y0
z=@-F7%2_^e*oKoNqZ}7us`WE%_q`s2{-3BK!j1Iw0{K2itaVPCskm6qv_|s#nig>#
z**4^u3`t?UGh(IDliZZA^xS{bed?NGq)=^*o(OK<zrUbxuhkAw%Jr6mpAEu)?PI<8
z7{FX<t-DbB!r+u<i(ENiZ-k(S_Q55F;4o>Kt1bw+c`$7?UWNUh|H1t>D~qsQUD3c_
zc`zqY!k+zwz#x<KC{@q(Zf8Fdj`otUAWiCbVktH4Xo|2O#S4yJGq3L4(H&`93kz}u
zew$Z+mazxGaUt)NIeas+p8aq9lVmXiG|$*y$V3Z_8j}ePm#MlAjU%PMZ%|g$`Ud2q
z3#)&7Y!W;Ekhy_uE0B!<S+J`>Nc=zA5y9Lt0`^;%I5K2Mc>YO*3N*9*0K%RJw{Mup
zwrGGHhDT(g*{wm{9~QS}I>+uuMUK;=g=yofVm56K-&*zx{!(__CF$r+|0@DDGZPWF
zU@p+Q8Wea<K((E2Cite{N<*K!W1b@#hSYfi^3&WH{{E1ef6_l~{qhm>mjV{PJO6ri
zP<Oh#tPy-a!zt0jpwjZor8*PpCQs0r@iS+N)%3-DZN0W~Cd(TX`xEDD3}uYEoM|Gl
zBu^}TuMI+6lbZwFb5<h=hKdMTCEZV3Qj;rAds9P`Uf$+LDZ_OIXMN&ExY~}rau%s*
zY<a{ILD07Ewv%o5MIjW|&7_~9%|ATmZNbYv_pwQ1w1~T7VWHm3d(4lO&4aj`OXwAz
zs3r+aDtQtsT-QlywW{17+}a8yX45RLXKHu5_U#2{3sZpZ24TuR4`Lp@np09&XNsH9
zoK$|KT3)^)^U!<cx*_4lo=~%K-d!=ru*R08jcV@w&p`FB_<Jgb^+Xc8JP4*rrA11h
zj<|G4BPZvANJ1j5^ti0h4qjL?A|cU9j4}oq0$<<)VVU>bU`YUTb8NS0)?cog?r(L2
zv>Y)ET!&Qs{Tuii3X6F&>NE9xEuw@8^`g0YHLwvvzkRd1I}{o@_H90~4%B=$CeZZ4
z_9-_&BLaT2Sx&nE<9FfX4qtsRDSY8F*=^kkDHvgM<#_mEh?N5;9xACQzXXjNvc^pf
z-kDK(R?a~*7NhIPUf=P35nJf&d(`if_>A0?V4QW^JxthRLM5lF+~6_3s__N_VJb|9
z0CExBd&YvlG;Nz7(N>6YVr}1Y{>9uZA<`PEE>Q`O%e8>m_F3B@50q<MsxE~!pV!NQ
zD4AV_Vw0Ka7O9IWve|V^>tBlHQ@`h$KV$Sq0NC`6nWd2P_8AHaRzda`eRD>Sj*7~>
z#~(lJ+;a{E?_hUj;zZL`<Q3&8DWfQyH<Q&^7Lwo@;oCJIF1N5-8i?Czm`>faP%?2;
z8vCf;+MZY-?o3l?M3%&(*5KtwKab$mWkt}$1lC%@#O<5hOdv7;yo%jjOgvTTwf8pD
z;L%YoEKM4#m-}jCFIQMNQ$j+e%D+GqjpHRnUyIn!%oD5YXl{-blOJEm!{8aO<LZgG
zTZUeFCygdspr}|_*m@@^IahT++4=peh<9fD3GeQP-wU5L_@?&vSo?-p=X1xEMAV+t
z_O6?9JcNxhjfL^U)$nR@hMoe?z=IDOhczAu=${~F8h<2!xlyKV*dPPB%`fAAdl(1y
zpwO#WlR;^rcl|0tdw(6qe06c&!a!9@h(P(O;Lk~WN*fyEcPDk&eH#*l@Is0AwZB;!
zwc(kmRK$R_D#(^A85PXW+`BjF)b%#yhkNYSEBLsBmMfou*T?6BP!v#Q==0}o=Po}X
z{<-3}l#W9z`)9fmf7$?Z+rGz^;$EJ?{Vi78jIH-}0fo??Z%#;cJOves9NCo;l<Ll+
z`B%wISF!c<wf&NqH}QM&IOtPXQj7hcN7=s0iER7cby3j#6VKRt-Gf2_;rBr%x`S*A
zT0L6F*W6S{Do1VMu}#KJnIqZ@M**M6{!s3CogyR<ir$9T&|^&%bc@wn3hpe0fB3b#
zXfn)V>{^$9FGr+Kf_MQhi<w09M<}qZpfPYSF3y2Wq|MlqNY`WzlXEQ21?m8|&l;RV
z9wLigV#!hwl;so=h)NZfgG(m-7he&PlQe~9<0jbI42nfpt}QMWV5r14HG`M8AIe_;
zXUF&%a}@y#8nqIEX%aZa{fO#>Gc1MCg$$e#hrJbvnCwRHO3qNxlG3U;=_os#q2xy$
z!tvnJHlFX)=2V*(nz=}sPPZ<b|8&}KXoim=OdjTK#p}e&&*45oeCvTuan%HL0hJR`
z;K9dq$?eC+HwhaWxf=LudHjqHQ{`wI&LRW}BPHqUz=?V6<wsOOWf}EzNDpK9Gz5J`
zmU23!^wT0B_Zc`*9BXMO@az;cD`*>NG{1<d_5%SXEn96H)2z_F_rIrw{O1`~thfuq
zx+02d|Mfxh1T-gkvGeIK@_Z*Qw8Uur<JmiuKW7)&J<lPxkxOKVd4a{25&1!iYhU7~
z)Kw`#KGElJ=Q@=yx$n-6QPo&7t0ab<`mWyb*Zq;f<`4@YNdw#*lZO{xlRkX~!4ugA
z0XvRq*M&(RB=TrnXkcRxHm_IET*D>&dy5{3;ECqTOlE!<nvK@$KvDj5EnJWvb4i)d
z8x9TW?3?Xgx+EsLc3b({Y}0foY!+1*>TD2Lrw5L3^1~@kB0R-c=8Ll|&|-5K`LjP5
zCCYU!fhR(~8ImGqf&)dTW!5o5u|hDE$cFJxOq?{HF+$=P)2j!*pk6t*E$KS;M1CYc
zuHi}zl*e<ZSt0R;`cxlo^hVlTlvUIry}_{aZw&cMqE|wH0FclU{_=8Kt!LzS#FJ-5
zA{kdtR|)K9(5PLZCE|JV{*B04#KdEu2@?Plk;MAWg=XL#EZ%8fVggRWn%L@)H0?$_
z_Vs!L>`@qJeYnw;argea&{!08XuQ6HiOt?T4-_>i%sev~B|h1wt7ngZE0_t1LF7c_
zq<;_DSm-SGj3qEW0^vdteP~KIxL*pj)V~(|&h28fPQX>&@CfPmvmQ%bFO$=Yx0|$b
z_()zZJ3QaG<xY{7DBS7Jk14I(e7TY(C})GFCeDGvv9iW`3GUS#Pdc$Ji!Pe}Hv~dn
zxU{_E3>5?q{|PB^G3WDW5-U|>9{3XfwuKV)+34eWSxZ1uvxKm<_RlG^<+2{FiD4<E
zn}kn+FP$&L#BrB!pxU07dINM05DL*EDTJJ*9$Mb0j|x^?`2f++)1T~PY03HS+{yor
zA&A`w13pudkSb9B`&Zqe*3}K$H2aVS^Y1eQSgj*J%x83KXa^maFgU4}uW(azhkvyh
zriVToq)UxThXb#0@*=wSH3$`dkuXTBxWIj}sg+6N&tZ3M=y#K2uWS{+IW3rP8{I$u
z&yd)nUL4Qa8))O+t;n85n1Z{(X!b3RHTS^7j$K@=Rra+~gX^}yvb$L@X)}dFSzsY9
zXakiJGTviqzruaOj3Jmo({)GJ!|0%?j36v><CqdH6CXx8l~SL@p1INAxF$av(<;M@
zA*eeitl-9GA%RNq&on@a$DJ9OwDMJ91=H-s!*yG#Z`<gJ)=w&3A*(0?-OqdL`gI*8
zx5XVO#<Oo|8#$zrwrG()!;8bMNO8O>eNlnDQ?T3?aD8vD+*vR7Ey(p|HS-=z0#HC8
zE7Af)<b<P{?8SK&lSjaCZJnqIXl}kMi;1t1kPNrq>G*8c&SV`HdC;ZNQ1!u9qtYfT
zGJ5_UbZNz9Xa_MwR#UEaubtHtu-j|Q;)nB#NT+?k`8wq86r~kB(?IQlM(s-(c*wJL
zJ9UYf7si&PzT00hIZphCIM;oLr-n#nZY``~H}l+N+2{Pl)Rj#~xh!@2qS3F`$U#nF
zdQ8j{Ua7|CG`0{cuUL{g1zz0X@`VuZs!ZQQb2^K`aO78uitQ=(g+++$7QWApd$_JH
za|DpRTvce6cQ>ck0P;jIi~#)oLcgNzUs-sxgta8>2$b=Eif_KdBww`~=2CTPes$sQ
zbT+3B{8^Eu=6AAQ0hJxA-XK&IM~ic~-?NsG#jdDNhL<of$J^$3lE3Gh?H)xt!RB%^
z_;8v))j<!R*_ESBj?|0O8NMAgl8@A=M6gIPq76m5Xwz-d6k+<^wpTeICvgS9AWfB%
zF;s%hy%%@%_O`Le4>T{^kM_~(|5RU^njy(6p3$?(s(VpHuF~L<KBO+VZ|4Dg8|)hF
z+!^!;jhv@*T{UBV5Al98F4i3y#ZJkPtOx@ObU_bbcSWCWqJ<|CkQ|+*p?lT*`x-Ou
zO(;29>h~Q>frIw*)bm#R!}xl(^%#_PbI>Y~VYa`5{;}e<DH)%}VNGXmOJn?7U7pSt
zS@bQ-80E$_77r5-^iv6=gJZ(jo_$CB5alfyWujn694g0AW`?vfpQQ4`trK<X;+N~2
zi7fRwE(sEmE7sZemVUUa_*{I&7XSpFAp(lXT@<Vg(f1k6k?vI4@MCs1*|&5<$Agv-
zf?D9~{hv`mc7&1`Z{zHFgIqk|qJUwNnng3QExCAgID*YzF&#g9h9mWN@R(5Fvv>6L
z_+!RN(u&m#YaSE6e~gv;dh;#K75!P38it1gYKiEp=&+3D(!}IQ8UFD_Q$iFXKef|J
zZ1J%1eKOAS1YG-d3V<ujIf+K$ngBmcWHZb_#;=s|59~NQ{6juF(V`61f4bp<0x9vE
ze$_fpX)dHUUg)z*jar0_CaIji`5|AVJ2XKUI|hqc-qW%BEY%vBYW#4tMY6NfFUX;y
z8ll502nIc;!7~~ZXfYQ8bEGXcYAYCi;D*E@=P{7x6%XjyxY~|Z5h*4W|AIWWxAxFG
z*o-ilSXh@@wMd)?a}>tE2|Syh#Wv@atwztcDv3gyCIHzQTmPtRE@BciaQmTNv>Yh-
z*1|hCPV2B~FP_>(gQwmD#iqFc0Q&PT3L-zcsho-idTKQy?DTr2b-|-48S<bV!0t68
zkg$>pV=t52`h!qkkAnNa>@g<{<Q4sa97tKk>r(24K*eL+rkhli8AbUZp=Nhwd9=)u
z?uMKry^z*mG0Y;nRe)!6gm*dEut|&`n;|v2^9k^jhLv?+jLHEz@0>yYgMT%aEiK~D
zd2vEh(dr&rcfsB@Dxv=;PPxyq5IYHu!ze7O-BVJqH28=Bho^>F#KB+uX<hKPyT)1v
z9B;3|`!+b%Q%Oy_*25E>XPTwn^&BT#dVT1hU^g3IU|#W=pN+xFmO#A+_bM6CQP_;u
z#+J_|W=Rt)#51GqhGKWR)=I85lI3*#0eCqh@*y~$Kbjh;3m^abvA%q2`h0ysjV*k#
z`zq;^mVuo<^oV{|ZFyK)p~@MX^zI>6azp&GdR~hf;hk5soe;Gv-+9SH=kJ^Vl{ruH
z!JyHG70kreU8Ok*OEF9m1EEF#0t*Y>vOa^)hECLByW7~fEUu;FZu|RR632B)(n8Xe
zEVFPTyb*hRuC>wKEBq<#B6D%7zo+;=K6L~xI(0s`T}2K)-(3Vcp1VGsIkjGhoZWUz
z79vWza6wd6mRb1wH(bbbq`5gQ#-Yi!JTqtcX>OmQHSxh7+dKV-YoC*)F3dp43)-!Y
zJ@v%&xa?QFjz<IEZx7?%2xfR-&(U!eGi9Z0R7LiS7%Z`Ut<-A02J(_(DAurkw4y!w
zd%;r1+H1^lo|G4zFuWqY3RR1_3jFHaz@*hD=<)Rulw~%JE&ppjY1+nE_Dj?~%SeJ=
z+{oHF#CFUZuG^R-i0M;;f(N?5H@zdm9#bab%o;Ors$RL^$KRc;3C-28voMVlsheDD
zKBeWCF0SC3M_QvkZIw|0preFnb>pvShwFo`dc<|8==(2ewQieUyi9G#YV&R7rw1wc
z?ix5GpBaHQmVy{Tg{cwaujv}H72iHyW;5jcC>fK~U$GubHkRve-%K&H{Wblo#G8vn
zEBw+ikUbSWB!L7aGX83VYf49>GDv9d*iyX+Lq3~{w`^sn{BL_zfQw6--j6BwL&8v3
z68ixLQO7G1p%HWA7cxI<Lxq^z)ZUqjQ-&0_4`rVrl`ozql;dHxBtm_OOruw$xAQ5!
zcqv4Gg~fQkTAFhHIlcbXV=<P#IkCsgCpWK%_4Jma@Ug|WK5Gn{tNQ!FMqO*FriKhx
z)k>=Ydk487a^$$LVyPW6s?3q3B5o-)hH!**5=*N_O5#-Vq33Xw+6)h#^Za^(IPkVQ
zmoI?DjS0h+oTcEjuU}iZlAl9x@m%<0hAKw<%MdN2yW!pkh1|CVUx@Z!6M5lf4j_W$
zf4*d7w1YjqQWZYRhVM5{3Nza2LepMSPAo2bNq)30a~#{!?TV?y4O)932U7<E=wqC*
z38q;HK?QtXCixfzUSn~*Ey)+BI!c4G9|ME<A~}OU{<QaHv>$~Zj<Yp*gK>2C8WczD
zcc41BxGu!aLG%3kQ?}*snvV@f)({*oHLd2(?XyY?$KGpD!m%N=JImDmlx=lGhh1f~
zh=*sxL~LfKixd{YW$JwTQA=EQ@^d*bJ*rZG?)ZE3xaZA(_M<g7sA`mPUOCaqeEKWI
z+M!asGpcZCU2CTC*TA=?fSW_`?c6iF3I;}+<PdI7A|xm317~1ubw`+Hz!NzOEmQAG
zzkH-8bLm}hS@VJBmuU6D#7o`7>qh}jxX-}ia(sZ~Ycz=v5X&A?WI=A?$&pa&i9NDe
zsd`T__U9uOhT3Dcu%g}Fxuwley$ASp@2g2IiA9|mh+pT5H_CFD)7e05dBNuk+2{EH
zyZ+V}xyk%PEUuY^rsl+|W!FB&jaNP;JmF>d@iQ%5O<_ILlrKmBBytaok-p{PQ~H?m
z`b?1NV53i@Gxd_xyoboQyf&7;I--J<(^k#*wrSh#J~x-$3`Ch0ywH-6stD;0iqec_
zUD^D=Ug;cP@43Ds*Tm-MdmV0P<a4Z06zgLblQ?{PL2LY?@3*+A#`U<p71i2u)wc19
zRutvQFR(}<nGmO?_*dxjE<6B0BmI`H$Z|QGe)+b=+zqU!vRv7XCM0n)!Mc7WcTyEJ
z5oJ65k}N!f$%r}F-1%U_zPw@}?A`zJvvf3jJneMc+8jfqavD9&FvaUOFZ<@JrL)kZ
zc1oRUV7!CRrz*^`D_-`=hZEqeYe?nbVwVu%FL*%kTTcJ!B1<Zb9~bz<SO?RxUw(e#
ze75IgkxD9++^@`ssdp)~q=N_mkV?K~Dnd+Y^po;f@4wQ9BX&Hvq?uk2k4RViLNjp!
zc6G9j<H1$h;bFWNN`1kTYY8DE@*seN4JK;sU&TEpDICMh{Of8zOLSqD!jc$_wcFG+
zW+O3#c>k)QNp9lGTR)Tkl>zejDd=v<P;6?Q|6#2OaZO%}{Q^vS_p2*d=pTnoqbKQK
zwtuCm%lCk?#d>hk6pL$lJR#RVfq?LtYQ!ZoZ43kiSS1*5a1&k*Gv~kZuc#@Oh;8?O
zOjC2Ua%1lQ_=AC}%B(SBrp3zt=zv~@05kKv9xt1J6`NLKJ)<{8Ai|S>x=@!y-?KXq
z*FG${d%XWoIUn^jmncUNA+tBRSqBDSOXB9NWI&1<6@eQ#(PPjB`$==a(m{6lu#6BA
zdwB$<cNU7Y4Mer2tM`^6&Df@DGU$7q2%sU#?VCuW?B<523+53#Kw-S;I_|bLb;^7K
zmaw@zgShVU8M)dRpwIw<(J3-*E2}F0q+)O^z*N$)3`8g02+usfoWeIl0c^<_=9xV9
zDEr#P*pUH(f8Ii6eORzK&Rk)c98e|kHUkw16XtgXBWb}?bS^y5Z&r9fC4W(CB@bsA
z*}}PyDk6ZK6UfjZu04qi$O|3&{oWNTkQN?rZ0PL6S*3sgaB=amjr(O_j{F@C@J^`f
z8c${BvQJ&~#E2UO0KPe_zkdVRIyTBQ1Zyu2+6yjv!&;<J$R{<=BrZc*IWYk)rCM@X
zxM>a{$biJN+W0c=%XsTqu+h`A3pptOI@3{LNHD2aCE<?cG>!!LP<L2g)VxArSfqvd
zJF!t30bo5|U!OHuy#MRq&bM?Gotv`=0bn=QP}FXe`dW>j1NnRF@LPx!X8HSdNPUws
zEWq~ktTvYi^Byevqvciob~EHCn-?CC2*tZ?`02Op?UD6p^c@+nmD$dgP;mmCSgc*G
zm(%38{n8lZz%fTB=ZYtn0+chLXV9eYSKaA2_ot^)a!oPoc5xI;badn~rDwr}d)a<b
zVxwscD~j00_q0cmd+c@nP3xvf@1cR<y8a#Ap$t;M@FnnIcl+vkds$5lpCv_<%Ejdz
z77X<8jN-e>v6^Vt@Q*Ftv#fRcE^BV!iG>{2ZOXmI%|EozpR#7TrV`WFVQa}vjENjZ
zBSb$jx`U5&^bm81&zK*_ApIXNF=m{FYyQ~7p4>z`nB#{|c5^I@83w|RrYMgebnhF`
z<^$xS7R*QdUv|NxM_JC0?3?xX!v-Mcx)2yE48AvkHby@qEg78Q!n*);s(Sm6HqyJ|
zd9qM$(iylIiA9$9!$IZ#2kZc22Nik*r!?pGlZ2M0rg55miB`SW>54$eb|cEe$z<j{
z<gkx-@ZnR^DKjrIW~5HECp9}YLl`x)gqpIl`&U6{FA@?GPBykt*hw!fmx<cz>v2v2
zf%%Z3F|-gg%qEU01(OKq{<YO1{a(?AJ8^2+1y|iogbmCl{q3dX)KuVm)n~I$pM-~p
z7b*;mjE!?wI|5o)Yb+GB(b3V@+HW^bU`Md!X~Q1ssD(R;h@F%jR_c%J59v~;tjLPK
z>Km(7w||=OA|QdhfAmAU)KcusD#VJEn;&AEofXU>piOP!z(FkTf*l8F7W2D-US7KC
zX&7wZ=;*ctJhB@3$~CibaCpkK#;$d3Z7sVWOysytSfNCIh1YKr$GLyrVgx{Hm};9G
zTn*i1-PU-=k5ct_f+#+HsCpi8Ya)hV<|pKDMzaX>J0}Jrg!w9%LK%YD^6*LT{mh-P
zW5T692-aB9iX-nZFGX3%G&j-?FfbP*)R`NA7;ADh)r4IInwpx@wVGN+yV&IKwn)jy
zjNG;A?44}ARL4~-^Ygps7v`HwkB;hKM;e3Xg>F5E4&Y^KEic&a44uN1&q(y;0s(PD
zk6*U~SF_>p^wvJsq!zv2e!spBlFxB2{vNsFI++=2FRSZylhW4aXikHG$KkPx(b#JB
zSbW$wL&*FTY$SB~rMsFxuMzienf1qyu}TkicFccQQF&WMxY=2_yE~YE{ldJK(e;89
z0yEpKUZ4zL2OXYnk_-zxYxl`_GW>4utu9vooSXT%<($QjjbSoPGE5Q?SN<@W<!*e@
z153Ahow`|B`5CFIR@mD(xWGP;sI04-^}M}?ZWyN+FRrhj3a^N)$>4~2-1J0XNP|8Q
z+bYGDuQ6C6$?l(XcNz_kKx$IxoP=67il{CxufT!E9ocp4f`W_tdwVXFh^5W(ekRgn
ze{D`CwzQISG6FEqL~o8@UrgH4up!eJnJFFl3t<Y8)b-j-uyaH*3^ulj+F?w=A6aiA
z6Er@|O*&&nP)0$X@4Kq$hepPB=wpYIU9n-Gpn2S$w&5rY1-Pxn(8&g#T!=$XrU@!=
zrccTzEgTF%XC}Quh@N{wccRTcoTA?tAn$YQ*U)Azd)uD;^}yP{S+~)J)q?=x#q*va
zdDpkM&D|kzMA-kYkhA=X>g(b--7U<}AuSUOAt4>oNC_hhAt5C(G}0&~2#5j_(kR_A
zbPgQ@5`r|+N=nx=zrWzQukKp+yf|mwv(MgV@BR5k3BFZUuIQ*-mOcAvV-K}x6)4z1
zeN1uY136oX?+g$8yon!qX{Pw}_^2_q=|jk}DjHqq6=sW(C0>;paxYikJv@+=m*+Tl
z-H;(6AAL6QiUpM5OTg~_m!L0VAy#g2%gNbU)!m|+wVz~BZg9hy%U{X~297kt0~xV)
zVnqxvj6(<*(RqA0+eE}87sGTE<Vw*BbZ7T5EG7{~U1(Q`SScwj%}JZZeAP3@FRtjL
zH5m0I8$OlZ%Zuw4VLg?Ohk4&z|Ex#}^00Vrj^65ACd?)ux9{ckkKN>~dy|;*Fa{gk
z7S-1FoSvRG<sK%ou(SJcb8|n+2L&7t^51Vw7HTP(#w!Ltxu94GI$yMG-pUFvZX<_^
zgT={t)-8KINbKS~8T$=(*iH2HyE^u6y{}hOO6@s1#reBW-p~v--+Gt5ZO)`dLK&n5
z=;{>mI4mPX8euqx*Mb86N~V6#Yz*_A9bLS2bad(p2;bXjTT$&%<yoS+glZG3XaPOo
z2nqwL-P`LO=Ss9vgYSU_6@o%H-2~=<*5N#YqQhQJg!+!fJP7KNjGCEw?6BFWeQ_YM
zE_EnF!HPa%LTWgD*SJbwSSa^g(=0NYoSdHCAR;1qX^#7ni4AG<5eAG=Sr8aQuX+62
zp1?v^^v7n|Oz;k$MUIC>ca#IHV<zR+xJtB<Pqy*YiPp6>eNqP`^9T!Q4_XVc`^3xZ
zaIuGhc=BS<dV%<3O~pQB1{YURUOZ`qn<(aYfxCTf3(%OcE`)04%R$WZSJWW!qPJII
z_Y?2h54sCbPY0YboMSrUq+{*@VolS{x<6GLPOt?7t5D_j&`LJ^hPM2-<i<hDvV#<2
zA?eRx4#nOI`LuW^cx#phcs)95jxU%r@UB9URJTDvBGn#w8&VOU%Gs|s`Bxm$W_GrM
zmYT2z;5-a$t2i%S!ESp$$k8ebQUlMO|MMRK0UFiN{oMF5-6R0~g@V!3#h+giQ(zK#
z1sgxBZ90r5JqSEZ!d2`oBYFR+k>gJ3Jvu9E58c8rk7z6_ye3Nq!DBVxR<gLOu6(q(
zxq5kw-&CC`cwph@at)m8Cqcr}BHh7EtgM}~L9LCXU6bD4-aKFPRv1z-)4g{Df_Pj`
zX^okb6KFL&LrcqXSdHd_>h}+wjIN|uDg~kCNe&b+Utk19D{B13y)&bl@9zE@tV=q$
zf9Z`%xZ@OF5VHy|XkrQqBlQy4RqE`HjPW)CJkf0jomBd7VNucqP?X<>DPT*E?4B)U
zU5e;ZMh8xE82A*Cgwr={2;VMB>v@AdVqm9g(FbL%^MGmFZR+bli7EVa9|1He@=Ax>
z8P=quBSQ$1k`Sk4G}YqAk7-A#Bqeqr<GCe~c6%B?y%QyB_2bLL&(RrQB)9qa`4^|A
zK4)ZQ`G|@}af<3IGF9s6>NLMCBFBn3TwfFa1Z*nN(Iql+9eTm)8yh{3_;A@cw)}84
z@*?aD1I6bJZdhE+qU{P9W&pY+t5ptctpD1A+NPw_Gm5?SK6UYotcYs^GC?r^JGxH}
zy=#`P>@idAD=LzYA6JL~)b!-`zxG?4B&^?g-}{#J&akX|c9Qi(0ROXcL5bHp85@ie
z?zA6oC@CqCxj%eIPu#!2AgS^<hdmsUTkSsJ0z%`+5C$Q9YkNjtg7XN_k{e+u$(N9J
zLhAuG*)JJIw)OQNS%+Brd;<?TNy%dd|53avu-n|_PLT0f#gZNzF)~-%`9KBRikf(`
z{na*3*+~F!D=Uj#z{{LRM3O&O?LL=%Z%8Uet4D+f(rh@en3G9G5m^{c;BbX+QU4~1
zk%p1VzyXL6q49fl1dY{sI0w{3SZfd@w5z}?=o*($A!Ap_Ul$Zi0G*o3gz@Lk&0TtV
zNv+B<Pw4UEE7ji}JO`p_<EtO=>$Zk`NJ*)*YQ2R6{&aVDZ&NYFslDhNFMl{Gl9-x0
zelKAYmCmdopup#V#`~B<Xs0<i)I%+Qvxn{SzU{}d+e><-Gx8VV;H}EG(-|{2x$_0j
z4!@N!;tGK<MXIlY4H0*1t<iT6Rxd9uBuS~FY3{){Eq`nhP-U$=UNIZC*og1cdeExN
z|3L#CV|w+a8tHxc)Ox4wjh5iLrOJA2U&lM_$&HL2M$yF;ygTQ4%}tlhSX_iwjnS&7
zO)Ut8c`&5lAls61;+~3Cr~;LGpX$N<u6DjJBgcZca2+pg5>rGu!K}WVs(+|S-m23s
zBfXRVOwPaaJ%mLwi%=ZIHXFm99WCnWc5iSO5FW3*rM|mLHnF%IOcpY^o8W#FLVf8x
zppo2Roo1m{(=lt|w;JKQ-*JB@G)eUCFPo82Ty*nSbyF%fX?k9WY+IW}-0*vi>yXc<
z0x=r#ym_LaBkQ@n$oyElUVh;z5v$EjyqRJ-OKg=|lJQ=NLv&<j;sU5$1Gx9F=~cac
zNEhXxkW`i4+Xn6O=gI3pvOZq(SQLOR2RvWn@_M=9_ulUvjcsHB(Z&G}CpaXW@cJ*|
zY&0tS%;sh=@533Bz<Vzu6O*p}+$UBWLC>SjBKqEjT_A&*IXJkRaFDA<Y4%zE_v;Dr
z!8)Xaf&(->qFK+$?K<!W!?cy}jQ9P|=Ileb{%Sv)X!{+QX55YEp`4bL#Sdv4PC$+D
z4o!Q=p8qs<?8(d5)SiQXej^`L{X3`Nl$Y6iS(L;30NtV9HxMp)1l^md><|*>`2`GI
zrse&}L-!G7tD0a+9sWk9k6#Lu(AIb6zfV4F4Tb>LlPIjdwoVP8>&=d9{ch_NNUkp}
zoSmF2yRAJKdw<7EKC!=}FWBJMG(}n2APcSmngqUhGd*OF?v1Ou!&t#C5fM)uUQVL8
z#xx$RKOi@zVYduCLQC<2mcu?P?^9IJ7G1X_$RG7CCsOEWN7t)rki}@qa3PPtkl`nc
z5-?=7m3hzK2KW^@$GD*M>Z7n#o&{=`YO{4qqrJD6%^>Fcq*`%%uDcD2HOohM%1R`#
zLydyXi^G_R6h#?>2dM=s?S3jM2{di9{8CG@v@Si3D5K|TXkMn3pkN%2aY9P++*x^%
z_(;3qX1Y{n*9}4`DL}2~Hyq8*aShY=o1R@$97V)09HWjq%MVA|V_jOTnQpBj`s>TW
z%&uJEe#Ic~y2fFEZM&BDs__2r%dL)D1ylBLo?CI3#DRP;I8I|tSFUc@515!*G~$<6
z@zC^JKyyIK1EhZtZOkwNYgc?cPfA>;ZL4x1PSxaDPPh8^GL7VsQQet=xtH!;E(&st
zj?|ax+fn1=_aR46DAygYtT4~dRn@ib_UMD-7?p%X)T}jW>@&YSTi)(#K~w(7PCr2E
zlH8eF{ohBLWF*bEX^CXKkidiLiidE>&e@!y=@9k5Rq~#Ds&4sM*oh6wqRGZ#wjwWr
zz=sFCfE%qE;NXxLTbP)?-k)#}f_H_+7Ci;&YA<6Z@zBK_Fl9|sK5CJR8<ypp%@C<A
zi?BMvS=_pNo+VKRSgXky?Yw;=BxZ=>H-;i!4yowA|C?v4cRy=G5z(8BkBn7EWN!Gv
zK*s<?HL7k>{>h&v{-Ww@Q`CD7gd|?>wSz-67C!6{YgDhm@9X&U>Mm7D{%%8LK`kWg
zA{9y;Dam8to3pK?=0UqoWu0b^T=fReE=!&-C{)|&ujS3&Jhom`r-fA2h-dW{4k1)E
zUi$c)soJuCb7tUK=7u;mv9ji&2?W=xIS<w$Tm@;f2{@agF0w<mAef+SKb~V4+S3*e
z%6>^SDzSQ(Y8ialB6Q=)IL;j()yuj2Fr86ti6IGq+(F!I=O@@|`3JbOg~nbZdv_=P
z>a0!TuRXkvBv{wv-2XSyI#Q(4XySP-wxufr)YulG8j>ZI`lBTSG}Qi@4=8X(*#Usf
z?^T8qF32B7bl3ogxA96^5_qa-I#+UNI7ja%u?V#R)2Dl0q2a<p7wL=|7;nwen&le7
zR>M;;gy+M<tEE$kg!bVmwY#(E4>RZ2+8RX`4`P<SZ&^Hfm>#Vatz{+zf^1^{|3Ulp
z{%sZ24bglH(N;Vp4!T&~&&qW}=cODZOZpx(#(TnnJM~prTw4`0F&EYx#G{bTnMj6j
zFs-$6b2*#}O(;h=YmEVY7#PgEmpQgd6m7dd6vdJt1p<M~_e<yZqf+PgUEVk`f7*u*
zG#FA3gKQ{7Xt%bDcq%hE6?0Wc$??6oWVSphs6V0f9L>HRfh(640%`$U)^LO9OUwGe
zG#qQdQz?VI*ffYodqX7wAKses`NzHvFKBPaVUNwk4U{nWE>$cxge!2*gvDHx`N68$
zi_g8iG*k&jPEGcLC+5L-ZWalSJ@*oTdHuCXq29u25M=NLNju!k<lM)GJ6ye`nGqNn
zAv~{^&kQA+?7HKdb935sZM)^X@umqBRV&Ly&=6k{!+|f73fab|r(#g?TXqvm%w>9=
z<_**;@iQqE5K}V;JEkbK>H~2Lg7&>ktt+iF_d!{*2u;K<qZ*9mjYMSLk?1Fi_OEm=
zBh5+1zJHe!%-}?leo{$7fyNiWwGx=69lu{i_-|h#-+G!gu`%~5*L#__T3aLX-Vx=g
zRR;IoZxR#B@tIM*a?r^1veM6aN@`it*KxxUu!V<E^+zAs%`-VWe=q-`TTk}>*uY|y
z3##uGY8B3-ppKWsVy(SD3Kj+n4>%y-#g$iw$5%2H`~V2PH6#~(m{YEoFGIjZW5Hll
z@^m{iPZ1`Ar{Q|PEWfqSI{QH)to6Y6)!3h<MK|cnj+T}V+411|+l1!13n1wj`WHKw
z0SH2-NiW>|i^1r<s%qbE(?rSU2Ze$@|8kf}mSREu3f4!QewGV*V@aAiUeODS`KaMK
zy}-Fx`o=<UHexoDphfhW<inLVYpfXI$SWEMj%vC{&0qXnVgRc}Z52TvrE_et>SUMW
z_i%Q_XPpr}|Lku7{!|3*FTALV$JGw+pE<g}@gC3M*p<%-vAuBVNh^LgHbJ0ht4kOC
zYUIlfp!QQ4Z(r?Aq}J<Ck8yDX#-KH=B$+N<Ym-0!o0)Ms3u2pSAQw&OCbGM#K25FW
z5_F_M-Z*TqMB?u`Iy}BU$|q!X#bKwi*O9Zvzh)Wv>jLOD7$UKx&S@}K`yQ!pRlKR%
z^+D5f(~nXF(fn)bd>DS<OP6zaNTBz^y*R<^VB&U*M146(XpMJa$#CrvS(G^a5Te+b
zu&d!6{l9@#5qW5WBI*miXk?CZVTQnXT&Z;6#o-e_hvmO@HX1q_bFWK$mV2}x8uu5X
zd3laZG8$hm4PAjK6SE|iZ(8nd#p|>=L2Iq#bt8$*!oiw}xpatEQ{h^iLZ#)QT5rr9
zM;5+M-NVaezAbFEgvT=o>9DV_4F>A1<jG|e+MAo<(6{=P9xSCsNoX40^J>k8Xp~T@
zvp$|Gzn{!kOZeo@vB)wTHmMy&<v*F#RxPAQ$v3b0ZBuvj15i(Rsl{mhcgtZ0C#v(S
zLjZ%K^(k$)n;&&^aV@>PCIQZcpUZ?b-nQPBNy@J2$5*MD0hzvdWS_4|z6`a!BUV1$
z9L+di4Qr#HuLy`(wLr2i*1wp^X7C{FMY5By^vAPh?1?G3C-~>MDOnOJC9sN%BqgQO
zrDaMn0idGKE?uXca7exQQjJd2hSLyRtz5$~o-R10V6QOO$g(`#|5m#A6RNiMXt%jq
z_uSvX=~O<xU;Wg4CS;X`a!JAeqv#!P#1YhsgA0N)lS*LNx*vNHp>B#`6eu6(Pmx0k
zG8^n>W$d)$n9fR;6Ct)A)vPGREZzv43P1#<(mLF1DQV}C?6OrmUxk*N^uvBs*!7L9
zUnV6b8Q=^%WA@fK9d6_3Gh<UoSDFS0SGb3FWyZP`zK4a|)a0ObavS1f%h#<7rIwEQ
zozHv!HFK$ioOLt>e+Lv@00HA<1Q%{S+FG^J@7<ZSMvD2f13j|586pD5J^wUCOHnVM
zwk^5LtkIeMyunPF7ysq%bw$VRgo}rEcy<!8q+Y$%{L?fM)=DjRu~N*f7XP{*-vi%E
zJre<(-Zp^Bws!aF^ez{AEy(@A<RId*$-wcR?rF2|6>EIY@;VfncOjJ6!cTh2t>u37
z#o0tqLCdorSK%3YywWIkrJP*H=rhfmF*H3j3L%s8uFaj!Gq}#l9p;Syp{Ay9s_ZMX
zTu+oqk8Nd$##n4P$a)v^H^Z{qcD>mgP4*V959CjFoh#W&Dk>h&_77tS_;m@ABT5U?
z!Q)W`8#S)<W5@`bjlB1mISW<ed0bR)Fg%i_4vN@<H^&#?0PjXiu#|WpTwkBoCAxtk
z-D>OMKl3d(o-9<=Mv;F;9Hl*0w{q;_@KH{Q*_2PfVbBDV7jnH|+-5hNf*)|c4>oTP
z^q<2f?mARvG<o}sSj6`tA|m)x!Dhw{SdwoN%Sdgr+|q4N>#~yKWsc{w$CE?2Gzh=9
zNXfQMR!{y^Y&Lz1VNv<vlKoJqeDh^mOcWhQN|&D4V$vKHLaF+*3ndYAdGjwZF*ug~
zOv>Nb*f29vu4~C%uBA!qF=fa)0cW4KzB`q9xyZrZ)7~GoM<`AJWLaM$26y1qu_k>1
zG)D#Is#fqX7SV6jy}^RL*DTxN7c63=^ITLMRSZO#govWodV*}jxE~tm&Q;$V4Sx_z
zYX1$dp8P|t^-9i<<8_}c8@};W@U2gAmzoG4yvXrr4V|4^vhCBv)$u6IBlSuA*H~>J
zB79jU>Sg%*vg;QX-MfL;qxwHNY{d$$9E8arX#fO$9pXo=N#(hNBMc+LM+UBUZI@Bf
zB4KU=FlIso$1kVdI&RP8V)UCR=ZTr$$>Ez*-lpom2q9x$W5m-699n4dOt5=ptFF33
zGtNCTN)GHIEWGNMGR}Nj-ZSaGXl1TqoDM`-MKZX@ywo8b#@D+!ZikSY;uZ~wjb-Sp
zc6US150*Q$LhbPXHDa=*jc*XD1PoC1<Jxi79pn<smAT@H{Y!DGlFe8xyFpUIax@wr
zJd0<##3AgCle5uasx{mj1F8G1wpW3|Ik>yiapS@V2W&LTk5n5#U(`8FEK%&#u+h6K
zUgOVXGe^<gZfoA#_Yd*L>`HmTu3Bx-nz3yg#LCC+4}@ZCvivym-n5W|^rW6%6~FsQ
z;=0u8&rl?#_ygtTW=_)9SG{)7@QJ0aqclDz_iRVunJ>F7)!uuX3HR{Aa3&{uIa0{X
zT3$}!gPe`SPF#0tt^kJ-a~l${;Wvyd56rBpZa};M1cnopHoE+3m>ngmF>rf<O+jk{
zjx!$Xh}4n6lUcUD)_Y(^PD}4@iEl8~9>s?u3a4x(2`LI{QpRO<+h)PS0x9%P^x79V
z1y9YXZsNR4f-`&#vv%l2a3l9-D?=(vN_KU^QoiRPE$2IyU=R!Vs?^M(((|qC_30Y{
zb$y7uZ!xy;SL*|As>mBb5doEky`vp3X;J_RTIGdyYXl19AaHb>m8uDnx(Q>zSs&|8
zm5(`=_NuZeRP;FhJt!RRS*mA{y>Wq*qs`11_VWDaZCx#Iw377~?x-CqNGB{f%cNXW
zJ^=VqJ4uF6mF5&H!}ChM?q7G!8S)8Zg2kLXDY3xb_^7dRaOI*Akxz`R%@86CD$Tg4
zmu(fR-NaU{Rz2P&4Oqp;eaX2^T#nxPURe~5X~n@@?W`L97g_oUz&Du(rrYe+$!6zo
z+-+dO3D2MS{Q1d^6ne`lL<umoqIzMHy(EgxJV1E1r%|zy*yfh{nDQXKtZlawbNR3T
z?VOPJYkn%w{dK`0RDK9v{(ziN$XgzfRp7oRguC~oWOx<58ax^2xLu2dHq2}1YK<O}
z9kZ5N*?W&I{)O+N04{<*`b%JtLkESAL8j>A$PVs!bJce#V*-%#YWmb4bIRZHggJ5u
z*VvOh`OGIzM)4b*u(cZ^(>u~ObhStIipLyQk<+Jpx4VH$a_d{=gIS$FTE{<aU-{&o
zW28Ty9IU{rt$Bk%klaKdqI+I7ce21P8x=8PcKKf#p!<^`eN~zg&<2U*GU$rZ4Vak$
zy13}CBdUH&K07SWGIX)i*DDD3Q${)?x#|{h&h_Rb46^t&ky1*rEYU(ZgW*U#a92r^
zd5b2YY1xZgIzsQ)?CDr7zv8kooNK(?c=FC8i*G95<DY$qW0gt*V;eB`Pm6v;Phyn^
zslG~k5A9A>uQOmBuCZxGKsdEl7{g!9MDM>T!u9k8UiaaI<X+z}PcsCk{EBx(sF^t#
zJ{SGP6GhDSqlDL55`MMX*a|KKJ75rVuF#ZcL{8_4VJXFZ=89UeVF0@{uSMmjr9KBs
zY!NBJ@ySn-Ko_i#o;;q%PF4#vVX=CG{84C@-cG%7Ds5x!3nA%IX!B7Y3v}+-<Mwnm
zqyt+Z3sLI7BB`U;`@|}QHJ66Qo1AN!A9IhIjY6W+lrH%Ux5Y*pr45T{-jv%EA~zq>
zPleUCE9BXjR85sw8BU4n_9Wb&>tA9+oL+rtuf_`V7F^T#r92S$T}r^WHH0utDhzDB
z=#dd!(<=W+@gS0<jz`j%nH(XlkScfBiN6u%h#PL>Y5_5e)cz_WE`q%29l$Cua`!}1
z#{S!zg?bn!u<zkOJG>wUIFDw%|IXB-ux{#`jqG$;zUS@U&)GIM!j-$(eCXV6qw)Mh
zR1w9)ik42g&)QrC{JYw@_OHL`J!pC_W^{p1H0>MreI|ZsOLnHd<fv9Ue&rz`6(w+q
zt$O+@4BsQp^{|EeK5?%7+(fzYNy*Q@pgA)4t~>J!{aC+tD8jnG?Q$V&5t<GHnp)!F
z_BLyeSvmbH($9aW97V<3+Ij3zqcschv=Y4hX!xw_Cx`FO<SAF^&}`fFzjz*=f3cj?
z%=7Y-P%f_U<;bu+O`MVZssY5r(_CJ7wvm1R`{ahx6lh5eca=rG$Hq{COqx=olySNP
zM2Xp;osw<7aEltUv~JtdvC((W_=*8dio$kSMk*}yxJ#hgqWYdOx~&N?lB8#+e&4G@
z%|?Ab?+9&ICNiBdb8s~9dqI#ofhz_V!*oZzrb75`))t?NxGqTIL+e_t*h!hIJ_nLw
z;AC2Zew}^KmwiaR+lj6xg*PjS;O-QPb_0oA-yXTy_D0h_ZIW}qaCT~khvkt3LpgA~
z=2=_SH9ZU1nZ3&3jzR$7VlrSTONn1M6O*PS_}H*WqxQWmMC@I!fhA|m%MZl?PZFlF
z2k03!#E((di5=d!^rrOkK1((Em#qC*=3E`QVngk#QRxi+73&I0Xx$$yp`WUt1?|@~
z3?H7xcss~la!C(~jzt_Mt#^}yq3$db)<l?`(}<L$4A;Dt?`DmzmiW?gk-_1oWUtrd
z;#T1VmvjhRg+85u20WVs_F?a-I4=5CUjxy@lrYg>MQC1wXJ8NP%s(WRg?o<bz!#Jd
z_uL{8LqkJL`e{mY*aggSCGAr4RM+QV*}-yVgvc5W;!ybNCyHsm^<<1Br_e}33acV9
z_f{KF9M0mAODKziuu8gjDhx|IJnPr=>>U1!S;JPu_DNPEQh);G)&iRS^gB~iMnEwu
zL9Vz?JY{Fn-L^pG2UooA%PU-Or2zehKan^&b#-FF9HG&UhbT*tw~jlLg&ZqxaNM?5
z+0a<<xm)3=Ea-<0N1|g{LTAR&e<|wZXWuZ%@yVM+z>o`p&c_ZQJ;6ivVH>i*v+Izk
z*|nsFu`WBzN|*R1SQZ9@dF)OVr)oc?`A3XtFIs9I$|UY2ucWoD|8nBFy6C$MhGDGN
zThmQ`^Ojsh04**A$e>bsqH19Zp>zI@jt?AzaNp59UfGAG(3@)G6dA#1QGer~JjHY;
zeg52Q;|}V;=j>JTt=c>kUHj@}TyE;EM@MHcUxG$=$0k1p4-O8Bf8x_wi;xN!WBn><
z^jb6`-2{g?nQ4cq8Vs2Vzj|RpmNy(O-3KTdulW~Bp8o5oTogYf`$s&X+kEnNK+n&V
zyu3WTwu2acz&-P+8Oep8diwF*7NO~kQh=nfDW1hEg;<>ta*JlhDspj86~C@Prj=LT
zi&LMC){nWq#NiHD#eeXS#a>UYtqNfP06TYQ_`y)T_VDI8lh7|IBSi><!%L?+LZDL<
zHp=lF%9Qey8*hOgjO<RAE}Nt&jn7LAY^F*q`Po?doYiR(v2SkDG3TXon2&!iak-rM
zyD!2qgmri8$5O@(mkz;R6bavt`@|SRs70K{(mKW+`$YoI%EoC}!X*B|FfDRSU%yC_
zeT{<lZ2dAcFdV{h3(Uz)Tf2NqOugSLeoR)EVN-|(L)8-47meZYizdh3Z9HwC$E*1D
zzKm8b7G!*d-yi7mDgB7k)r>88rb+zS-hIR<PCQXWr(KQS^+cW>D>$<p9<sNL;UTu}
zLQkU(nB5A~R3W|A6C2pwy`h4a9cxxy;WJ;2Rjg}|kvMh|SngB9wSF4U%7ELc(#Mxz
zXDU|qjM=nV+Ss(m+cOHa_kI}!S(3Lu%Orzq2%9|hbOQ6e`x06WdLXB>%>8I)^s$(G
zFC#7>-%H9)O%KbVY9OJJclh(OVQ}~A73)Gf=#{*B;){||dZ(i%Mhf#q>D&m3zg>TC
zZlG|i?S~{9m{G=(+n8I0t<piBuRoUb-NxjyF*f!oX_aQQl;)^ntm}vcmazJ}Oa1Ht
ze|{_kc$Rv8+fXTzs(7zTSkizCCy}mFFaevkUPy*lXc>i#UShH(6Md*4ycmDXzsMpR
z^!xw3@bA@G!e-oRp(mTzJ`7gHy=0AO+#Z&zwC~x$%@m``A4*s3M8~QponogH@97Bl
zvFf1h^)~%a0utqJkMdPjv%ADC!aC11dwY#m!_3}-hEA{}<ZiFk*e@62V4a>=+4n~J
zD*0baHRxSD06C{|8TJD5m?Mxow{rHS_tlesMEyhezglb_yvr3J%PFpVkjY!Ih6890
zw_0a4mJYSD|I|&0=wc9g`^-;?ned2Pe>_Z!&fr_qVes93<T@_jM{o8v_cyTqfn5`z
zxx4^)eXOEcry$7Q>-SHbQ0nI7Ppp)GxOL(Uwm#~k8-s>l7Q~MnLkC@cCq{f5tX_tw
zZPtQh-afijL^gS84u8AW#rB|G86oD?gP`CuZ|pk)0k~`hnV5R~A;8hALV-?#O+C1!
z3kh)q`1_Uo%eh^;CJjt*a3W%dB|RG$fjHZ;*l!n&*o;vf)qlNt|L<9e5$Z_#9BwRA
Ry!GEu4OLy03MH%X{{j4EO8x)<

literal 29618
zcmZs@bzGD|*YGchNT(9gE#2L)<O)a#(%lUL(h}0$DbfuBOCu{O-62cq(k<QayTJQ?
ze(&>s-Vc8)yIebS=FH5QbI$h+;cu1YFwtJ2J$dp3Q$Zf2_T&j7+mj~<EGWppC#yCB
z3QwN6dMbb<H9o@j^q+s!cn34kzny)CNQ-1=Yg$Sjh%Ct=@oCH(l^4gxh&~q?MFz=R
z&%4J++pY4~GZ{=WbgS+N>Q}fjFOom0y<j}QU*g`N_i)&!<?g37vsgO!Y!5Zww-&VA
z7d^OzUCu9~1X7|<gE-xHe_6%1P&;4f8Qf;^-H-lzWA}Zg)_l+`e!F8=1y)YS)qUri
zd_mk#Ex8ANeEUbOR{oSy#hf*s>ShfONfIYsN<%_TO(rE`HIj&+AB|cSK|$fAHd6w-
z$$MIGVq_x7LFLUG9{9=%fB(i;90u!+lLq^Fzll<H25B+&iB)((nZ4x_`ScD}zD}`B
z=IXuV78oY@T?am$13GP4EP?Tv#@}7h#?Q-O#4AyEPzM)B`sB^)cN=m`;vnIU1V772
zW+73n0bAgppz|<m^W~WkPOFq_R<674%nTEW`807l{g%l0y*|tQY&FG3V=dS!9g1a0
zOGiiC6@tm#@?i_{2u?7;Rqb_8CwmgiD?1#|PBPuH@J(A@F8wOu%2I2`eUgw@J%wa^
zMT<n$_u#3g^I)N8hF)5&c7Z!_@tIvbyWL*P<sdzv)y{Ybt&o*g7Hxf00o}M{E1b40
zhtD3SaWLO_uztAmlccn?wD)&MP;_u`Fsl^L2n(IHAk_3{j3*${yS-=<{*kydetGeC
zW$tN)w<o#Sj#a#;>NM_Gn)&OSFJ<c;v~`1hlFF*f4!K8SxBXlVPJZ!6{~|VgRbS+1
zm&N(9A9<@dLa)l8P%(L!FQG<ebx2Kl?~>Yc=B(^pc>}^iIMm@`<`?9_WltshC(U}R
z0u-2@S}V9wzV^%*`o+spM$yGFGT&gYJ35{(=l{pOH98!h;gxg<1}Dh$s4y<h^(igu
zX)t8>iFG=Ub;2K)W(;eOV{Gx8v3FO3B)+~Er=y~ynJ4RnHFX|DHQZ3Xyq|3jD3=#%
z^70bC3YT80q7I9=qI^F~M7c-9vQMK`N57l6E>-zH^IcnCKdVs957C!CD(q`UP_`G1
zC!29MF*W7)Kb_VpW54S}4WtZnqGr{mv(~iBNK?Bsd13lWu|BEB#w3r|Sx{zmf*pEO
zn;I8oPsvV6MoA$h)qqai{6l48;{A=bdk2qM0>P!O*i1oTdf)PJy9@NHdDe6P-MoZ>
zgwR*c@NMTocPbjcQ@XWRa;I&+T0<A_WbLU~YU-f8+l3oGS?4Q`GFLE&wK_W$`@G$%
zd28P@KV^H<czwQ!qZ)cvK)!)T`50K^NcWBt%r4pZ`wE^V<og;Vuq=C?=JQ`RvFbLQ
z5F8!7)6vPGCZ}YVl66O8wAMhhwq{#%?@~eTe(v@&iukzyeA$0l31;uGxG>zlbPF$D
z+Gx@8e<{4-O+_&uo#xCOUGk-I?}ge#3DU%bUY57V&oFWDp7t`+gxYNOaeo8F+2yV+
zu&%$CYgOMRN4M?1u-53D;v<~1uO!6BKklEY)Qvom!2xz{uCk8W?O#jAI@2ob<G4Su
zrd9Z!mz(*qSE!!-PdyP(5r}csjuPV%i^Svy&9j9)mP``}!fwcN*4EZe|JFBW`c~eW
zX+d2V%8x}>*L0tn(UxtHiK7ZyZwEp22&S+1MLAbyiRyDJ`)@`{G8>NSR2mK#YpRo(
zway|VA_nT>Q*%HWS81?8(Ah8fK}!n13uEjAf``?agc^|^)HBqD2u&VRi%YqI4}nrh
zSuDs2E-KAZ0wJsOu1)XxF4bjpKDCAQuIe&-;<_A_$0dR73+N2mmo4d7)ec-a^G}l8
z*%%#M`LESh>FoC!>o;~a%#aFb%g*(oXbR0!vO4h3kljcHeTKDm^@6oP$h#c>wDZVi
zU+bfz%ILNmCYRDm#kM{%+vd&9&Cx&H>S~67&X82o6~M}jD2hK|1or!!fwVm~ZYT8q
z>2?#hpM!V5#i#m8Y3kTcOsIBdVbd}&ki341t2C^MZY@|?aLIi=FxOUhKWDw;{`!bI
znAW0G=P9jBpQ5djj*#Yo_i{km6sC(lggY-6mm<BAU;^%8$gEkhX;^PFO~!YGm@uJ3
zxcA!ShnK#OS%Z%JAmhy%{=+QF>m&rq>l{T;u_{Q?vU=X#*ss&y@3$Ucz2G{!UF}bN
z=}F9K5<FgSJA1natIwSM?tLz;IYI5;#V2slNyQg8ytr$7Sw!}9R9W}lH`}xIg<!aX
zzN5y0$Nim+epTuMJ2q)V`bk4>7^XZJwr%h9m(|{oz5N0%ftq}`Bx`VXKb&~I78eb%
z3kq`l>Wd4A1Tv>)9T&<HBr14DpVuNL4~Ae_Vj)`xgqJux$-KD_hxqJNHYR|MkDm6S
zqYRX&=4(`?CMCT%y+1kmkQUm0buy`P{Uf!2C$n{K7JT5Kf_HQjM9nUxW<vkn76h(J
zC7PwjwoY%I6yUc%)pB&atQqnZz22=;kTUT57Ej0?Abrr{wxhU62uzox1_3;Q7-SFD
z<AkLQQQGLj6>IwMr3<EE^|sH^1?Qd}ahVUic*z?)ngLnuU?{41=(CRG2svlX09roM
zMiC7=_Dd+q-8-uG`EniP>~NJKa?y=cUd@o><MLPh{&G|w7$3QhiM$SA{KMWdu)5t2
zecFjFqN^bSHsmNq)18$L-e60AwNAZFNnFw*B^xm@aYR$!eIu|+5G~SbM=IxL)py#-
zy)<DVi*D-&e9DGRhPbJ&6Ek+R1#~68qG!KMr9ZcQ{45gr^uS$7Cvf6%Tv_t)S|0g=
z!uObAVnm!o1$0#v{&jXs#o>B)y(EqpggL1>@kYvbx9-R5!;;H@DIwRbx4%fYCh?PX
zU#wfSZPz~?A92~)>3B{->IbtfzKyExc0Sj=6jpc~$TupsW<I=xa{S@7)al|LSv?nf
zT3RiJj6rtn90Gs-%UJ_&R_&}0{E=PT5&|tLKi3`3PXA`=Cho*|TO3E6Lz&Op_o4T9
zW(9}-Ysp#zmF&R24iv!cepZxcmu<ubJMzuSSv4;ezqL|VZBXVQw7(P^Q8}tjDu1+0
zAm@T!ilYSm8NVA^_BlP=hc8nOC>qoTj>l50(nXd(%q&i@_$nP|+6L}RX#+fPCROUg
zLnxiJY(3`FN|@BnjBMo&Oj?g$Mez><yK{EaF@|;1wGzP-x|9DsO96+kt|Sn?naB%|
zOpFDSE1*9%e3y_S5ZcBndCosR(tOs&dSXlU&@?qA+(h(~bE$a$x}t(!#d8ieOp98<
z#}24t+q#oI#53BuoqK^}Kp97;!A@JwOdfDT9AaZ*4ddhDzSRS#ytk0s_6Y-0&LLS<
zF2+C}mL;3rj6ber03c4uZst4I_$~YS24AS_#>h|avt8?xgXLu+9;-M`vpyWti@$#i
z0uP)p&EFEZy(P5&$~t1zcZXHg4v%2Q7<n{J+WckQGPW+|R%%!$`-}5LA|JoSXJy$%
z5p(yZaTo^%;9D&^G{%4VvQKw`HTxFXT=luzcnHMp@6jMTR2L=|$xW&T{cL-EvXvk9
z+A@f8;66l`$`Ms}ZMlY;!BrL|uiJb5MZ9)+c=+}8=}s}^^-6Cvw;o$6r{|HGDR4CQ
z0v$!Ab6dWuvlv$6@;<YpTfcYyueg1s^~f;L{HAm;LtDz|D^2`T@~DR3HUsR5z*DfI
zBDFJB*ilGHX{@CEV!0N(^wf0bnuSA`wxBWg<bEx3tJx$MQ>Kv~5yfnYx$gqQSj;Cg
z30p+gfs?Jtm&BZ?ieCd;te)EEDnX*f3aYUSN6|e!lDxkEcI9~kc^_%c#{Xe+><`1u
zm$l|%q@1<ZoHbah+B!L-upTY_lL?o61sw?~NfT+OnC%Fbm(X(3^w3W-20pF@e&NPL
z@8FhGl@olX*7eGfE@gDcZ102((rN5D^fE5ymyIk#VXv5MOUhf_cHG;PGWk>nun+Y{
zlzZ|3Z?pApZ-`QPEo$%QLzxTuUs`-E%N&HiN+h_x^48dBWOYw{OM8`;Fp&2kw3EsJ
zGWs4^e2EIdx;vy__NJ&}R<$kZk6@@937=ism1vj9^A1a&P)|PJn1T`9xhO4plBb|M
z0}Sitenp*c?pEwm>*avEE4bL|@v{#4Y3!0&zvTm`*U2UVeleA6@_Rk;cfv!1rDDGk
z^1bfu^1X7r5fj_biKm~7n1N2)9(-(?c<2$za|c*d6o%W1q<(fnf(Ztx0FL;8w2P_1
z^JFH=Qj<@iU#%TV>;j#QeQ?`|iw3%GU-QuqeQs72#KpE!o|u@3nwrw6FI9NIg>ZS!
z5O!Dbu*$D&ezq~xbmTck1$Zdb*nX((BMOIIAtNDWn3a#>uH(7JEFUK^swe&CZtvm+
zKH1L0q}t)g$Ho`zm(_9DpKq)twC-s6Ozpe{t7q<;7Y;GzVUE`GSad7>$cKW!q)DRo
z{lH|!&@_kLO+5eZ*vlrGO6Ao%{B^Y*ysaP67Gf-tMo!!-xe=L!{6)cz`+4`^o+sn<
z=A8UV#lV6x40Z@(YkL<sC5<0=-EHmXbPz=$PM$eud9-*ND{>?cOEvVH1CzI)YIb-u
zg>b!&6e`()oNc1}0^>n2{gVxEk|m6sGogVnUu08zzT)Xu7L#k|G11JSnIaSQg4m!V
z$wK&djOamzCTcCy;gDb^=Z<A+Xtmz;!IWY1^?ob&-&$r@Xi1Zw4TdkQgnw&I?VQ{G
zuq7&k#*lM_*y))14z8d_`fj?(^HAcmEHZYG`yQ<0o-Tk})9;gS8&?8>y41KIMKESf
zEKW%NukNhAXZxw8>cuAb!qkp?gNELF^=6@=4sCsFI`F+&RXOVDlw3@R`LdppS}>;(
z3laVSfuns|8q3`$MwD0hAp3x~pH7m^GLFrwxa-HP(Cww3(qx3+n&5f%5L%<YgCkB*
ztt`EVUFFM0Z--vuy3R-UB$ub(BsecMZGaa?>F~+7wOpsT@()X{9agKqboXow+m^K*
zo*|NO?0$vc9|elM-gaJRa$seO42DZLN0FGA+G&ot3*e&JIdE{Ible+V9<9-^nysqE
zyMoFhvrHTbm$z&;Hfzh4%B$Nmq8i4E^vg~0XrrE)cK(uouk(ck7Tfw2Hz0&a2QMz%
z$cA;C0I)JNaxog`PYgDF($S=ooBGggN>M)#`HDlRV5RWzNGtFN$?=EMYilugXK~2*
z$0-v$LWdNZn-=HFJN6@Y*Y|d9jeSA+^p<hmbZ_{3)O)nxG<IQQ?!WjMt>}6f;AsmK
z;23gIm}HooaC`{$JH$P7w-1Z%R^Y1v+4;>bWdja^C{)wP)wk9cSz#(Y`D1<(G>Dir
ziKx{Ab#I;5X&4g8*2yh|4GTVZ13x8ZnRE_LZHG!(0;-|{@wQSohJNwS!!qyKY1#fD
zdnV>QJLTtzIphCm_wi`PmzJ5?Hg_h4hZ)oOP||2j6A>m$;eHfYWAuh2vX978Zu@)S
zn7K%hQLXbt$lNS?H}WVOqd$i71XrV>)ar38VD}~7M9_#^V10pK0XEl}ifPWm`qV$*
zx!8?ioNeGkr^aV|{wZlP=Uobm?eTx^$3kv4#P78!k@COGk4++fRf6~)5A(B27%H3o
z_{GsHKlF_mw&WaU!Z>1Pibr4-(KGd3w{I99Tl8dX6>v4_VZKrB`wMgShwz@so}4xF
z@g-6u&J#IrX}A<zDtOF7;hqpL)hT54Z_{&sW<Htg1B2@vmhqxo7(s2&+XaDmcWOUd
z!?&8V;dM4_<9t^VhMSY^f~Iyv`BA4!@-1?|=V>lwu{uRoBOwyZ&k|!qGX1`<XV^N3
z03kmEx~g?`cEJinuL`O@3k5dY{=|9^eA1<aXZ4@%S2O8u4dwMZ|JsXbW{F}8#y?A=
zHRE1j@q3NRH=(B0X}&DY#kSgwbDy|)q^}~*_s8JD07UYQrF?Gd&SU2^_xaSmM~jBb
zPQ=_xN>#8%+h1ObrCi%SBuz=;RPb_AW#nvc-rGuQLZ_fg9y30Xj7QI(Fr2`ea)Q9E
zV9(s0Tfb?Eh9f*BxoPvMOe6zazJ%TvMiOUY8MqXZbsbB`{o0EWu5fUP1gTi@pMwua
ztddPfKx#%-XIOeHLH;gIMG{t%t7ug+a7#6(g*{l0++){ys`~F_M~2l}8;r>0Y|i)3
zBAfQ4(fql?3FNc;@d-h3awifJhPu}@q~7rPTNaf|0@U|YcOSivI8T3ko^wZ*Vp$Mt
zVI@2C&-hqNDoD>J>f@4t?M<!P`J{k(|7J$MR$LQK$2^PgCA5!Zg1{5UW93a^Q!pav
z_z+>~*B%KCDgWBFd2J1EqkWO{-$ssXVXCp<-;!)t1;@UpLAI}hYAr+|0l-$a=e7@N
zSMBv1HLl=VUqBga$YKE<xL(v>C_V{m9<vaMOX;Pg3OJ+LN%$O1x}%oyZToGTT=#AR
z#w+}S8$wJYi9n6}u-(qVGTOXI_Np8(y=Xgz=linr*5$BmcXgwQW4@=TyEYhxHbX7`
z<{}>G4k?n03t7NQKUAOk&HV8_X*k$C#7@V}Y*J`{b)NcF>`LAxk#Q_}!m=AX?RuS!
z6~rA`CzY=Ks*^XV#v$g>!ys`k4Qy9k>YsgPno^VVa@}^4B(r?c%mU3I4K!b?mYAX@
z_y*m$t;6r^E$sqLj{lvf;~{Db7%zIguTF>(SKT}Y)FkS)k?moT#B*?9e_M0@lH0JQ
zy!ZD{7aI&80m@Rb&G@W3^)G%OVDNh4wLds2PIV_o{vDa<Tz>Fe8pja1RfG@KIBD-k
zL;&f71X8g-_xIivVN$a}|BS}j_87>?cToyNz&6mtxJ<4tbE?|`mvQ%Wi~t5nm0Koy
z+G_$G<**>W4s$Xf5$w416dtd`6HCv$snl&eW7;dCA1&A!P}GrHBOfo8w3Kpck4s~6
zOsTOPP3LCt-d|`oNJvjlXFV=Qy8P^u9KUSdkmcx67zcf`=w2p-siW)~^4lkOeTAaE
z`8bfjR+wFfxpqXiN+&&Az@xd3c`m!!N55Uyl$qupYV*z=o|Rg+bJBJ<0Hpscwi`VC
z2>Az(s5m}?xwuuN3SV#ch@SXUIhWeuKr32})*<(cW8?#l7YN0Atnf+R7a20eLO{~Y
zcS6e$IGE48fWt}%CzYu-SM0aObJG;>?JAC$22i*l{M(`iFgr2p!<inLL#m}bEk~p+
zLO{f%v5!kd7%qjBtc^Enx{B0UM_fP*6)*qoO~vZbcW{rDo)eAI`7O00l2Pxek%@F>
z7)LViAg)XN`^xKK*=VX*65dczQ&6nmbQlmGtJ)rg%2qN`cq$APctr8JYAug@on?CH
zad__a5}jW+aH%ou`O;Y2*yLLrp_}k|DJrM?{V0JsxMO)>Ii##nug_6@{QH{<-A&-Z
zATg1w@;9Spe#Pf(T8R<v6__r44M#M>_<QICYvMfPm<c}p!QIv0_-whqx0zpD9Qu9o
z5X~<x<?}B)&I5Bg)?Am^u$0v|oX0Goj%cKvr-ITK-wANzUWt@D8|dHP-I5J<bdau%
z5e&#*k{#Xd8f%F<uczNS=o?7OgNIiMF@w3}B3<oI()gn{YXl9{T&G;91XPH46UcdO
zu>6$=DqgG6dkyWBk&cLzF~+plBa1@vw@O+qTsMAOXzwE-+vs0G<C-*N`$$$AmBn6s
z931NJxAw{l9|Urc8AdE;LPXrX<W)P=>;m`BM+cm~y1`AN3<Y#X6cnE8EI*1!Stjt9
z&cm>7u~yC2UF&(!zbe;7Y=^cA@DHNl{-<T#6@=n0Oc{N@CxQ~nJkA|NW-Qm)Sl->g
zy4>`;5l%1}l!%bx-#0F}3~ChLu+YV&TvD?3(AA=w!ULtnGLht&5aTr|6JAbZdpJ9!
zyi_*Yy<>-4e$ygnGHoKDWqXNP(zZuJ<d-i+>we88t-;|e_{_9MxWr_L$h)a3GL7QM
z=d$s4kLB&vX)3b3&bned>1o^H+PtbxfWqfiG|Ax0$3yj&yg^ODv^~^T60SD>DJU1e
znczMm$7i}!9+*rP<#=AMGic{~{DxV^$jX_Jy&#3W7doNG17Q3g`kyJO&FVmD3|W+G
z0qy#opyy7kz^Zs9g@z?$tp}_PXe|yQ)$8kQ9yYGCWuT3-RDA8p+~49z+eziOukqyd
zPy#c}OOap%zp7>QuXj2>qdSg2&(rUyr*sxXIEGI4|9pnan)giPj~E+Z5`ZW;uqL#I
zeki_a6MFqztS9I>XTCj-t7rlP0W)B(3-{!Xs_nwIoy&2jcShhc17BIRLP}m_7J3Gj
z;}B$ZUQsHWPdl=thEJ{P029wci#sdpJ)?&*f`>OTR)mL>%10Ebt`YBZ??8l~>f6r4
z=Ca5C&<W`Usy|~eZ<paug@?Gd0dfmE)vxHxw2k_xEcKOw+XlmHO84(#*oFpi(%JwH
z!-u-=F628F0Ul-Y1$N()ak*O_V`~~03(Dtt&VYUbQK>Lh0^ZEuI|RcO<@ay!mGn4}
zqk0UUoAy4e3(z2BF*P=FCWI5;Bkq$Pi_=GgTC;vL!y*nnY2qYSdvRX5cDwEZf1{!M
z17Wf24&Ee5?J5jsDL$}>*<U_ptfrr9Z{ppmp?6m(w@>ZM$=2>h9@H6+qb92Bml;C~
zI>NLU8t<0r{We~TB^B5sXXij<+sSt!l#k+RAKY}Zo+x5Pt16?Ny!tbU>$NV-FYjkH
zr%j<FTMflyPpY|qLN}@TkUU@e-}KSMHl4=erL*lsW(~ZfbS}mCc)6C!o*MnPX;Lx-
zZ!RzhgG2zAu(&SbcO%{Qhn((bvso^QUs)O8f$f~g#ZM_Y*DZ5=8<c?M+O{jQ3;IR*
zu__EI!<R!YNfRC+ay_7n^!wGoS3B$L(ltMoi3@){6LDas^@#I2`M@O}&T&~HQP5;s
zRV|$~o&>zx#5xtYS~?}PU+9SAZeoj4TBKyY-d4*jC<(KkhWxjC?Nin;P}{<OIXj?B
zVN^+7t4RZLUsDX_=MpAETxXLH+tS)UaFSTfVqH&RE{DCl3N44SFjN3$z#e{wMN>@h
zWv<VeCX}AQd7$Ti0xd^zxRtkWv}7!4Om?zm_Xvz_>o$is&ujVJ6r&apEdpwrlGLwy
zq3V!X$g5`65%|oa00(7|j(S>fhn6ilsp%#MC&)XChw3j)horxYM0V<o`REtX`X0#>
zk_-Fv)n{f>>)Z0~?(T$!zJFc~q|u_fjU&UPGG}Tx@qL9amyIf1po`3=_i{~DgDI@K
zuh7S@CujS|@^ZOWlU9g*0+Yz46k`H;r1PI6DD>X$)2`#9;!MT2gx>DS$@h;Fozv%!
z1d1wtRRt2N2d|qfQl!aBz0;UwkbLVPGH9Y^kuUO|l7)i{fA&U`2={k2_0fl8;$elO
zqM|adVII?>&xL!fMDvG)H(M~1TE>G^w-3Ib&ggD*dXy6-d>{ul;r3THm;|8eBYGda
zE6}q0^LJ6WfT!1$^;UN9rsBhqE5e^i$Gg5J{Y;hk350m5F@rz+=H&f>_rj=E>1%)e
zr%oGlGVmBRyq98ox3nnK5Y^PYmsDZ`Z7l>J^@<A_p77C43LR7hq1i9B&Anp$ph+u-
z7T*-SK!3?ThhkW3%m0_;r-y(Rn1|ApWlaT<Q{3mmDU{*MN0U5|-kaOI>x0&Qk3CS?
zi%FH2|7Hu4t8k}4U=OB$5ZLuad)NEI8$siCdWL29dHYFYHWwjv6dmS*eL`253v(&$
z&GTB>)b%!cKpy|=aPr0pf!hr6=*enfyfk^TsWnAh^Cgzbc&Vee+EA082s7CS;V$Ss
zx91(9q7po$p}YN?fBo&gBn-k!?BZ@&-0m3hED!%68dtB$8P<Q$t~1D*J_lcIMz)U?
zPrm1njpD^4U5F(WoB-V|*(-ax|0NAPX6tnAnO*BOIzy+XO<+-r9woO#rEPg_(b@7t
zAu=WH&{jb&Y~tQ%Se{CNFd}75JybsTeq|`3DVW2vl-=g<^`B3hFN}lxa`qQnyBKSr
zO2>GgSHlBv+>@r=@+vY2fb7rEWaQpCMK66({x#<eigw~=rbEk?A_!N|8rev;i&r29
z&9j+~D1*>?<%RVQf<Qq;vqR{OKTeLQxi?!<c$2*TJ|3vl@0&$IT-z<BnpMD>{UP<E
zCi>|wW0(D|D}yew?CP%HrCF%1V#l{JjkTE}Pm1I&|K$cEs&7KKI^1g}c0{HE!fQem
z;4Bdjmu%$-zIy22mw0j(G-6`p7WtEd->^2qx2!S4aQx2uUNHOdSe+|1&%}+A;}KFL
z`F(q<Buy46pUYg`cEtDC^Ci9K$V0@=g8Slmc9uzvXQ#2Ilyfw|eb@UeW++h#3K4*f
zW;OpI1p*c56aDA}#QhwDUq}?rpOfCWy10b&FZ=({qSv=?(JUSUL(oaxxj|*f-;h<Q
z(LsZ?{(paWl(AmmZM{}lTbU{Z6M|9~iImrA0AVWpzRk!}abk<wg}<=rm#4x@<yfLM
zzOts$>G7=fB&)kldmmHvHj|c*8?}EpWw^qC5d|zdB|`$Zk9qdO)*VFuqIXcS$7N=w
zxw*OiGbv+3d}dF{0$jgp%7APkHyFclE0UiAwWYw&{T%hvd5HC~A(ilTZjEFZFYJ>7
zseMK~9}sAJo$q5Z>{WMuZu_B9DCMI^i@v`#d-qbnIbMi!=qor0q79?@yySiG9U<xk
zwR8A4B|PQE!#v}*MeBTsLqeDhF^AD7p^wUMFb?`c_`s_!@vpE*%rSlK2?i9iR~}+e
z0@w#3gjc3N-b0SPLG*fw&}*IwRD-<VrW;A~&s?8JV;D3^AlB5F_!)2Gx}Z?kK>=@h
zIl_k_2is`a=_6&9_aVto5$X9gP}C6VyFL>ZOS$GQbAvUMh~?}%1Am@F6WQy<Wxwqx
z&(m`uEeedZrYY?YKO}&)7QA9%{jQN(4Q1N}TrhU|PyA>u0_6=UB8Py6u6|HJC_kT&
zKqxg8;Tw#PlY|>O^{R@BSH86h4xx`}zJI2`Fp~~20z^UXpJJ_)if?Y~58vP+9+LJ&
zR%6a$P(KOixapjF3P>J=V}K&IB24>ETKBcBjkb^dlvIclOSdRjh~}RoktEAoSIXgl
zIKrf!ECo?0_Jv*g-IVJCdw$`0D0fV4{+5q##Ww$R%JK`GP4Z(Y3Scf=@cnz`bH~(X
zHG`AZ-qzzRzs@y&({#C>Ssgrzo@Kg6l6jee%}SRwD|z!rZ^t&j`#(obF`wIuNvf^+
z55eM*9uW)y6zfkj2#50Vb0O83KqeE@1<_yhK~%jiSv@^Ad=ZMz5K>);)wt5127-i2
zK}o;J(ZPcw4;+!iKJ8fOw_WTAq&&ciS3z%YlKeSx*C451s=2o+mz_VERQ6M#GF}dp
zxK6iA?M3+X{`XKEG!)CFv}reOvOZ0hS{4MM9b&|x1(xLayA7zT5`!psnivB472{IR
z`rZZmPzz1Bt3WwKRwbQ$?2~{nNx2BCTtVvU>Z&l+KyjQMhn988Rt<ZU@z7HnDOA50
zr2^g;1vO{&^Mm%OVyd6k9UA@-NOiCIQv7*TOxd|gcg9ab;|)A;)O;@##Wl?Sn9TF(
zf}sE1%{*(oR4SKR37o2cQ=RnwEX`3QSqA41^~%+=mB_!*coz8=56K|3nvW9eYbthD
zcO|p8i?5aH@L?&V*m>;sMTInN#~D9-vcGwqZs+EC&Y=L{IrgnKzMWz#v-sV`N_&RH
z7u=BJkG1qK4>fB)c`s*S`!wK&f7IVttvyp`W^Me`^xIYYnyT}@7a)QG9BP~0RWc+L
zj<1qsU{29VU2N1|c(k^AlvHfs&sKK`d-BfhxOcQ4rl=bIBP`Z?8kfA76-EWG$_85V
zfAN;uI|OrV^ppBMMSNPB!XB-u@QT37(I_x*?&eP@h4Q5B_^W<I8fypR8J>-2IfLan
zY2l89A)<qpcV*!T4p&96{#`p+wCun2CGW!f!M6SrzvTLavMYR9oXAxXm%2BG(p{_V
zTnr;fLlg5oiLw_R5pxc+J;TTVA_Qc=Z#8qi&Wpu5ru$X*TVH9XIGt>cW1TO!j=tfv
zuLxL2qsL0y;@J4>hQP_mYovKkXf^tlK#s8w>L>>2DUk(w-y81)2_&2O6maxmq;cKD
zxE-MCVMp^U_qp$W*$-px2VskC`gdXS>(ONXuEQ%m{DPBkAoKJ|=ua9Qzn}kEXDOJq
zmF^+;&n=rYZ1Kvm%QTLgz0dcn&KErlL#zzRUvkwNtoyZAbQoAQoOs>PA5~WT6n_1*
z^B6!$A8IO|<JrxGO<h8eF_Ma1{UrSe*B=mCN!;*}hJY;$O9w*({(+>}MK-9Go|Bp|
zL#O6RVdcy>kj#}x2Ex;|y(~k9wa<n-EPeb*1#L~CP$NM8h<T2Cm4cX=ZoP`zUU)sb
zw)bswVY{YEs(D$!kuG-HX`T!lj&)u=r#+8ghnHUNY<?*lzVxvk)$cfV`aDsf(SsIO
zxAiUjrC+YH+a%E6+?HP+C}7wG4wUcZpDaVw+XtwKguB$;gF*CKYvTrpIUgV32oPW^
z2Eb7Np?a+hqB5EX>_%Muq1fqyagO?pnB2qHKnT|TOy+?DKJlAR<iROns%ZU$;p>VI
zG#u%WUr8b>OyP@+PqG5qr>50wN_tO%!*}%I%#X0MdpTmfNCH2xl<uco^VE~DNOpTP
z9?o<f7oQ|B;NLv9(8%@0Qd1KSuLcrt4<G!I(W`|dR*5HQA;S|2vp?L%i{KGHlE~d|
zI`JPu+J&@i2&bmbn{>{P=rXYT^CR)ZBmB=}4*}xCCl4v$$KM`O(f@hm@elHP|Bpxh
z?>7GbNB&nEVFNOHl+M&{w@HP79B~5iEq()P|LHg@EHZI5)#*D=caOpmxJel<^{Bp@
zZaT1GEVCsrn(CkN{|2e51IM#uOw^6(rW;YCPyHuf7(5IdgRO=ro?;bWVA7|w_~d`T
z2cm&ThU-7MN?VL%NYJ_(ForY{OV1!kcTxL`4m&uc9Q3Hd$EQG>(zeEUGF<flDYOiE
z7+%<btPWQsCoU^pz@uXFxNuThdO+B7uC25#y^q5bi0`KR8Sr&=`{0<YO7-}00Ntom
ztfh46!K82G!Gf+2QzV&%0#C4{q7_8IAzjz{*Ort5_yeU`x2#K=>7%m4(CFC0HJ4wC
z53twgSpJhsRkgb(V?um1_Gs?J^}loTsQCX(B2Z+&GM*8<DopzIeb(yyQ8VQznA9@q
zQTQWTwo-&IDEe7%|A_@^#!IcB#7os1dHpzETDC{gaQ^f9pVcJ!-`9tf{G)Qh|ABC%
zaCF@M5<GEJnfe$l`(*#05m`gTRAF3;DsG?<4Qt_@Gn;IJs<3UZm6;Oq#@+C3&-on1
zzuFIxnW}l=f9N*QRuXsK)q*dJ*A%mCbb(xyO?LGn3%>!$2%01kM0*-9-GKEFcAkH=
z;M#We_5KxasJJaCR>uMq>p2-l4DAg||0?rvrUF5_4B3OH7Rmi8qXg!@J`JE)^I#%p
zREzZm(mS*;G|6Eg6aR4X+bG?Qg^_>nELrmJKP)3#7iYvCa}^XuQe`m~REN+v%AU5}
zN<5_S#u=-LIq{d(&ee8L*jL*JxNR)=Ic!F6CCyS(D5m~<=0@`6c`Z7BvuU040MA=G
zhe$_2^mI-8@MTW}utQ%thtF(aBqu|D-{gVr@Bk@Jn%>D~mt((jBUmM=scR&uU&wsG
zc|2w3?K^P`QM3I|A+IdMDcev68Q-l~4&f!#K-d2k%AN$*%T|`=lwB8}wdG8G*RcF^
z@DP=8DMQy)R!(fOBX0`VzHJCMKT^o;r9{3w^;u#oeEWRttsRY#kIfavyz$$T)U30!
zL`Ma<!fU4a>m_T*mZ_8jzz}DMiw!+Mq8gG$Hlz1*Vc9iGONjhLKnBx3Ov#V%){tq}
z7zR{a^0wxAEm4uoW+%&;i4YO?{^ZS2H5?MkOb(GjL5I+f6-+hT<b;-d%KGhx273D(
zBn!l!HIt2s^E*k%vO|p&iaCTw`>#*EIyS7{PoJenuJN}~m0b^umtL2jFOqN3<+Lu}
z)KzT#pY+`n;I)hsYL*@3G+sA0fSD-afUEt*5w)Arh8Qj(`tz6+J8*uDFO5Gb5s|14
zx(6d#R@}U;+=*_@Q#auKM$cKg!yMc9k%KLYJz-Xkhtl_R-)%^93GW)d`I&0QORKjL
zG;}&$Y9#@TAq&6n68V6TCye~|6(nb@{bYp<4wc0)lOg@O9JTE`t11G0NO0bUnD$nl
zEEt-6Q4buI;^P>7t!_F-L%AbIYh?Tx!YQ$O(5^68ky%mj%r^9_2@y$kyu0Ux=Z_if
zi%eDTk#m#K`@WTXE`YS#gfbh(Wj2#rvR%C0Ue}&~X&rp|^{6k_2H?)!2`LT4rPJ5q
zPA@=g?(6({WOF-j-b;vl6-=*Fw`P+RQ_jiq{$0^e;ve|WWme62l@^<|FTO?NKEp3X
z&QG*SV)|QO4Or3IW^XiRD;y;xem{wBKE5Eef9D!5sC7Pjvq;`yS&^K!{Z{spRDtZ}
zH;%W61T9OS!Um1089Z;vVZ-gsy>A^S0^MkU@(X+gJ+vi)`)?P}HikQPcH-&l1@9)C
zR_(^VVZB6dA`xIa=AW#G9KEm~_;Ep<1ZlFtxT(fnfvt|$vIxEX5N+o74R<D^p{I$`
zch6Fvu+8tjlYy^z&F|Efy^8~{;(tn4v?{;bFC|}U4#@!n`0@T@u|PsfWX}r-?s)vT
z=`xQ^q5r0H41r0WPYft>x498ZI6=w0ERl;mC!azT0ey=?Uf1z8>l>gNW2WOxi68bJ
zx8rGCib|V2xCw`l%sQ!@%pu#XR9^pXJ8VEfZ<p_a*`L#dyIqY*GuQ>#_NRo+>5C`+
zs1rI-hPs#XzykerC_`zzrSALNKeo4E&8zP-&LwpQZZo@$%I!rT9k+qu-ER^@`uXq(
z`Ts)njS1pvc4-o;@-TY2hXCejZy@KPLrsP1P1Mx3@BSr?ka_b&8l??-Fk-=Id`Z%U
zu6V^$f-|CeOaC1zj=b-sOCE=Q;gsHmz27WJ6~F>ODwkFP0fZ}aJS(SR09Wh2m&v0n
z@@0#$vW<EbbT4<GieE#(AVIB!$%d5ceCii@{xhs-Jp8SZYtUux-D)xgi>L37JW%Ya
zu}T`hO<nwJzQ^MVCfH(!5CA0N)a_fakWfuK(m42Rv@Nn&=rdb^ysF0cH<Dd>eMo)g
z90pH@2>Gn>U!|of9DF3Lm62Wt>2wA+ts>(fDoxViN@W(hP~Irbh1iBir#=GW3j%)|
zpc0vas%0eKx+b0g=VB{|0-SXZOQ4a9b;E&=D;MO-CreyQk?A**!M1(YBJ3cQLnM4h
zc|7b~^ih>INTG^d8wEC<3v$M_0kWX<;G~eXYP=l%XBN5eAvyQN?6l{}Dj07*|8+c4
zWk>=r4Y@P*oKP%KczM*ks=eLelcd0kp?b*=exL!t%+A*Q-kQTn<`G%*!+>dibGzEN
zIX}ZX1xv6fq+$_6!GI}B%x~tu_PmsiMzz2tUfGrZu2t4B*jC*8tq||>qSPwS@04t=
zP(Cy!;RUzHZc=Pahr-njqoXfs{HQp*^;cB&OHRg=n>4|X5mZ6|T%pv~!{J`%+7rh$
z$u#f3V=s0}QP7jJQMb!<P5~Y6R@14{yC+6-VJj`W*zJ<-5TJBevE!X!OajI_7V3J7
zc(TTW9EEAx{hlTU0?8Is{!FEEJJfjgG+3r{z}Q{b^{BOV-mLwu`{t($!@<(IT;AeO
zt9fjw+u%p1$&;q2S;H!B!E;J##^k5&M9VY?8NrAzGvdN<=2)@;wkc7*gQ*+b_TiDq
zqLsPnIbnBx5zT}f8Wg><3l2Xv(9ctnt{)Z>dcm(;kR7%RBLosr@CxO9D-z$Y>?d1=
zsy~WYOuLB8E6!yJtZ||FcVH}PnIM%3#L6U)Nw%QpO0{&Y=JLgSM^`orsPMacLd>K~
z^PRH(J^b2tQCL6y`1clfBN-Fi@`XWn4+Ua^BPW9Sa|!p_3myh3+d9ZKG|E%IQ-C7D
zNh*0PoLE9ZkLh~er-GJ6_yzMgt;~%MsQf*<sAb(nF6}RQu>PellyG{(z&UG}k2bc?
z;j*fjqM(p)piD^Zp#~1!GhD{-baMGdLh$+gt-ghS=xUrm1`QvzeB?zv$nCqa{!l@q
z$U4>Yi98+?xcvMF*p8sC`|9~va6!Gie*7zH24SnFJ2pJl35f#MZNR1-b0zC>xP%X?
zG5Ei<HyL2gb>Pcc2U$6!{PmCLr+%rNcGj-Asqy{5SC001=l3J0n6;tACXIn%PUC%^
zLi-v=oxVw~(|j7R!93T54SB-wiCI6z5#voOP`k={smWKiK%x5mK!gPrfZSt+wVnS^
z1PFwDkayF%$1ZGuF*y@qCo+x7vJd8zLju;d?R$X7(Jgou=c`0gvvRkKEP38V*r6K>
zO0UxTUq1=IJP+HwKAdp#VjPk&meQ+bUBe;IF05yBJM|dXApvSEg8x`(|Gq!6l@!SR
zdB1k{kElkKEN$##|JALB4tF^pPgoD8^!LszG^F=3`lBBn0M&fA+H1H0MKw0pg2%oN
zoi3Q>Q(NODH2;$04Z{%PE6s5wzCHS0CQ~f$P<bjZ1~AjzsBK4ePx#xuNW67w=OtS(
zkF_-h9-e?;Ms{J}_%4}@>lp~ynXzv)ub$0)QZ?`M7~pjpw`nuo6RHSMVHHZVAw9Ca
zmf;#-3$i&#42{~z-F0$eW~}&Mm?h2bxb(Cz>*i-q)p7A6@u;{{9d)`&|IvznaGr52
zZ*!9n@|n-RyAbWFcWc~T>T}Hlc&O|2vG<Z2>>nI3vxvQlzo)U;%qy*~o+>ERz?w91
zY3*=58)L9B04KJwVT6Gj+P~;TErTKA_Bf!Ab}8!!E{^~@D$_LdQreWhU7z+;Yy@9O
zoOOeHRi|dwn&ae5vVOuf(ymAz*Xi!>?)~NV&W-W;J+}ES2?vngJUar8xVM%hb8p^{
znGO7s3qFQv0C!1_QGD54SOWRdv*YiS{q`GjypsbUdRp>2XGv@;4j*w+H7H;N<=tCc
z&9rQwRlAf&A%es9oxAkwi~J3OgDFKCx+)0Cod%{Se0Jfv^+i4!W>qHKQ0`YzUKa|F
zEaTTsE-Pe9La*#Y#x49Q5g50Y#x!Q%b4A}6{Ca*krcCgpw9Czi$#tTk&$VE5n%N;y
zkZF1_HZG-n8lkx1Dc}qM!JR{j-xYMBfsmoi<q<!+CDdw7yHnzGI4XblNM3QQeGgAi
z!*EtWjcR&A^i&P=*G>s1gXlLVyKr!48#xEN@MXjAR_=+VrEB%Ojx*(-%t>!_xCjCv
zMoWW=I-NrrtAn9*Du%H|rD0(U!xMw|GE1cD2A{XAuxA6i3-eUHyC;`tzTAVyyXfec
zPq@n)c|^y%*XDS0_&eT5SOuFs(pd26$n4F}eyH5-UIKsFbd=T?{0Y2ovA{^4@gj?p
z^Gx8;clT^}C9M5!vbE9W0&?|zODylCDt#5#eAm+m8$Hsl`kquh3kQE5^&hBxTFky+
znDkyn&*T39%aOr|gK3;+-=>2x^=?8Uj+`%)dM$jcoA&htry0e;s0HTj)U1g?ayp%_
zNxe!7^|IWjlxlG@S};QCslDnnU<96@B3&1&pH>-qMvl06K6@M;a0^CmDAoUkv!AG|
z+K7XpMHm`ATd@&~45^0s(75Rm#(aIL=uN*!aFp=(zujT63xkf1tvnJyC6~?y;1-x<
zgmAl8o(xC)K$5nh6(wLp-E<jlV{Py%rHdl~(%@12VA_)e$U^<(viKCR9kKlmZ<qFk
zk`B4zGxX5$QqdULR<y!bn)Zgh$0b*yP#tep%avvD2%i9sLR<DCHVNm7>mAyxTPg4M
z+V>c3JDFn*OE}E8&x^z=Q*A@!I$fqCfrE-o6R}Ps=SlWx(mlw`Aw@tAwDe^aG((eW
zUh&a-kD>Kyi=;ieFFnAl`2h?g;n%FVVi9n5QP#{g@t<oEz}0kn)j%tOm_D7E(9e6m
zoM)%dtj@28i`w|hH&kzn^?bw3rGoKOvs^^XIKzdRamh33$g51iDJ5Ymgv!3Ai!{uQ
z(PR8xy0>S?9>5$9hIebP7|v_cy2$u73UEMdem-MZ`1uU*G9$8bX~ozqqjlT4?ReQ%
zT<%<kOd`YbP?`OHtG8)%)3H6lRHUp;ssjh#S)gvnI=4k<*9<@0T3L}%v2)i|wytD%
zVbTidF68>^w~bDcoL{sUD>Z^wHgj0U$B@xvgh3Q3T86^-%xw1{WT$0{_`Fxl@Kx%s
zn(F&r2D#FHu>N5GsChDrjZWCuG7Byvt^3w5?Pa2kg6eDc8-0>0NQru8*v&u4>J+|H
zT5L1AsGSu2=6a}PZY|^TUk~8;I3u8x8>pOcIlC~Q_q}Wasl0`8ki!&l7FdD^8K(|f
zNV(Neg4gikx3k>vQU}7m9Dm7VEk+ln{dm0;Mtt$32q5An$ZT_AH7_txmn=RE`?xza
zRe^)1Huy`pBeL=$77nCIW-?W<1Aki(N6F`g+Qm!xFjG61PJJ}G3{3?GHm=BEaV4!V
z+7z**24QUQIMK2tl7&SU<T`R}=bEV9iJ#C8yr5!B%nnDt>IFzjD<gqv`}ODZ`QV)v
zy>-8vKQPyJ*O3)!P@P3=CXpWr$O>Pr%>DQ9bUVkT5Q2UTAN%y$8{FLQ+7Sbqa%f~S
z1!HBge&2vp>dXFkDO$GNr<d6?f*x>NLm@J=_YV~}^&_(cbCkkL-jMvC2dhrFtnzh-
z*o%)CI-Qyp^j{nN+U3b==Q2i=cCVioz;gfYq$)WHZU0CV^k`Id-Ne6i`J(z#OfpdF
zeF`#=UqX})Ua~;_sY}K<Wi>#uL*aKk_zx^{IA22dj}2Rj-PdFCo?i~nnNJa2ofr$o
zje>WM)b9dd_ph$u{PoiapF-;$XB}lL!*^ozF2`Ef9xKQswb$&J|DB-*FoG?70FTQ|
z+z!5P9q~OhAifswbkkqDhKKgnB=X&C?U-!>No8W7j(Oxae!-gpx_XRwP<obR-jQR9
zMZw!%E!oABcR4~Jv|9?xly15gHSq6_LeuV0U9-fBIxDD9zet(x%m8prP`NfPyX3y|
z#^jf0qNZIX5EjRMT)~)a`JTA1!%w*S{ePq6x=#>!LjZmQqP?l((u@)uLN))8c#^6q
zbk!WzK#1^U`ngz}78iVGUA;h~fG*Q`40Pd;k|Lj5H>puDh6vywnFkz%8l-e&$Xe8X
zg6C7eYex1eHY4AFv#cSL_ovz&?S<3r;p{jTKg+F^$-4h?PRm}X@8W8!JN3JWtzxwQ
zVC}Ixqi5anR|B9Na{EDJU7m5ar>4nA8^M<uSy_JP+gk#K^ILCnh0xCiwvHUb84p_4
z-mw%U{EdW|rNr?P&f?b>q!=mYRpY8Q^MPM7@@#m&WSlyOWz7>Yg5Y>XnX9GMZP&w}
zVAh#fbBW`B?&~e=cx^E5mQ_7l4=hWMRpJHE!$TdlSjDf(3I{Vz;T5Zf{|gekP?3qb
zK>9rsmlia;1?Ns`60ORC6c0h-cos>}9D7)te64&v2Q6!OPZmzL#+&Z~N;YY{sU-!O
zg)uM60O$Q}XO<R40|>3&tN<q*oR*M!rN7P&6?Z>#Kj8Oqi?}p!du@1%fE@t^%lc=o
z)1htHJ%i7Gu5D3HN-dHBYJNAt_A{Ex1jP8gDFPmIw?wwV6$&R!^P2jlozr_ixvbO;
zc0W)hcYWb2YZz_&4?3oj!qzzOO~sw&wFT($+cex%5sFosk=T}TvF(k_VtIT}&%@dp
zn~Hr`Ft$VCBmU`O&*9c8+^x(m-)%ZoF<X+<PI$#5`x?rlaNRI{_3Xze@<jZ1>td?3
zZzlTHszPsYjd9eU-K3pwY|f{8)oW#fHG+)ZH~VLbW-AO*246VK+;ouY#<$GhhaS@=
z*eVVG0Y`66oytDkV|^7w9`8=r&N%xj1i@N?wLHIarfp0+wFD{C+_)evKtA{R^52LT
zLOK5t>&x+95<}Wq1^)x1_=?KyuVag{Z*;0uAM$eb-7<o;>AWbw<;qVDWAv~p(F2Aq
zKUwTv;J`Wgy_2)jF2bL%k8Sla=l$*4H=(UeECGuN-W+{(x=H5&E}F7gGH-L`{{ZKA
zE8GMc2d?LLo8#5}u1=8*{K+84X~p{=VdV8gfFo`2z@7)z^G)7}g2_;nt7fXqgdi&)
zmQ=}sz(LS4#WoUzrXSb7&Hcc|K?2SJTg5Wl`a2s68Mme~*oG%rE-_YLH<Q+6PutJQ
zQsNfu=7zSD1HVm4>p#}W%1s{0;X(->3*M<!cNqO$>o^-LzoW5hx>bp7(!f=D*oh4X
zouBN`2H!H$lx^%?oB5^oiJapLb{XG|5)i+y@4C5{J#BIIR~rA-UEsiBV!2*wna4#q
zpz~Ud=h)U6$&bWOIV3K%S}MNHiaS;{P~AbFp)yKZw_Q2i!jCYIlz*_Mnxedp(ohbq
z@_vL$Ei61+UXMDaY4ed-`&N6dxYw%+Wsz3ylg<4G;vCbdH-6(KO9y_mW!`dp5N+zz
z$SJ2^uWdJN>)tkaE%*Gijrk~9pUVffuIob`i-7nz7_sPF6UUzy-YgayD+vv0-*NPX
zul$LmWQQLkDk)Sl=AZ>=Gus{qs``%kN0*45qsBMe`)izMLSJ4gL%5#jU9s^2J`mH$
zcXm``?do;l&K8B}&fc2tNvb7TH?DxtTK&qnewBM@NdsL?64j_Smi^keLTZWA6vgeP
zuw`L;P2D-K<B~)8i<YE^wH2?dcOpxSUTF%oU2dauhZX-!3hy-L4$^)eli%k<BI@<o
z>w#&{y*}uWZDudK_HSVBu)O@AD^;@b!)lqpO_>fN2r^GzHhk@%I(kE+oOmz?xHvx5
zme#GtLtnpf_f@%AZv79@Y%4Nkh;v0VqT<LW<-lnQ5i-n#gP?#wM*0aIWp!#a#v=#1
zOHM3Z{+1^@m3oeJNHQD&kMgP+XYC5d%5nS~KsrHqsfV@^LS&i*9RcoK?I_>nen)-b
zxEnduno;n-|N7JT{M)gv7%7YnUYv3vOKDA7+tM4w&p(j-W%TIZMYI@2wvDNxGzOe;
z2H(t#vAU1NAMq}X#c;MtAja-eTi^J`%#5p&M+dU9fsEo1RPQ*hx2xUteMgem>58cW
ze?=Q((rjMv0;{q`z7<6QojA@Oh9uH4!k7kBFl$&o7e7*nk^M%8_M|=`jv%UBc_7l8
z`a%rB(>m6ab;PY2rm2f1&tf7p;ri_O*%D0B>38?e+-vB080@u2x$X8ac@b9VsiqF;
z*2)58+Hkqm2OQzoL1}$xkmyB;lkce8D4$h={UZDa)B5?Y;Fmw&{Lf$Aq?;{{yz#zH
z9SU8}EK?YSO1Ui|PBjTw>(qY4cp`~|Rwb-u`Q=NC3$}}ggqyxKD35U@E$tY+m+%h>
z-H_~I>p7WX(&Q*boch?kM$t3Fq6js+BrEj0msYx0A8~xGa|mptvS*RvV^CEpuf42-
z`W@|p`-i3Pu%8Ef^X4(gBNkrzux-mc>wjfxs6;u6vL+aG9}ev<OaktN4;V5?f_kNY
zWysWXDUwvhyZn*?sdO@vcwpG@9@iI2aotHY*-0WPGLGJrWnYpFN%<S_t<)15dY#YH
zif(L{Gaba3%p!@gACkK+g)omQ=pIK?a|q1$^?NqbN=_)H-E<?p<F{Y4M87+i%rJ<Y
zktZP9J}#sQxtVS%u*pk&@wJFP2Kpv2Eb6&arQ#a{o$JJ2F{zm?vpv&*<1oA#|1;C&
zee~s~^EL>t;Y`NSp)&}%wB*I4BjP%Gq1)x)3J23NkSAaasx1k6xOBI5=}>$vkj}k7
zn~_yCyo4$jLw>+PcfFXdRMcKW&$stoJbAM6qVBan)de2a(8AQG($innRg4S<NlN|)
zV?C3aZJxK>6iT%>cO;>c<7hpr&dx{9{o`;)vh@cx37na0;*cB}UDu$&%fF#_{f!l^
zvOJuld}+1Y-~9`rr{6COZ^(r&gJ^L6r%2)fUXNs+V2?PJ&d_R7Xq2wI{v5q-RrWVh
zmz|%h7W4W8$vOp`?`6N<)oAbBxd^3EQ5UbPqUF2f_CNC>>Ml!?#5iBFq2!w;+Spk=
znluaR{VLBFeL}r13sEy4{>=l^tc5327O(wtR%9mUmS}asd`ay@qIh(r%J-ipG;QDK
zb-MXQ2-=p=!V@;+HhD&ws8Iq@axstZLEBbJLp?%05^e6=cGcpIQ?uJ!wL^;feme+t
z29UmI)JhP(qG)=C_p!_;UOdz0Ce%G58=;8~)?w)R;g9(7H9v4OHX*TcW(2e|+LIoU
z;vx%NIYkM4?RZoRNs@c=o(>2*9~mxFM4K6qSuk@&ete+B>IhG3$a=J0su2IbjM54*
zu`pbroz>*EmZ53jzssylbn)Ru_h^s6FgdwoYI^I|l|?7jhYT${KXLZKL4SaV&UvWd
z|F5^R{%h*}|Gx^--6b(#^ypH$I}Kuhq@x)nLplcoDPc4M14T*+2|+}<L!?CM5CjQ9
zdY=Qn-rqmr`@{CbZrj<pu5)(IwddpUxIft`HFUKf{}V+iua>CB>Uwwo>EY2S8Nb+9
z;I{k!w%MOo=YSVpCsOcFSX?!*po-M8(9>QTyyA!88nbqCSF<3A4P&n+mjJYZ;g)15
z<zO?`@}1<qe&uy1cLPAw_&T0(ky|V`EONbf?Lf{Pcw|UzKVcDV`?qOj4oF-V*NXw7
z7j+v_K0h(K*ZMMof}RJPAvkb|xuH#b@lX8bm0q$N`JTFE1TG`NbfE~Yho$@?x^Y?(
zf-vA1q}!+BbuR4wr_{crq~|d;dQQG?(m;dh;+grU%o4n4oH$gL@;=vQU0)|0hvzz9
zPke;BwYRRS^*NW&;PO9x+bB*K9xHGv#w>IwK0<uQ=lXyU@WbOEixnW@eX1MIi{|Rr
z+UyHrgf@S8)XJuVpX^PCuZ|Lw*F#;^u&#*=5c^~DpOU+(Z=C^5=*p<twQQ`Wo`S9r
zOU`f`X1{(rt-kfrtv^qU6-09X9RLG~@V@a*u6a7q7v<HW?JU>tN>A-o`x5$Zfc<(8
zm;Tr$WLb2imUX<^^7g+ztglHNN~*|`hW~anaHm-?T#wFx2Jkw7sXgH4-UuRze_y9z
zwmC}%9h^c~c^{_S&_4B%>L|P(qf82>E5zFP%}MLFP3ZWgxGUt}aCD&FLKYb^Y>r~v
zr5rgiF|SmvU<SCxJD9G`FI10Inu50aMrK=HtVDhi;ka}C8D(xEKOqOMfu#Mh($cQN
zJ7=<*O}V!JCR`g@<F;0yrnuE*uE0aLe5O+Q-`T(kK{&!IzA|NUX)s<NVB;Sc?%{Bl
z1KzZT3E_#=zRZ{FX~&Ih<VsgpHPI`&`$44q-%dJ$A!Q0kjogC6gL5v3+!y4v#x6#U
z9<&?(%X9kL9$YlAmsWSIA9X!f?D3qCvaaMr76HVVv8q#5MhRKrhy?AwZ>{R&9!p9q
z*xIZyzsb_L!TrB8MHyOj!Op7dH=~Do-$kJ0{lDEowHz;(r&g-ITCPLzDc)F0?K1~{
z8U&P3ulC!1o0FCIFxIVs4XBFOHf@)ac%)3f%I06T7wrEoINZC|-vMXz;$SrX<;Cw%
zVWOK$sWdkT`@XE=lyxA1YXefp;Gqj4VHPB6<sycZnbk9BF<K)Hte=2_H1{?hFQF2h
zhO!Za|Ic9!EJS6B3kl6T%GFgqw-skn=cB%ST5&lr&OHk4TO=F<W{?ASEF+hX`D>+$
z99dXYSTfYRk6QzZqSFA3(}{p7Xb$$hG;wS#ULZlBZo!B7q$(Y%n$<`Le`8=;hLU2E
za`82qZTS~MzYCjd+^YxMl2R_EGO)wpa!O-#)_FZJP*Kqjx<^PiTE=IWC+h`QP6R5#
z0X`LolcdW8Oi_Y|ofU26pEcI(=UNQJ=rv-=?j&?}sujDUt2F-Zd{5kw4`h%JR0(8~
z5A4N$@B_d<+i(8+w+Rc;_9;nJ2IA?bchkjLgOL8^*;<E>>->z<P*t8kTAC`pb9ZwO
z2@_@^v+cZ_kJX`nevTqCkeq8C9Q=58PZhzQ2}X~Y_g~HlO8YPm_Y;1j_%K!e_qUai
z^guHM>7V9YUS%u;e)qxez(arApt;>kE1NZ^T96>x+NI9rYd?~HY3!Z7W^oQhDsWht
zf=`bm@kkgRUm=RLBhwN%RAU$b^QL5s(#pXVI|!q!{YKA*?_2E?;bO}vk2i_O$M4?^
z={i!Yu@!}%7@f8xKh^xn-uC_OJ~Jy=&1)~3-nwz|GjYy2ZlzWln4VEZCV^PqBDFx+
zEokvdiZ}nZXu{Jyf0Sc2_e&$KP9-NMRMk1;mewM<cFjcX-Ct{#)s$*YIOLjNj(z|L
zoVnf}W+~V)MkXt7V5ZEhSJj7}6+_>57b>_l227Q%&&aHV=Opxk4J+00&FWxnGkbl0
z?e_e$P>;3aU>{w1?jgA;xnP<Q{B{}0{y9X+$zS~sc>1NXO;+r@NVSk<{rzkzn0}z|
zZ`(gx-$od?9B^?RJ9jC&0a8c;zzMPc14|LLmlF$25Y@Q2H><^%Ueuq!Aga<kXr%6N
zdbq{IRT}G3YxTiD{?p@1%*aK}$q}IQOPkB8hm?181|5{j%|9n<GO~CFI04^Nh_fQ`
z27RyA4sf_#jcZltZ+*yJkl$6l9#h$NwyCKXDQ%nh_90;WHQCBwXR0&GsisODN2n7!
z+n|GT5Xfx0B0G52T-_${N7&Udtw%p0(S$W4cEuKv*W&nSS?~eL!g?4!FKf(hBr+-K
zk>`SrLz<fa*7MtYquo1Ih|46gJ)OZ3_Xk!7AC4pZ?^`xQZD)=@`;V4Zm7j|`$O$c3
z@G2${fYZySaYf19XQ8&fzb1?amE;pHFV2`FV@V$3;;P;5bokW>?>^pJPK56ZbIA*B
zYiVe7vnAL4spDMk9{9U#?35dL9NC-6g$L|qX69Z0Uzl^d1@TBAEAoT8iz*{c-Bql#
zPhJ0GySShMQfD9|{~2N177$()_`)J#$<9PEDEiTLUZLH-Cap%Oa4+?Y!W}8)R9+{m
zmmkf8NXc*-^5_l@Z<cqcJO%I(7|XvN9Ec=Xts(n~#eV(!7zH7<E}R@1j|E8HJ?6Ya
zW*iS|icD0FwVQ;?96>4Soyy}4tjX}FNDA^PHFIJ&s0hauz+&TjdBbG`dQA6nn;ZN0
z9JO^^g<k()JsB!rFm$@<BV6kytjiodb-(FHtK6zuV7wt-clh2_rk|?{<pzbw{8-v%
zIT)>Xr7!j@_}EY4K$Y>%z9*o!H;S+u2t<WG+i6<=c=@Y#MB(`2@4Pfa%)4&>e_)Ir
zLk7<THvA&-hqFwTvr$=u%(iHV)dcf}qmZ!aa9bjil<%Ga+^jf;RG2RH9VJr-9lG9V
zM5N-uD}%V%sHuSs0jA2!3w#C~d@`EtX?E`8xlpChrpZU?$}<N0ENWIQql>agDPfnu
zv1Z~Ns2N*uAJ)^|uPL@}A%yXTgw|k~-7P&Pw?99>^I(2c>OU6q!!`bhW8OE$#6(56
z)OizgTiQ+0&-5=ku_{T1*56nfA|YZ_&2RavLt{5odm$m6O=SIhv)?1vaDDjn+d@!>
zK_*H1<(^1)z%DrM+U>yU`9o8AR%vq)cJJ}R4N1jf6Ai}Ym2k339T%6)cR*0ubL#n>
zdr~uT@x9(Duj&OGY&7%E=;j+-mpbEmM(LyoVUL0PM%C#igsgR%OB4^NPAq*lAs8cj
zMO1c%!-X?TJ4j1F5R?eqm|!HdrYyY+y(ygO{<_Xxf1KnrTw64rGnEbbtI}k(`%r{v
z!nTOU<Wz_`w|~>$Iw3j@o5T~oEplL6Ioge+?Av5y+B^U%=x@M$Z1KOoV7LuK(S1;%
zPQu$BUNVGa%y$Q`2ycPx<jKtR4&Zk_MPu)+EK5APEMtkL+@^PL!|5t|vWOL^sP74+
zhDnBz<FdZp<S4(qV|g5U`04Asx#HGVK6WdVxGK@FQEGC$+w8ZLFXIT_UA;u&Y;<oR
z%5%aD`8lM;>S^b<`Z?+V-5xyr&~*4Lm+yDKsr7FJ1M(nM^=u@KX#LW?VE5M$OQpwE
zZI{jGgtLPZ8m9~?aw>;$AMg2Y@UE<SC!;SIEHU%Kq)ZZW=K0!B+e2^9rbI>Is+;Xv
zM&tO_41Q;*H&|8{Ow>*TGww(<q-10`rTB6V<vHnjH{E9(X`y#%U63QK<h0(Uy36%i
zGK{Vw2{!lAu{}7I-$DvDtK_gJNDBW<g=~WH5dy)r8$LIFZBD-&9O9QnV4C^#E$?|)
zOwS5k3deQ@`JytDT)goj@dqVYGm4|?9;<dn`j2y=FCTT5IGPkTvRltL31XXD`tPDD
zFCs?rf7^C{^2AyGd<=3Fih5bV@43gOJTPV~C6M_=1V2E$C%8y^VDCwWLfX^wV>m?;
zOG*|9OH?O3LD{Fo40HWC{^X!LslW^BUNlZGaeMR=q8Fuk5CN15Qv$1d=R;Cq5p3$L
zEXQ_!bS9*v1O&uu#6HsSA`04uZ<%tAHKKl-64!*8KLBBdkujOXzB_^B5CL3jHktbM
z^5xW1n8!lOh8W!ubt3r$BFP|%zQv`m#4Sj}fR>@*qrb$xzdnUWs(kI?uBSm*WiA!S
zh<@sz0N*@ZWA|ifoUtvJeozoVu@KXhL&BPEl=eBChEi(@fkja;NMG1QsDZd&&>8cM
zhJ;BVIbUf7j!CP%8kzL|d1?`uy?sxy%Y=>G;an;vUW1HF+GJ8is>^)W`R7YXA+R%}
z^klJPmWb`=cL04Wq_m#9AwJi1Qb7{1<+zSsu?*Jm;zcu8ZYv0jb<bSQ#KAgii&i@p
ze+1m(pe&B0uZ}zYktOCB58`A8e|Zw%03ddHsx1P(vPnBRUXW3;6)Q%4VtF+6>Y2ml
zMA@4vkVu*wE?$UUUtgcgon6MQCGVyOvPfM@^caUW)EAR%tYO~IBV%0Hss4SpMs`sM
zN1ELu$kaVPhsKjWVBiz8K0V+yiUHhF`xZ15^!ngAYX|ODf*G%SspN);`Kh3kjL)H>
zWNvtXF_4~ci=C;fHY)dbPbspO<NWBIZMczLM?|T5TE+uVhq?jL!+Dsl1H-I!gU9z*
z8?L$0Esq6vYul%<GFG>=2V}k&Gg&D41Oug|x4fTkZTI^oNjbJhlwSs|Wj*nCo2hX;
zunE1WAKtP5)58{8fjwSMQVd*4(G1O$e|BV?)~Q4s`QD4|^?H#U+gEXu)3A)&xSGgh
z{&hMZ>YZ=lOQzIz7;bSOWwc;+L!m2<C~%;`J!2YowcFR(^d^B`VeNv*YGdiSP3HmY
zVq`v)I{H#L6$?DIgCNe%B~%Tmz86i&jg7<v2F>%^pMo$F5K1*@Crco?UNQU6UGuOu
zoV8CR@Q~A=uMX;*U$>fT?nI_V_xALa&KgLhJUHJbcH}lRxCfY3>27^t4VL2$&iW{E
z?Gv*F$Q3Iunt<wa3Ygw%!c0O4UwJN&Ap9Wnp(Z2sifr_Jg)>#eVAj3ABVWrOg~9>v
ze?47Mjm|yoC$0#c&{tJ#cYR?O#KJARLxWl3N!i<a51cS%w`XaC@})ZL{ZlEP>O<#r
zmZ@|UAR(m}Bjc-77hJM>YMQy3L*sKB(CkkOLaGy!{Bar12hlEc<YdQfpMY8*dlFXH
z{<IA@Ma_aRR{AFVY~p=mu(R#2)j4Nw7mpX+jtQE}<KnlFC>Vu(w9<L_Ysx6j<=@>g
zn4(~{&bqgc&W+xV)z>FyG^eWnm5&nGQVagD%DQ20Vq;QDf8}r?LLdx_9&K9m>RSG(
zhm92liSv+j-=c~GE&$i$jO@2*4$mhSqswxR@FO*39^@N3Ti}Sfzln7av~D?m6^Tz?
zH5IkOm_i8BS2uu<dgp<?<9dBl9vQC#{Ic_#+e!zwDs>72F3CTGR=RsBlo=ZYxZ-rJ
zwVNz-Ok)ej)uJiTg{5V^i$ZM7TtC2X!^1x*x#xjqlpfRwqOiIVL)a4ILhJxvuA|~q
z(W}_TFm{7%7<Y;X{%4N)ro28B^%!6NMB@X8==8zNslA*}0Th0CY`I=GIB`Z<F^OZ#
zyz*MDLpc~_*501?p7YN)3Kt*hqt4e9)g6e%$Rfie_HreC8$((HNrMhe4L!(Sh#Drx
zOq$#o<#nHt5bhY`IhE=Wr5YZOlp7wunhwIhng>opF&vd4k7U;gvu!F!^R?5y@Cek1
zJxI%-w+Rw8q|R7ZYmPtvKCgiJrC9yp@^lp@9lY;QqQ93+LvFm6k&w&{3AwwR5z~03
zpJ*+KS;P|4dA#tbCLLCNywE~iFZe^j^sz!Jh0C;GN<d#Mc7QG}f2TX^$mYzE8{!NM
ze9?crw6T={#i<P667y(qcSmJBbv22CCp>32HQth{RE%P*D}d3&Che*{=Y8Ur6?t!`
z#UAbE)?glN(dkAxrBZ-LTI*b%QAt$vo5^N6AVhRF@&pJNS6UzdztcIJyM>g=am(Bl
z2xCVjv#Mv_G2!mR8y1FKW@+>>LyI3F`(nTiacupLdIt*4T|rv+={PYP%mTB@551I4
zs~e;*qk<{!vkaJ!?Kk49e@pOJwx)=FVM}?4Wjy}12UngkF1jG(SW3N04<s4-6y-_}
z<n!A(B>2_VxkcUfJj`f#h9)a~fUB{7%3!g89XE{zFX@lo!|F!TE@3}+Ea`wCX2dfu
zUmOkSh|ICNBkA9H(Wf#b{p_`Rod>7SPMce^pxg7)7BI7KsDEB!L-8Ql;#?yz8gW16
z{NWaI=0Ikcl}T>eK4upt+x<rWXO8Db#5Y!XE{9@zZ)8ACUEpxJbHPGiGr#i++rigI
zXHii-_jf3@C6n|jU%NWFs^>@veUjaHHlbyBpSn9LmqWW~FRBU9(pOT~Y_~B2!YZxb
zv<>*w-nZXRq~}TEtb$p-z;SPe1M!^gj3x`x^|kRo93kS;zF&qvnmwC~G*#QWm8cUV
zMNS)IOdk?MPGUm!lB{Mo=7w|Jk#uD!UmU9a9HJHtgC<8Rt;%cFdL;i~E;wXTxtW54
z%l}~IRH=w32}>+idAc9kw2OrG{-!-J7JTxNH!!=iYa*mcsFYbi*|_s_r6RqH5s@~^
zlG?E0)yJO$cCOV%Im-~Yj=YCPQ_IU@#+B||YP9t*_{=EToqGX4Hq_Hz@7E(^?CUCe
zDrRa!RjX*9-HC%}t1s2=^iI4PF8?Xec9GBj7nMo&@N|=SYN0qnmDc!`VZo1aji>2q
zr0%l=#lOvKov<<WBB~hMsxGq>n#wLmbRxleJ*E4=K_0g<rvy`J9B;69^9n2rbdZj>
z?`6hTEz;uK$-8q`uKe*49$c9%jRu}&l8n7=tkXZDt|^ceB5Yc!_dq!K^_S{UEed)Y
zgQl6;n+-}Vo29e;4p+iaz!Jz)#EBKHy)WYRfmpgSLOQU)(ld9m0Y1_O*~X^6xv<f2
z#nN*PngBp4yvT&K%{lU5Bb#N7#J{81uDC|CNfl>k{M{uwDq>V$uREuN2a2vFEHl%B
zsiCW41;SpeE-CI&3D4TtgU8)ihjLK;_1hkQu)1U<YbmI}eT5~<H}#f<PY!L&mDG;4
zv5{G_6q$S?XAm(uDd?5^xO$z!cPL|x_wn#*EUFu8@}ZZx@kE9K9V&miQH*$4z-$=s
zN2wTf9E2==0-tuVgfvOKu{t{nUHnyLYuDZ0WN<tbabJ(_fWo>F$h{wx434FjINJ;w
zJ?hY#QqDJJtz0)szx8SGi`bn~P;xpWYgXYwYXFO%Ji^ASEfA^OX2cFLxD;w~gbBxn
zK-9WCGUW9W2R0(~(xRCQEYI%Jcmz!jRlckUTK9fdqi>*<_i|#!sFIvnp#pY^o<s}q
zbfV<Q5-ho}#1}Rdo$9RF#gcHo32*aYQ@4We(JRG9bLvAnbcyEKj`~0?mAGC!+I8n4
z6FrQ@%fqBGCq4?+hELkN(5^aR8>>aDsBy8~kwD5UCAWTmeY3oJcq9DR7yhoG8ju`2
zkO4quwe!GJ+^ReaNhX;)VJljOH9f53inG3NB1ISSBm8M{q<3aG#2&(=9e?Ej7LBO;
zf5MLFoEQclY^oV<)b^X*({`+q7Yyk884#Vy?({2~fOl7o-_KNy!j%BaD9$rj=d5zS
zRDa5La{u=q=i9eTBHcbvJL(l{JU5AzjJW}a6S)rasXjC4!FAY+GkCG=G&4|Z{(Mpa
zvh#UJY^Wxj7GeK%PVb8x--_SypJ}*OwxmvLI|&V~=g2KA+MgAR)|I;y_Ff~nu#t$v
zRc5H<Y#~Axr(<Z2n;VJs6|KkAf4JUn45712buzE5D^mMvHJWc(S;82Bdj0C{q{7kW
zg?KM66=Z1+oE~O;>3^IW1YAR?b2p(rLz0YMdOhLDe4O)cran&j*llfCmElr^D{q?I
zxKGq4n0~SnP>D6o1JJ+*3>7M2@{2R0L`omxL<jh~6l1rVxww2ANx`{Xvb)r3<0Wb0
zOMi*P>!TDxg)!U<kvzg~;|@0?2$sHemuqq7vLv3c2oFzty^rQ|Au38QMSwC&vr=^V
z8wTzlh7uHI@3!EaL}kdTNkZDekcmbL+PCJ}Oz2zlai1If1>kUygtL@g@wp9D%X)n;
z)c933_}LHMp>yH4zd6I{fOClXRnPqu4hXeS2+vwzV=E}4!qtxZ&hvuGS>}c=>2B*E
zAZH6yDN+|VN_Ai@V492CtM@R|eu8gE(~GyrG|#oVRjOl|T3qE$jO@c4ug4H7pNOlO
zU_StGVD{0wBy6Hk_aNApGO})V$LE<(_FlU+_pzpOy^3ceoAUelrC|h*;_mUCMMP0Z
z&QI1JIK{^XDYt-cfOqg6X7w}pKps<42@=AIs#`G97!;_>8(qt!RA>Ec!r&qQl}kK(
z^rhe}+EmrpMy?Yg`^hPyPED(Fhs`;mqxU9FAE;Kfpn(<=5NcF1O#^^x)iG-M=#wmw
z7d*Av_mTLk)PCE-;^X{gqOXF(R^eD(<x8|i;!*qwOi!)4i{Z=ygOL3eScytU22dKH
z-gn!L3&1!l8J6stN+lpp_l+~D>5tLuV#8c`?85nJFHJ9Z9b?{7(XS5Po8*Gv=l~BI
zIAe)K8gjU!8+r>~#-Ab(`dH7N82MF8at&e|<o$I1<3-43wYK$};bhc2xQ<1}a2r_A
z=hA9D+fT^)R$=aQI2TU%rW#hUkRxF+_zm_&&I2ck%c_o#Rr?WBX2fssD|&+dq;$Vn
zMsi#MT%_)IA|!wO@{Z1Z0=Ti~i2*YvuXnml*9RmUJyjSU{u77%Hf?{|b8?2ARcr*!
zk6y>ZeH)37UWOQ#HaS<@Q)a|H4NFN5^?G6TIQy}Bev+K`F1_)Y#e!V*M$2Lo8;onE
zpcX_q&Hh~yCMFs;jinFXy^r!#mc*c09)sf1=O74<BoN?dm*=JgtdgR&0`yVpJY{b;
z>}|{Aetq9cmR!u0EUxXfQQ5G-oh_ZveqUftBS;u6>&QwE3PS3(TZX*te5NYd@hTmQ
z3i(v*`MUYT)&?iS3mbB_-S9+X&B82hK&>EKut(P5KoslD{Z-f+6xaA?Yw9=eV3yM*
z-NEk+{ex=2qsFFtTz6`fwEt*%X>8}^FibHHm3-0m@<J?$Bdm?M8#>3(vB2m@5?ahN
zJG|PrA=swtr!f{ap&EX7Rp*3qRoy}b+31kL2`{vVTqO>jYxNEa-S>p5sH7}Metv;C
zQcJP51Vp}w9krEh_uES0)bwJX6@a4R96@oDzo9o9Qr03HqZ-PzLLy_|DraMq)VH;e
z;+GzMd&b3Ti31F%ZpW8xr66n^ara~J;|^3z|Hi#pRVXGea<LgwlrCR-=_EdD02oyq
zBY7bwXXLwl*8EFUL$&e9x8DS<9JvI#zDgVB$E>OEx3L7D@Ab6FdM$(@*k?IGL!3{A
zVt@kt;}8MTLP38kD{g1#=bT0@v3CXAosM1{aA#@?_}-TuZgXn1=p`juieT!9f_{L(
z5paWl2fp0y;~8;iZPq-2)06Y<fW;Ko*b^FINrd*k>a)~0!FHRc=J{i4YF%y_s<~3S
zXvboo^dX0pnmWSq2nWCMslBt`ZJ|#>LM|;caK-{}d$U^vRH<t-(W4Dh3)iNshaUx>
zJwc0?iN*~i6R<<1=e#=T*>CQ`8C^wbIUK`|ZH0W__#}cM9fF<QvPw&08q{c8ZVLK@
z!bjCAK1G`LSw%?VZq{z*U*UzSgPjS~4`%UX#B*kHx$%j`;ph;L+6&+Jhnj%m8%JFV
zhnq`@Z9Qp7CPODC2ekHm2y(>*I|~t?HUf~C(2N!aW=UIw{=NQ-G*?@0NSW9x2>$ru
z_`$E5!Pd*+Rm-haev|o9M>v97?_hr7R^mYNTONp^++L?Z<U%g0qG>ir{Qmkw%AW5@
zI$%gKEupem1qkvbXdRvs<rLl7we0Xl0-}ZejcV*=Q0O!Ra15~RT;fnBnI>JQc}HNL
z#h(nFQfl86ZQCr-930FPZt*(Yhjj!VXj_B#Ya|FTS1NUpo%8^QYCILaFldRNoo_UA
zT3QkPtvRJxFb89KN1^mNZgN8NBb(r%kA{jDe{l58ywyqp#uPuz*ANc;=jn}&zko$p
zc`|!*e5y8@6AqW6r%l#7oBhnDO>iHR8UOKgvs{+_W?x^v7mO>7xv-v{>U}8mc?HZU
zsu5bOudbzppE!{Dj-N6MyExjX^Xz316hqo)Zue6E8RAc(=u6=!)kyX%S$n+xOrVHy
zR~S0Anqld2GA*$f-nj7Nlan*}SDMIC?C~F7aYP@`MWJtvgo;ORId$_ff6d3f574U5
zqz2A5a?E+Uu67fC=qH@Gw#osL1iDU6Yd5tYU6z3bWm*qiQfg(-3|vJqUP5kb%s!W`
z61M(A=q9>S|1RaohgwKM3+Bo$zKJSCzik?lW(m~R_dK<2`7dQ3C(-9bWs+o7T*d;+
zdN=cxn|ZAceXwNGWHOd8m?W)L>&E7z;KTZjP4#L}_OS2p1AKFr)H*c)1BkwVb0$s<
z&*ACeaaRD<XuI+QGRAYO?jN$yDfMBFK$GaQr2Q51ESYyAo<ucxPdBIc8X9$lD?jsS
zW%cRiCi%n$5vsfaECii|<BhO`sFMuO84)YU6Kq^W;_!e&;T_Mfmd5-w2CN}K<Aydl
zfI)1bZ?Qwulw4~q1`j_PSgmnsBAV)0JxbOvJzG`hZJq3H$6&sRfAh-0(gi*FI@m~*
z=Mzg3hr2{|(Yb6GbUSSbwq2bH%5gLqXQ!<a2FJB!OMC7BUX+6o#c#b%fsZr6SglF4
zAXADm4n8ZuWBGD;Ww;&NVKGe+HQ`Zz!lMB|k}T)|W^do~^8G<f0@LbV`&g`v0>D<c
z>6><q-fI5!{lgTu#bPmMAz>N}l<X`n`!eb+^BwNET!)4Hb{;JwLcI(y_~bpZ5E`6F
zxQ6UkhI$2<FLuM8o(j&<SiRRD=92cx#<5MovIPTGp*Goo-ItOky!o};Jr-sXkW&B7
z)smBOCI~THP-L}9aHacnW&pFoZ)S-8YSX=XWbq7r=}}Y$XQaAhqF;Db5E6J_s?(lb
z&}m{=#1CfY$;rXd-dNG)C~!sIPZM-_)!r~4^1)c^^!I4~25(`9>tw|V?nle6WQ@ZV
zTP3nji){Do4xshavYfiW%~9za9~$nyFkbh%S*Bym^Ny|K3KI1`Ig;n8KxIbe*WHAh
z;Wty1rx8!IA0rT3lh1@b0^#lo>iyBz27%X6IVELqZ6PkOHEwqfCZOsAk(6{2`G6V)
zTO3XQkESOh`3;PG_bsSoG0AFyDI@~M@3Mjf)y7x%!K`3g(WxO9GH=?<vzDRI(mwL}
zoZ%)_P*h{Dr{Ac1!}s@JmY<0|bbsOX{thoQmzZ3G^B25VIV100C~B`P0?72r3qYaq
zo)5)dkdxoJTW5Xdby1!fav3egn{yVj6Z;Q@BQanV*vFl<QHydo>|%IX$XHGm_DANX
zeT9hv-{8~=+tyTdC|jE{3$vK*Ij)}*rMD6(<vcpy`-oA@b6`ewfIAPX9h6F;hU*NK
zTZ>asS*kfPZM6Eqgx2QI%8jj?3pyBTn+8Q|h?(&2)-!CDz~M9JW`Zl7E*kq{7iL<z
z;r`t!Zi2>I5R`wZ(TC-IQ1$J_QOd{s<2eqbvS&_-ZpoT^PjhU?MxzdQZddB!=emX5
z@6}b*%@bGOX>c$MHpbMm1=mkH4h6!N^$t$C(a_lj$AJvZ6yxTGsEeiBI2Ls2Zw-R%
zG+rer!~?-5pgz)*#AYLc*k74fo*eYaej%lI4qc#+5|8zA=vAkeY!%JC$oCnR<;eq7
zuD<o$XC9IYg#<-ZA6E@0a!SzMU3U2*()SF_YI(xviqugRDJlZM0erYrG~};yw#v^A
z_9!nMP+@KD#SE0nzN5I)@NH9O`^fvXKO(&WhM*wJW0FNc1*7b;fxsS9VYk;UbzjOs
zDj8u-gJh}MdUu|cl2uzc!M5j@76}?>u(!pH;Jnf;i9h3YT7bsx{o=L4Si|^xSSU^=
z+93gP?OsL!jX^?)3Rursdvqrsi@zb__$6OAc{{egU;Cip{A?Zzsa;z=2Y&IZ5yX%H
zC4&lSHUHjq<scnOHEvFbh#`%KS9Az9IP0cu7G{`92Z#<R8_!#CMpy9}NE#e#Lu1VL
z8_o2j)w?Fb5NSHqezneyb9AXo@9Q5ZnN%w1LCVWuT3nQ9i_nY1srZD1gp1+_nB<>Z
zONbAeQN}^v0+P|iHO5ZwktpJ91gJ`VPWw7}|EFZXlYNefi9Nl-LqcqIr-z|qhHvUU
zm_0^!Z8#^VK+L4hU};(G;n@iZv*_Rkk1^EhLw_^UTz}BjyFX}oRmIvs*gX_mb@uyU
zbE>+n)VM=K11J+DXe2T-k}^w505AS6P0oxdR4AaspOecGbUd;ItsqeYuHu4Rg4FfP
zLZIjjVN0h(n&zAomDRU&Qi;08wMqIw)05f;snXG?6_)ND6qhYaiU#0mmGwP4+Gg$&
zgySL}c5j*viINkvZ|7zrc{!8mj~}i~7boiAT$zr+vj#5|M(OLUHog^K7>^lfI=bZm
zsOM(Ig$3cYji;-B12D;*iN+S_c2)fHCY@iou)2pKT4<Gnng+nWz*xjrw&}@cBBj&Y
zcZ-AnEJvz!x)F22ZDyld=NeOyG*<Uhon1Y)<U8|-A~qsfg6*foC3no-gE+nW`wc-`
zPCr{u^d}03_D?p_3>BKb)A3DYh%-1W+372-r_=Y)jjira#vsxd=d&3-d43c*TD`9U
zx=QqNLS8M9h61u@!E*y`S+X{w5wNUI$+YH@I0bPfBD`Z~u~a|DX~4-`c=V&uRpSGY
zkh?tQcJKxc4e@hoir9%|2I}q@QH@!7Q0Re>o!BXf_N_%3_tUda2^kVHWsj{EMoDVN
z)ak8o_4^b!m~_=l#|;M+pG<#y@q0MK6{ln{w5#c<;$~O{G~{H}MQFCcvs#Vv>q8;h
z@DxevZQYCNsEsHV#2ClW<%+ZRs%aKMVnfgX2lBX$$7JI&ukCyvC28`SoHLr=VA({A
zYmOVp`p2Q<|LUf=c1;M6Hj*R?E)_{@t6jF7E}?`&%y(m|(>{h9@eZLfy%%DO`cSjH
zjt79<y58LGO(Rt5JrkMdq2v`*^Wi3o=CzX?oH|=b{>L$u4&c_eXM(;8mftBv4^ZOI
z2h<taAO4&zChkQwL3R=Es&s+I4vB!i%LE9O)51R3%HF5@CpZ4Nfn-kX?kI&V*hC#9
z2Oe#fDLnl(ZJYw)km}*q3-(63K+p9>&|R;@jDJe&%6!XSCtMT<MFU;N-t|%ONyGzZ
z=m$EPM42vnI2-|LisxiXgL1=+Z-L}eT={F<Ubw40Y~Ak{uptVU*>TKImJP=eN=dAk
zJAZGk4;=8EtjKaNc55`0>fN?DGMCo*j|M{QZuhY=n+{m80XTb8u6dsQzYQJYKLN7Z
zMF?i)8)M~2;5fov4r5YHjKq`RX6MX&0@LM^evV%FA5!G@%?MM8S=A*)hr4*;%D8C`
z(i-D!J*s;MhE7%5tepax@SKvl%*LN76NFKYi=U(00P0qk*L(h$#!TQ2Q37HKPrJi1
zvQYjDml*z&GQ3mW^F=UR_>&svmUkzYaKLhG2SlpDI-eRtd(sGW>zK$<kWy`Fx3|Yt
z4!`or1joAa`b4+1@^IBX@*C^^bQ9-m`*YYgE}`-DtFArS&v%0nuU<>G>rP~AvIYBo
zkbOjP{!satA}`kO=E)7hn=@feuPQS`UW(o{j(S}A(yG0gj}+ygwNpt*Y(gDIP}Uhy
zG}Mk=<&9k)k^ehKf0w<`Fw+&Nlpy;F2|4Ae$TFBy+_Y$-0e~hcaQe}ykde`|fS<TP
z!RdNB;4DY5K2h?7-oCO6n6}Q{1$xEV003iLCQxps-bA0Z!I>m3FPCDyy-Z%EUtS87
z-mQ;|JHg0v0rxIwcte0&GDT1fA!nf~{)om*ea@T6X7<WWf*YA7-2qa!<9>WAK%@WW
zPuBfevRbMK{|qo_Uw1q|-qTFZCG(NivHq+i<#j|od7BH@q9R{~1n!G7iBEX3Qs;ii
zSUAC+$XhHSs7gdgY`rmfq(*(Q{_MB=sZm-+GHD_Ne<^juhSRu^qGrE*?oTYB8l1QT
zF{Nh=eE0XvS_2Px_Fu}mt!-tp<KI`oDGf?wr#2y0Fx1jNJPnC>ltnnaDmZ_3?h(-t
zK(@~uu6hI8c?=3FPKXVSi{hw$wpqs0meO?3$;IYHmP%Xtvic3D+ip=_bkU`6KDa%f
zW-olu@w9Q$u>WPn`jCQoy=b%1fHw&cuD`;Z1&L;(fr{D3XNQtg=h>-Z{XR}F0Aw5i
zUNQyj9UiI)f8BtTCKXwHOUXn8s~wq2(;j|A;+V2R=FsK#q>ch4nuC2&P=L(<Cx2H(
z4EKjOGMsZ$(FQM9*TBqJmvQ!^s=9nK>R%`9%S~y?{sI*}83MSI^N59T{Eukqy<%{<
zvFEv6^CvtRsFX^Sn7wIKw~lM&#8a84_&{TsvaR$o)gp%|7^_uFz@C9@=*AuSb@KS!
zo+~Pvc31~w%{4J|Ld?m5#RwOyPR)>IKj>2<c9O7LkqEPAkAF?Ds1~8DmQZ3wFrZZ?
z{&Z(9m<_=6I<?Y`fXpAi9-#+#LS)hxq_ce$!kp0t#};+BWM5-2x5>93LQ5iyeo}&}
z?LBtEmvaXrp^~1L=kqD9>RE_7K0fu<lca|^uTLwmNnGA<5|U|IGG%Nw<9~NPI;{*z
z^tdNWrJAqX1b%{au-#b+2$N)%_BcN-&8hJpC=IMI^07;y`Hg)x$=mhk@LnL$d+IXk
zpjePls+t5{OsmsBAA#!&(hesG4F`OTh40L};~Ui<X5#*yvIz}-_I2}t<;%FH%hRpD
z4uiP}qtuH#jEWxTaM3<ibc>uO;NU78eDk%u;pOva_K3H7w2Rt3C6;Lc!A2$7BLKI~
z{(I?PsbH?fFY`{0ju(QZdpJwf{$|ff!ZLm}=GGsf9XPrJ&*R0|<$&{Z{q8{EC$}G5
zxofW(KC9dUjKh>1IgX^cqk^fG^TRk_ohm2&(m;!!I*H84S;$9K916>5iH#OaB@8jf
zGQ&ya<5ZQ^9OWKlEFJ?eg{5~luUwfm&Kf9R8g1&6q+YC=HD%w}e*EQ*Vlzp<hR<5R
zyZj{w6_1#PruOBdg5HZ}>m;-v-7d2);C;suugkupOpqgX?jtLjC;pEIrOXW(ebbqa
z<7{jFk2V%z05v(piUU?|qCtaeA1wu-pl6->n21o1rPN)sq$u5%QY*2E#1YgUl(p2?
zPF^*UINiDo=-uUO^EV~YN;Kx52^k53$m&^KJIMcS?f=KKG07#H!DlDpGow$rKrhZ4
N+Uf>sRVt4o{trO2#vK3v


From 7e1f056670018f6d651bfd8691ff725049c97e40 Mon Sep 17 00:00:00 2001
From: Alexandre Poirot <poirot.alex@gmail.com>
Date: Tue, 4 Nov 2014 06:46:00 +0100
Subject: [PATCH 123/153] Bug 1064108 - Prevent sideloading apps with too
 permissive permission. r=jryans

---
 modules/libpref/init/all.js                    |   2 ++
 .../apps/tests/unit/data/app-engineering.zip   | Bin 0 -> 1163 bytes
 .../apps/tests/unit/test_webappsActor.js       |  17 +++++++++++++++++
 toolkit/devtools/apps/tests/unit/xpcshell.ini  |   4 +++-
 toolkit/devtools/server/actors/webapps.js      |  15 +++++++++++++++
 5 files changed, 37 insertions(+), 1 deletion(-)
 create mode 100644 toolkit/devtools/apps/tests/unit/data/app-engineering.zip

diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js
index 236fdb3ba8e..96ef0f5c5bd 100644
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -757,6 +757,8 @@ pref("devtools.debugger.force-local", true);
 pref("devtools.debugger.prompt-connection", true);
 // Block tools from seeing / interacting with certified apps
 pref("devtools.debugger.forbid-certified-apps", true);
+// List of permissions that a sideloaded app can't ask for
+pref("devtools.apps.forbidden-permissions", "embed-apps,engineering-mode,embed-widgets");
 
 // DevTools default color unit
 pref("devtools.defaultColorUnit", "hex");
diff --git a/toolkit/devtools/apps/tests/unit/data/app-engineering.zip b/toolkit/devtools/apps/tests/unit/data/app-engineering.zip
new file mode 100644
index 0000000000000000000000000000000000000000..4a1cf83ac7bb2d3670f6903be34b383abd3bc510
GIT binary patch
literal 1163
zcmWIWW@Zs#U|`^2IFdTgi7D`)iaU@O3&dOuG7On{DXA5D86~+np&^_M%pVri2ZC^E
z1vdjD%L`@(1~9QX(C4JT-bx*h&=VRb&u)CYsWEV6r)HU%>P%J3m1SnX45V~UrB0qQ
zKPdC~(ghD@#7v4`5-=$$X3>O*fCa}>7xPbK)MA;<#1H^?%8N;MuGcc&A72M_h5{o4
z13%Cyxruq1X{p5}dgZA}i3J5<_k6yg6#~L&?g^dX$aTm-!1cSW>xo<2BC;mVJG}Qu
zNe)w*k&0mJrQOz<6JC8fUw!6J%F31rD`ZXtp5Q*BA~MnD$xD_%cJGr_f1J8ER~+n}
zsxigSPUQ2#c`MFN4KcczqwDt}&!?#W(AsYjGj(Jv_-Z#+MDf=;TjWbkPA<PE*dBjv
zZrj|#8xo64trse%MoC>ad=WTfN=DA@-QRn^tus;NICm`L|1XAfVvJ1t*Ok?sir=`V
zvUqElJi^<zC;fF|eGsAJ0Q9yi5c7ayAUQuz*U-p9uOKfS?B~1Fz6CZ;|Arn1uX#Qc
zKYu#uQBp#}gRfr-IGHZ>D4aRSqM|;9{XTP$%{;w6MVaf9>*v@XIB?+1i4zKi+sl~)
z<{Z3y^?d5wU?*Xuz!#kS*U9hL1reAlxM8j^Gl4t85$FK29l;x<b3;-hSW<G%^vDY4
zqmnkUe`Bs$s+ur@9l-_kI55V6K_Q_S9mD}-gD^ZOj7-hou85oZEf9p!q93TF0*JW+
zycwC~m~ka;36M1mz{JI{r4htJPU@_Xq>g4TvU!*(6xqCPpm`YS6=*1yw2EvfX8c18
z1v&3qV-wJ=sHp*HA}BTBaVBP5BAdv;1T_&Bvp@quF^kneT=9bJ?_QXJ@K^$xh$V&s
Vyjj^mo?->USwL^y2I^yA001SWVJ!dv

literal 0
HcmV?d00001

diff --git a/toolkit/devtools/apps/tests/unit/test_webappsActor.js b/toolkit/devtools/apps/tests/unit/test_webappsActor.js
index 6350b88e962..78fec4d4bc4 100644
--- a/toolkit/devtools/apps/tests/unit/test_webappsActor.js
+++ b/toolkit/devtools/apps/tests/unit/test_webappsActor.js
@@ -282,6 +282,23 @@ add_test(function testInstallOverrideSystem() {
       do_throw("Override of a non-removable app has been accepted.");
     }, function (e) {
       do_check_eq(e.message, "The application " + appId + " can't be overridden.");
+
+      // Then make it removable again...
+      DOMApplicationRegistry.webapps[appId].removable = true;
+      run_next_test();
+    });
+});
+
+add_test(function testInstallEngineeringMode() {
+  let appId = "actor-test"; // Match app.zip id
+
+  let packageFile = do_get_file("data/app-engineering.zip");
+  gActorFront.installPackaged(packageFile.path, appId)
+    .then(function ({ appId }) {
+      do_throw("App with engineering mode permission was accepted.");
+    }, function (e) {
+      do_check_eq(e.message, "Installing apps with any of these permissions is forbidden: " +
+                             Services.prefs.getCharPref("devtools.apps.forbidden-permissions"));
       run_next_test();
     });
 });
diff --git a/toolkit/devtools/apps/tests/unit/xpcshell.ini b/toolkit/devtools/apps/tests/unit/xpcshell.ini
index 79a69c323cb..1cc8ee198ef 100644
--- a/toolkit/devtools/apps/tests/unit/xpcshell.ini
+++ b/toolkit/devtools/apps/tests/unit/xpcshell.ini
@@ -2,7 +2,9 @@
 head = head_apps.js
 tail = tail_apps.js
 skip-if = toolkit == 'android'
-support-files = data/app.zip
+support-files =
+  data/app.zip
+  data/app-engineering.zip
 
 [test_webappsActor.js]
 skip-if = buildapp == "b2g"
diff --git a/toolkit/devtools/server/actors/webapps.js b/toolkit/devtools/server/actors/webapps.js
index eb04ecd489b..9a77e1e0229 100644
--- a/toolkit/devtools/server/actors/webapps.js
+++ b/toolkit/devtools/server/actors/webapps.js
@@ -18,6 +18,9 @@ let { ActorPool } = require("devtools/server/actors/common");
 let { DebuggerServer } = require("devtools/server/main");
 let Services = require("Services");
 
+// Comma separated list of permissions that a sideloaded app can't ask for
+const UNSAFE_PERMISSIONS = Services.prefs.getCharPref("devtools.apps.forbidden-permissions");
+
 let FramesMock = null;
 
 exports.setFramesMock = function (mock) {
@@ -490,6 +493,18 @@ WebappsActor.prototype = {
             return;
           }
 
+          // Completely forbid pushing apps asking for unsafe permissions
+          if ("permissions" in manifest) {
+            let list = UNSAFE_PERMISSIONS.split(",");
+            let hasOne = list.some(p => p.trim() in manifest.permissions);
+            if (hasOne) {
+              self._sendError(deferred, "Installing apps with any of these " +
+                                        "permissions is forbidden: " +
+                                        UNSAFE_PERMISSIONS, aId);
+              return;
+            }
+          }
+
           let appType = self._getAppType(manifest.type);
 
           // Privileged and certified packaged apps can setup a custom origin

From faf6332bbf2200710310883bd7f1fb328328791c Mon Sep 17 00:00:00 2001
From: Sebastian Zartner <sebastianzartner@gmail.com>
Date: Fri, 31 Oct 2014 10:57:00 +0100
Subject: [PATCH 124/153] Bug 1068381 - Use an icon for the prettyprint button
 instead of a label. r=bgrins

---
 browser/devtools/debugger/debugger.xul           |   4 +---
 browser/themes/linux/jar.mn                      |   2 ++
 browser/themes/osx/jar.mn                        |   2 ++
 browser/themes/shared/devtools/debugger.inc.css  |   8 +++++++-
 .../devtools/images/debugger-prettyprint.png     | Bin 0 -> 639 bytes
 .../devtools/images/debugger-prettyprint@2x.png  | Bin 0 -> 1259 bytes
 browser/themes/windows/jar.mn                    |   4 ++++
 7 files changed, 16 insertions(+), 4 deletions(-)
 create mode 100644 browser/themes/shared/devtools/images/debugger-prettyprint.png
 create mode 100644 browser/themes/shared/devtools/images/debugger-prettyprint@2x.png

diff --git a/browser/devtools/debugger/debugger.xul b/browser/devtools/debugger/debugger.xul
index 53b27218053..eb42add05bb 100644
--- a/browser/devtools/debugger/debugger.xul
+++ b/browser/devtools/debugger/debugger.xul
@@ -369,9 +369,7 @@
                                tooltiptext="&debuggerUI.sources.blackBoxTooltip;"
                                command="blackBoxCommand"/>
                 <toolbarbutton id="pretty-print"
-                               class="devtools-toolbarbutton devtools-monospace"
-                               text-as-image="true"
-                               label="{}"
+                               class="devtools-toolbarbutton"
                                tooltiptext="&debuggerUI.sources.prettyPrint;"
                                command="prettyPrintCommand"
                                hidden="true"/>
diff --git a/browser/themes/linux/jar.mn b/browser/themes/linux/jar.mn
index dd7a3bbe481..54b55f3b33e 100644
--- a/browser/themes/linux/jar.mn
+++ b/browser/themes/linux/jar.mn
@@ -293,6 +293,8 @@ browser.jar:
   skin/classic/browser/devtools/debugger-step-over@2x.png (../shared/devtools/images/debugger-step-over@2x.png)
   skin/classic/browser/devtools/debugger-blackbox.png  (../shared/devtools/images/debugger-blackbox.png)
   skin/classic/browser/devtools/debugger-blackbox@2x.png  (../shared/devtools/images/debugger-blackbox@2x.png)
+  skin/classic/browser/devtools/debugger-prettyprint.png  (../shared/devtools/images/debugger-prettyprint.png)
+  skin/classic/browser/devtools/debugger-prettyprint@2x.png (../shared/devtools/images/debugger-prettyprint@2x.png)
   skin/classic/browser/devtools/debugger-toggleBreakpoints.png (../shared/devtools/images/debugger-toggleBreakpoints.png)
   skin/classic/browser/devtools/debugger-toggleBreakpoints@2x.png (../shared/devtools/images/debugger-toggleBreakpoints@2x.png)
   skin/classic/browser/devtools/tracer-icon.png        (../shared/devtools/images/tracer-icon.png)
diff --git a/browser/themes/osx/jar.mn b/browser/themes/osx/jar.mn
index 733224ac33d..7be4f863961 100644
--- a/browser/themes/osx/jar.mn
+++ b/browser/themes/osx/jar.mn
@@ -415,6 +415,8 @@ browser.jar:
   skin/classic/browser/devtools/debugger-step-over@2x.png   (../shared/devtools/images/debugger-step-over@2x.png)
   skin/classic/browser/devtools/debugger-blackbox.png       (../shared/devtools/images/debugger-blackbox.png)
   skin/classic/browser/devtools/debugger-blackbox@2x.png    (../shared/devtools/images/debugger-blackbox@2x.png)
+  skin/classic/browser/devtools/debugger-prettyprint.png    (../shared/devtools/images/debugger-prettyprint.png)
+  skin/classic/browser/devtools/debugger-prettyprint@2x.png (../shared/devtools/images/debugger-prettyprint@2x.png)
   skin/classic/browser/devtools/debugger-toggleBreakpoints.png (../shared/devtools/images/debugger-toggleBreakpoints.png)
   skin/classic/browser/devtools/debugger-toggleBreakpoints@2x.png (../shared/devtools/images/debugger-toggleBreakpoints@2x.png)
   skin/classic/browser/devtools/tracer-icon.png             (../shared/devtools/images/tracer-icon.png)
diff --git a/browser/themes/shared/devtools/debugger.inc.css b/browser/themes/shared/devtools/debugger.inc.css
index c4fdcbc1087..6dc3dd7e9f4 100644
--- a/browser/themes/shared/devtools/debugger.inc.css
+++ b/browser/themes/shared/devtools/debugger.inc.css
@@ -68,7 +68,13 @@
 }
 
 #pretty-print {
-  font-weight: bold;
+  list-style-image: url(debugger-prettyprint.png);
+}
+
+@media (min-resolution: 2dppx) {
+  #pretty-print {
+    list-style-image: url(debugger-prettyprint@2x.png);
+  }
 }
 
 #toggle-breakpoints {
diff --git a/browser/themes/shared/devtools/images/debugger-prettyprint.png b/browser/themes/shared/devtools/images/debugger-prettyprint.png
new file mode 100644
index 0000000000000000000000000000000000000000..fb59dcc33dba6f686feff4ccd5d56c716515610b
GIT binary patch
literal 639
zcmV-_0)YLAP)<h;3K|Lk000e1NJLTq001BW000mO1^@s6cL04^00004b3#c}2nYxW
zd<bNS00009a7bBm000fw000fw0YWI7cmMzZ8FWQhbW?9;ba!ELWdL_~cP?peYja~^
zaAhuUa%Y?FJQ@H10sKisK~zYI<&?c@R8bU#zm-f9$Ecv=C<bE?K`c~oWC|gcf}O3;
zV4p^7eFUGu);e}hr7;!}41#|Ig9(N)M#031%i``cIl0^!A0P`3o4fzkKKt%{;GjeK
zhwWQH8#oR;mDCCSEN}<t0xu*zt4d~j8aNG103Ri-hJFe-5BvtUfMb#t0BTwA72qDQ
z3oHVgS?*2XJJ15!w!cbxQzCBwR{;a-z;<Td26m#jCh#&DMlz>!Azw*)Bx$MNCTU61
zL*R9&W-1zRG~~LZ1xXuO{08s|=mmNIa(Mx%8^0=&Cv25`bEI5<$_Cp_;2K3|>%eqX
z0nLzk>&n<E`R1sH+#Nz*qxemSlf7p95^xu|4Ez8(Lkf5f+yHLdJ_|en)_{vZBMMy2
z$WJD6N#AUrpy<$y?IXau)PYH0G|vB!{3bKq7{x~Qw<^e6i9FQG&KSUmq-9BSz<eZ~
z9YTIHeC8$1MQk_LbtRHc4Il?N6Fw`FI+D8iFntL*F{FU;l5dWmAsfI{1v%_>IQi}y
z!d}R{wPmDL>s8qPhO7@DhrJ6V-+cvq2zlN1ecP>Mu-&r#fMTEk-VZ2X7gzue#q_86
zrtLO++tYss`oBQZTicH*p5k$0NCIPV7Ac<M<%$AMQ9Lp|-~#YDvyH}O*MT)j-HP}F
Ziht=3s+cjoDe3?K002ovPDHLkV1g6c3JU-L

literal 0
HcmV?d00001

diff --git a/browser/themes/shared/devtools/images/debugger-prettyprint@2x.png b/browser/themes/shared/devtools/images/debugger-prettyprint@2x.png
new file mode 100644
index 0000000000000000000000000000000000000000..e3791bfa13a63a525029f55a45559e79530ab307
GIT binary patch
literal 1259
zcmV<H1Qh#;P)<h;3K|Lk000e1NJLTq002M$001Be1^@s6qMd$(00004b3#c}2nYxW
zd<bNS00009a7bBm000}W000}W0bUxB8~^|S8FWQhbW?9;ba!ELWdL_~cP?peYja~^
zaAhuUa%Y?FJQ@H11ZYV_K~!jg?U=i7TtyVdf8Tm-C-DPYieqBJD?$+74v7RvC?EvA
zk?0UYqCi3v2pawbL`g$IM?n_}5G6<?&^U-hC_DrxkjUWR#Gshnu*RFL55>%7@6OKL
zy}O~ye$~#MIgjt`IWuPlh8SXq>lrGVG_wWZ0bmZ;35)<WN$)4tKL<<$EnpM42%MJm
z`ykGl*#xlL+pc<lo05J^tiKBw1I*iR0P8>nI1GF*X(KOFEinE9uoRhE1EK){9s_Rd
zR%IVadM{-wVgGJme`KlwL<0aU0K0;3Eue`D;sIbeKUql_f08))K_Fns%$_JKU}pP>
zlOF^lIPx{%R5+Q+fFr@U1{?)efj<h2y@^ZNeZaH8RBrBZ;8+=tft!MH6F3802L36K
z`wG|rOagb{$^o4JCnPmPfm8tIgYgHFKJMW(l2(8f;FOtFf#(Z!79mXIpCz3wVZRR4
z&8!C8iVHxJJS0j07!Ag&y^KfjTQDAru8Je{>+iCHW;PBy3QUkAZ)P`?F_gkqSqE|`
zO4WYRDzm77{2t(7OePh8kwLudfqrxr9?voKAb*HNxpxJ?%qqCEJdZ*C&9LUCz3xJo
zndmN;t371Kfk)^jKaV3{0mi)U4#XT<jC|jStm}nK5nB(IklRgn1|&-`M}Cq{@}s~*
zw7JOZ?m*QmIe=?mZULSS)|``cv4rCtkaWS!R=my(ubbH?xRYW{(huJLEN<tY3f6<`
zJU3%DQslk;D`wX4a~TeLpXxwE(j|FCZ+Jy{Yy+o(cdwz9-3z>gYp27kT9)*dUw4Q|
z2Z`%BzLV5-3KWsgt(gGsC7xAll1>)YWQFeIa1e}A{<O(MBsR`~e4T=G-rG)Ys#yjs
z0(Szp0}lrR=On$>ulHW>+jOS10Vja7z)zCC_Uq<=8QkVOAK0%+`XZ+@B)^;@Z)Qj6
z>_!c^fXkQ-N$XVr??~p%Q@|@Zq1()CPrv(s-+{w=en--$;aW-SxLX@$b~CPIGEAG<
zPDz`6lF#;(Jid|iYyLwlHILyUmB&oXNDs`0K2h#2uo|&H-VgaqCSpJAPP+pj>8dx7
z$BrIO#}J<7HLtr6lD2^>!RHD3BM;sCM^jQ5*yLp>bm0F$Px3iz2jly3gvydHqZ252
z5D73y281`dYrzQc7jCyN`{$J6mO7ro2rra0S|roYg(|%K)PXPiAP=r=^5`oA)_}da
z@iS)D!fjBEtb+^TJIY<S2a)hash?)5L7TvTX>Vqez^J6K&Ccx4;y6vx{h}1TQl|oN
zoX+dxH1MMTy#~CTkb9NxjxNLJiSHdSvoYEwcbRr?KZm>6YyqDo#1~1IUi3{PS^|=e
z<DS4u-NSpJ1ss)BDgd|(%oL9NvZO6f{xE}G(+xNy>3nRm*R%Kxa38LovvajB>BGeO
zCECr$7H}T;HhhXMVe=l~q$gj&b*Nce-jwu9LUupx<F|!N`#&WO@}M)s5JOxC_!qxG
Vs+<eIV$uKr002ovPDHLkV1gj6JYE0*

literal 0
HcmV?d00001

diff --git a/browser/themes/windows/jar.mn b/browser/themes/windows/jar.mn
index 7478aeac6fc..10a92364953 100644
--- a/browser/themes/windows/jar.mn
+++ b/browser/themes/windows/jar.mn
@@ -329,6 +329,8 @@ browser.jar:
         skin/classic/browser/devtools/debugger-step-over@2x.png     (../shared/devtools/images/debugger-step-over@2x.png)
         skin/classic/browser/devtools/debugger-blackbox.png         (../shared/devtools/images/debugger-blackbox.png)
         skin/classic/browser/devtools/debugger-blackbox@2x.png      (../shared/devtools/images/debugger-blackbox@2x.png)
+        skin/classic/browser/devtools/debugger-prettyprint.png      (../shared/devtools/images/debugger-prettyprint.png)
+        skin/classic/browser/devtools/debugger-prettyprint@2x.png   (../shared/devtools/images/debugger-prettyprint@2x.png)
         skin/classic/browser/devtools/debugger-toggleBreakpoints.png  (../shared/devtools/images/debugger-toggleBreakpoints.png)
         skin/classic/browser/devtools/debugger-toggleBreakpoints@2x.png  (../shared/devtools/images/debugger-toggleBreakpoints@2x.png)
         skin/classic/browser/devtools/tracer-icon.png               (../shared/devtools/images/tracer-icon.png)
@@ -761,6 +763,8 @@ browser.jar:
         skin/classic/aero/browser/devtools/debugger-step-over@2x.png  (../shared/devtools/images/debugger-step-over@2x.png)
         skin/classic/aero/browser/devtools/debugger-blackbox.png      (../shared/devtools/images/debugger-blackbox.png)
         skin/classic/aero/browser/devtools/debugger-blackbox@2x.png   (../shared/devtools/images/debugger-blackbox@2x.png)
+        skin/classic/aero/browser/devtools/debugger-prettyprint.png    (../shared/devtools/images/debugger-prettyprint.png)
+        skin/classic/aero/browser/devtools/debugger-prettyprint@2x.png (../shared/devtools/images/debugger-prettyprint@2x.png)
         skin/classic/aero/browser/devtools/debugger-toggleBreakpoints.png (../shared/devtools/images/debugger-toggleBreakpoints.png)
         skin/classic/aero/browser/devtools/debugger-toggleBreakpoints@2x.png (../shared/devtools/images/debugger-toggleBreakpoints@2x.png)
         skin/classic/aero/browser/devtools/tracer-icon.png           (../shared/devtools/images/tracer-icon.png)

From 36a759e0ddc5ccb534993810cb48d03252152546 Mon Sep 17 00:00:00 2001
From: vivek <vivekb.balakrishnan@gmail.com>
Date: Fri, 31 Oct 2014 13:35:00 +0100
Subject: [PATCH 125/153] Bug 1078365 - ""Feedback:LastUrl" should use JS-Java
 callbacks". r=margaret

---
 mobile/android/base/BrowserApp.java            |  8 +++-----
 mobile/android/chrome/content/aboutFeedback.js | 12 ++----------
 2 files changed, 5 insertions(+), 15 deletions(-)

diff --git a/mobile/android/base/BrowserApp.java b/mobile/android/base/BrowserApp.java
index 0e84c0c71d2..ff7095fcc16 100644
--- a/mobile/android/base/BrowserApp.java
+++ b/mobile/android/base/BrowserApp.java
@@ -1398,7 +1398,7 @@ public class BrowserApp extends GeckoApp
             });
 
         } else if ("Feedback:LastUrl".equals(event)) {
-            getLastUrl();
+            getLastUrl(callback);
 
         } else if ("Feedback:MaybeLater".equals(event)) {
             resetFeedbackLaunchCount();
@@ -3017,7 +3017,7 @@ public class BrowserApp extends GeckoApp
         settings.edit().putInt(getPackageName() + ".feedback_launch_count", 0).apply();
     }
 
-    private void getLastUrl() {
+    private void getLastUrl(final EventCallback callback) {
         (new UIAsyncTask.WithoutParams<String>(ThreadUtils.getBackgroundHandler()) {
             @Override
             public synchronized String doInBackground() {
@@ -3038,9 +3038,7 @@ public class BrowserApp extends GeckoApp
 
             @Override
             public void onPostExecute(String url) {
-                // Don't bother sending a message if there is no URL.
-                if (url.length() > 0)
-                    GeckoAppShell.sendEventToGecko(GeckoEvent.createBroadcastEvent("Feedback:LastUrl", url));
+                callback.sendSuccess(url);
             }
         }).execute();
     }
diff --git a/mobile/android/chrome/content/aboutFeedback.js b/mobile/android/chrome/content/aboutFeedback.js
index 6d81b9241e7..da894819172 100644
--- a/mobile/android/chrome/content/aboutFeedback.js
+++ b/mobile/android/chrome/content/aboutFeedback.js
@@ -58,8 +58,6 @@ function init() {
   document.getElementById("sumo-icon").src = helpSectionIcon;
   document.getElementById("sad-thanks-icon").src = sadThanksIcon;
 
-  window.addEventListener("unload", uninit, false);
-
   document.getElementById("open-play-store").addEventListener("click", openPlayStore, false);
   document.forms[0].addEventListener("submit", sendFeedback, false);
   for (let anchor of document.querySelectorAll(".no-thanks")) {
@@ -76,20 +74,14 @@ function init() {
   }, false);
 
   // Fill "Last visited site" input with most recent history entry URL.
-  Services.obs.addObserver(function observer(aSubject, aTopic, aData) {
+  Messaging.sendRequestForResult({ type: "Feedback:LastUrl" }).then(function(aData) {
     aData = aData.substring(0, 200);
     document.getElementById("last-url").value = aData;
     // Enable the parent div iff the URL is valid.
     if (aData.length != 0) {
       document.getElementById("last-url-div").style.display="block";
     }
-  }, "Feedback:LastUrl", false);
-
-  Messaging.sendRequest({ type: "Feedback:LastUrl" });
-}
-
-function uninit() {
-  Services.obs.removeObserver(this, "Feedback:LastUrl");
+  });
 }
 
 function switchSection(aSection) {

From 871c08649f6ebf37b17b4d4e8bb70c5bd2dfa95f Mon Sep 17 00:00:00 2001
From: Gijs Kruitbosch <gijskruitbosch@gmail.com>
Date: Tue, 4 Nov 2014 22:56:46 +0000
Subject: [PATCH 126/153] Bug 1080801 - re-enable test waiting for bug 930863
 which is already fixed, r=ally

---
 browser/base/content/test/general/browser.ini | 1 -
 1 file changed, 1 deletion(-)

diff --git a/browser/base/content/test/general/browser.ini b/browser/base/content/test/general/browser.ini
index b8c55f65921..5d5b2f86263 100644
--- a/browser/base/content/test/general/browser.ini
+++ b/browser/base/content/test/general/browser.ini
@@ -232,7 +232,6 @@ skip-if = e10s # Bug ?????? - test directly manipulates content
 [browser_bug580638.js]
 [browser_bug580956.js]
 [browser_bug581242.js]
-skip-if = e10s # Bug 930863 - pageshow issues ("TypeError: charset is undefined" in pageshow listener, as document is null)
 [browser_bug581253.js]
 skip-if = e10s # Bug 1093756 - can't bookmark the data: url in e10s somehow
 [browser_bug581947.js]

From 8717cfcb2b5b43bac961dbf1b9bfddff6b7fcbe7 Mon Sep 17 00:00:00 2001
From: Gijs Kruitbosch <gijskruitbosch@gmail.com>
Date: Wed, 5 Nov 2014 00:33:02 +0000
Subject: [PATCH 127/153] Bug 1080801 - re-enable the working urlbar tests,
 rs=gavin

---
 browser/base/content/test/general/browser.ini             | 3 ---
 browser/base/content/test/general/browser_urlHighlight.js | 2 +-
 2 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/browser/base/content/test/general/browser.ini b/browser/base/content/test/general/browser.ini
index 5d5b2f86263..a4a232af081 100644
--- a/browser/base/content/test/general/browser.ini
+++ b/browser/base/content/test/general/browser.ini
@@ -449,7 +449,6 @@ skip-if = buildapp == 'mulet' || e10s # Bug 921935 - focusmanager issues with e1
 [browser_unloaddialogs.js]
 skip-if = e10s # Bug ?????? - test uses chrome windowMediator to try and see alert() from content
 [browser_urlHighlight.js]
-skip-if = e10s
 [browser_urlbarAutoFillTrimURLs.js]
 skip-if = e10s # Bug 1093941 - Waits indefinitely for onSearchComplete
 [browser_urlbarCopying.js]
@@ -462,9 +461,7 @@ skip-if = e10s # Bug 1093941 - ESC reverted the location bar value - Got foobar,
 [browser_urlbarStop.js]
 skip-if = e10s # Bug 1093941 - test calls gBrowser.contentWindow.stop
 [browser_urlbarTrimURLs.js]
-skip-if = e10s
 [browser_urlbar_search_healthreport.js]
-skip-if = e10s # Bug ?????? - FHR tests failing (either with "no data for today" or "2 records for today")
 [browser_utilityOverlay.js]
 [browser_visibleFindSelection.js]
 skip-if = e10s # Bug ?????? - test directly manipulates content
diff --git a/browser/base/content/test/general/browser_urlHighlight.js b/browser/base/content/test/general/browser_urlHighlight.js
index 3ab31273841..a73ff43fcf1 100644
--- a/browser/base/content/test/general/browser_urlHighlight.js
+++ b/browser/base/content/test/general/browser_urlHighlight.js
@@ -16,7 +16,7 @@ function testVal(aExpected) {
     value = value.substring(pos + range.length);
   }
   result += value;
-  is(result, aExpected);
+  is(result, aExpected, "Correct part of the urlbar contents is highlighted");
 }
 
 function test() {

From e5c662e5776fd4395e4b01a5efcb8257d67f485c Mon Sep 17 00:00:00 2001
From: Gijs Kruitbosch <gijskruitbosch@gmail.com>
Date: Wed, 5 Nov 2014 00:04:27 +0000
Subject: [PATCH 128/153] Bug 1069757 - re-enable browser_urlbarCopying.js in
 e10s mode, r=markh

---
 browser/base/content/test/general/browser.ini | 1 -
 1 file changed, 1 deletion(-)

diff --git a/browser/base/content/test/general/browser.ini b/browser/base/content/test/general/browser.ini
index a4a232af081..84887fe77b8 100644
--- a/browser/base/content/test/general/browser.ini
+++ b/browser/base/content/test/general/browser.ini
@@ -452,7 +452,6 @@ skip-if = e10s # Bug ?????? - test uses chrome windowMediator to try and see ale
 [browser_urlbarAutoFillTrimURLs.js]
 skip-if = e10s # Bug 1093941 - Waits indefinitely for onSearchComplete
 [browser_urlbarCopying.js]
-skip-if = e10s # Bug 1069757 - browser_urlbarCopying.js needs e10s love.
 [browser_urlbarEnter.js]
 skip-if = e10s # Bug 1093941 - used to cause obscure non-windows child process crashes on try
 [browser_urlbarRevert.js]

From e043c1645d966ac910f95ee0d2c58f21e2a5baa4 Mon Sep 17 00:00:00 2001
From: Gijs Kruitbosch <gijskruitbosch@gmail.com>
Date: Wed, 5 Nov 2014 11:22:45 +0000
Subject: [PATCH 129/153] Bug 1093997 / bug 1080801 - re-disable
 browser_urlbarSearchSingleWordNotification.js for intermittently failing in
 e10s, rs=test-disabling

---
 browser/base/content/test/general/browser.ini | 1 +
 1 file changed, 1 insertion(+)

diff --git a/browser/base/content/test/general/browser.ini b/browser/base/content/test/general/browser.ini
index 84887fe77b8..b91b801a6ca 100644
--- a/browser/base/content/test/general/browser.ini
+++ b/browser/base/content/test/general/browser.ini
@@ -457,6 +457,7 @@ skip-if = e10s # Bug 1093941 - used to cause obscure non-windows child process c
 [browser_urlbarRevert.js]
 skip-if = e10s # Bug 1093941 - ESC reverted the location bar value - Got foobar, expected example.com
 [browser_urlbarSearchSingleWordNotification.js]
+skip-if = e10s # Bug 1093997 - intermittent failures in e10s-mode only
 [browser_urlbarStop.js]
 skip-if = e10s # Bug 1093941 - test calls gBrowser.contentWindow.stop
 [browser_urlbarTrimURLs.js]

From d049eeaaff69891505578fe3f4c0d173c57aa258 Mon Sep 17 00:00:00 2001
From: "Carsten \"Tomcat\" Book" <cbook@mozilla.com>
Date: Wed, 5 Nov 2014 12:34:42 +0100
Subject: [PATCH 130/153] Backed out changeset 4206d18e42c0 (bug 684096) for
 test bustage

---
 browser/devtools/webconsole/console-output.js | 11 +--
 browser/devtools/webconsole/test/browser.ini  |  2 -
 .../test/browser_webconsole_column_numbers.js | 48 ------------
 .../webconsole/test/test-console-column.html  | 17 ----
 .../test/test-repeated-messages.html          |  5 +-
 browser/devtools/webconsole/webconsole.js     | 78 ++++++++-----------
 6 files changed, 37 insertions(+), 124 deletions(-)
 delete mode 100644 browser/devtools/webconsole/test/browser_webconsole_column_numbers.js
 delete mode 100644 browser/devtools/webconsole/test/test-console-column.html

diff --git a/browser/devtools/webconsole/console-output.js b/browser/devtools/webconsole/console-output.js
index e8722c9ca74..636da69fe06 100644
--- a/browser/devtools/webconsole/console-output.js
+++ b/browser/devtools/webconsole/console-output.js
@@ -943,16 +943,14 @@ Messages.Simple.prototype = Heritage.extend(Messages.BaseMessage.prototype,
       return null;
     }
 
-    let {url, line, column} = this.location;
+    let {url, line} = this.location;
     if (IGNORED_SOURCE_URLS.indexOf(url) != -1) {
       return null;
     }
 
     // The ConsoleOutput owner is a WebConsoleFrame instance from webconsole.js.
     // TODO: move createLocationNode() into this file when bug 778766 is fixed.
-    return this.output.owner.createLocationNode({url: url,
-                                                 line: line,
-                                                 column: column});
+    return this.output.owner.createLocationNode(url, line);
   },
 }); // Messages.Simple.prototype
 
@@ -1252,7 +1250,6 @@ Messages.ConsoleGeneric = function(packet)
     location: {
       url: packet.filename,
       line: packet.lineNumber,
-      column: packet.columnNumber
     },
   };
 
@@ -3449,8 +3446,8 @@ Widgets.Stacktrace.prototype = Heritage.extend(Widgets.BaseWidget.prototype,
       fn.textContent = l10n.getStr("stacktrace.anonymousFunction");
     }
 
-    let location = this.output.owner.createLocationNode({url: frame.filename,
-                                                        line: frame.lineNumber},
+    let location = this.output.owner.createLocationNode(frame.filename,
+                                                        frame.lineNumber,
                                                         "jsdebugger");
 
     // .devtools-monospace sets font-size to 80%, however .body already has
diff --git a/browser/devtools/webconsole/test/browser.ini b/browser/devtools/webconsole/test/browser.ini
index 765aa1d931e..74ae6af532c 100644
--- a/browser/devtools/webconsole/test/browser.ini
+++ b/browser/devtools/webconsole/test/browser.ini
@@ -82,7 +82,6 @@ support-files =
   test-console-output-04.html
   test-console-output-dom-elements.html
   test-console-output-events.html
-  test-console-column.html
   test-consoleiframes.html
   test-data.json
   test-data.json^headers^
@@ -325,4 +324,3 @@ skip-if = buildapp == 'mulet'
 [browser_webconsole_autocomplete_crossdomain_iframe.js]
 [browser_webconsole_console_custom_styles.js]
 [browser_webconsole_console_api_stackframe.js]
-[browser_webconsole_column_numbers.js]
diff --git a/browser/devtools/webconsole/test/browser_webconsole_column_numbers.js b/browser/devtools/webconsole/test/browser_webconsole_column_numbers.js
deleted file mode 100644
index 2912950da93..00000000000
--- a/browser/devtools/webconsole/test/browser_webconsole_column_numbers.js
+++ /dev/null
@@ -1,48 +0,0 @@
-/*
- * Any copyright is dedicated to the Public Domain.
- * http://creativecommons.org/publicdomain/zero/1.0/
- */
-
- // Check if console provides the right column number alongside line number
-
-const TEST_URI = "http://example.com/browser/browser/devtools/webconsole/test/test-console-column.html";
-
-let hud;
-
-function test() {
-  addTab(TEST_URI);
-  browser.addEventListener("load", function onLoad() {
-    browser.removeEventListener("load", onLoad, true);
-    openConsole(null, consoleOpened);
-  }, true);
-}
-
-function consoleOpened(aHud) {
-  hud = aHud;
-
-  waitForMessages({
-    webconsole: hud,
-    messages: [{
-      text: 'Error Message',
-      category: CATEGORY_WEBDEV,
-      severity: SEVERITY_ERROR
-    }]
-  }).then(testLocationColumn);
-}
-
-function testLocationColumn() {
-  let messages = hud.outputNode.children;
-  let expected = ['6:6', '6:38', '7:8', '8:10', '9:8', '10:6'];
-
-  let valid = true;
-
-  for(let i = 0, len = messages.length; i < len; i++) {
-    let msg = messages[i].textContent;
-
-    is(!msg.contains(expected[i]), true, 'Found expected line:column of ' + expected[i])
-  }
-
-  is(valid, true, 'column numbers match expected results');
-
-  finishTest();
-}
\ No newline at end of file
diff --git a/browser/devtools/webconsole/test/test-console-column.html b/browser/devtools/webconsole/test/test-console-column.html
deleted file mode 100644
index ff9cc81e10e..00000000000
--- a/browser/devtools/webconsole/test/test-console-column.html
+++ /dev/null
@@ -1,17 +0,0 @@
-<!DOCTYPE HTML>
-<html dir="ltr" xml:lang="en-US" lang="en-US">
-  <head>
-    <!-- Any copyright is dedicated to the Public Domain.
-     http://creativecommons.org/publicdomain/zero/1.0/ -->
-    <meta charset="utf-8">
-    <title>Console test</title>
-
-    <script type="text/javascript">
-      console.info("INLINE SCRIPT:"); console.log('Further');
-        console.warn("I'm warning you, he will eat up all yr bacon.");
-          console.error("Error Message");
-        console.log('Rainbooooww');
-      console.log('NYAN CATZ');
-    </script>
-  </head>
-</html>
diff --git a/browser/devtools/webconsole/test/test-repeated-messages.html b/browser/devtools/webconsole/test/test-repeated-messages.html
index 97f5482e469..5bbc8fd5abc 100644
--- a/browser/devtools/webconsole/test/test-repeated-messages.html
+++ b/browser/devtools/webconsole/test/test-repeated-messages.html
@@ -5,10 +5,7 @@
     <title>Test for bugs 720180, 800510 and 865288</title>
     <script>
       function testConsole() {
-        // same line and column number
-        for(var i = 0; i < 2; i++) {
-          console.log("foo repeat");
-        }
+        console.log("foo repeat"); console.log("foo repeat");
         console.log("foo repeat"); console.error("foo repeat");
       }
       function testConsoleObjects() {
diff --git a/browser/devtools/webconsole/webconsole.js b/browser/devtools/webconsole/webconsole.js
index baf94930af5..d8e0f584a72 100644
--- a/browser/devtools/webconsole/webconsole.js
+++ b/browser/devtools/webconsole/webconsole.js
@@ -1359,19 +1359,9 @@ WebConsoleFrame.prototype = {
   {
     // Warnings and legacy strict errors become warnings; other types become
     // errors.
-    let severity = 'error';
+    let severity = SEVERITY_ERROR;
     if (aScriptError.warning || aScriptError.strict) {
-      severity = 'warning';
-    }
-
-    let category = 'js';
-    switch(aCategory) {
-      case CATEGORY_CSS:
-        category = 'css';
-        break;
-      case CATEGORY_SECURITY:
-        category = 'security';
-        break;
+      severity = SEVERITY_WARNING;
     }
 
     let objectActors = new Set();
@@ -1389,27 +1379,21 @@ WebConsoleFrame.prototype = {
       errorMessage = errorMessage.initial;
     }
 
-    // Create a new message
-    let msg = new Messages.Simple(errorMessage, {
-      location: {
-        url: aScriptError.sourceName,
-        line: aScriptError.lineNumber,
-        column: aScriptError.columnNumber
-      },
-      category: category,
-      severity: severity,
-      timestamp: aScriptError.timeStamp,
-      private: aScriptError.private,
-      filterDuplicates: true
-    });
-
-    let node = msg.init(this.output).render().element;
+    let node = this.createMessageNode(aCategory, severity,
+                                      errorMessage,
+                                      aScriptError.sourceName,
+                                      aScriptError.lineNumber, null, null,
+                                      aScriptError.timeStamp);
 
     // Select the body of the message node that is displayed in the console
     let msgBody = node.getElementsByClassName("message-body")[0];
     // Add the more info link node to messages that belong to certain categories
     this.addMoreInfoLink(msgBody, aScriptError);
 
+    if (aScriptError.private) {
+      node.setAttribute("private", true);
+    }
+
     if (objectActors.size > 0) {
       node._objectActors = objectActors;
     }
@@ -2577,8 +2561,7 @@ WebConsoleFrame.prototype = {
     // right side of the message, if applicable.
     let locationNode;
     if (aSourceURL && IGNORED_SOURCE_URLS.indexOf(aSourceURL) == -1) {
-      locationNode = this.createLocationNode({url: aSourceURL,
-                                              line: aSourceLine});
+      locationNode = this.createLocationNode(aSourceURL, aSourceLine);
     }
 
     node.appendChild(timestampNode);
@@ -2621,8 +2604,11 @@ WebConsoleFrame.prototype = {
    * Creates the anchor that displays the textual location of an incoming
    * message.
    *
-   * @param object aLocation
-   *        An object containing url, line and column number of the message source (destructured).
+   * @param string aSourceURL
+   *        The URL of the source file responsible for the error.
+   * @param number aSourceLine [optional]
+   *        The line number on which the error occurred. If zero or omitted,
+   *        there is no line number associated with this message.
    * @param string aTarget [optional]
    *        Tells which tool to open the link with, on click. Supported tools:
    *        jsdebugger, styleeditor, scratchpad.
@@ -2630,10 +2616,10 @@ WebConsoleFrame.prototype = {
    *         The new anchor element, ready to be added to the message node.
    */
   createLocationNode:
-  function WCF_createLocationNode({url, line, column}, aTarget)
+  function WCF_createLocationNode(aSourceURL, aSourceLine, aTarget)
   {
-    if (!url) {
-      url = "";
+    if (!aSourceURL) {
+      aSourceURL = "";
     }
     let locationNode = this.document.createElementNS(XHTML_NS, "a");
     let filenameNode = this.document.createElementNS(XHTML_NS, "span");
@@ -2644,13 +2630,13 @@ WebConsoleFrame.prototype = {
     let fullURL;
     let isScratchpad = false;
 
-    if (/^Scratchpad\/\d+$/.test(url)) {
-      filename = url;
-      fullURL = url;
+    if (/^Scratchpad\/\d+$/.test(aSourceURL)) {
+      filename = aSourceURL;
+      fullURL = aSourceURL;
       isScratchpad = true;
     }
     else {
-      fullURL = url.split(" -> ").pop();
+      fullURL = aSourceURL.split(" -> ").pop();
       filename = WebConsoleUtils.abbreviateSourceURL(fullURL);
     }
 
@@ -2663,27 +2649,27 @@ WebConsoleFrame.prototype = {
     if (aTarget) {
       locationNode.target = aTarget;
     }
-    locationNode.setAttribute("title", url);
+    locationNode.setAttribute("title", aSourceURL);
     locationNode.className = "message-location theme-link devtools-monospace";
 
     // Make the location clickable.
     let onClick = () => {
       let target = locationNode.target;
       if (target == "scratchpad" || isScratchpad) {
-        this.owner.viewSourceInScratchpad(url);
+        this.owner.viewSourceInScratchpad(aSourceURL);
         return;
       }
 
       let category = locationNode.parentNode.category;
       if (target == "styleeditor" || category == CATEGORY_CSS) {
-        this.owner.viewSourceInStyleEditor(fullURL, line);
+        this.owner.viewSourceInStyleEditor(fullURL, aSourceLine);
       }
       else if (target == "jsdebugger" ||
                category == CATEGORY_JS || category == CATEGORY_WEBDEV) {
-        this.owner.viewSourceInDebugger(fullURL, line);
+        this.owner.viewSourceInDebugger(fullURL, aSourceLine);
       }
       else {
-        this.owner.viewSource(fullURL, line);
+        this.owner.viewSource(fullURL, aSourceLine);
       }
     };
 
@@ -2691,12 +2677,12 @@ WebConsoleFrame.prototype = {
       this._addMessageLinkCallback(locationNode, onClick);
     }
 
-    if (line) {
+    if (aSourceLine) {
       let lineNumberNode = this.document.createElementNS(XHTML_NS, "span");
       lineNumberNode.className = "line-number";
-      lineNumberNode.textContent = ":" + line + (column >= 0 ? ":" + column : "");
+      lineNumberNode.textContent = ":" + aSourceLine;
       locationNode.appendChild(lineNumberNode);
-      locationNode.sourceLine = line;
+      locationNode.sourceLine = aSourceLine;
     }
 
     return locationNode;

From 2f2f23a6ec0dc779ee596f5ac4f8f27a72eade3e Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@lucasr.org>
Date: Wed, 5 Nov 2014 12:32:41 +0000
Subject: [PATCH 131/153] Bug 1094160 - Set default visibility of tabs panel on
 startup (r=mcomella)

---
 mobile/android/base/resources/layout/tabs_panel_view.xml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/mobile/android/base/resources/layout/tabs_panel_view.xml b/mobile/android/base/resources/layout/tabs_panel_view.xml
index f7a3ed30fa9..a7dde94434d 100644
--- a/mobile/android/base/resources/layout/tabs_panel_view.xml
+++ b/mobile/android/base/resources/layout/tabs_panel_view.xml
@@ -3,8 +3,11 @@
    - License, v. 2.0. If a copy of the MPL was not distributed with this
    - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
 
+<!-- The tabs panel is initial hidden on startup. It will be made
+     visible when the user activates it. See TabsPanel.show() -->
 <org.mozilla.gecko.tabs.TabsPanel xmlns:android="http://schemas.android.com/apk/res/android"
                                   android:id="@+id/tabs_panel"
                                   android:layout_width="match_parent"
                                   android:layout_height="match_parent"
-                                  android:background="@color/background_tabs"/>
+                                  android:background="@color/background_tabs"
+                                  android:visibility="invisible"/>

From b5fd2a6bc8531dfb9d0ed46039cc1eaab291c0b0 Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@lucasr.org>
Date: Wed, 5 Nov 2014 12:35:15 +0000
Subject: [PATCH 132/153] Bug 1067556 -  Adjust new tab button's position
 (r=mcomella)

---
 .../new_tablet_tab_strip_button.xml           | 45 +++++++++++++++++++
 .../res/layout-large-v11/tab_strip.xml        |  3 +-
 .../drawable/new_tablet_tab_strip_button.xml  |  7 +++
 .../android/base/resources/values/dimens.xml  |  1 +
 4 files changed, 55 insertions(+), 1 deletion(-)
 create mode 100644 mobile/android/base/newtablet/res/drawable-large-v11/new_tablet_tab_strip_button.xml
 create mode 100644 mobile/android/base/resources/drawable/new_tablet_tab_strip_button.xml

diff --git a/mobile/android/base/newtablet/res/drawable-large-v11/new_tablet_tab_strip_button.xml b/mobile/android/base/newtablet/res/drawable-large-v11/new_tablet_tab_strip_button.xml
new file mode 100644
index 00000000000..e2cc5f8d42f
--- /dev/null
+++ b/mobile/android/base/newtablet/res/drawable-large-v11/new_tablet_tab_strip_button.xml
@@ -0,0 +1,45 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<selector xmlns:android="http://schemas.android.com/apk/res/android"
+          xmlns:gecko="http://schemas.android.com/apk/res-auto">
+
+    <item android:state_pressed="true"
+          android:state_enabled="true">
+
+        <inset android:insetTop="@dimen/new_tablet_tab_strip_button_inset"
+               android:insetBottom="@dimen/new_tablet_tab_strip_button_inset"
+               android:insetLeft="@dimen/new_tablet_tab_strip_button_inset"
+               android:insetRight="@dimen/new_tablet_tab_strip_button_inset">
+            <shape android:shape="rectangle">
+                <solid android:color="@color/highlight_dark"/>
+                <corners android:radius="@dimen/new_tablet_browser_toolbar_menu_item_corner_radius"/>
+            </shape>
+        </inset>
+
+    </item>
+
+    <item android:state_focused="true"
+          android:state_pressed="false">
+
+        <inset android:insetTop="@dimen/new_tablet_tab_strip_button_inset"
+               android:insetBottom="@dimen/new_tablet_tab_strip_button_inset"
+               android:insetLeft="@dimen/new_tablet_tab_strip_button_inset"
+               android:insetRight="@dimen/new_tablet_tab_strip_button_inset">
+            <shape android:shape="rectangle">
+                <solid android:color="@color/new_tablet_highlight_focused"/>
+                <corners android:radius="@dimen/new_tablet_browser_toolbar_menu_item_corner_radius"/>
+            </shape>
+        </inset>
+
+    </item>
+
+    <item>
+        <shape android:shape="rectangle">
+            <solid android:color="@android:color/transparent"/>
+        </shape>
+    </item>
+
+</selector>
diff --git a/mobile/android/base/newtablet/res/layout-large-v11/tab_strip.xml b/mobile/android/base/newtablet/res/layout-large-v11/tab_strip.xml
index 76071bf3707..b5ae8e5bc1f 100644
--- a/mobile/android/base/newtablet/res/layout-large-v11/tab_strip.xml
+++ b/mobile/android/base/newtablet/res/layout-large-v11/tab_strip.xml
@@ -20,6 +20,7 @@
         android:layout_width="@dimen/new_tablet_tab_strip_height"
         android:src="@drawable/tab_new_level"
         android:contentDescription="@string/new_tab"
-        android:background="@drawable/action_bar_button_inverse"/>
+        android:layout_marginRight="9dp"
+        android:background="@drawable/new_tablet_tab_strip_button"/>
 
 </merge>
diff --git a/mobile/android/base/resources/drawable/new_tablet_tab_strip_button.xml b/mobile/android/base/resources/drawable/new_tablet_tab_strip_button.xml
new file mode 100644
index 00000000000..d3e7c791725
--- /dev/null
+++ b/mobile/android/base/resources/drawable/new_tablet_tab_strip_button.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+
+<bitmap xmlns:android="http://schemas.android.com/apk/res/android"
+        android:src="@null"/>
diff --git a/mobile/android/base/resources/values/dimens.xml b/mobile/android/base/resources/values/dimens.xml
index e2ce1932917..85b4d40b7ca 100644
--- a/mobile/android/base/resources/values/dimens.xml
+++ b/mobile/android/base/resources/values/dimens.xml
@@ -39,6 +39,7 @@
     <dimen name="new_tablet_browser_toolbar_menu_item_inset_vertical">5dp</dimen>
     <dimen name="new_tablet_browser_toolbar_menu_item_inset_horizontal">3dp</dimen>
     <dimen name="new_tablet_browser_toolbar_menu_item_corner_radius">5dp</dimen>
+    <dimen name="new_tablet_tab_strip_button_inset">5dp</dimen>
     <dimen name="forward_default_offset">-13dip</dimen>
 
     <!-- Dimensions used by Favicons and FaviconView -->

From 5c8b20b4085a69b65a1e0ba42845335426ac995a Mon Sep 17 00:00:00 2001
From: Jordan Santell <jsantell@gmail.com>
Date: Wed, 22 Oct 2014 17:18:31 -0700
Subject: [PATCH 133/153] Bug 1078539 - Add a doorhanger widget for the
 developer edition notification to browser console, developer tools, webide
 and  responsive design mode. r=jryans

---
 browser/app/profile/firefox.js                |  11 ++
 .../dev-edition-promo/dev-edition-logo.png    | Bin 0 -> 6764 bytes
 .../dev-edition-promo/dev-edition-promo.css   |  74 +++++++++
 .../dev-edition-promo/dev-edition-promo.xul   |  36 +++++
 browser/devtools/framework/toolbox.js         |  17 +++
 browser/devtools/jar.mn                       |   3 +
 .../responsivedesign/responsivedesign.jsm     |   8 +
 browser/devtools/shared/doorhanger.js         | 144 ++++++++++++++++++
 browser/devtools/shared/moz.build             |   1 +
 browser/devtools/webconsole/hudservice.js     |   4 +
 browser/devtools/webide/content/webide.js     |   4 +
 11 files changed, 302 insertions(+)
 create mode 100644 browser/devtools/framework/dev-edition-promo/dev-edition-logo.png
 create mode 100644 browser/devtools/framework/dev-edition-promo/dev-edition-promo.css
 create mode 100644 browser/devtools/framework/dev-edition-promo/dev-edition-promo.xul
 create mode 100644 browser/devtools/shared/doorhanger.js

diff --git a/browser/app/profile/firefox.js b/browser/app/profile/firefox.js
index 7796bb09b58..d5f4f7b32b5 100644
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -1306,6 +1306,17 @@ pref("browser.devedition.theme.enabled", false);
 pref("browser.devedition.theme.showCustomizeButton", false);
 #endif
 
+// Developer edition promo preferences
+pref("devtools.devedition.promo.shown", false);
+pref("devtools.devedition.promo.url", "https://mozilla.org/firefox/developer");
+
+// Only potentially show in beta release
+#ifdef MOZ_UPDATE_CHANNEL == beta
+  pref("devtools.devedition.promo.enabled", true);
+#else
+  pref("devtools.devedition.promo.enabled", false);
+#endif
+
 // Disable the error console
 pref("devtools.errorconsole.enabled", false);
 
diff --git a/browser/devtools/framework/dev-edition-promo/dev-edition-logo.png b/browser/devtools/framework/dev-edition-promo/dev-edition-logo.png
new file mode 100644
index 0000000000000000000000000000000000000000..4b90768d2d172703a185da55bf3ab9e619ca6a63
GIT binary patch
literal 6764
zcmV-y8k6OTP)<h;3K|Lk000e1NJLTq002M$002M;1^@s6s%dfF000^@Nkl<ZcmeI3
zd5mP&b)Ua`?^|l`eWqvMxDH8Clt@vbDa+byfr<^wNo+)bBf*YfIEfL&Fzh7AW+8AO
zC`kTDVj&2USP^Uo5u7-SOxcQLEu>6^t4N9*4rhil(=)wy*IxCOyX5IsRkP5Tkz$a_
zg6IHWo%im$)7|HH&pqcp42u7+?FaS)`+*6*&-Qa)*{+sC`7SBNgE-z+_#?*HTMJ*u
zArJsK>s&`k`KoiQ0M9yj!dm+nF#Ns>@K+w+<;}L<AZs+L@y{UmX>06zj5aDa7EhXE
zw5AxxIfo2GoX(L_5~zYwOcVqJfh<tDRPu|?@i}Ac=Yam3F2FB7_T~xTaHpgYzh<5L
z*=(3r2K@m^k~7Q<S+2<o90F?{IvL^$A66@vevcrIQA(n$^}$C`NK`ISuEYgp;!3Hb
zr1&l1Q^2)1O@P1lCr#d{W!f%D_=L{$j~BtJem|k#AChE-+&a=UCreVC5Ex@HX$nGM
z3m;S}xWWr-P*I2q3Iqg75Y=kL7%HU@QOuj2sZoieG>U>xJI5!0<{RGvZ!iN=ZGPT4
z_o-g1GuKaY1_k|Ahk=G9Ny(A~lWUA~UI3&-Dg`)H6e9zL?z9mINQRJSC_#Zh1p#5T
zN~v7p_Tvjg2N&rXfwVANEo~P<{1Wi*zwb5Rz@Ym9;EPPzYcie{h|eUw{!et;J$n6w
zL4QcEJ7kdMXut`H%X1&Rc3`!}T8k6{z^^#g;*tbElBGx`QBoo&B4EKmtP^JI6;8k7
zUbgBpEaAWkYPHJm9*f0a-`?C!fzF>=fM5F0=lO2-zEg`2e*WU_V_~3TzydVG_^fpH
z_j~Q`t?lh5o%IcdX-*!-<VixN4aR~_QgRib5eTUef%4f<h~igX7&8*XS=?}dDwVtd
zg^CDgkw6dzsB#4*A<!wIl)Uw!xARP6p5;(*${8A!@<!+KTJ~q|IrfXd=l@g!{O14I
z<Ysob6sWIVY5l=tS6e^&!CU6v4}9r@DBWKK_D8MFt-02<ReH@9sd4BaL`y}wzKTJT
zM^$RoGIyUkL{o)m2N%y>CP^|>DaQ1Aqskvg=x&FwQo$BpI7d*gBXPJ+3n8VSM-&t5
z0b#99cwm{g%mqAq%iZ*?<pZ^l;UH(O({T^pb>vrofAYU9z`uO*<^l+9f9jK8d+ql+
z!;JTyUU)2<ZTwAi{`uzRD>JS2O$LJ@xeUk#10TG$g2YPZ8&%GpIZS_Xf%5~66>wr_
zn`fUn@Aq`p>msa0c>!W{r{yz2MG>~&MLIhYXKo%l=;O5Zbwj0HLYosFIf>FK_r3jY
zzIxy&ZEbmEHl~zlPLa8Owet60>8Af0Smk?|{0~>#+>GCQe(j^}?hu=4{`*U-56f2j
z>zn6Znc2B|jb5r57UP4BHIm(JY^A}_z|qA9$L_m>Z-!N#X(wpsINNFR%#$yp;+VYG
z18u<=ADAmV+Tha6-wR(iw66>K`WhxEA;JiH9h`y83TovLx4XsDU-~K!H`j5%e`}>|
z29i|~ib0b8y1ugcjRV#AU;*C^@fW{vl^fZQ&6j6B{n*9L^PAlWW3hQoC6GLDxJ19W
zE(u4DAhXW5xSop1`a|N|PIGanaYEpv;N3C&;iG>tssT!2k_4O^?QtRe!N;`Q2y6UU
z*qFf-f=XwwGDHqL$T&jHFJZUVkWt9|@gp30<VUGozR3DB&mlkf2+yh#0{G!-$Su<G
zjX!*f(+{0}>h=S(4*@whvEWdsxRDv_?qAvIh1M4>O^D^>QiC-a(GH=RYpn1M8#$v`
zC`Ygim-;zK0l=wB#B+~7gEN+(TqW;y*)xYPin#HOcMj9-plWqodlxGuD(NGJU0kP$
zI(8b74ro31EafQVr5||@Cy$-v(8X6cck)gW2Vd*u)EW^BM;5s9t@HP1KXl(GfWO5}
zOujJ4xe?b}gVWu9B21cb%VL%L&mQG!?pW!iw2}<x8~_$e?hGgDA*+KFrsC0CyR2`w
z{b9$X2{MXMaj76ih5<4NQPmnjV+Qpd>J3B~BH|JVNtpF<wRvoL26x~XF4Ndj9UQDZ
z|01_O`8dxT#gnJc^7fED`=d_E!r9YgoeoXye&sFY@Xi8mguK~<i|d_=O>^FMVgXmH
z@WN&nYuzYt#~z|!Ar4p@Wb8LnjD__&L8<K1-&u>vQojvsp8GK&1iIbEbXwS67j*7h
zVsP{%a(036@G*iDXZ)c^Zm;9kS8+#g!NpZBeB&A3Hte!t92c$R?pOg1?cke3&GF*Q
zko1Sa<K65N1>6XEvj^v|?{;rLJj<q)Y;_Z`4xF7%*@^eH;Yx3^`lGQ}3f~n@96RKL
z7D9q`1r~6Ao^uw2oZS0o&Wy%<aSQ_N+6wN{%doWujagJ7s7w;%@^Mr$#60?WmXu&U
zxAd*!<akSOYD1^dpj3*voazt%<V<|Dfc*r;2RE{>&)3EIcH;Z?-XDzsG4f(chP8eM
zLhMZe$4nquY4%uHY;f0G&LFJwM_TI~vC;H)J6ycJ<-3H8VqXvi4q-H|*T%MXkTbK8
zCI|-@4Lh4iYY@iZaOhKKxl+u#V|R<k8jHM^86GGHZ00bu@U3Cahi6JW-%Qjq{p`cQ
zKVzTC;sN`?xrOUm{DU+zV9ZDW=RCpz9=GR>bqH55Rp1l?jAgf%@a>-FMI(7KF+5f9
z^w4tb*fRIresa_b(;;@y!}dD3eiy76XPZMv`TFl><iQ~~R|(I53t=qgsi&!qSLEq|
z=B`q}p+Nfki-|@!Sjp`B3)qjm(cp8Ny<gwy4v#vcM`=0!1NNuBV84w75`e`Kn+!Kh
zvEQND!>;al%vOtjs@dLd;l|>MF^sXcVC^clF^5IqQ~(ZOJTHt8S&D3JbLFM;+-5Vp
z2F|gX8y1xGTf;bqEEs6}&I0x$_YZui5iecqBtPeJ4aS0X2s>5yn9hR9_4M=6btgA0
zmn4TH!5#GyXG#GlV#Qk)>fCYsAXnFSxODmYB>24*cOn?QE2MqYpp6`K5WQVY5Q7jC
zk^D6{WT%Nn5?vepEP&O_B5^DR3T;6+NUS^X?s_y=z%+9Iz{Vi^g{!;$GI}Dw^a|kt
z5L4M805SFx5fW`VbYPxAtIy??E!s(rE0+mpYPjt!F2C^YQ7}_K-!TeGb$3zy7Q$IX
za}!Z*5UyWDOEtX}UjKK4E?i$jz~1wf%#Z=bjxwOHE!uIWfNA9ZflIC7M@^plD(tL*
z>D0tc-Q&I3R}aM0HW<vzkaT;vZkJM)a4d3Me(G6XeC{Qz)*!%*PlXg<EY|-~DZ-A#
z7sDPdD*5NCy@d%&{$8ZRQSeeiuSNTbuQDguTZERe0O)buPK{+T5X&=ydkdH#r*D=+
zdFN_-c*f=9GrCXxeZZ6mQ~TaIriBOvT(WR?(E$$6)sX3s$G`C`&E4_JT05R=_x8WS
z5SR=zcL+1H1TdPbGmr|ICy3@6S#@Uos~vOicn9+*Ptaby&I}-@7Djjh1R?nQUN8CC
zmCg3Y3z#6MZ#D<nd%MF_SpSk@ac-*m17dpBDLk)VGk#u{f?6Oc3BmDlL~nVCelq0B
zwe@k}Q+r-Yux?5Oi?kX^;idFKIH8c+tJt}N;2cut$o3YlwSlQLFh&!7?B|Ia4d{0G
zv3dl&-ZeJ0<zOfYfpeEP9%;6E_ZKihPT%x0^U%Rk;CyScroefotFylz1wK9I2?Q+0
zA;&8b_s&*m1d@6|pv2Uw7uZq2AV$|?5q#G5ySM_I=L9Cl)E5wiM+iU11EZfMpfc$5
zyozaj_%Bc!4jDQqF)Ehf_+_oE1Z4r2RyL~naQM~&CdlcV`B<G<Z}prt7FRH8QTy8z
zV?UkxAPYYeDj)EC6tJ1(L_%<^98oJ62k*TYdk~=Wy?c=*1l?_d-Y%-ULmt=szW2W?
z&p;@|xC02IJxVH+bF9DRZ7escJlW4V5h=<-kWLm4L0w9cJQEe0#RW_ViVr5%8D@jd
zAeGJ-thERsa6;ln!B2TX0Mtq$N=alvy%hPr`||1zX`omNjBkZU?>WPlHg*thR8z#1
z2v({|>U*42FuBhY;_EN(iLII&nAs&na~+HZAP-^&l^Lo)Gq=nwETCHnogB`@inZJ#
z9Y~-oEStR!QLw<Y1yLZGSTEJj*F*W9cHfM9vKZqK7K9jW2_+q&lC%aXNXe;2nQO1E
z@^ohaN^-g$@THf|Bb?*a7ha*;8zK;(l%J2Iz~B%bqyiyvGQd_Fey&p?&S;|62KYi~
z{2bj_1Qn4jpF;K9h>I^!wvUh-%lSm3tfOlz$Af^5wmvf*4%KQRhdt!tJ^`i&25ENS
z$ZVD7P8$hWArJ*Zit);b!daXZB$@W(x6W30{-qTXV-ZRs!hk?2L=c13bb7;46(6tq
zbOxB}JVNKby8AI9!3lI&#@6NtJDcdaW#9IkP?(uTA4K`ei~ipLxY-JUb=(#zsz6|@
z7a<4KIAdc3a%YpJ`35_sx?##>F~EdU7}R}=TZ=Wu`w4cs2#!yO)j+Yc)h5-(2d~1Q
zKv6D*zHkW#AV7r>gd@-E1<^T1!b}~8bYlryn?>RfqjQKq6veCO2{$fd!<c;T5H>0U
z5XA8~Xv?8c5*bI$LC-p*2Vw!~+A528ou!$Xs|8F5iVr4sd%awH;lg!7DNsUEjzfBh
z_Q8tL9zY1jg;8**Ugo)%wh&Sx1LYB6K)Y1o=u(5#Yim;l)WW3l3k6aD;Ku2WwMdf_
z=P6QW{^(n@J3lt513_m8ge2O0jeK?)TV#h?SVm_CA@D7)?i_P*z=gz&M07A0NU}Tc
z;zd>G5WK>a1>w|9y&R<*yPagQS}G0GoIpveHApM4QXri4io!?`F?wn7t1gv91O<iP
z8s;qDbr**N#oEQouM1!u)7wA_!HGlj)DG7`=j>d&PH%h1KMRu{d36@m-h{CLx;BT%
zQv?vT))8?`Si2pW8{$aOF%G9Ky%?mO9GRh=YF-Uyef_E^@dQ&A6a!4`()#Y@N)+4~
z2J(2CK@>==wH{#vR*d%PXqz~+wn!<EN_YXJ90@?-H&ab~>m4l3&6Auz&tSK?*9zws
zW?4Ra2ln(WzEW=+=fzlhC}4Sgg|#nyfuz+&N`(y~zu#S41|bnPWnu>(`3Z>12yM~U
z(n>XlY7ysCgPa`PaHP2f3y~5;LVS%W3yJ|ImgV}3^R?1#&e-D;e5Eh0$AJsKC!OC0
zqm?Y?Q;tHk5Cl@-r10|?)l6R-+}t9iA3DHMlOeN=uwJ7V#hlADZjg?)6#@!Y(~R{Z
zt&jfspTU0i-y#PCOm!BU4zPvyW-SxTPM@V*t7CgP+C>afLtYBTt3NUY*s<_csX8w;
zhtmQeivcDWt^c4=iJ!I3(jOG})-vBHW5(wKYpnOK0PEOp_c<_EMGB}!p<m%jpqPn*
zy<@L*j#OK=2w5-HxT;}ynE7WD{JA5~F<O&5%Su?HK0oIL57R!e5V)vHP+SY0V`V^N
z`4CB|PER}h$<;ZOwmx{}+{hQqDnV<Q`@db{et#|$rho}S@xjEdQW@U56g~O!t1B!m
z%%F4Q|3h-S)yGP)mjx7F3Fm*PPkTTcOCt{H4pYE!v|dIiMKj6i<{E?mMn9t-2ZV(m
zrWwu75Hn1v3YghmCEvJ4U@}@)uX;g8<bd-*2Ez`fRHJg|J?v^n7(z`6dZ|Gf2X@p3
zy*X$o$<;yTGgLYE8TMIF3^Hx4cK0i@wX!QxTco*H*0;pCQt~N13dA4)IodWvN|Jxa
zM*&OK5*wWX{UrBwVXnA8UWsu6tixy3Zg;@WFvI4iKy#+5Fi(Gj*5%6xXD~i!gBbg~
zGDEq&LGDkEqwT2fxgR_FFEbxpC!74O3Srz>Ffh6HnH7iXm1aNvGW#qj2AQ@d<@MQm
z`RQh>bN``3OI+L7rMRb3i5NC}qbvXz`$6K>^;;uJa}17S^L6^g_;zo|X5sy55<J$9
z&KVfXk=YuxW|OT)zd}CfzrNz`_29kSQJHAaCauk(fP+Pc*%D<hfQST{1EX_*!Uujk
zIY0twVo=s%d&zHc0}E`g&we|0<ltv7yt?8A2$ZB&t)P7km}CIno3WQtpb)-bn#{0i
z20j~39-PB=J7^?CG0s^;nxY0h7<9RM`4U@eS19#+qm|t+0ARuxVKqryC1|dJ5R~8g
zAX{n9tp^*v#;kM_CT6tptB!;DO33<dkGgVPeDTuU4F$OJ;wARmp|gj6=h%^@Pn~<|
zVs!SNTe-Hj<5zL6QKi}GGv3WinHRy~z!(IOr8(=lAq05t3HmEnr{DY0ag}ub7-gOL
zm7W&B&%>Kff01XnLDSDW{P2%(jWWyi7@-8scH*}Y;J1L*(O3Y7%>)f)X<k|3?mLgy
zxPi&y0sHB>aQnc)g@2b120ZiBw^_ZmK@<j5%aK>uV+_{&2~)4l){Zb1?IiMnhgp8$
z0pe0T3U(}#bY}0kn+GM*s6rA~Fku-0s{&M>QaO5*BM-lu#e3gQ=j=PFhKimNgi^BE
z>S40nqsH6N7T19rbq9OlMH-Rf<Sj>53fNCjd~hS{t*-vYk)sDcx^i_b6f$6QeVdb~
zk7A8RFfq619SUIF6)eIDkPe6R*^n)trheuu3nfJ*PuRG4h1V{ufDq*61~%=FJB%c4
z%p==de)Z>O%9!{4m>=)7`h-YCtwej6(RYv*9)Y*nQkmWMz-L0E62WUP(@){HdycWT
z)B9s?V5;%1kJ1}v`ymVB)?zJQ*uJ**PU{anhF(8GDTy|QkqHn06X!rooIo(Gkt53t
z-F#F>WSW3=xQ!KzP~a?KXA6-H2xk|Wf5$sH_~3)|&fe#%|JHhonVBkCDWaEV%ol!R
zb%#95k>Cq)6etG641wcVWLSUtX%^o3Fnxkcxv{@mz<$J?zwsD1v(nb}S%-M#(z%NV
zv<%QHfC3Q&qn95Qpp^30N(D$I3)INV0wEDn_<)@(5dM14$8ktm2~4Mj>37Ms!IZ1G
znR#Rw;`2vJ-^)|$Xy<xQ&!sqI<=Xb>dT|DwYm!9!?sH_mg1T}Zd*W7h636j_Gamy!
z!wpQG_|Pv92I_{0nb~BaUVd%RYX5XL7y@7?EA1GWnBES;doh_JMjiyhQQ(-^<nT1q
zhEzr5<vOO?z{X|VIAdljB^1ycrX<?z)tK2*#O`+6|NEtd22nX;*iUJ-`;@|fV+Uv0
zjAq&CWh~8BzMSRemkYQNs{XFO<S%YUTl4ba#hFvB>#J{d)&k?6?f~4#@2d&pNBc*-
z2{!^aeeJw2#UYJyOeG45l%mxgl4Lnpw-<al49Ev5y@G?q%I7#LVd!hY+<YAwMO@z<
zkfs@pO8jaR$`1+{7H}if;(I@afbWV~U-{zViQ|8^eQot1xM>k^_z%yXjmI66N#0E!
zOyMZUp+9!d&(wU@8Dp`=Q7J|Ad&5cKo>CN`liVM^jx5g?J|zwUh6V=4(o1sEEXNs3
zG56It3O-<rTPxsZh?9Ts%X}}p{E7F<2Y&UpPo;_Y`t@(Wa!9KX9fTMeV3mRbSs=U*
zrs}|Gyj(4L0kk$qDG)*yh&}KC2xK6s)+!8#sXu1>Q7MSxh+(RID^^m_?ezWcsLV9j
zZ1!;0`M`y9)GFaO^Y->n0_%Ja69@k4@9^Dh^Iv>qa_kT9`y2o2tw~RPe(U1p`PW5I
z*aGJT2nr-}B8Yrlh`1b6u9i_jFlv2iMxKoW6oRM}5h#TNl3_{^Duk4y7p^EAz3mA|
z2C2UmQqWkOXKknJ=QwLAwvcPY?$g&k_sPGVp8MlIU;y_<zb_yF1w=r6+eiNHz2WRF
zzrA(t!r@V82r(+y6GEs7a#{c%j2A~pRG=tTO2p+7QjYEctaX!DZr|Qau9?_$agjkl
zX?}*y-JYKxg^GGfoinR1{+*S7^UGfahCntJz`hv*1V9LsfXd?AKX~%sLm&C)%~vnq
zo94y~pbM=04iYC7s8P^TPQ;kp`_?!TM2xPb5HQ&e2)vv4eNCoX1YTd7=i-G`s?`!D
zoe)Jq`@(O2{Qb6hZ42lF$yfmWy#!EvZxd4}3I=Nz^v-i%_|o#be!LdQ=q}Ui2{|cN
z;62Xb#-5S)IFG|w=dZoDetewD6K`<FdcsmnRI7Mjs+P%z36<6c>f$-vVBoq}U-*ap
z=O2B3D)4-I_1~xf6BAQjI-}Wn=FxA(%gg8LC+@tHZf{0tjTZttZgHakv7^A4Vqfsy
zdyEBZ{2Ubqs5n9=DW;%YQrPp~MqfIQvA}`leAvG7$*uqTkNzVt7z>aBdRl-tx&@}i
z3MRDxr~q}KAyl|<^uxdQ=agFbsdQtjp@qcwEuluWK`5M*9(>wM7<Yql>W{D4w+;M|
zpC4691W|-ZQ>-xrv3z0p;-mk#`PlD12XukK)ZU*6;NDCD0OV9Xh=KC75aI0dfdlXR
z%RjDYd??>(&KczEBFK>lR!E!}3BZ&9j1h>D5c^V2m14q~hL$8xWY?enPuu_HpMHHD
zcz+ytx^LgR@7K4+1fcc_Q5uU;r9hTyvrF&$`F90s{(a=!N4YAgH^{fQg-J536njF5
zF!EwpZAR_0R6@ovs$2po5@FLzg6vh@UVX0h<<CB$w=erbH=XkPR^9&Z`r4cvqkwQq
zj0h-=DaR-7UZ~&l!w-bVZo6HSN`XxVTG;RwXXP=c-IA<Ug$wehlhv0W$C|_rI=#Hp
z>LnMSTyd@I&2f-J@23NvE_NgA|B>$v?(Y!O*>MxE#>l<jACv?-(SV(-<k;t)@%6rE
zc8vSK>5G$M3V9R6l%F;?#(o#vg#S0bIeOz3D)x`>3&`yg<ojtqu>T2KHYP_G*Oz7h
O0000<MNUMnLSTaEL<B(q

literal 0
HcmV?d00001

diff --git a/browser/devtools/framework/dev-edition-promo/dev-edition-promo.css b/browser/devtools/framework/dev-edition-promo/dev-edition-promo.css
new file mode 100644
index 00000000000..69de6eec401
--- /dev/null
+++ b/browser/devtools/framework/dev-edition-promo/dev-edition-promo.css
@@ -0,0 +1,74 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#doorhanger-container {
+  width: 450px;
+}
+
+#top-panel {
+  padding: 20px;
+  background: #343c45; /* toolbars */
+  color: #8fa1b2; /* body text */
+  font-size: 15px;
+  line-height: 19px;
+  min-height: 100px;
+}
+
+#top-panel h1 {
+  font-weight: bold;
+  font-family: Open Sans, sans-serif;
+  font-size: 1.1em;
+}
+
+#top-panel p {
+  font-family: Open Sans, sans-serif;
+  font-size: 0.9em;
+  width: 300px;
+  display: block;
+  margin: 5px 0px 0px 0px;
+}
+
+#icon {
+  background-image: url("chrome://browser/content/devtools/framework/dev-edition-logo.png");
+  background-size: 64px 64px;
+  background-repeat: no-repeat;
+  width: 64px;
+  height: 64px;
+  margin-right: 20px;
+}
+
+#lower-panel {
+  padding: 20px;
+  background-color: #252c33; /* tab toolbars */
+  min-height: 75px;
+  border-top: 1px solid #292e33; /* text high contrast (light) */
+}
+
+#button-container {
+  margin: auto 20px;
+}
+
+#button-container button {
+  font: message-box !important;
+  font-size: 16px !important;
+  cursor: pointer;
+  width: 125px;
+  opacity: 1;
+  position: static;
+  -moz-appearance: none;
+  border-radius: 5px;
+  height: 30px;
+  width: 450px;
+}
+
+#close {
+  background-color: transparent;
+  color: #8fa1b2; /* body text */
+}
+
+#go {
+  margin-left: 100px;
+  background-color: #70bf53; /* green */
+  color: #f5f7fa; /* selection text color */
+}
diff --git a/browser/devtools/framework/dev-edition-promo/dev-edition-promo.xul b/browser/devtools/framework/dev-edition-promo/dev-edition-promo.xul
new file mode 100644
index 00000000000..921c33ea9e5
--- /dev/null
+++ b/browser/devtools/framework/dev-edition-promo/dev-edition-promo.xul
@@ -0,0 +1,36 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- This Source Code Form is subject to the terms of the Mozilla Public
+   - License, v. 2.0. If a copy of the MPL was not distributed with this
+   - file, You can obtain one at http://mozilla.org/MPL/2.0/. -->
+<!DOCTYPE window [
+<!ENTITY % toolboxDTD SYSTEM "chrome://browser/locale/devtools/toolbox.dtd" >
+ %toolboxDTD;
+]>
+<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
+<?xml-stylesheet rel="stylesheet" href="chrome://browser/content/devtools/framework/dev-edition-promo.css" type="text/css"?>
+
+<window xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul" id="dev-edition-promo">
+  <vbox id="doorhanger-container">
+    <hbox flex="1" id="top-panel">
+      <image id="icon" />
+      <vbox id="info">
+        <h1>Using Developer Tools in your browser?</h1>
+        <p>Download Firefox Developer Edition, our first browser made just for you.</p>
+      </vbox>
+    </hbox>
+    <hbox id="lower-panel" flex="1">
+      <hbox id="button-container" flex="1">
+        <button id="close"
+                flex="1"
+                standalone="true"
+                label="No thanks">
+        </button>
+        <button id="go"
+                flex="1"
+                standalone="true"
+                label="Learn more »">
+        </button>
+      </hbox>
+    </hbox>
+  </vbox>
+</window>
diff --git a/browser/devtools/framework/toolbox.js b/browser/devtools/framework/toolbox.js
index 98927e34d97..7737e9f2dd2 100644
--- a/browser/devtools/framework/toolbox.js
+++ b/browser/devtools/framework/toolbox.js
@@ -17,6 +17,7 @@ let EventEmitter = require("devtools/toolkit/event-emitter");
 let Telemetry = require("devtools/shared/telemetry");
 let {getHighlighterUtils} = require("devtools/framework/toolbox-highlighter-utils");
 let HUDService = require("devtools/webconsole/hudservice");
+let {showDoorhanger} = require("devtools/shared/doorhanger");
 
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/Services.jsm");
@@ -100,6 +101,7 @@ function Toolbox(target, selectedTool, hostType, hostOptions) {
   this._prefChanged = this._prefChanged.bind(this);
   this._saveSplitConsoleHeight = this._saveSplitConsoleHeight.bind(this);
   this._onFocus = this._onFocus.bind(this);
+  this._showDevEditionPromo = this._showDevEditionPromo.bind(this);
 
   this._target.on("close", this.destroy);
 
@@ -124,6 +126,8 @@ function Toolbox(target, selectedTool, hostType, hostOptions) {
   this.on("host-changed", this._refreshHostTitle);
   this.on("select", this._refreshHostTitle);
 
+  this.on("ready", this._showDevEditionPromo);
+
   gDevTools.on("tool-registered", this._toolRegistered);
   gDevTools.on("tool-unregistered", this._toolUnregistered);
 }
@@ -1649,5 +1653,18 @@ Toolbox.prototype = {
 
   _highlighterHidden: function() {
     this.emit("highlighter-hide");
+  },
+
+  /**
+   * For displaying the promotional Doorhanger on first opening of
+   * the developer tools, promoting the Developer Edition.
+   */
+  _showDevEditionPromo: function() {
+    // Do not display in browser toolbox
+    if (this.target.chrome) {
+      return;
+    }
+    let window = this.frame.contentWindow;
+    showDoorhanger({ window, type: "deveditionpromo" });
   }
 };
diff --git a/browser/devtools/jar.mn b/browser/devtools/jar.mn
index 0ccd0038ff4..b1ac5a12104 100644
--- a/browser/devtools/jar.mn
+++ b/browser/devtools/jar.mn
@@ -103,6 +103,9 @@ browser.jar:
     content/browser/devtools/framework/options-panel.css               (framework/options-panel.css)
     content/browser/devtools/framework/toolbox-process-window.xul      (framework/toolbox-process-window.xul)
     content/browser/devtools/framework/toolbox-process-window.js       (framework/toolbox-process-window.js)
+    content/browser/devtools/framework/dev-edition-promo.xul           (framework/dev-edition-promo/dev-edition-promo.xul)
+    content/browser/devtools/framework/dev-edition-promo.css           (framework/dev-edition-promo/dev-edition-promo.css)
+    content/browser/devtools/framework/dev-edition-logo.png            (framework/dev-edition-promo/dev-edition-logo.png)
     content/browser/devtools/inspector/inspector.xul                   (inspector/inspector.xul)
     content/browser/devtools/inspector/inspector.css                   (inspector/inspector.css)
     content/browser/devtools/connect.xhtml                             (framework/connect/connect.xhtml)
diff --git a/browser/devtools/responsivedesign/responsivedesign.jsm b/browser/devtools/responsivedesign/responsivedesign.jsm
index 0546fae1dc5..4feb039976d 100644
--- a/browser/devtools/responsivedesign/responsivedesign.jsm
+++ b/browser/devtools/responsivedesign/responsivedesign.jsm
@@ -17,6 +17,7 @@ XPCOMUtils.defineLazyModuleGetter(this, "SystemAppProxy",
 
 var require = Cu.import("resource://gre/modules/devtools/Loader.jsm", {}).devtools.require;
 let Telemetry = require("devtools/shared/telemetry");
+let {showDoorhanger} = require("devtools/shared/doorhanger");
 let {TouchEventHandler} = require("devtools/touch-events");
 
 this.EXPORTED_SYMBOLS = ["ResponsiveUIManager"];
@@ -217,6 +218,13 @@ function ResponsiveUI(aWindow, aTab)
 
   // E10S: We should be using target here. See bug 1028234
   ResponsiveUIManager.emit("on", { tab: this.tab });
+
+  // Hook to display promotional Developer Edition doorhanger. Only displayed once.
+  showDoorhanger({
+    window: this.mainWindow,
+    type: "deveditionpromo",
+    anchor: this.chromeDoc.querySelector("#content")
+  });
 }
 
 ResponsiveUI.prototype = {
diff --git a/browser/devtools/shared/doorhanger.js b/browser/devtools/shared/doorhanger.js
new file mode 100644
index 00000000000..003d8a7197d
--- /dev/null
+++ b/browser/devtools/shared/doorhanger.js
@@ -0,0 +1,144 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+"use strict";
+
+const { Ci, Cc } = require("chrome");
+const { Services } = require("resource://gre/modules/Services.jsm");
+const { DOMHelpers } = require("resource:///modules/devtools/DOMHelpers.jsm");
+const { Task } = require("resource://gre/modules/Task.jsm");
+const { Promise } = require("resource://gre/modules/Promise.jsm");
+const { getMostRecentBrowserWindow } = require("sdk/window/utils");
+
+const XULNS = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
+const DEV_EDITION_PROMO_URL = "chrome://browser/content/devtools/framework/dev-edition-promo.xul";
+const DEV_EDITION_PROMO_ENABLED_PREF = "devtools.devedition.promo.enabled";
+const DEV_EDITION_PROMO_SHOWN_PREF = "devtools.devedition.promo.shown";
+const DEV_EDITION_PROMO_URL_PREF = "devtools.devedition.promo.url";
+const LOCALE = Cc["@mozilla.org/chrome/chrome-registry;1"]
+               .getService(Ci.nsIXULChromeRegistry)
+               .getSelectedLocale("global");
+
+/**
+ * Only show Dev Edition promo if it's enabled (beta channel),
+ * if it has not been shown before, and it's a locale build
+ * for `en-US`
+ */
+function shouldDevEditionPromoShow () {
+  return Services.prefs.getBoolPref(DEV_EDITION_PROMO_ENABLED_PREF) &&
+         !Services.prefs.getBoolPref(DEV_EDITION_PROMO_SHOWN_PREF) &&
+         LOCALE === "en-US";
+}
+
+let TYPES = {
+  // The Developer Edition promo doorhanger, called by
+  // opening the toolbox, browser console, WebIDE, or responsive design mode
+  // in Beta releases. Only displayed once per profile.
+  deveditionpromo: {
+    predicate: shouldDevEditionPromoShow,
+    success: () => Services.prefs.setBoolPref(DEV_EDITION_PROMO_SHOWN_PREF, true),
+    action: () => {
+      let url = Services.prefs.getCharPref(DEV_EDITION_PROMO_URL_PREF);
+      getGBrowser().selectedTab = getGBrowser().addTab(url);
+    },
+    url: DEV_EDITION_PROMO_URL
+  }
+};
+
+let panelAttrs = {
+  orient: "vertical",
+  hidden: "false",
+  consumeoutsideclicks: "true",
+  noautofocus: "true",
+  align: "start",
+  role: "alert"
+};
+
+/**
+ * Helper to call a doorhanger, defined in `TYPES`, with defined conditions,
+ * success handlers and loads its own XUL in a frame. Takes an object with
+ * several properties:
+ *
+ * @param {XULWindow} window
+ *        The window that should house the doorhanger.
+ * @param {String} type
+ *        The type of doorhanger to be displayed is, using the `TYPES` definition.
+ * @param {String} selector
+ *        The selector that the doorhanger should be appended to within `window`.
+ *        Defaults to a XUL Document's `window` element.
+ */
+exports.showDoorhanger = Task.async(function *({ window, type, anchor }) {
+  let { predicate, success, url, action } = TYPES[type];
+  // Abort if predicate fails
+  if (!predicate()) {
+    return;
+  }
+
+  let document = window.document;
+
+  let panel = document.createElementNS(XULNS, "panel");
+  let frame = document.createElementNS(XULNS, "iframe");
+  let parentEl = document.querySelector("window");
+
+  frame.setAttribute("src", url);
+  let close = () => parentEl.removeChild(panel);
+
+  setDoorhangerStyle(panel, frame);
+
+  panel.appendChild(frame);
+  parentEl.appendChild(panel);
+
+  yield onFrameLoad(frame);
+
+  panel.openPopup(anchor);
+
+  let closeBtn = frame.contentDocument.querySelector("#close");
+  if (closeBtn) {
+    closeBtn.addEventListener("click", close);
+  }
+
+  let goBtn = frame.contentDocument.querySelector("#go");
+  if (goBtn) {
+    goBtn.addEventListener("click", () => {
+      if (action) {
+        action();
+      }
+      close();
+    });
+  }
+
+  // Call success function to set preferences, etc.
+  success();
+});
+
+function setDoorhangerStyle (panel, frame) {
+  Object.keys(panelAttrs).forEach(prop => panel.setAttribute(prop, panelAttrs[prop]));
+  panel.style.margin = "20px";
+  panel.style.borderRadius = "5px";
+  frame.style.borderRadius = "5px";
+  frame.setAttribute("flex", "1");
+  frame.setAttribute("width", "450");
+  frame.setAttribute("height", "179");
+}
+
+function onFrameLoad (frame) {
+  let { resolve, promise } = Promise.defer();
+
+  if (frame.contentWindow) {
+    let domHelper = new DOMHelpers(frame.contentWindow);
+    domHelper.onceDOMReady(resolve);
+  } else {
+    let callback = () => {
+      frame.removeEventListener("DOMContentLoaded", callback);
+      resolve();
+    }
+    frame.addEventListener("DOMContentLoaded", callback);
+  }
+
+  return promise;
+}
+
+function getGBrowser () {
+  return getMostRecentBrowserWindow().gBrowser;
+}
diff --git a/browser/devtools/shared/moz.build b/browser/devtools/shared/moz.build
index 4f137acff4b..8a8d92ae667 100644
--- a/browser/devtools/shared/moz.build
+++ b/browser/devtools/shared/moz.build
@@ -33,6 +33,7 @@ EXTRA_JS_MODULES.devtools += [
 EXTRA_JS_MODULES.devtools.shared += [
     'autocomplete-popup.js',
     'd3.js',
+    'doorhanger.js',
     'frame-script-utils.js',
     'inplace-editor.js',
     'observable-object.js',
diff --git a/browser/devtools/webconsole/hudservice.js b/browser/devtools/webconsole/hudservice.js
index ed9682e1c1b..15449d4130b 100644
--- a/browser/devtools/webconsole/hudservice.js
+++ b/browser/devtools/webconsole/hudservice.js
@@ -19,6 +19,7 @@ loader.lazyImporter(this, "devtools", "resource://gre/modules/devtools/Loader.js
 loader.lazyImporter(this, "Services", "resource://gre/modules/Services.jsm");
 loader.lazyImporter(this, "DebuggerServer", "resource://gre/modules/devtools/dbg-server.jsm");
 loader.lazyImporter(this, "DebuggerClient", "resource://gre/modules/devtools/dbg-client.jsm");
+loader.lazyGetter(this, "showDoorhanger", () => require("devtools/shared/doorhanger").showDoorhanger);
 
 const STRINGS_URI = "chrome://browser/locale/devtools/webconsole.properties";
 let l10n = new WebConsoleUtils.l10n(STRINGS_URI);
@@ -713,6 +714,9 @@ BrowserConsole.prototype = Heritage.extend(WebConsole.prototype,
 
     this._telemetry.toolOpened("browserconsole");
 
+    // Hook to display promotional Developer Edition doorhanger. Only displayed once.
+    showDoorhanger({ window, type: "deveditionpromo" });
+
     this._bc_init = this.$init();
     return this._bc_init;
   },
diff --git a/browser/devtools/webide/content/webide.js b/browser/devtools/webide/content/webide.js
index df883f1feee..66c7b8e3405 100644
--- a/browser/devtools/webide/content/webide.js
+++ b/browser/devtools/webide/content/webide.js
@@ -23,6 +23,7 @@ const {GetTemplatesJSON, GetAddonsJSON} = require("devtools/webide/remote-resour
 const utils = require("devtools/webide/utils");
 const Telemetry = require("devtools/shared/telemetry");
 const {RuntimeScanners, WiFiScanner} = require("devtools/webide/runtimes");
+const {showDoorhanger} = require("devtools/shared/doorhanger");
 
 const Strings = Services.strings.createBundle("chrome://browser/locale/devtools/webide.properties");
 
@@ -96,6 +97,9 @@ let UI = {
     }
 
     this.setupDeck();
+
+    // Hook to display promotional Developer Edition doorhanger. Only displayed once.
+    showDoorhanger({ window, type: "deveditionpromo", anchor: document.querySelector("#deck") });
   },
 
   uninit: function() {

From 0859e1e56f5916f93f6e4d5cf61842aeb01b283d Mon Sep 17 00:00:00 2001
From: Gijs Kruitbosch <gijskruitbosch@gmail.com>
Date: Sat, 1 Nov 2014 22:57:56 +0000
Subject: [PATCH 134/153] Bug 690307 - make trimURL not generate URLs that
 parse back into search queries, r=mak

--HG--
extra : rebase_source : ef509eef3a3427288ba204b32046c4565f3c5cc2
---
 .../test/general/browser_urlbarTrimURLs.js      |  3 +++
 browser/base/content/utilityOverlay.js          | 17 +++++++++++++----
 2 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/browser/base/content/test/general/browser_urlbarTrimURLs.js b/browser/base/content/test/general/browser_urlbarTrimURLs.js
index 095ccc4a633..92485161eee 100644
--- a/browser/base/content/test/general/browser_urlbarTrimURLs.js
+++ b/browser/base/content/test/general/browser_urlbarTrimURLs.js
@@ -55,6 +55,9 @@ function test() {
   testVal("jar:http://mozilla.org/example.jar!/");
   testVal("view-source:http://mozilla.org/");
 
+  testVal("http://localhost");
+  testVal("http://someotherhostwithnodots");
+
   Services.prefs.setBoolPref(prefname, false);
 
   testVal("http://mozilla.org/");
diff --git a/browser/base/content/utilityOverlay.js b/browser/base/content/utilityOverlay.js
index a37093768ed..a7308f91510 100644
--- a/browser/base/content/utilityOverlay.js
+++ b/browser/base/content/utilityOverlay.js
@@ -712,8 +712,17 @@ function openPrefsHelp() {
 function trimURL(aURL) {
   // This function must not modify the given URL such that calling
   // nsIURIFixup::createFixupURI with the result will produce a different URI.
-  return aURL /* remove single trailing slash for http/https/ftp URLs */
-             .replace(/^((?:http|https|ftp):\/\/[^/]+)\/$/, "$1")
-              /* remove http:// unless the host starts with "ftp\d*\." or contains "@" */
-             .replace(/^http:\/\/((?!ftp\d*\.)[^\/@]+(?:\/|$))/, "$1");
+
+  // remove single trailing slash for http/https/ftp URLs
+  let rv = aURL.replace(/^((?:http|https|ftp):\/\/[^/]+)\/$/, "$1");
+
+  // Strip the leading http:// only if the host has at least one '.' or
+  // looks like an ipv6 ip:
+  let hostMatch = rv.match(/^http:\/\/([^\/]*)/);
+  let ipv6Regex = /\[[\da-f:]*\]/;
+  if (hostMatch && (hostMatch[1].contains(".") || ipv6Regex.test(hostMatch[1]))) {
+    /* remove http:// unless the host starts with "ftp\d*\." or contains "@" */
+    rv = rv.replace(/^http:\/\/((?!ftp\d*\.)[^\/@]+(?:\/|$))/, "$1");
+  }
+  return rv;
 }

From 2c390faa97c6f0246dd1e1ede21af4138423c0e1 Mon Sep 17 00:00:00 2001
From: Nicolas Perriault <nperriault@gmail.com>
Date: Wed, 5 Nov 2014 13:59:46 +0000
Subject: [PATCH 135/153] Bug 1093620 - Using a single root store for Loop
 rooms. r=Standard8

--HG--
rename : browser/components/loop/content/shared/js/localRoomStore.js => browser/components/loop/content/shared/js/activeRoomStore.js
rename : browser/components/loop/content/shared/js/roomListStore.js => browser/components/loop/content/shared/js/roomStore.js
rename : browser/components/loop/test/shared/localRoomStore_test.js => browser/components/loop/test/shared/activeRoomStore_test.js
rename : browser/components/loop/test/shared/roomListStore_test.js => browser/components/loop/test/shared/roomStore_test.js
---
 .../components/loop/content/conversation.html |  3 +-
 .../loop/content/js/conversation.js           | 17 ++--
 .../loop/content/js/conversation.jsx          | 17 ++--
 browser/components/loop/content/js/panel.js   | 17 ++--
 browser/components/loop/content/js/panel.jsx  | 17 ++--
 .../components/loop/content/js/roomViews.js   | 22 ++---
 .../components/loop/content/js/roomViews.jsx  | 22 ++---
 browser/components/loop/content/panel.html    |  3 +-
 .../loop/content/shared/js/actions.js         |  8 ++
 .../{localRoomStore.js => activeRoomStore.js} | 11 +--
 .../js/{roomListStore.js => roomStore.js}     | 59 ++++++++++--
 browser/components/loop/jar.mn                |  4 +-
 .../test/desktop-local/conversation_test.js   |  6 +-
 .../loop/test/desktop-local/index.html        |  4 +-
 .../loop/test/desktop-local/panel_test.js     | 26 ++---
 .../loop/test/desktop-local/roomViews_test.js | 42 ++++-----
 ...mStore_test.js => activeRoomStore_test.js} | 10 +-
 .../components/loop/test/shared/index.html    |  8 +-
 ...oomListStore_test.js => roomStore_test.js} | 94 ++++++++++++++++---
 browser/components/loop/ui/index.html         |  3 +-
 browser/components/loop/ui/ui-showcase.js     | 20 ++--
 browser/components/loop/ui/ui-showcase.jsx    | 20 ++--
 22 files changed, 279 insertions(+), 154 deletions(-)
 rename browser/components/loop/content/shared/js/{localRoomStore.js => activeRoomStore.js} (91%)
 rename browser/components/loop/content/shared/js/{roomListStore.js => roomStore.js} (84%)
 rename browser/components/loop/test/shared/{localRoomStore_test.js => activeRoomStore_test.js} (91%)
 rename browser/components/loop/test/shared/{roomListStore_test.js => roomStore_test.js} (79%)

diff --git a/browser/components/loop/content/conversation.html b/browser/components/loop/content/conversation.html
index 201b4c22499..730ddb3a467 100644
--- a/browser/components/loop/content/conversation.html
+++ b/browser/components/loop/content/conversation.html
@@ -35,7 +35,8 @@
     <script type="text/javascript" src="loop/shared/js/dispatcher.js"></script>
     <script type="text/javascript" src="loop/shared/js/otSdkDriver.js"></script>
     <script type="text/javascript" src="loop/shared/js/conversationStore.js"></script>
-    <script type="text/javascript" src="loop/shared/js/localRoomStore.js"></script>
+    <script type="text/javascript" src="loop/shared/js/roomStore.js"></script>
+    <script type="text/javascript" src="loop/shared/js/activeRoomStore.js"></script>
     <script type="text/javascript" src="loop/js/conversationViews.js"></script>
     <script type="text/javascript" src="loop/shared/js/websocket.js"></script>
     <script type="text/javascript" src="loop/js/conversationAppStore.js"></script>
diff --git a/browser/components/loop/content/js/conversation.js b/browser/components/loop/content/js/conversation.js
index 4c1c42e8fa5..bedb8c7be9d 100644
--- a/browser/components/loop/content/js/conversation.js
+++ b/browser/components/loop/content/js/conversation.js
@@ -287,7 +287,7 @@ loop.conversation = (function(mozL10n) {
           if (this.state.callFailed) {
             return GenericFailureView({
               cancelCall: this.closeWindow.bind(this)}
-            )
+            );
           }
 
           document.title = mozL10n.get("conversation_has_ended");
@@ -538,7 +538,7 @@ loop.conversation = (function(mozL10n) {
       conversationStore: React.PropTypes.instanceOf(loop.store.ConversationStore)
                               .isRequired,
       dispatcher: React.PropTypes.instanceOf(loop.Dispatcher).isRequired,
-      localRoomStore: React.PropTypes.instanceOf(loop.store.LocalRoomStore)
+      roomStore: React.PropTypes.instanceOf(loop.store.RoomStore)
     },
 
     getInitialState: function() {
@@ -578,7 +578,7 @@ loop.conversation = (function(mozL10n) {
         case "room": {
           return (DesktopRoomView({
             mozLoop: navigator.mozLoop, 
-            localRoomStore: this.props.localRoomStore}
+            roomStore: this.props.roomStore}
           ));
         }
         case "failed": {
@@ -632,10 +632,15 @@ loop.conversation = (function(mozL10n) {
       dispatcher: dispatcher,
       sdkDriver: sdkDriver
     });
-    var localRoomStore = new loop.store.LocalRoomStore({
+    var activeRoomStore = new loop.store.ActiveRoomStore({
       dispatcher: dispatcher,
       mozLoop: navigator.mozLoop
-    });;
+    });
+    var roomStore = new loop.store.RoomStore({
+      dispatcher: dispatcher,
+      mozLoop: navigator.mozLoop,
+      activeRoomStore: activeRoomStore
+    });
 
     // XXX Old class creation for the incoming conversation view, whilst
     // we transition across (bug 1072323).
@@ -663,7 +668,7 @@ loop.conversation = (function(mozL10n) {
 
     React.renderComponent(AppControllerView({
       conversationAppStore: conversationAppStore, 
-      localRoomStore: localRoomStore, 
+      roomStore: roomStore, 
       conversationStore: conversationStore, 
       client: client, 
       conversation: conversation, 
diff --git a/browser/components/loop/content/js/conversation.jsx b/browser/components/loop/content/js/conversation.jsx
index 673f91211e3..4d813d01620 100644
--- a/browser/components/loop/content/js/conversation.jsx
+++ b/browser/components/loop/content/js/conversation.jsx
@@ -287,7 +287,7 @@ loop.conversation = (function(mozL10n) {
           if (this.state.callFailed) {
             return <GenericFailureView
               cancelCall={this.closeWindow.bind(this)}
-            />
+            />;
           }
 
           document.title = mozL10n.get("conversation_has_ended");
@@ -538,7 +538,7 @@ loop.conversation = (function(mozL10n) {
       conversationStore: React.PropTypes.instanceOf(loop.store.ConversationStore)
                               .isRequired,
       dispatcher: React.PropTypes.instanceOf(loop.Dispatcher).isRequired,
-      localRoomStore: React.PropTypes.instanceOf(loop.store.LocalRoomStore)
+      roomStore: React.PropTypes.instanceOf(loop.store.RoomStore)
     },
 
     getInitialState: function() {
@@ -578,7 +578,7 @@ loop.conversation = (function(mozL10n) {
         case "room": {
           return (<DesktopRoomView
             mozLoop={navigator.mozLoop}
-            localRoomStore={this.props.localRoomStore}
+            roomStore={this.props.roomStore}
           />);
         }
         case "failed": {
@@ -632,10 +632,15 @@ loop.conversation = (function(mozL10n) {
       dispatcher: dispatcher,
       sdkDriver: sdkDriver
     });
-    var localRoomStore = new loop.store.LocalRoomStore({
+    var activeRoomStore = new loop.store.ActiveRoomStore({
       dispatcher: dispatcher,
       mozLoop: navigator.mozLoop
-    });;
+    });
+    var roomStore = new loop.store.RoomStore({
+      dispatcher: dispatcher,
+      mozLoop: navigator.mozLoop,
+      activeRoomStore: activeRoomStore
+    });
 
     // XXX Old class creation for the incoming conversation view, whilst
     // we transition across (bug 1072323).
@@ -663,7 +668,7 @@ loop.conversation = (function(mozL10n) {
 
     React.renderComponent(<AppControllerView
       conversationAppStore={conversationAppStore}
-      localRoomStore={localRoomStore}
+      roomStore={roomStore}
       conversationStore={conversationStore}
       client={client}
       conversation={conversation}
diff --git a/browser/components/loop/content/js/panel.js b/browser/components/loop/content/js/panel.js
index 82542501d73..6455f5daf96 100644
--- a/browser/components/loop/content/js/panel.js
+++ b/browser/components/loop/content/js/panel.js
@@ -489,7 +489,9 @@ loop.panel = (function(_, mozL10n) {
 
     handleCopyButtonClick: function(event) {
       event.preventDefault();
-      navigator.mozLoop.copyString(this.props.room.roomUrl);
+      this.props.dispatcher.dispatch(new sharedActions.CopyRoomUrl({
+        roomUrl: this.props.room.roomUrl
+      }));
       this.setState({urlCopied: true});
     },
 
@@ -506,7 +508,6 @@ loop.panel = (function(_, mozL10n) {
     },
 
     _isActive: function() {
-      // XXX bug 1074679 will implement this properly
       return this.props.room.participants.length > 0;
     },
 
@@ -548,7 +549,7 @@ loop.panel = (function(_, mozL10n) {
     mixins: [Backbone.Events],
 
     propTypes: {
-      store: React.PropTypes.instanceOf(loop.store.RoomListStore).isRequired,
+      store: React.PropTypes.instanceOf(loop.store.RoomStore).isRequired,
       dispatcher: React.PropTypes.instanceOf(loop.Dispatcher).isRequired,
       userDisplayName: React.PropTypes.string.isRequired  // for room creation
     },
@@ -636,8 +637,8 @@ loop.panel = (function(_, mozL10n) {
       showTabButtons: React.PropTypes.bool,
       selectedTab: React.PropTypes.string,
       dispatcher: React.PropTypes.instanceOf(loop.Dispatcher).isRequired,
-      roomListStore:
-        React.PropTypes.instanceOf(loop.store.RoomListStore).isRequired
+      roomStore:
+        React.PropTypes.instanceOf(loop.store.RoomStore).isRequired
     },
 
     getInitialState: function() {
@@ -696,7 +697,7 @@ loop.panel = (function(_, mozL10n) {
       return (
         Tab({name: "rooms"}, 
           RoomList({dispatcher: this.props.dispatcher, 
-                    store: this.props.roomListStore, 
+                    store: this.props.roomStore, 
                     userDisplayName: this._getUserDisplayName()})
         )
       );
@@ -789,7 +790,7 @@ loop.panel = (function(_, mozL10n) {
     var client = new loop.Client();
     var notifications = new sharedModels.NotificationCollection();
     var dispatcher = new loop.Dispatcher();
-    var roomListStore = new loop.store.RoomListStore({
+    var roomStore = new loop.store.RoomStore({
       mozLoop: navigator.mozLoop,
       dispatcher: dispatcher
     });
@@ -797,7 +798,7 @@ loop.panel = (function(_, mozL10n) {
     React.renderComponent(PanelView({
       client: client, 
       notifications: notifications, 
-      roomListStore: roomListStore, 
+      roomStore: roomStore, 
       dispatcher: dispatcher}
     ), document.querySelector("#main"));
 
diff --git a/browser/components/loop/content/js/panel.jsx b/browser/components/loop/content/js/panel.jsx
index 5143fc5b5e1..cd187d700ee 100644
--- a/browser/components/loop/content/js/panel.jsx
+++ b/browser/components/loop/content/js/panel.jsx
@@ -489,7 +489,9 @@ loop.panel = (function(_, mozL10n) {
 
     handleCopyButtonClick: function(event) {
       event.preventDefault();
-      navigator.mozLoop.copyString(this.props.room.roomUrl);
+      this.props.dispatcher.dispatch(new sharedActions.CopyRoomUrl({
+        roomUrl: this.props.room.roomUrl
+      }));
       this.setState({urlCopied: true});
     },
 
@@ -506,7 +508,6 @@ loop.panel = (function(_, mozL10n) {
     },
 
     _isActive: function() {
-      // XXX bug 1074679 will implement this properly
       return this.props.room.participants.length > 0;
     },
 
@@ -548,7 +549,7 @@ loop.panel = (function(_, mozL10n) {
     mixins: [Backbone.Events],
 
     propTypes: {
-      store: React.PropTypes.instanceOf(loop.store.RoomListStore).isRequired,
+      store: React.PropTypes.instanceOf(loop.store.RoomStore).isRequired,
       dispatcher: React.PropTypes.instanceOf(loop.Dispatcher).isRequired,
       userDisplayName: React.PropTypes.string.isRequired  // for room creation
     },
@@ -636,8 +637,8 @@ loop.panel = (function(_, mozL10n) {
       showTabButtons: React.PropTypes.bool,
       selectedTab: React.PropTypes.string,
       dispatcher: React.PropTypes.instanceOf(loop.Dispatcher).isRequired,
-      roomListStore:
-        React.PropTypes.instanceOf(loop.store.RoomListStore).isRequired
+      roomStore:
+        React.PropTypes.instanceOf(loop.store.RoomStore).isRequired
     },
 
     getInitialState: function() {
@@ -696,7 +697,7 @@ loop.panel = (function(_, mozL10n) {
       return (
         <Tab name="rooms">
           <RoomList dispatcher={this.props.dispatcher}
-                    store={this.props.roomListStore}
+                    store={this.props.roomStore}
                     userDisplayName={this._getUserDisplayName()}/>
         </Tab>
       );
@@ -789,7 +790,7 @@ loop.panel = (function(_, mozL10n) {
     var client = new loop.Client();
     var notifications = new sharedModels.NotificationCollection();
     var dispatcher = new loop.Dispatcher();
-    var roomListStore = new loop.store.RoomListStore({
+    var roomStore = new loop.store.RoomStore({
       mozLoop: navigator.mozLoop,
       dispatcher: dispatcher
     });
@@ -797,7 +798,7 @@ loop.panel = (function(_, mozL10n) {
     React.renderComponent(<PanelView
       client={client}
       notifications={notifications}
-      roomListStore={roomListStore}
+      roomStore={roomStore}
       dispatcher={dispatcher}
     />, document.querySelector("#main"));
 
diff --git a/browser/components/loop/content/js/roomViews.js b/browser/components/loop/content/js/roomViews.js
index 83e8f947dc5..8e2228214d4 100644
--- a/browser/components/loop/content/js/roomViews.js
+++ b/browser/components/loop/content/js/roomViews.js
@@ -14,33 +14,31 @@ loop.roomViews = (function(mozL10n) {
     mixins: [Backbone.Events, loop.shared.mixins.DocumentTitleMixin],
 
     propTypes: {
-      mozLoop:
-        React.PropTypes.object.isRequired,
-      localRoomStore:
-        React.PropTypes.instanceOf(loop.store.LocalRoomStore).isRequired,
+      mozLoop:   React.PropTypes.object.isRequired,
+      roomStore: React.PropTypes.instanceOf(loop.store.RoomStore).isRequired,
     },
 
     getInitialState: function() {
-      return this.props.localRoomStore.getStoreState();
+      return this.props.roomStore.getStoreState();
     },
 
     componentWillMount: function() {
-      this.listenTo(this.props.localRoomStore, "change",
-        this._onLocalRoomStoreChanged);
+      this.listenTo(this.props.roomStore, "change:activeRoom",
+                    this._onActiveRoomStateChanged);
     },
 
     /**
-     * Handles a "change" event on the localRoomStore, and updates this.state
+     * Handles a "change" event on the roomStore, and updates this.state
      * to match the store.
      *
      * @private
      */
-    _onLocalRoomStoreChanged: function() {
-      this.setState(this.props.localRoomStore.getStoreState());
+    _onActiveRoomStateChanged: function() {
+      this.setState(this.props.roomStore.getStoreState("activeRoom"));
     },
 
     componentWillUnmount: function() {
-      this.stopListening(this.props.localRoomStore);
+      this.stopListening(this.props.roomStore);
     },
 
     render: function() {
@@ -58,4 +56,4 @@ loop.roomViews = (function(mozL10n) {
     DesktopRoomView: DesktopRoomView
   };
 
-})(document.mozL10n || navigator.mozL10n);;
+})(document.mozL10n || navigator.mozL10n);
diff --git a/browser/components/loop/content/js/roomViews.jsx b/browser/components/loop/content/js/roomViews.jsx
index e9a6ab10f8c..38529449e4b 100644
--- a/browser/components/loop/content/js/roomViews.jsx
+++ b/browser/components/loop/content/js/roomViews.jsx
@@ -14,33 +14,31 @@ loop.roomViews = (function(mozL10n) {
     mixins: [Backbone.Events, loop.shared.mixins.DocumentTitleMixin],
 
     propTypes: {
-      mozLoop:
-        React.PropTypes.object.isRequired,
-      localRoomStore:
-        React.PropTypes.instanceOf(loop.store.LocalRoomStore).isRequired,
+      mozLoop:   React.PropTypes.object.isRequired,
+      roomStore: React.PropTypes.instanceOf(loop.store.RoomStore).isRequired,
     },
 
     getInitialState: function() {
-      return this.props.localRoomStore.getStoreState();
+      return this.props.roomStore.getStoreState();
     },
 
     componentWillMount: function() {
-      this.listenTo(this.props.localRoomStore, "change",
-        this._onLocalRoomStoreChanged);
+      this.listenTo(this.props.roomStore, "change:activeRoom",
+                    this._onActiveRoomStateChanged);
     },
 
     /**
-     * Handles a "change" event on the localRoomStore, and updates this.state
+     * Handles a "change" event on the roomStore, and updates this.state
      * to match the store.
      *
      * @private
      */
-    _onLocalRoomStoreChanged: function() {
-      this.setState(this.props.localRoomStore.getStoreState());
+    _onActiveRoomStateChanged: function() {
+      this.setState(this.props.roomStore.getStoreState("activeRoom"));
     },
 
     componentWillUnmount: function() {
-      this.stopListening(this.props.localRoomStore);
+      this.stopListening(this.props.roomStore);
     },
 
     render: function() {
@@ -58,4 +56,4 @@ loop.roomViews = (function(mozL10n) {
     DesktopRoomView: DesktopRoomView
   };
 
-})(document.mozL10n || navigator.mozL10n);;
+})(document.mozL10n || navigator.mozL10n);
diff --git a/browser/components/loop/content/panel.html b/browser/components/loop/content/panel.html
index 04752a461e6..ce5b36912c8 100644
--- a/browser/components/loop/content/panel.html
+++ b/browser/components/loop/content/panel.html
@@ -27,7 +27,8 @@
     <script type="text/javascript" src="loop/shared/js/validate.js"></script>
     <script type="text/javascript" src="loop/shared/js/actions.js"></script>
     <script type="text/javascript" src="loop/shared/js/dispatcher.js"></script>
-    <script type="text/javascript" src="loop/shared/js/roomListStore.js"></script>
+    <script type="text/javascript" src="loop/shared/js/roomStore.js"></script>
+    <script type="text/javascript" src="loop/shared/js/activeRoomStore.js"></script>
     <script type="text/javascript" src="loop/js/client.js"></script>
     <script type="text/javascript;version=1.8" src="loop/js/contacts.js"></script>
     <script type="text/javascript" src="loop/js/panel.js"></script>
diff --git a/browser/components/loop/content/shared/js/actions.js b/browser/components/loop/content/shared/js/actions.js
index 52f1d2866ba..601bf345fe2 100644
--- a/browser/components/loop/content/shared/js/actions.js
+++ b/browser/components/loop/content/shared/js/actions.js
@@ -203,6 +203,14 @@ loop.shared.actions = (function() {
      */
     OpenRoom: Action.define("openRoom", {
       roomToken: String
+    }),
+
+    /**
+     * Copy a room url in the user's clipboard.
+     * XXX: should move to some roomActions module - refs bug 1079284
+     */
+    CopyRoomUrl: Action.define("copyRoomUrl", {
+      roomUrl: String
     })
   };
 })();
diff --git a/browser/components/loop/content/shared/js/localRoomStore.js b/browser/components/loop/content/shared/js/activeRoomStore.js
similarity index 91%
rename from browser/components/loop/content/shared/js/localRoomStore.js
rename to browser/components/loop/content/shared/js/activeRoomStore.js
index ddb7b2bc35f..fd44c3c1939 100644
--- a/browser/components/loop/content/shared/js/localRoomStore.js
+++ b/browser/components/loop/content/shared/js/activeRoomStore.js
@@ -6,7 +6,7 @@
 
 var loop = loop || {};
 loop.store = loop.store || {};
-loop.store.LocalRoomStore = (function() {
+loop.store.ActiveRoomStore = (function() {
   "use strict";
 
   var sharedActions = loop.shared.actions;
@@ -23,7 +23,7 @@ loop.store.LocalRoomStore = (function() {
    *                            actions and registering to consume them.
    * @param {MozLoop}         options.mozLoop - MozLoop API provider object
    */
-  function LocalRoomStore(options) {
+  function ActiveRoomStore(options) {
     options = options || {};
 
     if (!options.dispatcher) {
@@ -41,7 +41,7 @@ loop.store.LocalRoomStore = (function() {
     ]);
   }
 
-  LocalRoomStore.prototype = _.extend({
+  ActiveRoomStore.prototype = _.extend({
 
     /**
      * Stored data reflecting the local state of a given room, used to drive
@@ -54,9 +54,6 @@ loop.store.LocalRoomStore = (function() {
      * @property {Error=} error - if the room is an error state, this will be
      *                            set to an Error object reflecting the problem;
      *                            otherwise it will be unset.
-     *
-     * @property {String} localRoomId - profile-local identifier used with
-     *                                  the MozLoop API.
      */
     _storeState: {
     },
@@ -100,6 +97,6 @@ loop.store.LocalRoomStore = (function() {
 
   }, Backbone.Events);
 
-  return LocalRoomStore;
+  return ActiveRoomStore;
 
 })();
diff --git a/browser/components/loop/content/shared/js/roomListStore.js b/browser/components/loop/content/shared/js/roomStore.js
similarity index 84%
rename from browser/components/loop/content/shared/js/roomListStore.js
rename to browser/components/loop/content/shared/js/roomStore.js
index f281e304f91..f659629741f 100644
--- a/browser/components/loop/content/shared/js/roomListStore.js
+++ b/browser/components/loop/content/shared/js/roomStore.js
@@ -48,14 +48,16 @@ loop.store = loop.store || {};
    * Room store.
    *
    * Options:
-   * - {loop.Dispatcher} dispatcher The dispatcher for dispatching actions and
-   *                                registering to consume actions.
-   * - {mozLoop}         mozLoop    The MozLoop API object.
+   * - {loop.Dispatcher} dispatcher       The dispatcher for dispatching actions
+   *                                      and registering to consume actions.
+   * - {mozLoop}         mozLoop          The MozLoop API object.
+   * - {ActiveRoomStore} activeRoomStore  An optional substore for active room
+   *                                      state.
    *
    * @extends {Backbone.Events}
    * @param {Object} options Options object.
    */
-  function RoomListStore(options) {
+  function RoomStore(options) {
     options = options || {};
 
     if (!options.dispatcher) {
@@ -68,9 +70,16 @@ loop.store = loop.store || {};
     }
     this._mozLoop = options.mozLoop;
 
+    if (options.activeRoomStore) {
+      this.activeRoomStore = options.activeRoomStore;
+      this.activeRoomStore.on("change",
+                              this._onActiveRoomStoreChange.bind(this));
+    }
+
     this._dispatcher.register(this, [
       "createRoom",
       "createRoomError",
+      "copyRoomUrl",
       "deleteRoom",
       "deleteRoomError",
       "getAllRooms",
@@ -80,7 +89,7 @@ loop.store = loop.store || {};
     ]);
   }
 
-  RoomListStore.prototype = _.extend({
+  RoomStore.prototype = _.extend({
     /**
      * Maximum size given to createRoom; only 2 is supported (and is
      * always passed) because that's what the user-experience is currently
@@ -101,6 +110,7 @@ loop.store = loop.store || {};
      * @see  #getStoreState
      */
     _storeState: {
+      activeRoom: {},
       error: null,
       pendingCreation: false,
       pendingInitialRetrieval: false,
@@ -115,21 +125,36 @@ loop.store = loop.store || {};
      * - {Boolean} pendingInitialRetrieval Pending initial list retrieval flag.
      * - {Array}   rooms                   The current room list.
      * - {Error}   error                   Latest error encountered, if any.
+     * - {Object}  activeRoom              Active room data, if any.
      *
+     * You can request a given state property by providing the `key` argument.
+     *
+     * @param  {String|undefined} key An optional state property name.
      * @return {Object}
      */
-    getStoreState: function() {
+    getStoreState: function(key) {
+      if (key) {
+        return this._storeState[key];
+      }
       return this._storeState;
     },
 
     /**
-     * Updates store state and trigger a "change" event.
+     * Updates store state and trigger a global "change" event, plus one for
+     * each provided newState property:
      *
-     * @param {Object} newState The new store state.
+     * - change:rooms
+     * - change:pendingInitialRetrieval
+     * - change:pendingCreation
+     * - change:error
+     * - change:activeRoom
+     *
+     * @param {Object} newState The new store state object.
      */
     setStoreState: function(newState) {
       for (var key in newState) {
         this._storeState[key] = newState[key];
+        this.trigger("change:" + key);
       }
       this.trigger("change");
     },
@@ -144,6 +169,13 @@ loop.store = loop.store || {};
       this._mozLoop.rooms.on("delete", this._onRoomRemoved.bind(this));
     },
 
+    /**
+     * Updates active room store state.
+     */
+    _onActiveRoomStoreChange: function() {
+      this.setStoreState({activeRoom: this.activeRoomStore.getStoreState()});
+    },
+
     /**
      * Local proxy helper to dispatch an action.
      *
@@ -285,6 +317,15 @@ loop.store = loop.store || {};
       });
     },
 
+    /**
+     * Copy a room url.
+     *
+     * @param  {sharedActions.CopyRoomUrl} actionData The action data.
+     */
+    copyRoomUrl: function(actionData) {
+      this._mozLoop.copyString(actionData.roomUrl);
+    },
+
     /**
      * Creates a new room.
      *
@@ -362,5 +403,5 @@ loop.store = loop.store || {};
     }
   }, Backbone.Events);
 
-  loop.store.RoomListStore = RoomListStore;
+  loop.store.RoomStore = RoomStore;
 })();
diff --git a/browser/components/loop/jar.mn b/browser/components/loop/jar.mn
index d7b8046428c..6e6c4649701 100644
--- a/browser/components/loop/jar.mn
+++ b/browser/components/loop/jar.mn
@@ -58,8 +58,8 @@ browser.jar:
   # Shared scripts
   content/browser/loop/shared/js/actions.js           (content/shared/js/actions.js)
   content/browser/loop/shared/js/conversationStore.js (content/shared/js/conversationStore.js)
-  content/browser/loop/shared/js/roomListStore.js     (content/shared/js/roomListStore.js)
-  content/browser/loop/shared/js/localRoomStore.js    (content/shared/js/localRoomStore.js)
+  content/browser/loop/shared/js/roomStore.js         (content/shared/js/roomStore.js)
+  content/browser/loop/shared/js/activeRoomStore.js   (content/shared/js/activeRoomStore.js)
   content/browser/loop/shared/js/dispatcher.js        (content/shared/js/dispatcher.js)
   content/browser/loop/shared/js/feedbackApiClient.js (content/shared/js/feedbackApiClient.js)
   content/browser/loop/shared/js/models.js            (content/shared/js/models.js)
diff --git a/browser/components/loop/test/desktop-local/conversation_test.js b/browser/components/loop/test/desktop-local/conversation_test.js
index 5e85eca3d04..f169b46dd60 100644
--- a/browser/components/loop/test/desktop-local/conversation_test.js
+++ b/browser/components/loop/test/desktop-local/conversation_test.js
@@ -126,14 +126,14 @@ describe("loop.conversation", function() {
 
   describe("AppControllerView", function() {
     var conversationStore, conversation, client, ccView, oldTitle, dispatcher;
-    var conversationAppStore, localRoomStore;
+    var conversationAppStore, roomStore;
 
     function mountTestComponent() {
       return TestUtils.renderIntoDocument(
         loop.conversation.AppControllerView({
           client: client,
           conversation: conversation,
-          localRoomStore: localRoomStore,
+          roomStore: roomStore,
           sdk: {},
           conversationStore: conversationStore,
           conversationAppStore: conversationAppStore
@@ -161,7 +161,7 @@ describe("loop.conversation", function() {
         dispatcher: dispatcher,
         sdkDriver: {}
       });
-      localRoomStore = new loop.store.LocalRoomStore({
+      roomStore = new loop.store.RoomStore({
         mozLoop: navigator.mozLoop,
         dispatcher: dispatcher
       });
diff --git a/browser/components/loop/test/desktop-local/index.html b/browser/components/loop/test/desktop-local/index.html
index 6c4a1eaf8ab..7e1bf165eba 100644
--- a/browser/components/loop/test/desktop-local/index.html
+++ b/browser/components/loop/test/desktop-local/index.html
@@ -43,9 +43,9 @@
   <script src="../../content/shared/js/validate.js"></script>
   <script src="../../content/shared/js/dispatcher.js"></script>
   <script src="../../content/shared/js/otSdkDriver.js"></script>
-  <script src="../../content/shared/js/roomListStore.js"></script>
+  <script src="../../content/shared/js/roomStore.js"></script>
+  <script src="../../content/shared/js/activeRoomStore.js"></script>
   <script src="../../content/js/client.js"></script>
-  <script src="../../content/shared/js/localRoomStore.js"></script>
   <script src="../../content/js/conversationAppStore.js"></script>
   <script src="../../content/js/roomViews.js"></script>
   <script src="../../content/js/conversationViews.js"></script>
diff --git a/browser/components/loop/test/desktop-local/panel_test.js b/browser/components/loop/test/desktop-local/panel_test.js
index 007a373c362..8b3ecd9ba25 100644
--- a/browser/components/loop/test/desktop-local/panel_test.js
+++ b/browser/components/loop/test/desktop-local/panel_test.js
@@ -140,7 +140,7 @@ describe("loop.panel", function() {
   });
 
   describe("loop.panel.PanelView", function() {
-    var fakeClient, dispatcher, roomListStore, callUrlData;
+    var fakeClient, dispatcher, roomStore, callUrlData;
 
     beforeEach(function() {
       callUrlData = {
@@ -155,7 +155,7 @@ describe("loop.panel", function() {
       };
 
       dispatcher = new loop.Dispatcher();
-      roomListStore = new loop.store.RoomListStore({
+      roomStore = new loop.store.RoomStore({
         dispatcher: dispatcher,
         mozLoop: navigator.mozLoop
       });
@@ -167,7 +167,7 @@ describe("loop.panel", function() {
         client: fakeClient,
         showTabButtons: true,
         dispatcher: dispatcher,
-        roomListStore: roomListStore
+        roomStore: roomStore
       }));
     }
 
@@ -679,11 +679,13 @@ describe("loop.panel", function() {
       });
 
       it("should copy the URL when the click event fires", function() {
+        sandbox.stub(dispatcher, "dispatch");
+
         TestUtils.Simulate.click(copyButton);
 
-        sinon.assert.calledOnce(navigator.mozLoop.copyString);
-        sinon.assert.calledWithExactly(navigator.mozLoop.copyString,
-          roomData.roomUrl);
+        sinon.assert.called(dispatcher.dispatch);
+        sinon.assert.calledWithExactly(dispatcher.dispatch,
+          new sharedActions.CopyRoomUrl({roomUrl: roomData.roomUrl}));
       });
 
       it("should set state.urlCopied when the click event fires", function() {
@@ -757,16 +759,16 @@ describe("loop.panel", function() {
   });
 
   describe("loop.panel.RoomList", function() {
-    var roomListStore, dispatcher, fakeEmail;
+    var roomStore, dispatcher, fakeEmail;
 
     beforeEach(function() {
       fakeEmail = "fakeEmail@example.com";
       dispatcher = new loop.Dispatcher();
-      roomListStore = new loop.store.RoomListStore({
+      roomStore = new loop.store.RoomStore({
         dispatcher: dispatcher,
         mozLoop: navigator.mozLoop
       });
-      roomListStore.setStoreState({
+      roomStore.setStoreState({
         pendingCreation: false,
         pendingInitialRetrieval: false,
         rooms: [],
@@ -776,7 +778,7 @@ describe("loop.panel", function() {
 
     function createTestComponent() {
       return TestUtils.renderIntoDocument(loop.panel.RoomList({
-        store: roomListStore,
+        store: roomStore,
         dispatcher: dispatcher,
         userDisplayName: fakeEmail
       }));
@@ -809,7 +811,7 @@ describe("loop.panel", function() {
     it("should disable the create button when a creation operation is ongoing",
       function() {
         var dispatch = sandbox.stub(dispatcher, "dispatch");
-        roomListStore.setStoreState({pendingCreation: true});
+        roomStore.setStoreState({pendingCreation: true});
 
         var view = createTestComponent();
 
@@ -820,7 +822,7 @@ describe("loop.panel", function() {
     it("should disable the create button when a list retrieval operation is pending",
       function() {
         var dispatch = sandbox.stub(dispatcher, "dispatch");
-        roomListStore.setStoreState({pendingInitialRetrieval: true});
+        roomStore.setStoreState({pendingInitialRetrieval: true});
 
         var view = createTestComponent();
 
diff --git a/browser/components/loop/test/desktop-local/roomViews_test.js b/browser/components/loop/test/desktop-local/roomViews_test.js
index 19b6b1ff973..e0fa46d0d09 100644
--- a/browser/components/loop/test/desktop-local/roomViews_test.js
+++ b/browser/components/loop/test/desktop-local/roomViews_test.js
@@ -3,28 +3,26 @@ var expect = chai.expect;
 describe("loop.roomViews", function () {
   "use strict";
 
-  var store, fakeWindow, sandbox, fakeAddCallback, fakeMozLoop,
-    fakeRemoveCallback, fakeRoomId, fakeWindow;
+  var sandbox, dispatcher, roomStore, activeRoomStore, fakeWindow, fakeMozLoop,
+      fakeRoomId;
 
   beforeEach(function() {
     sandbox = sinon.sandbox.create();
 
-    fakeRoomId = "fakeRoomId";
-    fakeAddCallback =
-      sandbox.stub().withArgs(fakeRoomId, "RoomCreationError");
-    fakeRemoveCallback =
-      sandbox.stub().withArgs(fakeRoomId, "RoomCreationError");
-    fakeMozLoop = { rooms: { addCallback: fakeAddCallback,
-                             removeCallback: fakeRemoveCallback } };
+    dispatcher = new loop.Dispatcher();
 
     fakeWindow = { document: {} };
     loop.shared.mixins.setRootObject(fakeWindow);
 
-    store = new loop.store.LocalRoomStore({
-      dispatcher: { register: function() {} },
-      mozLoop: fakeMozLoop
+    activeRoomStore = new loop.store.ActiveRoomStore({
+      dispatcher: dispatcher,
+      mozLoop: {}
+    });
+    roomStore = new loop.store.RoomStore({
+      dispatcher: dispatcher,
+      mozLoop: {},
+      activeRoomStore: activeRoomStore
     });
-    store.setStoreState({localRoomId: fakeRoomId});
   });
 
   afterEach(function() {
@@ -36,23 +34,19 @@ describe("loop.roomViews", function () {
     function mountTestComponent() {
       return TestUtils.renderIntoDocument(
         new loop.roomViews.DesktopRoomView({
-          mozLoop: fakeMozLoop,
-          localRoomStore: store
+          mozLoop: {},
+          roomStore: roomStore
         }));
     }
 
     describe("#render", function() {
-      it("should set document.title to store.serverData.roomName",
-        function() {
-          var fakeRoomName = "Monkey";
-          store.setStoreState({serverData: {roomName: fakeRoomName},
-                               localRoomId: fakeRoomId});
+      it("should set document.title to store.serverData.roomName", function() {
+        mountTestComponent();
 
-          mountTestComponent();
+        activeRoomStore.setStoreState({serverData: {roomName: "fakeName"}});
 
-          expect(fakeWindow.document.title).to.equal(fakeRoomName);
-        });
+        expect(fakeWindow.document.title).to.equal("fakeName");
+      });
     });
-
   });
 });
diff --git a/browser/components/loop/test/shared/localRoomStore_test.js b/browser/components/loop/test/shared/activeRoomStore_test.js
similarity index 91%
rename from browser/components/loop/test/shared/localRoomStore_test.js
rename to browser/components/loop/test/shared/activeRoomStore_test.js
index 5535a50298d..d86ee2b978e 100644
--- a/browser/components/loop/test/shared/localRoomStore_test.js
+++ b/browser/components/loop/test/shared/activeRoomStore_test.js
@@ -3,7 +3,7 @@
 var expect = chai.expect;
 var sharedActions = loop.shared.actions;
 
-describe("loop.store.LocalRoomStore", function () {
+describe("loop.store.ActiveRoomStore", function () {
   "use strict";
 
   var sandbox, dispatcher;
@@ -20,13 +20,13 @@ describe("loop.store.LocalRoomStore", function () {
   describe("#constructor", function() {
     it("should throw an error if the dispatcher is missing", function() {
       expect(function() {
-        new loop.store.LocalRoomStore({mozLoop: {}});
+        new loop.store.ActiveRoomStore({mozLoop: {}});
       }).to.Throw(/dispatcher/);
     });
 
     it("should throw an error if mozLoop is missing", function() {
       expect(function() {
-        new loop.store.LocalRoomStore({dispatcher: dispatcher});
+        new loop.store.ActiveRoomStore({dispatcher: dispatcher});
       }).to.Throw(/mozLoop/);
     });
   });
@@ -41,7 +41,7 @@ describe("loop.store.LocalRoomStore", function () {
         rooms: { get: sandbox.stub() }
       };
 
-      store = new loop.store.LocalRoomStore(
+      store = new loop.store.ActiveRoomStore(
         {mozLoop: fakeMozLoop, dispatcher: dispatcher});
       fakeMozLoop.rooms.get.
         withArgs(fakeToken).
@@ -64,7 +64,7 @@ describe("loop.store.LocalRoomStore", function () {
       }));
     });
 
-    it("should set localRoomId on the store from the action data",
+    it("should set roomToken on the store from the action data",
       function(done) {
 
         store.once("change", function () {
diff --git a/browser/components/loop/test/shared/index.html b/browser/components/loop/test/shared/index.html
index b5504daf486..f7760d59592 100644
--- a/browser/components/loop/test/shared/index.html
+++ b/browser/components/loop/test/shared/index.html
@@ -43,9 +43,9 @@
   <script src="../../content/shared/js/actions.js"></script>
   <script src="../../content/shared/js/dispatcher.js"></script>
   <script src="../../content/shared/js/otSdkDriver.js"></script>
-  <script src="../../content/shared/js/localRoomStore.js"></script>
+  <script src="../../content/shared/js/activeRoomStore.js"></script>
   <script src="../../content/shared/js/conversationStore.js"></script>
-  <script src="../../content/shared/js/roomListStore.js"></script>
+  <script src="../../content/shared/js/roomStore.js"></script>
 
   <!-- Test scripts -->
   <script src="models_test.js"></script>
@@ -56,10 +56,10 @@
   <script src="feedbackApiClient_test.js"></script>
   <script src="validate_test.js"></script>
   <script src="dispatcher_test.js"></script>
-  <script src="localRoomStore_test.js"></script>
+  <script src="activeRoomStore_test.js"></script>
   <script src="conversationStore_test.js"></script>
   <script src="otSdkDriver_test.js"></script>
-  <script src="roomListStore_test.js"></script>
+  <script src="roomStore_test.js"></script>
   <script>
     mocha.run(function () {
       $("#mocha").append("<p id='complete'>Complete.</p>");
diff --git a/browser/components/loop/test/shared/roomListStore_test.js b/browser/components/loop/test/shared/roomStore_test.js
similarity index 79%
rename from browser/components/loop/test/shared/roomListStore_test.js
rename to browser/components/loop/test/shared/roomStore_test.js
index a5a9fb690ce..a1d6631d106 100644
--- a/browser/components/loop/test/shared/roomListStore_test.js
+++ b/browser/components/loop/test/shared/roomStore_test.js
@@ -15,7 +15,7 @@ describe("loop.store.Room", function () {
   });
 });
 
-describe("loop.store.RoomListStore", function () {
+describe("loop.store.RoomStore", function () {
   "use strict";
 
   var sharedActions = loop.shared.actions;
@@ -57,13 +57,13 @@ describe("loop.store.RoomListStore", function () {
   describe("#constructor", function() {
     it("should throw an error if the dispatcher is missing", function() {
       expect(function() {
-        new loop.store.RoomListStore({mozLoop: {}});
+        new loop.store.RoomStore({mozLoop: {}});
       }).to.Throw(/dispatcher/);
     });
 
     it("should throw an error if mozLoop is missing", function() {
       expect(function() {
-        new loop.store.RoomListStore({dispatcher: dispatcher});
+        new loop.store.RoomStore({dispatcher: dispatcher});
       }).to.Throw(/mozLoop/);
     });
   });
@@ -71,24 +71,28 @@ describe("loop.store.RoomListStore", function () {
   describe("constructed", function() {
     var fakeMozLoop, store;
 
+    var defaultStoreState = {
+      error: undefined,
+      pendingCreation: false,
+      pendingInitialRetrieval: false,
+      rooms: [],
+      activeRoom: {}
+    };
+
     beforeEach(function() {
       fakeMozLoop = {
+        copyString: function() {},
         rooms: {
           create: function() {},
           getAll: function() {},
           on: sandbox.stub()
         }
       };
-      store = new loop.store.RoomListStore({
+      store = new loop.store.RoomStore({
         dispatcher: dispatcher,
         mozLoop: fakeMozLoop
       });
-      store.setStoreState({
-        error: undefined,
-        pendingCreation: false,
-        pendingInitialRetrieval: false,
-        rooms: []
-      });
+      store.setStoreState(defaultStoreState);
     });
 
     describe("MozLoop rooms event listeners", function() {
@@ -149,6 +153,19 @@ describe("loop.store.RoomListStore", function () {
       });
     });
 
+    describe("#getStoreState", function() {
+      it("should retrieve the whole state by default", function() {
+        expect(store.getStoreState()).eql(defaultStoreState);
+      });
+
+      it("should retrieve a given property state", function() {
+        var fakeActiveRoom = {fake: true};
+        store.setStoreState({activeRoom: fakeActiveRoom});
+
+        expect(store.getStoreState().activeRoom).eql(fakeActiveRoom);
+      });
+    });
+
     describe("#findNextAvailableRoomNumber", function() {
       var fakeNameTemplate = "RoomWord {{conversationLabel}}";
 
@@ -243,6 +260,19 @@ describe("loop.store.RoomListStore", function () {
       });
     });
 
+    describe("#copyRoomUrl", function() {
+      it("should copy the room URL", function() {
+        var copyString = sandbox.stub(fakeMozLoop, "copyString");
+
+        store.copyRoomUrl(new sharedActions.CopyRoomUrl({
+          roomUrl: "http://invalid"
+        }));
+
+        sinon.assert.calledOnce(copyString);
+        sinon.assert.calledWithExactly(copyString, "http://invalid");
+      });
+    });
+
     describe("#setStoreState", function() {
       it("should update store state data", function() {
         store.setStoreState({pendingCreation: true});
@@ -257,6 +287,14 @@ describe("loop.store.RoomListStore", function () {
 
         store.setStoreState({pendingCreation: true});
       });
+
+      it("should trigger a `change:<prop>` event", function(done) {
+        store.once("change:pendingCreation", function() {
+          done();
+        });
+
+        store.setStoreState({pendingCreation: true});
+      });
     });
 
     describe("#getAllRooms", function() {
@@ -325,6 +363,40 @@ describe("loop.store.RoomListStore", function () {
         expect(store.getStoreState().pendingInitialRetrieval).eql(false);
       });
     });
+
+    describe("ActiveRoomStore substore", function() {
+      var store, activeRoomStore;
+
+      beforeEach(function() {
+        activeRoomStore = new loop.store.ActiveRoomStore({
+          dispatcher: dispatcher,
+          mozLoop: fakeMozLoop
+        });
+        store = new loop.store.RoomStore({
+          dispatcher: dispatcher,
+          mozLoop: fakeMozLoop,
+          activeRoomStore: activeRoomStore
+        });
+      });
+
+      it("should subscribe to substore changes", function() {
+        var fakeServerData = {fake: true};
+
+        activeRoomStore.setStoreState({serverData: fakeServerData});
+
+        expect(store.getStoreState().activeRoom.serverData)
+          .eql(fakeServerData);
+      });
+
+      it("should trigger a change event when the substore is updated",
+        function(done) {
+          store.once("change:activeRoom", function() {
+            done();
+          });
+
+          activeRoomStore.setStoreState({serverData: {}});
+        });
+    });
   });
 
   describe("#openRoom", function() {
@@ -336,7 +408,7 @@ describe("loop.store.RoomListStore", function () {
           open: sinon.spy()
         }
       };
-      store = new loop.store.RoomListStore({
+      store = new loop.store.RoomStore({
         dispatcher: dispatcher,
         mozLoop: fakeMozLoop
       });
diff --git a/browser/components/loop/ui/index.html b/browser/components/loop/ui/index.html
index 36f34b836e5..827f50f928e 100644
--- a/browser/components/loop/ui/index.html
+++ b/browser/components/loop/ui/index.html
@@ -42,7 +42,8 @@
     <script src="../content/shared/js/validate.js"></script>
     <script src="../content/shared/js/dispatcher.js"></script>
     <script src="../content/shared/js/conversationStore.js"></script>
-    <script src="../content/shared/js/roomListStore.js"></script>
+    <script src="../content/shared/js/roomStore.js"></script>
+    <script src="../content/shared/js/activeRoomStore.js"></script>
     <script src="../content/js/roomViews.js"></script>
     <script src="../content/js/conversationViews.js"></script>
     <script src="../content/js/client.js"></script>
diff --git a/browser/components/loop/ui/ui-showcase.js b/browser/components/loop/ui/ui-showcase.js
index d0cd1dfd11c..4f1c388b589 100644
--- a/browser/components/loop/ui/ui-showcase.js
+++ b/browser/components/loop/ui/ui-showcase.js
@@ -57,7 +57,7 @@
   );
 
   var dispatcher = new loop.Dispatcher();
-  var roomListStore = new loop.store.RoomListStore({
+  var roomStore = new loop.store.RoomStore({
     dispatcher: dispatcher,
     mozLoop: navigator.mozLoop
   });
@@ -126,8 +126,8 @@
       return (
         React.DOM.div({className: "svg-icon-list"}, 
           this.shapes.map(function(shapeId, i) {
-            return React.DOM.div({className: "svg-icon-entry"}, 
-              React.DOM.p(null, SVGIcon({key: i, shapeId: shapeId})), 
+            return React.DOM.div({key: i, className: "svg-icon-entry"}, 
+              React.DOM.p(null, SVGIcon({shapeId: shapeId})), 
               React.DOM.p(null, shapeId)
             );
           }, this)
@@ -203,42 +203,42 @@
               PanelView({client: mockClient, notifications: notifications, 
                          callUrl: "http://invalid.example.url/", 
                          dispatcher: dispatcher, 
-                         roomListStore: roomListStore})
+                         roomStore: roomStore})
             ), 
             Example({summary: "Call URL retrieved - authenticated", dashed: "true", style: {width: "332px"}}, 
               PanelView({client: mockClient, notifications: notifications, 
                          callUrl: "http://invalid.example.url/", 
                          userProfile: {email: "test@example.com"}, 
                          dispatcher: dispatcher, 
-                         roomListStore: roomListStore})
+                         roomStore: roomStore})
             ), 
             Example({summary: "Pending call url retrieval", dashed: "true", style: {width: "332px"}}, 
               PanelView({client: mockClient, notifications: notifications, 
                          dispatcher: dispatcher, 
-                         roomListStore: roomListStore})
+                         roomStore: roomStore})
             ), 
             Example({summary: "Pending call url retrieval - authenticated", dashed: "true", style: {width: "332px"}}, 
               PanelView({client: mockClient, notifications: notifications, 
                          userProfile: {email: "test@example.com"}, 
                          dispatcher: dispatcher, 
-                         roomListStore: roomListStore})
+                         roomStore: roomStore})
             ), 
             Example({summary: "Error Notification", dashed: "true", style: {width: "332px"}}, 
               PanelView({client: mockClient, notifications: errNotifications, 
                          dispatcher: dispatcher, 
-                         roomListStore: roomListStore})
+                         roomStore: roomStore})
             ), 
             Example({summary: "Error Notification - authenticated", dashed: "true", style: {width: "332px"}}, 
               PanelView({client: mockClient, notifications: errNotifications, 
                          userProfile: {email: "test@example.com"}, 
                          dispatcher: dispatcher, 
-                         roomListStore: roomListStore})
+                         roomStore: roomStore})
             ), 
             Example({summary: "Room list tab", dashed: "true", style: {width: "332px"}}, 
               PanelView({client: mockClient, notifications: notifications, 
                          userProfile: {email: "test@example.com"}, 
                          dispatcher: dispatcher, 
-                         roomListStore: roomListStore, 
+                         roomStore: roomStore, 
                          selectedTab: "rooms"})
             )
           ), 
diff --git a/browser/components/loop/ui/ui-showcase.jsx b/browser/components/loop/ui/ui-showcase.jsx
index 030254c4e0b..69efcc769e4 100644
--- a/browser/components/loop/ui/ui-showcase.jsx
+++ b/browser/components/loop/ui/ui-showcase.jsx
@@ -57,7 +57,7 @@
   );
 
   var dispatcher = new loop.Dispatcher();
-  var roomListStore = new loop.store.RoomListStore({
+  var roomStore = new loop.store.RoomStore({
     dispatcher: dispatcher,
     mozLoop: navigator.mozLoop
   });
@@ -126,8 +126,8 @@
       return (
         <div className="svg-icon-list">{
           this.shapes.map(function(shapeId, i) {
-            return <div className="svg-icon-entry">
-              <p><SVGIcon key={i} shapeId={shapeId} /></p>
+            return <div key={i} className="svg-icon-entry">
+              <p><SVGIcon shapeId={shapeId} /></p>
               <p>{shapeId}</p>
             </div>;
           }, this)
@@ -203,42 +203,42 @@
               <PanelView client={mockClient} notifications={notifications}
                          callUrl="http://invalid.example.url/"
                          dispatcher={dispatcher}
-                         roomListStore={roomListStore} />
+                         roomStore={roomStore} />
             </Example>
             <Example summary="Call URL retrieved - authenticated" dashed="true" style={{width: "332px"}}>
               <PanelView client={mockClient} notifications={notifications}
                          callUrl="http://invalid.example.url/"
                          userProfile={{email: "test@example.com"}}
                          dispatcher={dispatcher}
-                         roomListStore={roomListStore} />
+                         roomStore={roomStore} />
             </Example>
             <Example summary="Pending call url retrieval" dashed="true" style={{width: "332px"}}>
               <PanelView client={mockClient} notifications={notifications}
                          dispatcher={dispatcher}
-                         roomListStore={roomListStore} />
+                         roomStore={roomStore} />
             </Example>
             <Example summary="Pending call url retrieval - authenticated" dashed="true" style={{width: "332px"}}>
               <PanelView client={mockClient} notifications={notifications}
                          userProfile={{email: "test@example.com"}}
                          dispatcher={dispatcher}
-                         roomListStore={roomListStore} />
+                         roomStore={roomStore} />
             </Example>
             <Example summary="Error Notification" dashed="true" style={{width: "332px"}}>
               <PanelView client={mockClient} notifications={errNotifications}
                          dispatcher={dispatcher}
-                         roomListStore={roomListStore} />
+                         roomStore={roomStore} />
             </Example>
             <Example summary="Error Notification - authenticated" dashed="true" style={{width: "332px"}}>
               <PanelView client={mockClient} notifications={errNotifications}
                          userProfile={{email: "test@example.com"}}
                          dispatcher={dispatcher}
-                         roomListStore={roomListStore} />
+                         roomStore={roomStore} />
             </Example>
             <Example summary="Room list tab" dashed="true" style={{width: "332px"}}>
               <PanelView client={mockClient} notifications={notifications}
                          userProfile={{email: "test@example.com"}}
                          dispatcher={dispatcher}
-                         roomListStore={roomListStore}
+                         roomStore={roomStore}
                          selectedTab="rooms" />
             </Example>
           </Section>

From 75c663bad50dcb837b16a3789fca49d008d3e86c Mon Sep 17 00:00:00 2001
From: Mark Banner <standard8@mozilla.com>
Date: Wed, 5 Nov 2014 13:59:46 +0000
Subject: [PATCH 136/153] Bug 1093475 When a Loop call URL is deleted/blocked,
 use the proper session. r=mikedeboer

---
 browser/components/loop/content/js/client.js  | 11 +++++-----
 .../loop/content/js/conversation.js           | 14 +++++++-----
 .../loop/content/js/conversation.jsx          | 14 +++++++-----
 .../loop/test/desktop-local/client_test.js    | 10 ++++-----
 .../test/desktop-local/conversation_test.js   | 22 ++++++++++++++-----
 5 files changed, 44 insertions(+), 27 deletions(-)

diff --git a/browser/components/loop/content/js/client.js b/browser/components/loop/content/js/client.js
index a5182163de2..bcf952a92f2 100644
--- a/browser/components/loop/content/js/client.js
+++ b/browser/components/loop/content/js/client.js
@@ -151,23 +151,25 @@ loop.Client = (function($) {
      * Block call URL based on the token identifier
      *
      * @param {string} token Conversation identifier used to block the URL
+     * @param {mozLoop.LOOP_SESSION_TYPE} sessionType The type of session which
+     *                                                the url belongs to.
      * @param {function} cb Callback function used for handling an error
      *                      response. XXX The incoming call panel does not
      *                      exist after the block button is clicked therefore
      *                      it does not make sense to display an error.
      **/
-    deleteCallUrl: function(token, cb) {
+    deleteCallUrl: function(token, sessionType, cb) {
       this._ensureRegistered(function(err) {
         if (err) {
           cb(err);
           return;
         }
 
-        this._deleteCallUrlInternal(token, cb);
+        this._deleteCallUrlInternal(token, sessionType, cb);
       }.bind(this));
     },
 
-    _deleteCallUrlInternal: function(token, cb) {
+    _deleteCallUrlInternal: function(token, sessionType, cb) {
       function deleteRequestCallback(error, responseText) {
         if (error) {
           this._failureHandler(cb, error);
@@ -182,8 +184,7 @@ loop.Client = (function($) {
         }
       }
 
-      // XXX hard-coding of GUEST to be removed by 1065155
-      this.mozLoop.hawkRequest(this.mozLoop.LOOP_SESSION_TYPE.GUEST,
+      this.mozLoop.hawkRequest(sessionType,
                                "/call-url/" + token, "DELETE", null,
                                deleteRequestCallback.bind(this));
     },
diff --git a/browser/components/loop/content/js/conversation.js b/browser/components/loop/content/js/conversation.js
index bedb8c7be9d..9b5192c55fc 100644
--- a/browser/components/loop/content/js/conversation.js
+++ b/browser/components/loop/content/js/conversation.js
@@ -499,12 +499,14 @@ loop.conversation = (function(mozL10n) {
     declineAndBlock: function() {
       navigator.mozLoop.stopAlerting();
       var token = this.props.conversation.get("callToken");
-      this.props.client.deleteCallUrl(token, function(error) {
-        // XXX The conversation window will be closed when this cb is triggered
-        // figure out if there is a better way to report the error to the user
-        // (bug 1048909).
-        console.log(error);
-      });
+      this.props.client.deleteCallUrl(token,
+        this.props.conversation.get("sessionType"),
+        function(error) {
+          // XXX The conversation window will be closed when this cb is triggered
+          // figure out if there is a better way to report the error to the user
+          // (bug 1048909).
+          console.log(error);
+        });
       this._declineCall();
     },
 
diff --git a/browser/components/loop/content/js/conversation.jsx b/browser/components/loop/content/js/conversation.jsx
index 4d813d01620..8ed6b960be7 100644
--- a/browser/components/loop/content/js/conversation.jsx
+++ b/browser/components/loop/content/js/conversation.jsx
@@ -499,12 +499,14 @@ loop.conversation = (function(mozL10n) {
     declineAndBlock: function() {
       navigator.mozLoop.stopAlerting();
       var token = this.props.conversation.get("callToken");
-      this.props.client.deleteCallUrl(token, function(error) {
-        // XXX The conversation window will be closed when this cb is triggered
-        // figure out if there is a better way to report the error to the user
-        // (bug 1048909).
-        console.log(error);
-      });
+      this.props.client.deleteCallUrl(token,
+        this.props.conversation.get("sessionType"),
+        function(error) {
+          // XXX The conversation window will be closed when this cb is triggered
+          // figure out if there is a better way to report the error to the user
+          // (bug 1048909).
+          console.log(error);
+        });
       this._declineCall();
     },
 
diff --git a/browser/components/loop/test/desktop-local/client_test.js b/browser/components/loop/test/desktop-local/client_test.js
index e09eeb2ae8d..3e32f0af286 100644
--- a/browser/components/loop/test/desktop-local/client_test.js
+++ b/browser/components/loop/test/desktop-local/client_test.js
@@ -56,7 +56,7 @@ describe("loop.Client", function() {
   describe("loop.Client", function() {
     describe("#deleteCallUrl", function() {
       it("should ensure loop is registered", function() {
-        client.deleteCallUrl("fakeToken", callback);
+        client.deleteCallUrl("fakeToken", mozLoop.LOOP_SESSION_TYPE.FXA, callback);
 
         sinon.assert.calledOnce(mozLoop.ensureRegistered);
       });
@@ -64,14 +64,14 @@ describe("loop.Client", function() {
       it("should send an error when registration fails", function() {
         mozLoop.ensureRegistered.callsArgWith(0, "offline");
 
-        client.deleteCallUrl("fakeToken", callback);
+        client.deleteCallUrl("fakeToken", mozLoop.LOOP_SESSION_TYPE.FXA, callback);
 
         sinon.assert.calledOnce(callback);
         sinon.assert.calledWithExactly(callback, "offline");
       });
 
       it("should make a delete call to /call-url/{fakeToken}", function() {
-        client.deleteCallUrl(fakeToken, callback);
+        client.deleteCallUrl(fakeToken, mozLoop.LOOP_SESSION_TYPE.GUEST, callback);
 
         sinon.assert.calledOnce(hawkRequestStub);
         sinon.assert.calledWith(hawkRequestStub,
@@ -86,7 +86,7 @@ describe("loop.Client", function() {
            // and the url.
            hawkRequestStub.callsArgWith(4, null);
 
-           client.deleteCallUrl(fakeToken, callback);
+           client.deleteCallUrl(fakeToken, mozLoop.LOOP_SESSION_TYPE.FXA, callback);
 
            sinon.assert.calledWithExactly(callback, null);
          });
@@ -96,7 +96,7 @@ describe("loop.Client", function() {
         // an error
         hawkRequestStub.callsArgWith(4, fakeErrorRes);
 
-        client.deleteCallUrl(fakeToken, callback);
+        client.deleteCallUrl(fakeToken, mozLoop.LOOP_SESSION_TYPE.FXA, callback);
 
         sinon.assert.calledOnce(callback);
         sinon.assert.calledWithMatch(callback, sinon.match(function(err) {
diff --git a/browser/components/loop/test/desktop-local/conversation_test.js b/browser/components/loop/test/desktop-local/conversation_test.js
index f169b46dd60..e189d28d722 100644
--- a/browser/components/loop/test/desktop-local/conversation_test.js
+++ b/browser/components/loop/test/desktop-local/conversation_test.js
@@ -539,6 +539,8 @@ describe("loop.conversation", function() {
       });
 
       describe("#blocked", function() {
+        var mozLoop;
+
         beforeEach(function() {
           icView = mountTestComponent();
 
@@ -547,6 +549,13 @@ describe("loop.conversation", function() {
             close: sinon.stub()
           };
           sandbox.stub(window, "close");
+
+          mozLoop = {
+            LOOP_SESSION_TYPE: {
+              GUEST: 1,
+              FXA: 2
+            }
+          };
         });
 
         it("should call mozLoop.stopAlerting", function() {
@@ -557,21 +566,24 @@ describe("loop.conversation", function() {
 
         it("should call delete call", function() {
           sandbox.stub(conversation, "get").withArgs("callToken")
-                                           .returns("fakeToken");
+                                           .returns("fakeToken")
+                                           .withArgs("sessionType")
+                                           .returns(mozLoop.LOOP_SESSION_TYPE.FXA);
+
           var deleteCallUrl = sandbox.stub(loop.Client.prototype,
                                            "deleteCallUrl");
           icView.declineAndBlock();
 
           sinon.assert.calledOnce(deleteCallUrl);
-          sinon.assert.calledWithExactly(deleteCallUrl, "fakeToken",
-                                                        sinon.match.func);
+          sinon.assert.calledWithExactly(deleteCallUrl,
+            "fakeToken", mozLoop.LOOP_SESSION_TYPE.FXA, sinon.match.func);
         });
 
         it("should get callToken from conversation model", function() {
           sandbox.stub(conversation, "get");
           icView.declineAndBlock();
 
-          sinon.assert.calledTwice(conversation.get);
+          sinon.assert.called(conversation.get);
           sinon.assert.calledWithExactly(conversation.get, "callToken");
           sinon.assert.calledWithExactly(conversation.get, "windowId");
         });
@@ -582,7 +594,7 @@ describe("loop.conversation", function() {
           var fakeError = {
             error: true
           };
-          sandbox.stub(loop.Client.prototype, "deleteCallUrl", function(_, cb) {
+          sandbox.stub(loop.Client.prototype, "deleteCallUrl", function(_, __, cb) {
             cb(fakeError);
           });
           icView.declineAndBlock();

From 71a8a5cef8267c7a2243ceddc7c42198d787ee4c Mon Sep 17 00:00:00 2001
From: Lucas Rocha <lucasr@mozilla.com>
Date: Wed, 5 Nov 2014 14:18:29 +0000
Subject: [PATCH 137/153] Backout 3b36af7151ec, bug 1093621, talos regression
 (r=backout)

---
 mobile/android/base/NewTabletUI.java                      | 7 ++-----
 mobile/android/base/resources/xml/preferences_display.xml | 2 +-
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/mobile/android/base/NewTabletUI.java b/mobile/android/base/NewTabletUI.java
index 41c1ac34e74..887034a809b 100644
--- a/mobile/android/base/NewTabletUI.java
+++ b/mobile/android/base/NewTabletUI.java
@@ -7,15 +7,12 @@ package org.mozilla.gecko;
 import android.content.Context;
 import android.content.SharedPreferences;
 
-import org.mozilla.gecko.AppConstants;
 import org.mozilla.gecko.preferences.GeckoPreferences;
 import org.mozilla.gecko.util.HardwareUtils;
 
 public class NewTabletUI {
-    // This value should be in sync with preferences_display.xml. On non-release
-    // builds, the preference UI will be hidden and the (unused) default
-    // preference UI value will still be 'true'.
-    private static final boolean DEFAULT = !AppConstants.RELEASE_BUILD;
+    // This value should be in sync with preferences_display.xml.
+    private static final boolean DEFAULT = false;
 
     private static Boolean sNewTabletUI;
 
diff --git a/mobile/android/base/resources/xml/preferences_display.xml b/mobile/android/base/resources/xml/preferences_display.xml
index d13fa0f3af9..122103c45f1 100644
--- a/mobile/android/base/resources/xml/preferences_display.xml
+++ b/mobile/android/base/resources/xml/preferences_display.xml
@@ -27,7 +27,7 @@
 
     <CheckBoxPreference android:key="android.not_a_preference.new_tablet_ui"
                         android:title="@string/new_tablet_pref"
-                        android:defaultValue="true" />
+                        android:defaultValue="false" />
 
     <PreferenceCategory android:title="@string/pref_category_advanced">
 

From 902be81689620927a36e78b961702ce5c48ef5c9 Mon Sep 17 00:00:00 2001
From: Mark Banner <standard8@mozilla.com>
Date: Wed, 5 Nov 2014 14:59:40 +0000
Subject: [PATCH 138/153] Bug 1094128 Convert the Loop Standalone controller
 app view to be based on the Flux style. r=nperriault

---
 .../loop/content/shared/js/actions.js         |  16 ++
 .../loop/content/shared/js/mixins.js          |   4 -
 .../loop/standalone/content/index.html        |   5 +
 .../content/js/standaloneAppStore.js          | 148 +++++++++++
 .../content/js/standaloneRoomViews.js         |  22 ++
 .../content/js/standaloneRoomViews.jsx        |  22 ++
 .../loop/standalone/content/js/webapp.js      | 114 ++++----
 .../loop/standalone/content/js/webapp.jsx     | 112 +++++---
 .../loop/test/standalone/index.html           |   6 +
 .../standalone/standaloneAppStore_test.js     | 246 ++++++++++++++++++
 .../loop/test/standalone/webapp_test.js       |  95 ++++---
 11 files changed, 661 insertions(+), 129 deletions(-)
 create mode 100644 browser/components/loop/standalone/content/js/standaloneAppStore.js
 create mode 100644 browser/components/loop/standalone/content/js/standaloneRoomViews.js
 create mode 100644 browser/components/loop/standalone/content/js/standaloneRoomViews.jsx
 create mode 100644 browser/components/loop/test/standalone/standaloneAppStore_test.js

diff --git a/browser/components/loop/content/shared/js/actions.js b/browser/components/loop/content/shared/js/actions.js
index 601bf345fe2..f92a6416551 100644
--- a/browser/components/loop/content/shared/js/actions.js
+++ b/browser/components/loop/content/shared/js/actions.js
@@ -37,6 +37,13 @@ loop.shared.actions = (function() {
       windowId: String
     }),
 
+    /**
+     * Extract the token information and type for the standalone window
+     */
+    ExtractTokenInfo: Action.define("extractTokenInfo", {
+      windowPath: String
+    }),
+
     /**
      * Used to pass round the window data so that stores can
      * record the appropriate data.
@@ -51,6 +58,15 @@ loop.shared.actions = (function() {
       // data.
     }),
 
+    /**
+     * Used to fetch the data from the server for a room or call for the
+     * token.
+     */
+    FetchServerData: Action.define("fetchServerData", {
+      token: String,
+      windowType: String
+    }),
+
     /**
      * Fetch a new call url from the server, intended to be sent over email when
      * a contact can't be reached.
diff --git a/browser/components/loop/content/shared/js/mixins.js b/browser/components/loop/content/shared/js/mixins.js
index f39f16f1573..222663f3370 100644
--- a/browser/components/loop/content/shared/js/mixins.js
+++ b/browser/components/loop/content/shared/js/mixins.js
@@ -33,10 +33,6 @@ loop.shared.mixins = (function() {
    * @type {Object}
    */
   var UrlHashChangeMixin = {
-    propTypes: {
-      onUrlHashChange: React.PropTypes.func.isRequired
-    },
-
     componentDidMount: function() {
       rootObject.addEventListener("hashchange", this.onUrlHashChange, false);
     },
diff --git a/browser/components/loop/standalone/content/index.html b/browser/components/loop/standalone/content/index.html
index ab5ffcb993a..81a3a6eef30 100644
--- a/browser/components/loop/standalone/content/index.html
+++ b/browser/components/loop/standalone/content/index.html
@@ -42,8 +42,13 @@
     <script type="text/javascript" src="shared/js/mixins.js"></script>
     <script type="text/javascript" src="shared/js/views.js"></script>
     <script type="text/javascript" src="shared/js/feedbackApiClient.js"></script>
+    <script type="text/javascript" src="shared/js/actions.js"></script>
+    <script type="text/javascript" src="shared/js/validate.js"></script>
+    <script type="text/javascript" src="shared/js/dispatcher.js"></script>
     <script type="text/javascript" src="shared/js/websocket.js"></script>
+    <script type="text/javascript" src="js/standaloneAppStore.js"></script>
     <script type="text/javascript" src="js/standaloneClient.js"></script>
+    <script type="text/javascript" src="js/standaloneRoomViews.js"></script>
     <script type="text/javascript" src="js/webapp.js"></script>
 
     <script>
diff --git a/browser/components/loop/standalone/content/js/standaloneAppStore.js b/browser/components/loop/standalone/content/js/standaloneAppStore.js
new file mode 100644
index 00000000000..35c77c9fec6
--- /dev/null
+++ b/browser/components/loop/standalone/content/js/standaloneAppStore.js
@@ -0,0 +1,148 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* global loop:true */
+
+var loop = loop || {};
+loop.store = loop.store || {};
+
+/**
+ * Manages the conversation window app controller view. Used to get
+ * the window data and store the window type.
+ */
+loop.store.StandaloneAppStore = (function() {
+  "use strict";
+
+  var sharedActions = loop.shared.actions;
+  var sharedUtils = loop.shared.utils;
+
+  var OLD_STYLE_CALL_REGEXP = /\#call\/(.*)/;
+  var NEW_STYLE_CALL_REGEXP = /\/c\/([\w\-]+)$/;
+  var ROOM_REGEXP = /\/([\w\-]+)$/;
+
+  /**
+   * Constructor
+   *
+   * @param {Object} options Options for the store. Should contain the dispatcher.
+   */
+  var StandaloneAppStore = function(options) {
+    if (!options.dispatcher) {
+      throw new Error("Missing option dispatcher");
+    }
+    if (!options.sdk) {
+      throw new Error("Missing option sdk");
+    }
+    if (!options.helper) {
+      throw new Error("Missing option helper");
+    }
+    if (!options.conversation) {
+      throw new Error("Missing option conversation");
+    }
+
+    this._dispatcher = options.dispatcher;
+    this._storeState = {};
+    this._sdk = options.sdk;
+    this._helper = options.helper;
+    this._conversation = options.conversation;
+
+    this._dispatcher.register(this, [
+      "extractTokenInfo"
+    ]);
+  };
+
+  StandaloneAppStore.prototype = _.extend({
+    /**
+     * Retrieves current store state.
+     *
+     * @return {Object}
+     */
+    getStoreState: function() {
+      return this._storeState;
+    },
+
+    /**
+     * Updates store states and trigger a "change" event.
+     *
+     * @param {Object} state The new store state.
+     */
+    setStoreState: function(state) {
+      this._storeState = state;
+      this.trigger("change");
+    },
+
+    _extractWindowDataFromPath: function(windowPath) {
+      var match;
+      var windowType = "home";
+
+      function extractId(path, regexp) {
+        var match = path.match(regexp);
+        if (match && match[1]) {
+          return match;
+        }
+        return null;
+      }
+
+      if (windowPath) {
+        // Is this a call url (the hash is a backwards-compatible url)?
+        match = extractId(windowPath, OLD_STYLE_CALL_REGEXP) ||
+                extractId(windowPath, NEW_STYLE_CALL_REGEXP);
+
+        if (match) {
+          windowType = "outgoing";
+        } else {
+          // Is this a room url?
+          match = extractId(windowPath, ROOM_REGEXP);
+
+          if (match) {
+            windowType = "room";
+          }
+        }
+      }
+      return [windowType, match && match[1] ? match[1] : null];
+    },
+
+    /**
+     * Handles the extract token info action - obtains the token information
+     * and its type; updates the store and notifies interested components.
+     *
+     * @param {sharedActions.GetWindowData} actionData The action data
+     */
+    extractTokenInfo: function(actionData) {
+      var windowType = "home";
+      var token;
+
+      // Check if we're on a supported device/platform.
+      if (this._helper.isIOS(navigator.platform)) {
+        windowType = "unsupportedDevice";
+      } else if (!this._sdk.checkSystemRequirements()) {
+        windowType = "unsupportedBrowser";
+      } else if (actionData.windowPath) {
+        // ES6 not used in standalone yet.
+        var result = this._extractWindowDataFromPath(actionData.windowPath);
+        windowType = result[0];
+        token = result[1];
+      }
+      // Else type is home.
+
+      if (token) {
+        this._conversation.set({loopToken: token});
+      }
+
+      this.setStoreState({
+        windowType: windowType
+      });
+
+      // If we've not got a window ID, don't dispatch the action, as we don't need
+      // it.
+      if (token) {
+        this._dispatcher.dispatch(new loop.shared.actions.FetchServerData({
+          token: token,
+          windowType: windowType
+        }));
+      }
+    }
+  }, Backbone.Events);
+
+  return StandaloneAppStore;
+})();
diff --git a/browser/components/loop/standalone/content/js/standaloneRoomViews.js b/browser/components/loop/standalone/content/js/standaloneRoomViews.js
new file mode 100644
index 00000000000..435eb105bc3
--- /dev/null
+++ b/browser/components/loop/standalone/content/js/standaloneRoomViews.js
@@ -0,0 +1,22 @@
+/** @jsx React.DOM */
+
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* global loop:true, React */
+
+var loop = loop || {};
+loop.standaloneRoomViews = (function() {
+  "use strict";
+
+  var StandaloneRoomView = React.createClass({displayName: 'StandaloneRoomView',
+    render: function() {
+      return (React.DOM.div(null, "Room"));
+    }
+  });
+
+  return {
+    StandaloneRoomView: StandaloneRoomView
+  };
+})();
diff --git a/browser/components/loop/standalone/content/js/standaloneRoomViews.jsx b/browser/components/loop/standalone/content/js/standaloneRoomViews.jsx
new file mode 100644
index 00000000000..5dcfd75a8de
--- /dev/null
+++ b/browser/components/loop/standalone/content/js/standaloneRoomViews.jsx
@@ -0,0 +1,22 @@
+/** @jsx React.DOM */
+
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* global loop:true, React */
+
+var loop = loop || {};
+loop.standaloneRoomViews = (function() {
+  "use strict";
+
+  var StandaloneRoomView = React.createClass({
+    render: function() {
+      return (<div>Room</div>);
+    }
+  });
+
+  return {
+    StandaloneRoomView: StandaloneRoomView
+  };
+})();
diff --git a/browser/components/loop/standalone/content/js/webapp.js b/browser/components/loop/standalone/content/js/webapp.js
index b4560456cdc..123752de728 100644
--- a/browser/components/loop/standalone/content/js/webapp.js
+++ b/browser/components/loop/standalone/content/js/webapp.js
@@ -14,6 +14,7 @@ loop.webapp = (function($, _, OT, mozL10n) {
   loop.config = loop.config || {};
   loop.config.serverUrl = loop.config.serverUrl || "http://localhost:5000";
 
+  var sharedActions = loop.shared.actions;
   var sharedMixins = loop.shared.mixins;
   var sharedModels = loop.shared.models;
   var sharedViews = loop.shared.views;
@@ -877,7 +878,8 @@ loop.webapp = (function($, _, OT, mozL10n) {
   var WebappRootView = React.createClass({displayName: 'WebappRootView',
 
     mixins: [sharedMixins.UrlHashChangeMixin,
-             sharedMixins.DocumentLocationMixin],
+             sharedMixins.DocumentLocationMixin,
+             Backbone.Events],
 
     propTypes: {
       client: React.PropTypes.instanceOf(loop.StandaloneClient).isRequired,
@@ -889,14 +891,25 @@ loop.webapp = (function($, _, OT, mozL10n) {
       notifications: React.PropTypes.instanceOf(sharedModels.NotificationCollection)
                           .isRequired,
       sdk: React.PropTypes.object.isRequired,
-      feedbackApiClient: React.PropTypes.object.isRequired
+      feedbackApiClient: React.PropTypes.object.isRequired,
+
+      // XXX New types for flux style
+      standaloneAppStore: React.PropTypes.instanceOf(
+        loop.store.StandaloneAppStore).isRequired
     },
 
     getInitialState: function() {
-      return {
-        unsupportedDevice: this.props.helper.isIOS(navigator.platform),
-        unsupportedBrowser: !this.props.sdk.checkSystemRequirements(),
-      };
+      return this.props.standaloneAppStore.getStoreState();
+    },
+
+    componentWillMount: function() {
+      this.listenTo(this.props.standaloneAppStore, "change", function() {
+        this.setState(this.props.standaloneAppStore.getStoreState());
+      }, this);
+    },
+
+    componentWillUnmount: function() {
+      this.stopListening(this.props.standaloneAppStore);
     },
 
     onUrlHashChange: function() {
@@ -904,23 +917,36 @@ loop.webapp = (function($, _, OT, mozL10n) {
     },
 
     render: function() {
-      if (this.state.unsupportedDevice) {
-        return UnsupportedDeviceView(null);
-      } else if (this.state.unsupportedBrowser) {
-        return UnsupportedBrowserView(null);
-      } else if (this.props.conversation.get("loopToken")) {
-        return (
-          OutgoingConversationView({
-             client: this.props.client, 
-             conversation: this.props.conversation, 
-             helper: this.props.helper, 
-             notifications: this.props.notifications, 
-             sdk: this.props.sdk, 
-             feedbackApiClient: this.props.feedbackApiClient}
-          )
-        );
-      } else {
-        return HomeView(null);
+      switch (this.state.windowType) {
+        case "unsupportedDevice": {
+          return UnsupportedDeviceView(null);
+        }
+        case "unsupportedBrowser": {
+          return UnsupportedBrowserView(null);
+        }
+        case "outgoing": {
+          return (
+            OutgoingConversationView({
+               client: this.props.client, 
+               conversation: this.props.conversation, 
+               helper: this.props.helper, 
+               notifications: this.props.notifications, 
+               sdk: this.props.sdk, 
+               feedbackApiClient: this.props.feedbackApiClient}
+            )
+          );
+        }
+        case "room": {
+          return loop.standaloneRoomViews.StandaloneRoomView(null);
+        }
+        case "home": {
+          return HomeView(null);
+        }
+        default: {
+          // The state hasn't been initialised yet, so don't display
+          // anything to avoid flicker.
+          return null;
+        }
       }
     }
   });
@@ -930,9 +956,8 @@ loop.webapp = (function($, _, OT, mozL10n) {
    */
   function init() {
     var helper = new sharedUtils.Helper();
-    var client = new loop.StandaloneClient({
-      baseServerUrl: loop.config.serverUrl
-    });
+
+    // Older non-flux based items.
     var notifications = new sharedModels.NotificationCollection();
     var conversation
     if (helper.isFirefoxOS(navigator.userAgent)) {
@@ -950,24 +975,18 @@ loop.webapp = (function($, _, OT, mozL10n) {
         url: document.location.origin
       });
 
-    // Obtain the loopToken
+    // New flux items.
+    var dispatcher = new loop.Dispatcher();
+    var client = new loop.StandaloneClient({
+      baseServerUrl: loop.config.serverUrl
+    });
 
-    var match;
-
-    // locationHash supports the old format urls.
-    var locationData = helper.locationData();
-    if (locationData.hash) {
-      match = locationData.hash.match(/\#call\/(.*)/);
-    } else if (locationData.pathname) {
-      // Otherwise, we're expecting a url such as /c/<token> for calls.
-      match = locationData.pathname.match(/\/c\/([\w\-]+)/);
-    }
-    // XXX Supporting '/\/([\w\-]+)/' is for rooms which are to be implemented
-    // in bug 1074701.
-
-    if (match && match[1]) {
-      conversation.set({loopToken: match[1]});
-    }
+    var standaloneAppStore = new loop.store.StandaloneAppStore({
+      conversation: conversation,
+      dispatcher: dispatcher,
+      helper: helper,
+      sdk: OT
+    });
 
     React.renderComponent(WebappRootView({
       client: client, 
@@ -975,13 +994,20 @@ loop.webapp = (function($, _, OT, mozL10n) {
       helper: helper, 
       notifications: notifications, 
       sdk: OT, 
-      feedbackApiClient: feedbackApiClient}
+      feedbackApiClient: feedbackApiClient, 
+      standaloneAppStore: standaloneAppStore}
     ), document.querySelector("#main"));
 
     // Set the 'lang' and 'dir' attributes to <html> when the page is translated
     document.documentElement.lang = mozL10n.language.code;
     document.documentElement.dir = mozL10n.language.direction;
     document.title = mozL10n.get("clientShortname2");
+
+    dispatcher.dispatch(new sharedActions.ExtractTokenInfo({
+      // We pass the hash or the pathname - the hash was used for the original
+      // urls, the pathname for later ones.
+      windowPath: helper.locationData().hash || helper.locationData().pathname
+    }));
   }
 
   return {
diff --git a/browser/components/loop/standalone/content/js/webapp.jsx b/browser/components/loop/standalone/content/js/webapp.jsx
index 86f72484140..505ced04002 100644
--- a/browser/components/loop/standalone/content/js/webapp.jsx
+++ b/browser/components/loop/standalone/content/js/webapp.jsx
@@ -14,6 +14,7 @@ loop.webapp = (function($, _, OT, mozL10n) {
   loop.config = loop.config || {};
   loop.config.serverUrl = loop.config.serverUrl || "http://localhost:5000";
 
+  var sharedActions = loop.shared.actions;
   var sharedMixins = loop.shared.mixins;
   var sharedModels = loop.shared.models;
   var sharedViews = loop.shared.views;
@@ -877,7 +878,8 @@ loop.webapp = (function($, _, OT, mozL10n) {
   var WebappRootView = React.createClass({
 
     mixins: [sharedMixins.UrlHashChangeMixin,
-             sharedMixins.DocumentLocationMixin],
+             sharedMixins.DocumentLocationMixin,
+             Backbone.Events],
 
     propTypes: {
       client: React.PropTypes.instanceOf(loop.StandaloneClient).isRequired,
@@ -889,14 +891,25 @@ loop.webapp = (function($, _, OT, mozL10n) {
       notifications: React.PropTypes.instanceOf(sharedModels.NotificationCollection)
                           .isRequired,
       sdk: React.PropTypes.object.isRequired,
-      feedbackApiClient: React.PropTypes.object.isRequired
+      feedbackApiClient: React.PropTypes.object.isRequired,
+
+      // XXX New types for flux style
+      standaloneAppStore: React.PropTypes.instanceOf(
+        loop.store.StandaloneAppStore).isRequired
     },
 
     getInitialState: function() {
-      return {
-        unsupportedDevice: this.props.helper.isIOS(navigator.platform),
-        unsupportedBrowser: !this.props.sdk.checkSystemRequirements(),
-      };
+      return this.props.standaloneAppStore.getStoreState();
+    },
+
+    componentWillMount: function() {
+      this.listenTo(this.props.standaloneAppStore, "change", function() {
+        this.setState(this.props.standaloneAppStore.getStoreState());
+      }, this);
+    },
+
+    componentWillUnmount: function() {
+      this.stopListening(this.props.standaloneAppStore);
     },
 
     onUrlHashChange: function() {
@@ -904,23 +917,36 @@ loop.webapp = (function($, _, OT, mozL10n) {
     },
 
     render: function() {
-      if (this.state.unsupportedDevice) {
-        return <UnsupportedDeviceView />;
-      } else if (this.state.unsupportedBrowser) {
-        return <UnsupportedBrowserView />;
-      } else if (this.props.conversation.get("loopToken")) {
-        return (
-          <OutgoingConversationView
-             client={this.props.client}
-             conversation={this.props.conversation}
-             helper={this.props.helper}
-             notifications={this.props.notifications}
-             sdk={this.props.sdk}
-             feedbackApiClient={this.props.feedbackApiClient}
-          />
-        );
-      } else {
-        return <HomeView />;
+      switch (this.state.windowType) {
+        case "unsupportedDevice": {
+          return <UnsupportedDeviceView />;
+        }
+        case "unsupportedBrowser": {
+          return <UnsupportedBrowserView />;
+        }
+        case "outgoing": {
+          return (
+            <OutgoingConversationView
+               client={this.props.client}
+               conversation={this.props.conversation}
+               helper={this.props.helper}
+               notifications={this.props.notifications}
+               sdk={this.props.sdk}
+               feedbackApiClient={this.props.feedbackApiClient}
+            />
+          );
+        }
+        case "room": {
+          return <loop.standaloneRoomViews.StandaloneRoomView/>;
+        }
+        case "home": {
+          return <HomeView />;
+        }
+        default: {
+          // The state hasn't been initialised yet, so don't display
+          // anything to avoid flicker.
+          return null;
+        }
       }
     }
   });
@@ -930,9 +956,8 @@ loop.webapp = (function($, _, OT, mozL10n) {
    */
   function init() {
     var helper = new sharedUtils.Helper();
-    var client = new loop.StandaloneClient({
-      baseServerUrl: loop.config.serverUrl
-    });
+
+    // Older non-flux based items.
     var notifications = new sharedModels.NotificationCollection();
     var conversation
     if (helper.isFirefoxOS(navigator.userAgent)) {
@@ -950,24 +975,18 @@ loop.webapp = (function($, _, OT, mozL10n) {
         url: document.location.origin
       });
 
-    // Obtain the loopToken
+    // New flux items.
+    var dispatcher = new loop.Dispatcher();
+    var client = new loop.StandaloneClient({
+      baseServerUrl: loop.config.serverUrl
+    });
 
-    var match;
-
-    // locationHash supports the old format urls.
-    var locationData = helper.locationData();
-    if (locationData.hash) {
-      match = locationData.hash.match(/\#call\/(.*)/);
-    } else if (locationData.pathname) {
-      // Otherwise, we're expecting a url such as /c/<token> for calls.
-      match = locationData.pathname.match(/\/c\/([\w\-]+)/);
-    }
-    // XXX Supporting '/\/([\w\-]+)/' is for rooms which are to be implemented
-    // in bug 1074701.
-
-    if (match && match[1]) {
-      conversation.set({loopToken: match[1]});
-    }
+    var standaloneAppStore = new loop.store.StandaloneAppStore({
+      conversation: conversation,
+      dispatcher: dispatcher,
+      helper: helper,
+      sdk: OT
+    });
 
     React.renderComponent(<WebappRootView
       client={client}
@@ -976,12 +995,19 @@ loop.webapp = (function($, _, OT, mozL10n) {
       notifications={notifications}
       sdk={OT}
       feedbackApiClient={feedbackApiClient}
+      standaloneAppStore={standaloneAppStore}
     />, document.querySelector("#main"));
 
     // Set the 'lang' and 'dir' attributes to <html> when the page is translated
     document.documentElement.lang = mozL10n.language.code;
     document.documentElement.dir = mozL10n.language.direction;
     document.title = mozL10n.get("clientShortname2");
+
+    dispatcher.dispatch(new sharedActions.ExtractTokenInfo({
+      // We pass the hash or the pathname - the hash was used for the original
+      // urls, the pathname for later ones.
+      windowPath: helper.locationData().hash || helper.locationData().pathname
+    }));
   }
 
   return {
diff --git a/browser/components/loop/test/standalone/index.html b/browser/components/loop/test/standalone/index.html
index edd1dde17de..251597f867b 100644
--- a/browser/components/loop/test/standalone/index.html
+++ b/browser/components/loop/test/standalone/index.html
@@ -37,11 +37,17 @@
   <script src="../../content/shared/js/views.js"></script>
   <script src="../../content/shared/js/websocket.js"></script>
   <script src="../../content/shared/js/feedbackApiClient.js"></script>
+  <script src="../../content/shared/js/actions.js"></script>
+  <script src="../../content/shared/js/validate.js"></script>
+  <script src="../../content/shared/js/dispatcher.js"></script>
   <script src="../../standalone/content/js/multiplexGum.js"></script>
+  <script src="../../standalone/content/js/standaloneAppStore.js"></script>
   <script src="../../standalone/content/js/standaloneClient.js"></script>
+  <script src="../../standalone/content/js/standaloneRoomViews.js"></script>
   <script src="../../standalone/content/js/webapp.js"></script>
  <!-- Test scripts -->
   <script src="standalone_client_test.js"></script>
+  <script src="standaloneAppStore_test.js"></script>
   <script src="webapp_test.js"></script>
   <script src="multiplexGum_test.js"></script>
   <script>
diff --git a/browser/components/loop/test/standalone/standaloneAppStore_test.js b/browser/components/loop/test/standalone/standaloneAppStore_test.js
new file mode 100644
index 00000000000..5c43c5b5818
--- /dev/null
+++ b/browser/components/loop/test/standalone/standaloneAppStore_test.js
@@ -0,0 +1,246 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+var expect = chai.expect;
+
+describe("loop.store.StandaloneAppStore", function () {
+  var sharedActions = loop.shared.actions;
+  var sharedUtils = loop.shared.utils;
+  var sandbox, dispatcher;
+
+  beforeEach(function() {
+    sandbox = sinon.sandbox.create();
+    dispatcher = new loop.Dispatcher();
+  });
+
+  afterEach(function() {
+    sandbox.restore();
+  });
+
+  describe("#constructor", function() {
+    it("should throw an error if the dispatcher is missing", function() {
+      expect(function() {
+        new loop.store.StandaloneAppStore({
+          sdk: {},
+          helper: {},
+          conversation: {}
+        });
+      }).to.Throw(/dispatcher/);
+    });
+
+    it("should throw an error if sdk is missing", function() {
+      expect(function() {
+        new loop.store.StandaloneAppStore({
+          dispatcher: dispatcher,
+          helper: {},
+          conversation: {}
+        });
+      }).to.Throw(/sdk/);
+    });
+
+    it("should throw an error if helper is missing", function() {
+      expect(function() {
+        new loop.store.StandaloneAppStore({
+          dispatcher: dispatcher,
+          sdk: {},
+          conversation: {}
+        });
+      }).to.Throw(/helper/);
+    });
+
+    it("should throw an error if conversation is missing", function() {
+      expect(function() {
+        new loop.store.StandaloneAppStore({
+          dispatcher: dispatcher,
+          sdk: {},
+          helper: {}
+        });
+      }).to.Throw(/conversation/);
+    });
+  });
+
+  describe("#extractTokenInfo", function() {
+    var store, fakeGetWindowData, fakeSdk, fakeConversation, helper;
+
+    beforeEach(function() {
+      fakeGetWindowData = {
+        windowPath: ""
+      };
+
+      helper = new sharedUtils.Helper();
+      sandbox.stub(helper, "isIOS").returns(false);
+
+      fakeSdk = {
+        checkSystemRequirements: sinon.stub().returns(true)
+      };
+
+      fakeConversation = {
+        set: sinon.spy()
+      };
+
+      sandbox.stub(dispatcher, "dispatch");
+
+      store = new loop.store.StandaloneAppStore({
+        dispatcher: dispatcher,
+        sdk: fakeSdk,
+        helper: helper,
+        conversation: fakeConversation
+      });
+    });
+
+    it("should set windowType to `unsupportedDevice` for IOS", function() {
+      // The stub should return true for this test.
+      helper.isIOS.returns(true);
+
+      store.extractTokenInfo(
+        new sharedActions.ExtractTokenInfo(fakeGetWindowData));
+
+      expect(store.getStoreState()).eql({
+        windowType: "unsupportedDevice"
+      });
+    });
+
+    it("should set windowType to `unsupportedBrowser` for browsers the sdk does not support",
+      function() {
+        // The stub should return false for this test.
+        fakeSdk.checkSystemRequirements.returns(false);
+
+        store.extractTokenInfo(
+          new sharedActions.ExtractTokenInfo(fakeGetWindowData));
+
+        expect(store.getStoreState()).eql({
+          windowType: "unsupportedBrowser"
+        });
+      });
+
+    it("should set windowType to `outgoing` for old style call hashes", function() {
+      fakeGetWindowData.windowPath = "#call/faketoken";
+
+      store.extractTokenInfo(
+        new sharedActions.ExtractTokenInfo(fakeGetWindowData));
+
+      expect(store.getStoreState()).eql({
+        windowType: "outgoing"
+      });
+    });
+
+    it("should set windowType to `outgoing` for new style call paths", function() {
+      fakeGetWindowData.windowPath = "/c/fakecalltoken";
+
+      store.extractTokenInfo(
+        new sharedActions.ExtractTokenInfo(fakeGetWindowData));
+
+      expect(store.getStoreState()).eql({
+        windowType: "outgoing"
+      });
+    });
+
+    it("should set windowType to `room` for room paths", function() {
+      fakeGetWindowData.windowPath = "/fakeroomtoken";
+
+      store.extractTokenInfo(
+        new sharedActions.ExtractTokenInfo(fakeGetWindowData));
+
+      expect(store.getStoreState()).eql({
+        windowType: "room"
+      });
+    });
+
+    it("should set windowType to `home` for unknown paths", function() {
+      fakeGetWindowData.windowPath = "/";
+
+      store.extractTokenInfo(
+        new sharedActions.ExtractTokenInfo(fakeGetWindowData));
+
+      expect(store.getStoreState()).eql({
+        windowType: "home"
+      });
+    });
+
+    it("should set the loopToken on the conversation for old style call hashes",
+      function() {
+        fakeGetWindowData.windowPath = "#call/faketoken";
+
+        store.extractTokenInfo(
+          new sharedActions.ExtractTokenInfo(fakeGetWindowData));
+
+        sinon.assert.calledOnce(fakeConversation.set);
+        sinon.assert.calledWithExactly(fakeConversation.set, {
+          loopToken: "faketoken"
+        });
+      });
+
+    it("should set the loopToken on the conversation for new style call paths",
+      function() {
+        fakeGetWindowData.windowPath = "/c/fakecalltoken";
+
+        store.extractTokenInfo(
+          new sharedActions.ExtractTokenInfo(fakeGetWindowData));
+
+        sinon.assert.calledOnce(fakeConversation.set);
+        sinon.assert.calledWithExactly(fakeConversation.set, {
+          loopToken: "fakecalltoken"
+        });
+      });
+
+    it("should set the loopToken on the conversation for room paths",
+      function() {
+        fakeGetWindowData.windowPath = "/c/fakeroomtoken";
+
+        store.extractTokenInfo(
+          new sharedActions.ExtractTokenInfo(fakeGetWindowData));
+
+        sinon.assert.calledOnce(fakeConversation.set);
+        sinon.assert.calledWithExactly(fakeConversation.set, {
+          loopToken: "fakeroomtoken"
+        });
+      });
+
+    it("should dispatch a SetupWindowData action for old style call hashes",
+      function() {
+        fakeGetWindowData.windowPath = "#call/faketoken";
+
+        store.extractTokenInfo(
+          new sharedActions.ExtractTokenInfo(fakeGetWindowData));
+
+        sinon.assert.calledOnce(dispatcher.dispatch);
+        sinon.assert.calledWithExactly(dispatcher.dispatch,
+          new sharedActions.FetchServerData({
+            windowType: "outgoing",
+            token: "faketoken"
+          }));
+      });
+
+    it("should set the loopToken on the conversation for new style call paths",
+      function() {
+        fakeGetWindowData.windowPath = "/c/fakecalltoken";
+
+        store.extractTokenInfo(
+          new sharedActions.ExtractTokenInfo(fakeGetWindowData));
+
+        sinon.assert.calledOnce(dispatcher.dispatch);
+        sinon.assert.calledWithExactly(dispatcher.dispatch,
+          new sharedActions.FetchServerData({
+            windowType: "outgoing",
+            token: "fakecalltoken"
+          }));
+      });
+
+    it("should set the loopToken on the conversation for room paths",
+      function() {
+        fakeGetWindowData.windowPath = "/c/fakeroomtoken";
+
+        store.extractTokenInfo(
+          new sharedActions.ExtractTokenInfo(fakeGetWindowData));
+
+        sinon.assert.calledOnce(dispatcher.dispatch);
+        sinon.assert.calledWithExactly(dispatcher.dispatch,
+          new sharedActions.FetchServerData({
+            windowType: "outgoing",
+            token: "fakeroomtoken"
+          }));
+      });
+
+  });
+
+});
diff --git a/browser/components/loop/test/standalone/webapp_test.js b/browser/components/loop/test/standalone/webapp_test.js
index 5ee89fb2d09..d45476d3900 100644
--- a/browser/components/loop/test/standalone/webapp_test.js
+++ b/browser/components/loop/test/standalone/webapp_test.js
@@ -10,6 +10,7 @@ var TestUtils = React.addons.TestUtils;
 describe("loop.webapp", function() {
   "use strict";
 
+  var sharedActions = loop.shared.actions;
   var sharedModels = loop.shared.models,
       sharedViews = loop.shared.views,
       sharedUtils = loop.shared.utils,
@@ -35,13 +36,10 @@ describe("loop.webapp", function() {
   });
 
   describe("#init", function() {
-    var conversationSetStub;
-
     beforeEach(function() {
       sandbox.stub(React, "renderComponent");
       loop.config.feedbackApiUrl = "http://fake.invalid";
-      conversationSetStub =
-        sandbox.stub(sharedModels.ConversationModel.prototype, "set");
+      sandbox.stub(loop.Dispatcher.prototype, "dispatch");
     });
 
     it("should create the WebappRootView", function() {
@@ -55,33 +53,36 @@ describe("loop.webapp", function() {
       }));
     });
 
-    it("should set the loopToken on the conversation for old-style call urls",
-      function() {
-        sandbox.stub(sharedUtils.Helper.prototype,
-          "locationData").returns({
-            hash: "#call/fake-Token",
-            pathname: "/"
-          });
-
-        loop.webapp.init();
-
-        sinon.assert.called(conversationSetStub);
-        sinon.assert.calledWithExactly(conversationSetStub, {loopToken: "fake-Token"});
+    it("should dispatch a ExtractTokenInfo action with the hash", function() {
+      sandbox.stub(loop.shared.utils.Helper.prototype, "locationData").returns({
+        hash: "#call/faketoken",
+        pathname: "invalid"
       });
 
-    it("should set the loopToken on the conversation for new-style call urls",
+      loop.webapp.init();
+
+      sinon.assert.calledOnce(loop.Dispatcher.prototype.dispatch);
+      sinon.assert.calledWithExactly(loop.Dispatcher.prototype.dispatch,
+        new sharedActions.ExtractTokenInfo({
+          windowPath: "#call/faketoken"
+        }));
+    });
+
+    it("should dispatch a ExtractTokenInfo action with the path if there is no hash",
       function() {
-        sandbox.stub(sharedUtils.Helper.prototype,
-          "locationData").returns({
-            hash: "",
-            pathname: "/c/abc123-_Tes"
-          });
+        sandbox.stub(loop.shared.utils.Helper.prototype, "locationData").returns({
+          hash: "",
+          pathname: "/c/faketoken"
+        });
 
-        loop.webapp.init();
+      loop.webapp.init();
 
-        sinon.assert.called(conversationSetStub);
-        sinon.assert.calledWithExactly(conversationSetStub, {loopToken: "abc123-_Tes"});
-      });
+      sinon.assert.calledOnce(loop.Dispatcher.prototype.dispatch);
+      sinon.assert.calledWithExactly(loop.Dispatcher.prototype.dispatch,
+        new sharedActions.ExtractTokenInfo({
+          windowPath: "/c/faketoken"
+        }));
+    });
   });
 
   describe("OutgoingConversationView", function() {
@@ -544,7 +545,8 @@ describe("loop.webapp", function() {
   });
 
   describe("WebappRootView", function() {
-    var helper, sdk, conversationModel, client, props;
+    var helper, sdk, conversationModel, client, props, standaloneAppStore;
+    var dispatcher;
 
     function mountTestComponent() {
       return TestUtils.renderIntoDocument(
@@ -555,7 +557,7 @@ describe("loop.webapp", function() {
         sdk: sdk,
         conversation: conversationModel,
         feedbackApiClient: feedbackApiClient,
-        onUrlHashChange: sandbox.stub()
+        standaloneAppStore: standaloneAppStore
       }));
     }
 
@@ -570,14 +572,21 @@ describe("loop.webapp", function() {
       client = new loop.StandaloneClient({
         baseServerUrl: "fakeUrl"
       });
+      dispatcher = new loop.Dispatcher();
+      standaloneAppStore = new loop.store.StandaloneAppStore({
+        dispatcher: dispatcher,
+        sdk: sdk,
+        helper: helper,
+        conversation: conversationModel
+      });
       // Stub this to stop the StartConversationView kicking in the request and
       // follow-ups.
       sandbox.stub(client, "requestCallUrlInfo");
     });
 
-    it("should mount the unsupportedDevice view if the device is running iOS",
+    it("should display the UnsupportedDeviceView for `unsupportedDevice` window type",
       function() {
-        sandbox.stub(helper, "isIOS").returns(true);
+        standaloneAppStore.setStoreState({windowType: "unsupportedDevice"});
 
         var webappRootView = mountTestComponent();
 
@@ -585,11 +594,9 @@ describe("loop.webapp", function() {
           loop.webapp.UnsupportedDeviceView);
       });
 
-    it("should mount the unsupportedBrowser view if the sdk detects " +
-      "the browser is unsupported", function() {
-        sdk.checkSystemRequirements = function() {
-          return false;
-        };
+    it("should display the UnsupportedBrowserView for `unsupportedBrowser` window type",
+      function() {
+        standaloneAppStore.setStoreState({windowType: "unsupportedBrowser"});
 
         var webappRootView = mountTestComponent();
 
@@ -597,9 +604,9 @@ describe("loop.webapp", function() {
           loop.webapp.UnsupportedBrowserView);
       });
 
-    it("should mount the OutgoingConversationView view if there is a loopToken",
+    it("should display the OutgoingConversationView for `outgoing` window type",
       function() {
-        conversationModel.set("loopToken", "fakeToken");
+        standaloneAppStore.setStoreState({windowType: "outgoing"});
 
         var webappRootView = mountTestComponent();
 
@@ -607,7 +614,19 @@ describe("loop.webapp", function() {
           loop.webapp.OutgoingConversationView);
       });
 
-    it("should mount the Home view there is no loopToken", function() {
+    it("should display the StandaloneRoomView for `room` window type",
+      function() {
+        standaloneAppStore.setStoreState({windowType: "room"});
+
+        var webappRootView = mountTestComponent();
+
+        TestUtils.findRenderedComponentWithType(webappRootView,
+          loop.standaloneRoomViews.StandaloneRoomView);
+      });
+
+    it("should display the HomeView for `home` window type", function() {
+        standaloneAppStore.setStoreState({windowType: "home"});
+
         var webappRootView = mountTestComponent();
 
         TestUtils.findRenderedComponentWithType(webappRootView,

From 3ad9de5f1e33b823e8764d1cb29cf23cda66e008 Mon Sep 17 00:00:00 2001
From: Mike Conley <mconley@mozilla.com>
Date: Wed, 5 Nov 2014 10:22:24 -0500
Subject: [PATCH 139/153] Bug 1085622 - Follow-up: failed to ifdef an extra
 call to gRemoteTabsUI.init(). r=trivial.

---
 browser/base/content/browser.js | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index 2a3e68a835f..c10af3b1ff4 100644
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -1618,7 +1618,9 @@ var gBrowserInit = {
     gSyncUI.init();
 #endif
 
+#ifdef E10S_TESTING_ONLY
     gRemoteTabsUI.init();
+#endif
   },
 
   nonBrowserWindowShutdown: function() {

From c261255d96ba9268f4c96a1e527768f0d94e581c Mon Sep 17 00:00:00 2001
From: Gijs Kruitbosch <gijskruitbosch@gmail.com>
Date: Wed, 5 Nov 2014 16:18:39 +0000
Subject: [PATCH 140/153] Bug 1080801 - update more test disabling comments,
 rs=comments-only DONTBUILD because only comments change

--HG--
extra : rebase_source : d07e98fd864e9dd9f52797dc9c1cd0ed5753f625
---
 browser/base/content/test/general/browser.ini | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/browser/base/content/test/general/browser.ini b/browser/base/content/test/general/browser.ini
index b91b801a6ca..bb358c9745c 100644
--- a/browser/base/content/test/general/browser.ini
+++ b/browser/base/content/test/general/browser.ini
@@ -128,7 +128,7 @@ skip-if = e10s # Bug ????? - no e10s switch-to-tab support yet
 skip-if = os != "win" || e10s # The Fitts Law back button is only supported on Windows (bug 571454) / e10s - Bug ?????? test touches content (attempts to add an event listener directly to the contentWindow)
 [browser_blob-channelname.js]
 [browser_bookmark_titles.js]
-skip-if = buildapp == 'mulet' || toolkit == "windows" || e10s # Disabled on Windows due to frequent failures (bugs 825739, 841341) / e10s - Bug ?????? test checks event.target on load event, which our e10s utils don't support
+skip-if = buildapp == 'mulet' || toolkit == "windows" || e10s # Disabled on Windows due to frequent failures (bugs 825739, 841341) / e10s - Bug 1094205 - places doesn't return the right thing in e10s mode, for some reason
 [browser_bug304198.js]
 skip-if = e10s
 [browser_bug321000.js]
@@ -339,13 +339,13 @@ skip-if = e10s # Bug ?????? - this test fails for obscure reasons on non-windows
 [browser_keywordBookmarklets.js]
 skip-if = e10s # Bug ?????? - this test fails for obscure reasons on non-windows builds only.
 [browser_keywordSearch.js]
-skip-if = e10s # Bug 921957 - remote webprogress doesn't supply originalURI attribute on the request object
+skip-if = e10s # Bug 921957 - remote webprogress doesn't supply cancel method on the request object
 [browser_keywordSearch_postData.js]
 skip-if = e10s # Bug ?????? - test directly manipulates content (gBrowser.contentDocument.body.textContent)
 [browser_lastAccessedTab.js]
 skip-if = toolkit == "windows" # Disabled on Windows due to frequent failures (bug 969405)
 [browser_locationBarCommand.js]
-skip-if = os == "linux" || e10s # Linux: Intermittent failures, bug 917535; e10s: Bug ?????? - Focus issues (There should be no focused element - Got [object XULElement], expected null)
+skip-if = os == "linux" || e10s # Linux: Intermittent failures, bug 917535; e10s: Bug 1094252 - Focus issues (There should be no focused element - Got [object XULElement], expected null)
 [browser_locationBarExternalLoad.js]
 skip-if = e10s
 [browser_menuButtonFitts.js]
@@ -464,7 +464,7 @@ skip-if = e10s # Bug 1093941 - test calls gBrowser.contentWindow.stop
 [browser_urlbar_search_healthreport.js]
 [browser_utilityOverlay.js]
 [browser_visibleFindSelection.js]
-skip-if = e10s # Bug ?????? - test directly manipulates content
+skip-if = e10s # Bug 921935 - focusmanager issues with e10s (test calls waitForFocus)
 [browser_visibleLabel.js]
 [browser_visibleTabs.js]
 [browser_visibleTabs_bookmarkAllPages.js]
@@ -479,7 +479,7 @@ skip-if = buildapp == 'mulet'
 [browser_wyciwyg_urlbarCopying.js]
 skip-if = e10s # Bug ?????? - test directly manipulates content (content.document.getElementById)
 [browser_zbug569342.js]
-skip-if = e10s # Bug 516755 - SessionStore disabled for e10s
+skip-if = e10s # Bug 1094240 - has findbar-related failures
 [browser_registerProtocolHandler_notification.js]
 skip-if = e10s # Bug 940206 - nsIWebContentHandlerRegistrar::registerProtocolHandler doesn't work in e10s
 [browser_no_mcb_on_http_site.js]

From 1be87a6e1425df289a08833e95cce1260130b12d Mon Sep 17 00:00:00 2001
From: Gijs Kruitbosch <gijskruitbosch@gmail.com>
Date: Mon, 3 Nov 2014 10:44:47 +0000
Subject: [PATCH 141/153] Bug 1090609 - don't disable open in tabs when there's
 only one item there, r=mak

---
 browser/components/places/content/controller.js          | 2 +-
 browser/components/places/content/sidebarUtils.js        | 2 +-
 toolkit/components/places/PlacesUtils.jsm                | 9 +++------
 .../tests/unit/test_utils_getURLsForContainerNode.js     | 1 -
 4 files changed, 5 insertions(+), 9 deletions(-)

diff --git a/browser/components/places/content/controller.js b/browser/components/places/content/controller.js
index 6d76e54f8f4..b43ead0b54a 100644
--- a/browser/components/places/content/controller.js
+++ b/browser/components/places/content/controller.js
@@ -636,7 +636,7 @@ PlacesController.prototype = {
       if (!openContainerInTabsItem.hidden) {
         var containerToUse = this._view.selectedNode || this._view.result.root;
         if (PlacesUtils.nodeIsContainer(containerToUse)) {
-          if (!PlacesUtils.hasChildURIs(containerToUse, true)) {
+          if (!PlacesUtils.hasChildURIs(containerToUse)) {
             openContainerInTabsItem.disabled = true;
             // Ensure that we don't display the menu if nothing is enabled:
             usableItemCount--;
diff --git a/browser/components/places/content/sidebarUtils.js b/browser/components/places/content/sidebarUtils.js
index 3f3ce23e22e..9be8919a10f 100644
--- a/browser/components/places/content/sidebarUtils.js
+++ b/browser/components/places/content/sidebarUtils.js
@@ -40,7 +40,7 @@ var SidebarUtils = {
     var openInTabs = isContainer &&
                      (aEvent.button == 1 ||
                       (aEvent.button == 0 && modifKey)) &&
-                     PlacesUtils.hasChildURIs(tbo.view.nodeForTreeIndex(cell.row), true);
+                     PlacesUtils.hasChildURIs(tbo.view.nodeForTreeIndex(cell.row));
 
     if (aEvent.button == 0 && isContainer && !openInTabs) {
       tbo.view.toggleOpenState(cell.row);
diff --git a/toolkit/components/places/PlacesUtils.jsm b/toolkit/components/places/PlacesUtils.jsm
index 95f585645c5..7ec5b61369c 100644
--- a/toolkit/components/places/PlacesUtils.jsm
+++ b/toolkit/components/places/PlacesUtils.jsm
@@ -956,7 +956,7 @@ this.PlacesUtils = {
    *        The container node to search through.
    * @returns true if the node contains uri nodes, false otherwise.
    */
-  hasChildURIs: function PU_hasChildURIs(aNode, aMultiple=false) {
+  hasChildURIs: function PU_hasChildURIs(aNode) {
     if (!this.nodeIsContainer(aNode))
       return false;
 
@@ -972,14 +972,11 @@ this.PlacesUtils = {
       root.containerOpen = true;
     }
 
-    let foundFirst = !aMultiple;
     let found = false;
     for (let i = 0; i < root.childCount && !found; i++) {
       let child = root.getChild(i);
-      if (this.nodeIsURI(child)) {
-        found = foundFirst;
-        foundFirst = true;
-      }
+      if (this.nodeIsURI(child))
+        found = true;
     }
 
     if (!wasOpen) {
diff --git a/toolkit/components/places/tests/unit/test_utils_getURLsForContainerNode.js b/toolkit/components/places/tests/unit/test_utils_getURLsForContainerNode.js
index f602f602ad1..2581ffaf6ad 100644
--- a/toolkit/components/places/tests/unit/test_utils_getURLsForContainerNode.js
+++ b/toolkit/components/places/tests/unit/test_utils_getURLsForContainerNode.js
@@ -165,7 +165,6 @@ function check_uri_nodes(aQuery, aOptions, aExpectedURINodes) {
   root.containerOpen = true;
   var node = root.getChild(0);
   do_check_eq(PU.hasChildURIs(node), aExpectedURINodes > 0);
-  do_check_eq(PU.hasChildURIs(node, true), aExpectedURINodes > 1);
   do_check_eq(PU.getURLsForContainerNode(node).length, aExpectedURINodes);
   root.containerOpen = false;
 }

From 774adccd1e801f8bccc50d89c063f917c763e46c Mon Sep 17 00:00:00 2001
From: Emanuel Hoogeveen <emanuel.hoogeveen@gmail.com>
Date: Tue, 4 Nov 2014 07:35:00 +0100
Subject: [PATCH 142/153] Bug 1084651 - Part 6: Rename SliceBudget::reset to
 the less misleading makeUnlimited. r=billm

---
 js/public/SliceBudget.h |  2 +-
 js/src/jsgc.cpp         | 22 +++++++++++-----------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/js/public/SliceBudget.h b/js/public/SliceBudget.h
index c45fdf02085..22e260fd04e 100644
--- a/js/public/SliceBudget.h
+++ b/js/public/SliceBudget.h
@@ -49,7 +49,7 @@ struct JS_PUBLIC_API(SliceBudget)
     /* Instantiate as SliceBudget(WorkBudget(n)). */
     explicit SliceBudget(WorkBudget work);
 
-    void reset() {
+    void makeUnlimited() {
         deadline = unlimitedDeadline;
         counter = unlimitedStartCounter;
     }
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index d4d98806a4a..551e9509e57 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -2932,13 +2932,13 @@ GCRuntime::refillFreeListInGC(Zone *zone, AllocKind thingKind)
 
 SliceBudget::SliceBudget()
 {
-    reset();
+    makeUnlimited();
 }
 
 SliceBudget::SliceBudget(TimeBudget time)
 {
     if (time.budget < 0) {
-        reset();
+        makeUnlimited();
     } else {
         // Note: TimeBudget(0) is equivalent to WorkBudget(CounterReset).
         deadline = PRMJ_Now() + time.budget * PRMJ_USEC_PER_MSEC;
@@ -2949,7 +2949,7 @@ SliceBudget::SliceBudget(TimeBudget time)
 SliceBudget::SliceBudget(WorkBudget work)
 {
     if (work.budget < 0) {
-        reset();
+        makeUnlimited();
     } else {
         deadline = 0;
         counter = work.budget;
@@ -5663,7 +5663,7 @@ GCRuntime::incrementalCollectSlice(SliceBudget &budget, JS::gcreason::Reason rea
          * Yields between slices occurs at predetermined points in these modes;
          * the budget is not used.
          */
-        budget.reset();
+        budget.makeUnlimited();
     }
 
     if (incrementalState == NO_INCREMENTAL) {
@@ -5695,7 +5695,7 @@ GCRuntime::incrementalCollectSlice(SliceBudget &budget, JS::gcreason::Reason rea
       case MARK: {
         /* If we needed delayed marking for gray roots, then collect until done. */
         if (!marker.hasBufferedGrayRoots()) {
-            budget.reset();
+            budget.makeUnlimited();
             isIncremental = false;
         }
 
@@ -5785,27 +5785,27 @@ GCRuntime::budgetIncrementalGC(SliceBudget &budget)
     IncrementalSafety safe = IsIncrementalGCSafe(rt);
     if (!safe) {
         resetIncrementalGC(safe.reason());
-        budget.reset();
+        budget.makeUnlimited();
         stats.nonincremental(safe.reason());
         return;
     }
 
     if (mode != JSGC_MODE_INCREMENTAL) {
         resetIncrementalGC("GC mode change");
-        budget.reset();
+        budget.makeUnlimited();
         stats.nonincremental("GC mode");
         return;
     }
 
     if (isTooMuchMalloc()) {
-        budget.reset();
+        budget.makeUnlimited();
         stats.nonincremental("malloc bytes trigger");
     }
 
     bool reset = false;
     for (ZonesIter zone(rt, WithAtoms); !zone.done(); zone.next()) {
         if (zone->usage.gcBytes() >= zone->threshold.gcTriggerBytes()) {
-            budget.reset();
+            budget.makeUnlimited();
             stats.nonincremental("allocation trigger");
         }
 
@@ -5816,7 +5816,7 @@ GCRuntime::budgetIncrementalGC(SliceBudget &budget)
         }
 
         if (zone->isTooMuchMalloc()) {
-            budget.reset();
+            budget.makeUnlimited();
             stats.nonincremental("malloc bytes trigger");
         }
     }
@@ -5916,7 +5916,7 @@ GCRuntime::gcCycle(bool incremental, SliceBudget &budget, JSGCInvocationKind gck
             resetIncrementalGC("requested");
 
         stats.nonincremental("requested");
-        budget.reset();
+        budget.makeUnlimited();
     } else {
         budgetIncrementalGC(budget);
     }

From ead95fdc75639fbe217bb0c0359f22e120d73df6 Mon Sep 17 00:00:00 2001
From: Gabor Krizsanits <gkrizsanits@mozilla.com>
Date: Wed, 5 Nov 2014 14:01:51 +0100
Subject: [PATCH 143/153] Bug 1093028 - Imports should block DOMContentLoaded
 of the parent. r=mrbkap

---
 dom/base/ImportManager.cpp                    |  4 +++
 .../file_blocking_DOMContentLoaded_A.html     | 11 ++++++
 .../file_blocking_DOMContentLoaded_B.html     | 11 ++++++
 .../file_blocking_DOMContentLoaded_C.html     | 11 ++++++
 .../file_blocking_DOMContentLoaded_D.html     | 10 ++++++
 dom/html/test/imports/mochitest.ini           |  6 ++++
 .../test_blocking_DOMContentLoaded.html       | 36 +++++++++++++++++++
 7 files changed, 89 insertions(+)
 create mode 100644 dom/html/test/imports/file_blocking_DOMContentLoaded_A.html
 create mode 100644 dom/html/test/imports/file_blocking_DOMContentLoaded_B.html
 create mode 100644 dom/html/test/imports/file_blocking_DOMContentLoaded_C.html
 create mode 100644 dom/html/test/imports/file_blocking_DOMContentLoaded_D.html
 create mode 100644 dom/html/test/imports/test_blocking_DOMContentLoaded.html

diff --git a/dom/base/ImportManager.cpp b/dom/base/ImportManager.cpp
index 918bae5184a..f322a903110 100644
--- a/dom/base/ImportManager.cpp
+++ b/dom/base/ImportManager.cpp
@@ -149,6 +149,7 @@ ImportLoader::Updater::UpdateMainReferrer(uint32_t aNewIdx)
     // Our import parent is changed, let's block the new one and later unblock
     // the old one.
     newMainReferrer->OwnerDoc()->ScriptLoader()->AddExecuteBlocker();
+    newMainReferrer->OwnerDoc()->BlockDOMContentLoaded();
   }
 
   if (mLoader->mDocument) {
@@ -168,6 +169,7 @@ ImportLoader::Updater::UpdateMainReferrer(uint32_t aNewIdx)
 
   if (mLoader->IsBlocking()) {
     mLoader->mImportParent->ScriptLoader()->RemoveExecuteBlocker();
+    mLoader->mImportParent->UnblockDOMContentLoaded();
   }
 
   // Finally update mMainReferrer to point to the newly added link.
@@ -300,6 +302,7 @@ ImportLoader::BlockScripts()
 {
   MOZ_ASSERT(!mBlockingScripts);
   mImportParent->ScriptLoader()->AddExecuteBlocker();
+  mImportParent->BlockDOMContentLoaded();
   mBlockingScripts = true;
 }
 
@@ -308,6 +311,7 @@ ImportLoader::UnblockScripts()
 {
   MOZ_ASSERT(mBlockingScripts);
   mImportParent->ScriptLoader()->RemoveExecuteBlocker();
+  mImportParent->UnblockDOMContentLoaded();
   for (uint32_t i = 0; i < mBlockedScriptLoaders.Length(); i++) {
     mBlockedScriptLoaders[i]->RemoveExecuteBlocker();
   }
diff --git a/dom/html/test/imports/file_blocking_DOMContentLoaded_A.html b/dom/html/test/imports/file_blocking_DOMContentLoaded_A.html
new file mode 100644
index 00000000000..2a18604ed10
--- /dev/null
+++ b/dom/html/test/imports/file_blocking_DOMContentLoaded_A.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html lang="en-US">
+<head>
+  <script>
+    order.push("AS0");
+  </script>
+  <link rel="import" href="file_blocking_DOMContentLoaded_B.html" onload="loaded()" onerror="failed()"></link>
+</head>
+<body>
+</body>
+</html>
diff --git a/dom/html/test/imports/file_blocking_DOMContentLoaded_B.html b/dom/html/test/imports/file_blocking_DOMContentLoaded_B.html
new file mode 100644
index 00000000000..a69a38d168b
--- /dev/null
+++ b/dom/html/test/imports/file_blocking_DOMContentLoaded_B.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html lang="en-US">
+<head>
+  <script>
+    order.push("BS0");
+  </script>
+  <link rel="import" href="file_blocking_DOMContentLoaded_C.html" onload="loaded()" onerror="failed()"></link>
+</head>
+<body>
+</body>
+</html>
diff --git a/dom/html/test/imports/file_blocking_DOMContentLoaded_C.html b/dom/html/test/imports/file_blocking_DOMContentLoaded_C.html
new file mode 100644
index 00000000000..76719b1b23e
--- /dev/null
+++ b/dom/html/test/imports/file_blocking_DOMContentLoaded_C.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html lang="en-US">
+<head>
+  <script>
+    order.push("CS0");
+  </script>
+  <link rel="import" href="file_blocking_DOMContentLoaded_D.html" onload="loaded()" onerror="failed()"></link>
+</head>
+<body>
+</body>
+</html>
diff --git a/dom/html/test/imports/file_blocking_DOMContentLoaded_D.html b/dom/html/test/imports/file_blocking_DOMContentLoaded_D.html
new file mode 100644
index 00000000000..0ae10e702b2
--- /dev/null
+++ b/dom/html/test/imports/file_blocking_DOMContentLoaded_D.html
@@ -0,0 +1,10 @@
+<!DOCTYPE html>
+<html lang="en-US">
+<head>
+  <script>
+    order.push("DS0");
+  </script>
+</head>
+<body>
+</body>
+</html>
diff --git a/dom/html/test/imports/mochitest.ini b/dom/html/test/imports/mochitest.ini
index 10f8ce54594..f37fd344a45 100644
--- a/dom/html/test/imports/mochitest.ini
+++ b/dom/html/test/imports/mochitest.ini
@@ -33,6 +33,10 @@ support-files =
   file_cycle_4_E.html
   file_encoding.html
   file_simple_import.html
+  file_blocking_DOMContentLoaded_A.html
+  file_blocking_DOMContentLoaded_B.html
+  file_blocking_DOMContentLoaded_C.html
+  file_blocking_DOMContentLoaded_D.html
 
 [test_cycle_1.html]
 skip-if = toolkit == 'gonk' # nested imports fail on b2g emulator
@@ -42,5 +46,7 @@ skip-if = toolkit == 'gonk' # nested imports fail on b2g emulator
 skip-if = toolkit == 'gonk' # nested imports fail on b2g emulator
 [test_cycle_4.html]
 skip-if = toolkit == 'gonk' # nested imports fail on b2g emulator
+[test_blocking_DOMContentLoaded.html]
+skip-if = toolkit == 'gonk' # nested imports fail on b2g emulator
 [test_encoding.html]
 [test_defaultView.html]
diff --git a/dom/html/test/imports/test_blocking_DOMContentLoaded.html b/dom/html/test/imports/test_blocking_DOMContentLoaded.html
new file mode 100644
index 00000000000..9fa32e5cab0
--- /dev/null
+++ b/dom/html/test/imports/test_blocking_DOMContentLoaded.html
@@ -0,0 +1,36 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=1093028
+-->
+<head>
+  <title>Test for Bug 1093028</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+  <meta http-equiv="Content-Type" content="text/html;charset=utf-8">
+</head>
+<body>
+  <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1093028">Mozilla Bug 1093028</a>
+  <script type="text/javascript">
+    SimpleTest.waitForExplicitFinish();
+    var counter = 0;
+    var fcounter = 0;
+    var order = [];
+    function loaded() {
+      counter++;
+    }
+    function failed() {
+      fcounter++;
+    }
+  </script>
+  <link rel="import" href="file_blocking_DOMContentLoaded_A.html" onload="loaded()" onerror="failed()"></link>
+  <script type="text/javascript">
+    is(counter, 4, "Imports are loaded");
+    is(fcounter, 0, "No error in imports");
+    var expected = ["AS0","BS0","CS0","DS0"];
+    for (i in expected)
+      is(order[i], expected[i], "import " + i + " should be " + expected[i]);
+    SimpleTest.finish();
+  </script>
+</body>
+</html>

From 725e52000a78394cd7c369ee26de2c9cf26172cf Mon Sep 17 00:00:00 2001
From: "Carsten \"Tomcat\" Book" <cbook@mozilla.com>
Date: Wed, 5 Nov 2014 14:03:58 +0100
Subject: [PATCH 144/153] Backed out changeset 2e9f81c5d00c (bug 1052839) for
 ggc bustage

---
 js/src/builtin/String.js              | 120 ---------------
 js/src/builtin/Utilities.js           |   1 -
 js/src/jit/CodeGenerator.cpp          | 104 -------------
 js/src/jit/CodeGenerator.h            |   1 -
 js/src/jit/IonBuilder.h               |   1 -
 js/src/jit/LIR-Common.h               |  30 ----
 js/src/jit/LOpcodes.h                 |   1 -
 js/src/jit/Lowering.cpp               |  10 --
 js/src/jit/Lowering.h                 |   1 -
 js/src/jit/MCallOptimize.cpp          |  34 -----
 js/src/jit/MIR.h                      |  41 -----
 js/src/jit/MOpcodes.h                 |   1 -
 js/src/jit/ParallelSafetyAnalysis.cpp |   1 -
 js/src/jscntxt.h                      |   1 -
 js/src/jsstr.cpp                      | 211 +++++++++++++++++++++++---
 js/src/jsstr.h                        |  11 +-
 js/src/vm/SelfHosting.cpp             |  22 +--
 js/src/vm/String.h                    |   3 -
 18 files changed, 192 insertions(+), 402 deletions(-)

diff --git a/js/src/builtin/String.js b/js/src/builtin/String.js
index c8fa7bbc796..577be1132b7 100644
--- a/js/src/builtin/String.js
+++ b/js/src/builtin/String.js
@@ -4,126 +4,6 @@
 
 /*global intl_Collator: false, */
 
-/* ES6 Draft Oct 14, 2014 21.1.3.19 */
-function String_substring(start, end) {
-    // Steps 1-3.
-    CheckObjectCoercible(this);
-    var str = ToString(this);
-
-    // Step 4.
-    var len = str.length;
-
-    // Step 5.
-    var intStart = ToInteger(start);
-
-    // Step 6.
-    var intEnd = (end === undefined) ? len : ToInteger(end);
-
-    // Step 7.
-    var finalStart = std_Math_min(std_Math_max(intStart, 0), len);
-
-    // Step 8.
-    var finalEnd = std_Math_min(std_Math_max(intEnd, 0), len);
-
-    // Steps 9-10.
-    var from, to;
-    if (finalStart < finalEnd) {
-        from = finalStart;
-        to = finalEnd;
-    } else {
-        from = finalEnd;
-        to = finalStart;
-    }
-
-    // Step 11.
-    // While |from| and |to - from| are bounded to the length of |str| and this
-    // and thus definitely in the int32 range, they can still be typed as
-    // double. Eagerly truncate since SubstringKernel only accepts int32.
-    return SubstringKernel(str, from | 0, (to - from) | 0);
-}
-
-function String_static_substring(string, start, end) {
-    if (arguments.length < 1)
-        ThrowError(JSMSG_MISSING_FUN_ARG, 0, 'String.substring');
-    return callFunction(String_substring, string, start, end);
-}
-
-/* ES6 Draft Oct 14, 2014 B.2.3.1 */
-function String_substr(start, length) {
-    // Steps 1-2.
-    CheckObjectCoercible(this);
-    var str = ToString(this);
-
-    // Steps 3-4.
-    var intStart = ToInteger(start);
-
-    // Steps 5-7.
-    var size = str.length;
-    // Use |size| instead of +Infinity to avoid performing calculations with
-    // doubles. (The result is the same either way.)
-    var end = (length === undefined) ? size : ToInteger(length);
-
-    // Step 8.
-    if (intStart < 0)
-        intStart = std_Math_max(intStart + size, 0);
-
-    // Step 9.
-    var resultLength = std_Math_min(std_Math_max(end, 0), size - intStart)
-
-    // Step 10.
-    if (resultLength <= 0)
-        return "";
-
-    // Step 11.
-    // While |intStart| and |resultLength| are bounded to the length of |str|
-    // and thus definitely in the int32 range, they can still be typed as
-    // double. Eagerly truncate since SubstringKernel only accepts int32.
-    return SubstringKernel(str, intStart | 0, resultLength | 0);
-}
-
-function String_static_substr(string, start, length) {
-    if (arguments.length < 1)
-        ThrowError(JSMSG_MISSING_FUN_ARG, 0, 'String.substr');
-    return callFunction(String_substr, string, start, length);
-}
-
-/* ES6 Draft Oct 14, 2014 21.1.3.16 */
-function String_slice(start, end) {
-    // Steps 1-3.
-    CheckObjectCoercible(this);
-    var str = ToString(this);
-
-    // Step 4.
-    var len = str.length;
-
-    // Step 5.
-    var intStart = ToInteger(start);
-
-    // Step 6.
-    var intEnd = (end === undefined) ? len : ToInteger(end);
-
-    // Step 7.
-    var from = (intStart < 0) ? std_Math_max(len + intStart, 0) : std_Math_min(intStart, len);
-
-    // Step 8.
-    var to = (intEnd < 0) ? std_Math_max(len + intEnd, 0) : std_Math_min(intEnd, len);
-
-    // Step 9.
-    var span = std_Math_max(to - from, 0);
-
-    // Step 10.
-    // While |from| and |span| are bounded to the length of |str|
-    // and thus definitely in the int32 range, they can still be typed as
-    // double. Eagerly truncate since SubstringKernel only accepts int32.
-    return SubstringKernel(str, from | 0, span | 0);
-}
-
-function String_static_slice(string, start, end) {
-    if (arguments.length < 1)
-        ThrowError(JSMSG_MISSING_FUN_ARG, 0, 'String.slice');
-    return callFunction(String_slice, string, start, end);
-}
-
 /* ES6 Draft September 5, 2013 21.1.3.3 */
 function String_codePointAt(pos) {
     // Steps 1-3.
diff --git a/js/src/builtin/Utilities.js b/js/src/builtin/Utilities.js
index bd1c36ace1d..8425c12801e 100644
--- a/js/src/builtin/Utilities.js
+++ b/js/src/builtin/Utilities.js
@@ -32,7 +32,6 @@
 // The few items below here are either self-hosted or installing them under a
 // std_Foo name would require ugly contortions, so they just get aliased here.
 var std_Array_indexOf = ArrayIndexOf;
-var std_String_substring = String_substring;
 // WeakMap is a bare constructor without properties or methods.
 var std_WeakMap = WeakMap;
 // StopIteration is a bare constructor without properties or methods.
diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
index 0b67a45152a..9063cde0a1f 100644
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@@ -6011,110 +6011,6 @@ ConcatFatInlineString(MacroAssembler &masm, Register lhs, Register rhs, Register
     masm.ret();
 }
 
-typedef JSString *(*SubstringKernelFn)(JSContext *cx, HandleString str, int32_t begin, int32_t len);
-static const VMFunction SubstringKernelInfo =
-    FunctionInfo<SubstringKernelFn>(SubstringKernel);
-
-bool CodeGenerator::visitSubstr(LSubstr *lir)
-{
-    Register string = ToRegister(lir->string());
-    Register begin = ToRegister(lir->begin());
-    Register length = ToRegister(lir->length());
-    Register output = ToRegister(lir->output());
-    Register temp = ToRegister(lir->temp());
-    Address stringFlags(string, JSString::offsetOfFlags());
-
-    Label isLatin1, notInline, nonZero, isInlinedLatin1;
-
-    // For every edge case use the C++ variant.
-    // Note: we also use this upon allocation failure in newGCString and
-    // newGCFatInlineString. To squeeze out even more performance those failures
-    // can be handled by allocate in ool code and returning to jit code to fill
-    // in all data.
-    OutOfLineCode *ool = oolCallVM(SubstringKernelInfo, lir,
-                                   (ArgList(), string, begin, length),
-                                    StoreRegisterTo(output));
-    if (!ool)
-        return false;
-    Label *slowPath = ool->entry();
-    Label *done = ool->rejoin();
-
-    // Zero length, return emptystring.
-    masm.branchTest32(Assembler::NonZero, length, length, &nonZero);
-    const JSAtomState &names = GetIonContext()->runtime->names();
-    masm.movePtr(ImmGCPtr(names.empty), output);
-    masm.jump(done);
-
-    // Use slow path for ropes.
-    masm.bind(&nonZero);
-    static_assert(JSString::ROPE_FLAGS == 0,
-                  "rope flags must be zero for (flags & TYPE_FLAGS_MASK) == 0 "
-                  "to be a valid is-rope check");
-    masm.branchTest32(Assembler::Zero, stringFlags, Imm32(JSString::TYPE_FLAGS_MASK), slowPath);
-
-    // Handle inlined strings by creating a FatInlineString.
-    masm.branchTest32(Assembler::Zero, stringFlags, Imm32(JSString::INLINE_CHARS_BIT), &notInline);
-    masm.newGCFatInlineString(output, temp, slowPath);
-    masm.store32(length, Address(output, JSString::offsetOfLength()));
-    Address stringStorage(string, JSInlineString::offsetOfInlineStorage());
-    Address outputStorage(output, JSInlineString::offsetOfInlineStorage());
-
-    masm.branchTest32(Assembler::NonZero, stringFlags, Imm32(JSString::LATIN1_CHARS_BIT),
-                      &isInlinedLatin1);
-    {
-        masm.store32(Imm32(JSString::INIT_FAT_INLINE_FLAGS),
-                     Address(output, JSString::offsetOfFlags()));
-        masm.computeEffectiveAddress(stringStorage, temp);
-        BaseIndex chars(temp, begin, ScaleFromElemWidth(sizeof(char16_t)));
-        masm.computeEffectiveAddress(chars, begin);
-        masm.computeEffectiveAddress(outputStorage, temp);
-        CopyStringChars(masm, temp, begin, length, string, sizeof(char16_t), sizeof(char16_t));
-        masm.store16(Imm32(0), Address(temp, 0));
-        masm.jump(done);
-    }
-    masm.bind(&isInlinedLatin1);
-    {
-        masm.store32(Imm32(JSString::INIT_FAT_INLINE_FLAGS | JSString::LATIN1_CHARS_BIT),
-                     Address(output, JSString::offsetOfFlags()));
-        masm.computeEffectiveAddress(stringStorage, temp);
-        static_assert(sizeof(char) == 1, "begin index shouldn't need scaling");
-        masm.addPtr(temp, begin);
-        masm.computeEffectiveAddress(outputStorage, temp);
-        CopyStringChars(masm, temp, begin, length, string, sizeof(char), sizeof(char));
-        masm.store8(Imm32(0), Address(temp, 0));
-        masm.jump(done);
-    }
-
-    // Handle other cases with a DependentString.
-    masm.bind(&notInline);
-    masm.newGCString(output, temp, slowPath);
-    masm.store32(length, Address(output, JSString::offsetOfLength()));
-    masm.storePtr(string, Address(output, JSDependentString::offsetOfBase()));
-
-    masm.branchTest32(Assembler::NonZero, stringFlags, Imm32(JSString::LATIN1_CHARS_BIT), &isLatin1);
-    {
-        masm.store32(Imm32(JSString::DEPENDENT_FLAGS), Address(output, JSString::offsetOfFlags()));
-        masm.loadPtr(Address(string, JSString::offsetOfNonInlineChars()), temp);
-        BaseIndex chars(temp, begin, ScaleFromElemWidth(sizeof(char16_t)));
-        masm.computeEffectiveAddress(chars, temp);
-        masm.storePtr(temp, Address(output, JSString::offsetOfNonInlineChars()));
-        masm.jump(done);
-    }
-    masm.bind(&isLatin1);
-    {
-        masm.store32(Imm32(JSString::DEPENDENT_FLAGS | JSString::LATIN1_CHARS_BIT),
-                     Address(output, JSString::offsetOfFlags()));
-        masm.loadPtr(Address(string, JSString::offsetOfNonInlineChars()), temp);
-        static_assert(sizeof(char) == 1, "begin index shouldn't need scaling");
-        masm.addPtr(begin, temp);
-        masm.storePtr(temp, Address(output, JSString::offsetOfNonInlineChars()));
-        masm.jump(done);
-    }
-
-    masm.bind(done);
-    return true;
-}
-
 JitCode *
 JitCompartment::generateStringConcatStub(JSContext *cx, ExecutionMode mode)
 {
diff --git a/js/src/jit/CodeGenerator.h b/js/src/jit/CodeGenerator.h
index feaab4cd889..5b795f94dce 100644
--- a/js/src/jit/CodeGenerator.h
+++ b/js/src/jit/CodeGenerator.h
@@ -188,7 +188,6 @@ class CodeGenerator : public CodeGeneratorSpecific
     bool visitTypedObjectProto(LTypedObjectProto *ins);
     bool visitTypedObjectUnsizedLength(LTypedObjectUnsizedLength *ins);
     bool visitStringLength(LStringLength *lir);
-    bool visitSubstr(LSubstr *lir);
     bool visitInitializedLength(LInitializedLength *lir);
     bool visitSetInitializedLength(LSetInitializedLength *lir);
     bool visitNotO(LNotO *ins);
diff --git a/js/src/jit/IonBuilder.h b/js/src/jit/IonBuilder.h
index 287684ddb98..fb7809dc106 100644
--- a/js/src/jit/IonBuilder.h
+++ b/js/src/jit/IonBuilder.h
@@ -781,7 +781,6 @@ class IonBuilder
                                   const Class *clasp3 = nullptr,
                                   const Class *clasp4 = nullptr);
     InliningStatus inlineIsConstructing(CallInfo &callInfo);
-    InliningStatus inlineSubstringKernel(CallInfo &callInfo);
 
     // Testing functions.
     InliningStatus inlineForceSequentialOrInParallelSection(CallInfo &callInfo);
diff --git a/js/src/jit/LIR-Common.h b/js/src/jit/LIR-Common.h
index 42286a11f27..4f274aec69f 100644
--- a/js/src/jit/LIR-Common.h
+++ b/js/src/jit/LIR-Common.h
@@ -3410,36 +3410,6 @@ class LStringSplit : public LCallInstructionHelper<1, 2, 0>
     }
 };
 
-class LSubstr : public LInstructionHelper<1, 3, 1>
-{
-  public:
-    LIR_HEADER(Substr)
-
-    LSubstr(const LAllocation &string, const LAllocation &begin, const LAllocation &length,
-            const LDefinition &temp)
-    {
-        setOperand(0, string);
-        setOperand(1, begin);
-        setOperand(2, length);
-        setTemp(0, temp);
-    }
-    const LAllocation *string() {
-        return getOperand(0);
-    }
-    const LAllocation *begin() {
-        return getOperand(1);
-    }
-    const LAllocation *length() {
-        return getOperand(2);
-    }
-    const LDefinition *temp() {
-        return getTemp(0);
-    }
-    const MStringSplit *mir() const {
-        return mir_->toStringSplit();
-    }
-};
-
 // Convert a 32-bit integer to a double.
 class LInt32ToDouble : public LInstructionHelper<1, 1, 0>
 {
diff --git a/js/src/jit/LOpcodes.h b/js/src/jit/LOpcodes.h
index 787ed80b215..2ae291e39fb 100644
--- a/js/src/jit/LOpcodes.h
+++ b/js/src/jit/LOpcodes.h
@@ -187,7 +187,6 @@
     _(RegExpTest)                   \
     _(RegExpReplace)                \
     _(StringReplace)                \
-    _(Substr)                       \
     _(Lambda)                       \
     _(LambdaArrow)                  \
     _(LambdaForSingleton)           \
diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
index 6787bfb23f0..cee7aeca01a 100644
--- a/js/src/jit/Lowering.cpp
+++ b/js/src/jit/Lowering.cpp
@@ -2171,16 +2171,6 @@ LIRGenerator::visitStringReplace(MStringReplace *ins)
     return defineReturn(lir, ins) && assignSafepoint(lir, ins);
 }
 
-bool
-LIRGenerator::visitSubstr(MSubstr *ins)
-{
-    LSubstr *lir = new (alloc()) LSubstr(useFixed(ins->string(), CallTempReg1),
-                                         useRegister(ins->begin()),
-                                         useRegister(ins->length()),
-                                         temp());
-    return define(lir, ins) && assignSafepoint(lir, ins);
-}
-
 bool
 LIRGenerator::visitLambda(MLambda *ins)
 {
diff --git a/js/src/jit/Lowering.h b/js/src/jit/Lowering.h
index aefc37e503d..f975d826deb 100644
--- a/js/src/jit/Lowering.h
+++ b/js/src/jit/Lowering.h
@@ -145,7 +145,6 @@ class LIRGenerator : public LIRGeneratorSpecific
     bool visitCharCodeAt(MCharCodeAt *ins);
     bool visitFromCharCode(MFromCharCode *ins);
     bool visitStringSplit(MStringSplit *ins);
-    bool visitSubstr(MSubstr *ins);
     bool visitStart(MStart *start);
     bool visitOsrEntry(MOsrEntry *entry);
     bool visitNop(MNop *nop);
diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp
index 10064610fe4..68bd67004b1 100644
--- a/js/src/jit/MCallOptimize.cpp
+++ b/js/src/jit/MCallOptimize.cpp
@@ -197,8 +197,6 @@ IonBuilder::inlineNativeCall(CallInfo &callInfo, JSFunction *target)
         return inlineToString(callInfo);
     if (native == intrinsic_IsConstructing)
         return inlineIsConstructing(callInfo);
-    if (native == intrinsic_SubstringKernel)
-        return inlineSubstringKernel(callInfo);
 
     // TypedObject intrinsics.
     if (native == intrinsic_ObjectIsTypedObject)
@@ -1552,38 +1550,6 @@ IonBuilder::inlineStrReplace(CallInfo &callInfo)
     return InliningStatus_Inlined;
 }
 
-IonBuilder::InliningStatus
-IonBuilder::inlineSubstringKernel(CallInfo &callInfo)
-{
-    MOZ_ASSERT(callInfo.argc() == 3);
-    MOZ_ASSERT(!callInfo.constructing());
-
-    // Return: String.
-    if (getInlineReturnType() != MIRType_String)
-        return InliningStatus_NotInlined;
-
-    // Arg 0: String.
-    if (callInfo.getArg(0)->type() != MIRType_String)
-        return InliningStatus_NotInlined;
-
-    // Arg 1: Int.
-    if (callInfo.getArg(1)->type() != MIRType_Int32)
-        return InliningStatus_NotInlined;
-
-    // Arg 2: Int.
-    if (callInfo.getArg(2)->type() != MIRType_Int32)
-        return InliningStatus_NotInlined;
-
-    callInfo.setImplicitlyUsedUnchecked();
-
-    MSubstr *substr = MSubstr::New(alloc(), callInfo.getArg(0), callInfo.getArg(1),
-                                            callInfo.getArg(2));
-    current->add(substr);
-    current->push(substr);
-
-    return InliningStatus_Inlined;
-}
-
 IonBuilder::InliningStatus
 IonBuilder::inlineUnsafePutElements(CallInfo &callInfo)
 {
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index 2f6dec55d70..6569cd5a05a 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -6925,47 +6925,6 @@ class MStringReplace
     }
 };
 
-class MSubstr
-  : public MTernaryInstruction,
-    public Mix3Policy<StringPolicy<0>, IntPolicy<1>, IntPolicy<2>>
-{
-  private:
-
-    MSubstr(MDefinition *string, MDefinition *begin, MDefinition *length)
-      : MTernaryInstruction(string, begin, length)
-    {
-        setResultType(MIRType_String);
-    }
-
-  public:
-    INSTRUCTION_HEADER(Substr);
-
-    static MSubstr *New(TempAllocator &alloc, MDefinition *string, MDefinition *begin,
-                        MDefinition *length)
-    {
-        return new(alloc) MSubstr(string, begin, length);
-    }
-
-    MDefinition *string() {
-        return getOperand(0);
-    }
-
-    MDefinition *begin() {
-        return getOperand(1);
-    }
-
-    MDefinition *length() {
-        return getOperand(2);
-    }
-
-    bool congruentTo(const MDefinition *ins) const {
-        return congruentIfOperandsEqual(ins);
-    }
-    AliasSet getAliasSet() const {
-        return AliasSet::None();
-    }
-};
-
 struct LambdaFunctionInfo
 {
     // The functions used in lambdas are the canonical original function in
diff --git a/js/src/jit/MOpcodes.h b/js/src/jit/MOpcodes.h
index 5d645ac6deb..734326c6e1a 100644
--- a/js/src/jit/MOpcodes.h
+++ b/js/src/jit/MOpcodes.h
@@ -95,7 +95,6 @@ namespace jit {
     _(CharCodeAt)                                                           \
     _(FromCharCode)                                                         \
     _(StringSplit)                                                          \
-    _(Substr)                                                               \
     _(Return)                                                               \
     _(Throw)                                                                \
     _(Box)                                                                  \
diff --git a/js/src/jit/ParallelSafetyAnalysis.cpp b/js/src/jit/ParallelSafetyAnalysis.cpp
index ed9f265575c..46e0f26efea 100644
--- a/js/src/jit/ParallelSafetyAnalysis.cpp
+++ b/js/src/jit/ParallelSafetyAnalysis.cpp
@@ -324,7 +324,6 @@ class ParallelSafetyVisitor : public MDefinitionVisitor
     UNSAFE_OP(CallInstanceOf)
     UNSAFE_OP(ProfilerStackOp)
     UNSAFE_OP(GuardString)
-    UNSAFE_OP(Substr)
     UNSAFE_OP(NewDeclEnvObject)
     UNSAFE_OP(In)
     UNSAFE_OP(InArray)
diff --git a/js/src/jscntxt.h b/js/src/jscntxt.h
index eb47e1df753..91e1dd45f4b 100644
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -977,7 +977,6 @@ bool intrinsic_IsCallable(JSContext *cx, unsigned argc, Value *vp);
 bool intrinsic_ThrowError(JSContext *cx, unsigned argc, Value *vp);
 bool intrinsic_NewDenseArray(JSContext *cx, unsigned argc, Value *vp);
 bool intrinsic_IsConstructing(JSContext *cx, unsigned argc, Value *vp);
-bool intrinsic_SubstringKernel(JSContext *cx, unsigned argc, Value *vp);
 
 bool intrinsic_UnsafePutElements(JSContext *cx, unsigned argc, Value *vp);
 bool intrinsic_DefineDataProperty(JSContext *cx, unsigned argc, Value *vp);
diff --git a/js/src/jsstr.cpp b/js/src/jsstr.cpp
index e16bc251d85..c74f06e6a0a 100644
--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -575,17 +575,9 @@ ValueToIntegerRange(JSContext *cx, HandleValue v, int32_t *out)
     return true;
 }
 
-JSString *
-js::SubstringKernel(JSContext *cx, HandleString str, int32_t beginInt, int32_t lengthInt)
+static JSString *
+DoSubstr(JSContext *cx, JSString *str, size_t begin, size_t len)
 {
-    MOZ_ASSERT(0 <= beginInt);
-    MOZ_ASSERT(0 <= lengthInt);
-    MOZ_ASSERT(beginInt <= str->length());
-    MOZ_ASSERT(lengthInt <= str->length() - beginInt);
-
-    uint32_t begin = beginInt;
-    uint32_t len = lengthInt;
-
     /*
      * Optimization for one level deep ropes.
      * This is common for the following pattern:
@@ -599,13 +591,16 @@ js::SubstringKernel(JSContext *cx, HandleString str, int32_t beginInt, int32_t l
         JSRope *rope = &str->asRope();
 
         /* Substring is totally in leftChild of rope. */
-        if (begin + len <= rope->leftChild()->length())
-            return NewDependentString(cx, rope->leftChild(), begin, len);
+        if (begin + len <= rope->leftChild()->length()) {
+            str = rope->leftChild();
+            return NewDependentString(cx, str, begin, len);
+        }
 
         /* Substring is totally in rightChild of rope. */
         if (begin >= rope->leftChild()->length()) {
+            str = rope->rightChild();
             begin -= rope->leftChild()->length();
-            return NewDependentString(cx, rope->rightChild(), begin, len);
+            return NewDependentString(cx, str, begin, len);
         }
 
         /*
@@ -633,6 +628,65 @@ js::SubstringKernel(JSContext *cx, HandleString str, int32_t beginInt, int32_t l
     return NewDependentString(cx, str, begin, len);
 }
 
+bool
+js::str_substring(JSContext *cx, unsigned argc, Value *vp)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+
+    JSString *str = ThisToStringForStringProto(cx, args);
+    if (!str)
+        return false;
+
+    int32_t length, begin, end;
+    if (args.length() > 0) {
+        end = length = int32_t(str->length());
+
+        if (args[0].isInt32()) {
+            begin = args[0].toInt32();
+        } else {
+            RootedString strRoot(cx, str);
+            if (!ValueToIntegerRange(cx, args[0], &begin))
+                return false;
+            str = strRoot;
+        }
+
+        if (begin < 0)
+            begin = 0;
+        else if (begin > length)
+            begin = length;
+
+        if (args.hasDefined(1)) {
+            if (args[1].isInt32()) {
+                end = args[1].toInt32();
+            } else {
+                RootedString strRoot(cx, str);
+                if (!ValueToIntegerRange(cx, args[1], &end))
+                    return false;
+                str = strRoot;
+            }
+
+            if (end > length) {
+                end = length;
+            } else {
+                if (end < 0)
+                    end = 0;
+                if (end < begin) {
+                    int32_t tmp = begin;
+                    begin = end;
+                    end = tmp;
+                }
+            }
+        }
+
+        str = DoSubstr(cx, str, size_t(begin), size_t(end - begin));
+        if (!str)
+            return false;
+    }
+
+    args.rval().setString(str);
+    return true;
+}
+
 template <typename CharT>
 static JSString *
 ToLowerCase(JSContext *cx, JSLinearString *str)
@@ -3938,6 +3992,54 @@ js::str_split_string(JSContext *cx, HandleTypeObject type, HandleString str, Han
     return aobj;
 }
 
+static bool
+str_substr(JSContext *cx, unsigned argc, Value *vp)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+    RootedString str(cx, ThisToStringForStringProto(cx, args));
+    if (!str)
+        return false;
+
+    int32_t length, len, begin;
+    if (args.length() > 0) {
+        length = int32_t(str->length());
+        if (!ValueToIntegerRange(cx, args[0], &begin))
+            return false;
+
+        if (begin >= length) {
+            args.rval().setString(cx->runtime()->emptyString);
+            return true;
+        }
+        if (begin < 0) {
+            begin += length; /* length + INT_MIN will always be less than 0 */
+            if (begin < 0)
+                begin = 0;
+        }
+
+        if (args.hasDefined(1)) {
+            if (!ValueToIntegerRange(cx, args[1], &len))
+                return false;
+
+            if (len <= 0) {
+                args.rval().setString(cx->runtime()->emptyString);
+                return true;
+            }
+
+            if (uint32_t(length) < uint32_t(begin + len))
+                len = length - begin;
+        } else {
+            len = length - begin;
+        }
+
+        str = DoSubstr(cx, str, size_t(begin), size_t(len));
+        if (!str)
+            return false;
+    }
+
+    args.rval().setString(str);
+    return true;
+}
+
 /*
  * Python-esque sequence operations.
  */
@@ -3974,6 +4076,73 @@ str_concat(JSContext *cx, unsigned argc, Value *vp)
     return true;
 }
 
+static bool
+str_slice(JSContext *cx, unsigned argc, Value *vp)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+
+    if (args.length() == 1 && args.thisv().isString() && args[0].isInt32()) {
+        JSString *str = args.thisv().toString();
+        size_t begin = args[0].toInt32();
+        size_t end = str->length();
+        if (begin <= end) {
+            size_t length = end - begin;
+            if (length == 0) {
+                str = cx->runtime()->emptyString;
+            } else {
+                str = (length == 1)
+                      ? cx->staticStrings().getUnitStringForElement(cx, str, begin)
+                      : NewDependentString(cx, str, begin, length);
+                if (!str)
+                    return false;
+            }
+            args.rval().setString(str);
+            return true;
+        }
+    }
+
+    RootedString str(cx, ThisToStringForStringProto(cx, args));
+    if (!str)
+        return false;
+
+    if (args.length() != 0) {
+        double begin, end, length;
+
+        if (!ToInteger(cx, args[0], &begin))
+            return false;
+        length = str->length();
+        if (begin < 0) {
+            begin += length;
+            if (begin < 0)
+                begin = 0;
+        } else if (begin > length) {
+            begin = length;
+        }
+
+        if (args.hasDefined(1)) {
+            if (!ToInteger(cx, args[1], &end))
+                return false;
+            if (end < 0) {
+                end += length;
+                if (end < 0)
+                    end = 0;
+            } else if (end > length) {
+                end = length;
+            }
+            if (end < begin)
+                end = begin;
+        } else {
+            end = length;
+        }
+
+        str = NewDependentString(cx, str, size_t(begin), size_t(end - begin));
+        if (!str)
+            return false;
+    }
+    args.rval().setString(str);
+    return true;
+}
+
 static const JSFunctionSpec string_methods[] = {
 #if JS_HAS_TOSOURCE
     JS_FN("quote",             str_quote,             0,JSFUN_GENERIC_NATIVE),
@@ -3983,11 +4152,11 @@ static const JSFunctionSpec string_methods[] = {
     /* Java-like methods. */
     JS_FN(js_toString_str,     js_str_toString,       0,0),
     JS_FN(js_valueOf_str,      js_str_toString,       0,0),
+    JS_FN("substring",         str_substring,         2,JSFUN_GENERIC_NATIVE),
     JS_FN("toLowerCase",       str_toLowerCase,       0,JSFUN_GENERIC_NATIVE),
     JS_FN("toUpperCase",       str_toUpperCase,       0,JSFUN_GENERIC_NATIVE),
     JS_FN("charAt",            js_str_charAt,         1,JSFUN_GENERIC_NATIVE),
     JS_FN("charCodeAt",        js_str_charCodeAt,     1,JSFUN_GENERIC_NATIVE),
-    JS_SELF_HOSTED_FN("substring", "String_substring", 2,0),
     JS_SELF_HOSTED_FN("codePointAt", "String_codePointAt", 1,0),
     JS_FN("contains",          str_contains,          1,JSFUN_GENERIC_NATIVE),
     JS_FN("indexOf",           str_indexOf,           1,JSFUN_GENERIC_NATIVE),
@@ -4014,11 +4183,11 @@ static const JSFunctionSpec string_methods[] = {
     JS_FN("search",            str_search,            1,JSFUN_GENERIC_NATIVE),
     JS_FN("replace",           str_replace,           2,JSFUN_GENERIC_NATIVE),
     JS_FN("split",             str_split,             2,JSFUN_GENERIC_NATIVE),
-    JS_SELF_HOSTED_FN("substr", "String_substr",      2,0),
+    JS_FN("substr",            str_substr,            2,JSFUN_GENERIC_NATIVE),
 
     /* Python-esque sequence methods. */
     JS_FN("concat",            str_concat,            1,JSFUN_GENERIC_NATIVE),
-    JS_SELF_HOSTED_FN("slice", "String_slice",        2,0),
+    JS_FN("slice",             str_slice,             2,JSFUN_GENERIC_NATIVE),
 
     /* HTML string methods. */
     JS_SELF_HOSTED_FN("bold",     "String_bold",       0,0),
@@ -4124,17 +4293,13 @@ js::str_fromCharCode_one_arg(JSContext *cx, HandleValue code, MutableHandleValue
 
 static const JSFunctionSpec string_static_methods[] = {
     JS_FN("fromCharCode", js::str_fromCharCode, 1, 0),
-
-    JS_SELF_HOSTED_FN("fromCodePoint",   "String_static_fromCodePoint", 1,0),
-    JS_SELF_HOSTED_FN("raw",             "String_static_raw",           2,0),
-    JS_SELF_HOSTED_FN("substring",       "String_static_substring",     3,0),
-    JS_SELF_HOSTED_FN("substr",          "String_static_substr",        3,0),
-    JS_SELF_HOSTED_FN("slice",           "String_static_slice",         3,0),
+    JS_SELF_HOSTED_FN("fromCodePoint", "String_static_fromCodePoint", 1, 0),
+    JS_SELF_HOSTED_FN("raw", "String_static_raw", 2, 0),
 
     // This must be at the end because of bug 853075: functions listed after
     // self-hosted methods aren't available in self-hosted code.
 #if EXPOSE_INTL_API
-    JS_SELF_HOSTED_FN("localeCompare",   "String_static_localeCompare", 2,0),
+    JS_SELF_HOSTED_FN("localeCompare", "String_static_localeCompare", 2,0),
 #endif
     JS_FS_END
 };
diff --git a/js/src/jsstr.h b/js/src/jsstr.h
index e262ace82aa..5231ab13369 100644
--- a/js/src/jsstr.h
+++ b/js/src/jsstr.h
@@ -249,14 +249,6 @@ EqualChars(const Char1 *s1, const Char2 *s2, size_t len)
     return true;
 }
 
-/*
- * Computes |str|'s substring for the range [beginInt, beginInt + lengthInt).
- * Negative, overlarge, swapped, etc. |beginInt| and |lengthInt| are forbidden
- * and constitute API misuse.
- */
-JSString *
-SubstringKernel(JSContext *cx, HandleString str, int32_t beginInt, int32_t lengthInt);
-
 /*
  * Inflate bytes in ASCII encoding to char16_t code units. Return null on error,
  * otherwise return the char16_t buffer that was malloc'ed. length is updated to
@@ -319,6 +311,9 @@ str_lastIndexOf(JSContext *cx, unsigned argc, Value *vp);
 extern bool
 str_startsWith(JSContext *cx, unsigned argc, Value *vp);
 
+extern bool
+str_substring(JSContext *cx, unsigned argc, Value *vp);
+
 extern bool
 str_toLowerCase(JSContext *cx, unsigned argc, Value *vp);
 
diff --git a/js/src/vm/SelfHosting.cpp b/js/src/vm/SelfHosting.cpp
index 17ef9e321f1..1be699b9659 100644
--- a/js/src/vm/SelfHosting.cpp
+++ b/js/src/vm/SelfHosting.cpp
@@ -120,26 +120,6 @@ intrinsic_IsConstructor(JSContext *cx, unsigned argc, Value *vp)
     return true;
 }
 
-bool
-js::intrinsic_SubstringKernel(JSContext *cx, unsigned argc, Value *vp)
-{
-    CallArgs args = CallArgsFromVp(argc, vp);
-    MOZ_ASSERT(args[0].isString());
-    MOZ_ASSERT(args[1].isInt32());
-    MOZ_ASSERT(args[2].isInt32());
-
-    RootedString str(cx, args[0].toString());
-    int32_t begin = args[1].toInt32();
-    int32_t length = args[2].toInt32();
-
-    JSString *substr = SubstringKernel(cx, str, begin, length);
-    if (!substr)
-        return false;
-
-    args.rval().setString(substr);
-    return true;
-}
-
 static bool
 intrinsic_OwnPropertyKeys(JSContext *cx, unsigned argc, Value *vp)
 {
@@ -1036,6 +1016,7 @@ static const JSFunctionSpec intrinsic_functions[] = {
     JS_FN("std_String_replace",                  str_replace,                  2,0),
     JS_FN("std_String_split",                    str_split,                    2,0),
     JS_FN("std_String_startsWith",               str_startsWith,               1,0),
+    JS_FN("std_String_substring",                str_substring,                2,0),
     JS_FN("std_String_toLowerCase",              str_toLowerCase,              0,0),
     JS_FN("std_String_toUpperCase",              str_toUpperCase,              0,0),
 
@@ -1060,7 +1041,6 @@ static const JSFunctionSpec intrinsic_functions[] = {
     JS_FN("_IsConstructing",         intrinsic_IsConstructing,          0,0),
     JS_FN("DecompileArg",            intrinsic_DecompileArg,            2,0),
     JS_FN("RuntimeDefaultLocale",    intrinsic_RuntimeDefaultLocale,    0,0),
-    JS_FN("SubstringKernel",         intrinsic_SubstringKernel,         3,0),
 
     JS_FN("UnsafePutElements",       intrinsic_UnsafePutElements,       3,0),
     JS_FN("_DefineDataProperty",     intrinsic_DefineDataProperty,      4,0),
diff --git a/js/src/vm/String.h b/js/src/vm/String.h
index 5f134309050..5cd432afef6 100644
--- a/js/src/vm/String.h
+++ b/js/src/vm/String.h
@@ -475,9 +475,6 @@ class JSString : public js::gc::TenuredCell
     }
 
     static size_t offsetOfNonInlineChars() {
-        static_assert(offsetof(JSString, d.s.u2.nonInlineCharsTwoByte) ==
-                      offsetof(JSString, d.s.u2.nonInlineCharsLatin1),
-                      "nonInlineCharsTwoByte and nonInlineCharsLatin1 must have same offset");
         return offsetof(JSString, d.s.u2.nonInlineCharsTwoByte);
     }
 

From e3a527b4ce15a9c718da0bcced65294b9be0ae29 Mon Sep 17 00:00:00 2001
From: JW Wang <jwwang@mozilla.com>
Date: Tue, 4 Nov 2014 18:11:00 -0500
Subject: [PATCH 145/153] Bug 1021682 - Fix and re-enable test_streams_gc.html
 on B2G. r=cpearce

---
 dom/media/test/mochitest.ini        | 1 -
 dom/media/test/test_streams_gc.html | 3 +--
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/dom/media/test/mochitest.ini b/dom/media/test/mochitest.ini
index 6fa5a296b53..d58679ddb43 100644
--- a/dom/media/test/mochitest.ini
+++ b/dom/media/test/mochitest.ini
@@ -497,7 +497,6 @@ skip-if = (toolkit == 'android' && processor == 'x86') #x86 only bug 914439
 [test_streams_element_capture_playback.html]
 [test_streams_element_capture_reset.html]
 [test_streams_gc.html]
-skip-if = buildapp == 'b2g' # bug 1021682
 [test_streams_srcObject.html]
 [test_streams_tracks.html]
 [test_texttrack.html]
diff --git a/dom/media/test/test_streams_gc.html b/dom/media/test/test_streams_gc.html
index 545b0c19286..e7a3560999d 100644
--- a/dom/media/test/test_streams_gc.html
+++ b/dom/media/test/test_streams_gc.html
@@ -7,7 +7,7 @@
   <script type="text/javascript" src="manifest.js"></script>
 </head>
 <body onload="doTest()">
-<audio id="a"></audio>
+<audio id="a" preload="metadata"></audio>
 <pre id="test">
 <script class="testbody" type="text/javascript">
 SimpleTest.waitForExplicitFinish();
@@ -36,7 +36,6 @@ function doTest() {
   }, false);
 
   a.currentTime = a.duration;
-  
   setTimeout(forceGC, 0);
 }
 </script>

From b80158ee9e94a01ec94af18083333ab21a56a1c4 Mon Sep 17 00:00:00 2001
From: Masayuki Nakano <masayuki@d-toybox.com>
Date: Wed, 5 Nov 2014 08:12:44 -0500
Subject: [PATCH 146/153] Bug 1047588 - IMEContentObserver::Init() should take
 nsIEditor because nsDocShell sometimes hasn't been initialized and
 nsContentEditor::GetHTMLEditor() fails. r=smaug

---
 dom/events/IMEContentObserver.cpp          | 29 +++++----------------
 dom/events/IMEContentObserver.h            |  2 +-
 dom/events/IMEStateManager.cpp             | 30 ++++++++++++----------
 dom/events/IMEStateManager.h               |  9 ++++---
 editor/libeditor/nsEditor.cpp              |  4 +--
 editor/libeditor/nsEditorEventListener.cpp |  3 ++-
 6 files changed, 34 insertions(+), 43 deletions(-)

diff --git a/dom/events/IMEContentObserver.cpp b/dom/events/IMEContentObserver.cpp
index 5620004d9fe..836c6882abc 100644
--- a/dom/events/IMEContentObserver.cpp
+++ b/dom/events/IMEContentObserver.cpp
@@ -28,7 +28,6 @@
 #include "nsISelectionController.h"
 #include "nsISelectionPrivate.h"
 #include "nsISupports.h"
-#include "nsITextControlElement.h"
 #include "nsIWidget.h"
 #include "nsPresContext.h"
 #include "nsThreadUtils.h"
@@ -99,8 +98,11 @@ IMEContentObserver::IMEContentObserver()
 void
 IMEContentObserver::Init(nsIWidget* aWidget,
                          nsPresContext* aPresContext,
-                         nsIContent* aContent)
+                         nsIContent* aContent,
+                         nsIEditor* aEditor)
 {
+  MOZ_ASSERT(aEditor, "aEditor must not be null");
+
   mESM = aPresContext->EventStateManager();
   mESM->OnStartToObserveContent(this);
 
@@ -110,27 +112,8 @@ IMEContentObserver::Init(nsIWidget* aWidget,
     return;
   }
 
-  nsCOMPtr<nsITextControlElement> textControlElement =
-    do_QueryInterface(mEditableNode);
-  if (textControlElement) {
-    // This may fail. For example, <input type="button" contenteditable>
-    mEditor = textControlElement->GetTextEditor();
-    if (!mEditor && mEditableNode->IsContent()) {
-      // The element must be an editing host.
-      nsIContent* editingHost = mEditableNode->AsContent()->GetEditingHost();
-      MOZ_ASSERT(editingHost == mEditableNode,
-                 "found editing host should be mEditableNode");
-      if (editingHost == mEditableNode) {
-        mEditor = nsContentUtils::GetHTMLEditor(aPresContext);
-      }
-    }
-  } else {
-    mEditor = nsContentUtils::GetHTMLEditor(aPresContext);
-  }
-  MOZ_ASSERT(mEditor, "Failed to get editor");
-  if (mEditor) {
-    mEditor->AddEditorObserver(this);
-  }
+  mEditor = aEditor;
+  mEditor->AddEditorObserver(this);
 
   nsIPresShell* presShell = aPresContext->PresShell();
 
diff --git a/dom/events/IMEContentObserver.h b/dom/events/IMEContentObserver.h
index f8dba04917f..43a67f5a022 100644
--- a/dom/events/IMEContentObserver.h
+++ b/dom/events/IMEContentObserver.h
@@ -64,7 +64,7 @@ public:
                           WidgetMouseEvent* aMouseEvent);
 
   void Init(nsIWidget* aWidget, nsPresContext* aPresContext,
-            nsIContent* aContent);
+            nsIContent* aContent, nsIEditor* aEditor);
   void Destroy();
   /**
    * IMEContentObserver is stored by EventStateManager during observing.
diff --git a/dom/events/IMEStateManager.cpp b/dom/events/IMEStateManager.cpp
index 663dd8baa2b..5e3722613f6 100644
--- a/dom/events/IMEStateManager.cpp
+++ b/dom/events/IMEStateManager.cpp
@@ -25,6 +25,7 @@
 #include "nsIContent.h"
 #include "nsIDocument.h"
 #include "nsIDOMMouseEvent.h"
+#include "nsIEditor.h"
 #include "nsIForm.h"
 #include "nsIFormControl.h"
 #include "nsINode.h"
@@ -559,12 +560,14 @@ IMEStateManager::OnClickInEditor(nsPresContext* aPresContext,
 // static
 void
 IMEStateManager::OnFocusInEditor(nsPresContext* aPresContext,
-                                 nsIContent* aContent)
+                                 nsIContent* aContent,
+                                 nsIEditor* aEditor)
 {
   PR_LOG(sISMLog, PR_LOG_ALWAYS,
-    ("ISM: IMEStateManager::OnFocusInEditor(aPresContext=0x%p, aContent=0x%p), "
-     "sPresContext=0x%p, sContent=0x%p, sActiveIMEContentObserver=0x%p",
-     aPresContext, aContent, sPresContext, sContent,
+    ("ISM: IMEStateManager::OnFocusInEditor(aPresContext=0x%p, aContent=0x%p, "
+     "aEditor=0x%p), sPresContext=0x%p, sContent=0x%p, "
+     "sActiveIMEContentObserver=0x%p",
+     aPresContext, aContent, aEditor, sPresContext, sContent,
      sActiveIMEContentObserver));
 
   if (sPresContext != aPresContext || sContent != aContent) {
@@ -586,21 +589,22 @@ IMEStateManager::OnFocusInEditor(nsPresContext* aPresContext,
     DestroyIMEContentObserver();
   }
 
-  CreateIMEContentObserver();
+  CreateIMEContentObserver(aEditor);
 }
 
 // static
 void
 IMEStateManager::UpdateIMEState(const IMEState& aNewIMEState,
-                                nsIContent* aContent)
+                                nsIContent* aContent,
+                                nsIEditor* aEditor)
 {
   PR_LOG(sISMLog, PR_LOG_ALWAYS,
     ("ISM: IMEStateManager::UpdateIMEState(aNewIMEState={ mEnabled=%s, "
-     "mOpen=%s }, aContent=0x%p), "
+     "mOpen=%s }, aContent=0x%p, aEditor=0x%p), "
      "sPresContext=0x%p, sContent=0x%p, sActiveIMEContentObserver=0x%p, "
      "sIsGettingNewIMEState=%s",
      GetIMEStateEnabledName(aNewIMEState.mEnabled),
-     GetIMEStateSetOpenName(aNewIMEState.mOpen), aContent,
+     GetIMEStateSetOpenName(aNewIMEState.mOpen), aContent, aEditor,
      sPresContext, sContent, sActiveIMEContentObserver,
      GetBoolName(sIsGettingNewIMEState)));
 
@@ -651,7 +655,7 @@ IMEStateManager::UpdateIMEState(const IMEState& aNewIMEState,
   }
 
   if (createTextStateManager) {
-    CreateIMEContentObserver();
+    CreateIMEContentObserver(aEditor);
   }
 }
 
@@ -1145,13 +1149,13 @@ IMEStateManager::DestroyIMEContentObserver()
 
 // static
 void
-IMEStateManager::CreateIMEContentObserver()
+IMEStateManager::CreateIMEContentObserver(nsIEditor* aEditor)
 {
   PR_LOG(sISMLog, PR_LOG_ALWAYS,
-    ("ISM: IMEStateManager::CreateIMEContentObserver(), "
+    ("ISM: IMEStateManager::CreateIMEContentObserver(aEditor=0x%p), "
      "sPresContext=0x%p, sContent=0x%p, sActiveIMEContentObserver=0x%p, "
      "sActiveIMEContentObserver->IsManaging(sPresContext, sContent)=%s",
-     sPresContext, sContent, sActiveIMEContentObserver,
+     aEditor, sPresContext, sContent, sActiveIMEContentObserver,
      GetBoolName(sActiveIMEContentObserver ?
        sActiveIMEContentObserver->IsManaging(sPresContext, sContent) : false)));
 
@@ -1195,7 +1199,7 @@ IMEStateManager::CreateIMEContentObserver()
   // instance.  So, sActiveIMEContentObserver would be replaced with new one.
   // We should hold the current instance here.
   nsRefPtr<IMEContentObserver> kungFuDeathGrip(sActiveIMEContentObserver);
-  sActiveIMEContentObserver->Init(widget, sPresContext, sContent);
+  sActiveIMEContentObserver->Init(widget, sPresContext, sContent, aEditor);
 }
 
 // static
diff --git a/dom/events/IMEStateManager.h b/dom/events/IMEStateManager.h
index 665edcc2d0f..01ad078ac38 100644
--- a/dom/events/IMEStateManager.h
+++ b/dom/events/IMEStateManager.h
@@ -11,6 +11,7 @@
 
 class nsIContent;
 class nsIDOMMouseEvent;
+class nsIEditor;
 class nsINode;
 class nsPIDOMWindow;
 class nsPresContext;
@@ -65,7 +66,8 @@ public:
   // Note that this method changes the IME state of the active element in the
   // widget.  So, the caller must have focus.
   static void UpdateIMEState(const IMEState &aNewIMEState,
-                             nsIContent* aContent);
+                             nsIContent* aContent,
+                             nsIEditor* aEditor);
 
   // This method is called when user operates mouse button in focused editor
   // and before the editor handles it.
@@ -89,7 +91,8 @@ public:
   //   If the editor is for contenteditable, the active editinghost.
   //   If the editor is for designMode, nullptr.
   static void OnFocusInEditor(nsPresContext* aPresContext,
-                              nsIContent* aContent);
+                              nsIContent* aContent,
+                              nsIEditor* aEditor);
 
   /**
    * All composition events must be dispatched via DispatchCompositionEvent()
@@ -149,7 +152,7 @@ protected:
                                  nsIContent* aContent);
 
   static void EnsureTextCompositionArray();
-  static void CreateIMEContentObserver();
+  static void CreateIMEContentObserver(nsIEditor* aEditor);
   static void DestroyIMEContentObserver();
 
   static bool IsEditable(nsINode* node);
diff --git a/editor/libeditor/nsEditor.cpp b/editor/libeditor/nsEditor.cpp
index d4e7e5a77b3..75b8797c819 100644
--- a/editor/libeditor/nsEditor.cpp
+++ b/editor/libeditor/nsEditor.cpp
@@ -315,7 +315,7 @@ nsEditor::PostCreate()
     rv = GetPreferredIMEState(&newState);
     NS_ENSURE_SUCCESS(rv, NS_OK);
     nsCOMPtr<nsIContent> content = GetFocusedContentForIME();
-    IMEStateManager::UpdateIMEState(newState, content);
+    IMEStateManager::UpdateIMEState(newState, content, this);
   }
   return NS_OK;
 }
@@ -496,7 +496,7 @@ nsEditor::SetFlags(uint32_t aFlags)
       // NOTE: When the enabled state isn't going to be modified, this method
       // is going to do nothing.
       nsCOMPtr<nsIContent> content = GetFocusedContentForIME();
-      IMEStateManager::UpdateIMEState(newState, content);
+      IMEStateManager::UpdateIMEState(newState, content, this);
     }
   }
 
diff --git a/editor/libeditor/nsEditorEventListener.cpp b/editor/libeditor/nsEditorEventListener.cpp
index 702a61862fb..01f6a4af7f8 100644
--- a/editor/libeditor/nsEditorEventListener.cpp
+++ b/editor/libeditor/nsEditorEventListener.cpp
@@ -1097,7 +1097,8 @@ nsEditorEventListener::Focus(nsIDOMEvent* aEvent)
   nsCOMPtr<nsIPresShell> ps = GetPresShell();
   NS_ENSURE_TRUE(ps, NS_OK);
   nsCOMPtr<nsIContent> focusedContent = mEditor->GetFocusedContentForIME();
-  IMEStateManager::OnFocusInEditor(ps->GetPresContext(), focusedContent);
+  IMEStateManager::OnFocusInEditor(ps->GetPresContext(), focusedContent,
+                                   mEditor);
 
   return NS_OK;
 }

From 0a14cd0584b8f2fdc18282d34dc6ac09be695d25 Mon Sep 17 00:00:00 2001
From: Shu-yu Guo <shu@rfrn.org>
Date: Wed, 5 Nov 2014 08:12:44 -0500
Subject: [PATCH 147/153] Bug 1092833 - Deal with uninitialized slots in
 MacroAssembler::initGCSlots. r=terrence

---
 js/src/jit-test/tests/ion/bug1092833.js | 49 +++++++++++++++++
 js/src/jit/IonMacroAssembler.cpp        | 71 ++++++++++++++++++++-----
 js/src/jit/IonMacroAssembler.h          |  3 ++
 3 files changed, 111 insertions(+), 12 deletions(-)
 create mode 100644 js/src/jit-test/tests/ion/bug1092833.js

diff --git a/js/src/jit-test/tests/ion/bug1092833.js b/js/src/jit-test/tests/ion/bug1092833.js
new file mode 100644
index 00000000000..64a74fb28fd
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1092833.js
@@ -0,0 +1,49 @@
+// Test that lexicals work with functions with many bindings.
+
+(function() {
+    var a01
+    var b02
+    var c03
+    var d04
+    var e05
+    var f06
+    var g07
+    var h08
+    let i09
+    var j10
+    var k11
+    var l12
+    var m13
+    var n14
+    var o15
+    (function n14() {
+      assertEq(i09, undefined);
+    })()
+})();
+
+try {
+  (function() {
+      var a01
+      var b02
+      var c03
+      var d04
+      var e05
+      var f06
+      var g07
+      var h08
+      let i09
+      var j10
+      var k11
+      var l12
+      var m13
+      var n14
+      var o15
+      (function n14() {
+        i12++
+      })()
+      let i12
+  })()
+} catch (e) {
+  assertEq(e instanceof ReferenceError, true);
+  assertEq(e.message.indexOf("i12") > 0, true);
+}
diff --git a/js/src/jit/IonMacroAssembler.cpp b/js/src/jit/IonMacroAssembler.cpp
index 397bd044f7e..11b8701b38f 100644
--- a/js/src/jit/IonMacroAssembler.cpp
+++ b/js/src/jit/IonMacroAssembler.cpp
@@ -27,6 +27,7 @@
 #endif
 #include "jsinferinlines.h"
 #include "jsobjinlines.h"
+#include "vm/Interpreter-inl.h"
 
 using namespace js;
 using namespace js::jit;
@@ -956,12 +957,18 @@ MacroAssembler::copySlotsFromTemplate(Register obj, const NativeObject *template
 }
 
 void
-MacroAssembler::fillSlotsWithUndefined(Address base, Register temp, uint32_t start, uint32_t end)
+MacroAssembler::fillSlotsWithConstantValue(Address base, Register temp,
+                                           uint32_t start, uint32_t end, const Value &v)
 {
+    MOZ_ASSERT(v.isUndefined() || IsUninitializedLexical(v));
+
+    if (start >= end)
+        return;
+
 #ifdef JS_NUNBOX32
     // We only have a single spare register, so do the initialization as two
     // strided writes of the tag and body.
-    jsval_layout jv = JSVAL_TO_IMPL(UndefinedValue());
+    jsval_layout jv = JSVAL_TO_IMPL(v);
 
     Address addr = base;
     move32(Imm32(jv.s.payload.i32), temp);
@@ -973,22 +980,43 @@ MacroAssembler::fillSlotsWithUndefined(Address base, Register temp, uint32_t sta
     for (unsigned i = start; i < end; ++i, addr.offset += sizeof(HeapValue))
         store32(temp, ToType(addr));
 #else
-    moveValue(UndefinedValue(), temp);
+    moveValue(v, temp);
     for (uint32_t i = start; i < end; ++i, base.offset += sizeof(HeapValue))
         storePtr(temp, base);
 #endif
 }
 
-static uint32_t
-FindStartOfUndefinedSlots(NativeObject *templateObj, uint32_t nslots)
+void
+MacroAssembler::fillSlotsWithUndefined(Address base, Register temp, uint32_t start, uint32_t end)
+{
+    fillSlotsWithConstantValue(base, temp, start, end, UndefinedValue());
+}
+
+void
+MacroAssembler::fillSlotsWithUninitialized(Address base, Register temp, uint32_t start, uint32_t end)
+{
+    fillSlotsWithConstantValue(base, temp, start, end, MagicValue(JS_UNINITIALIZED_LEXICAL));
+}
+
+static void
+FindStartOfUndefinedAndUninitializedSlots(NativeObject *templateObj, uint32_t nslots,
+                                          uint32_t *startOfUndefined, uint32_t *startOfUninitialized)
 {
     MOZ_ASSERT(nslots == templateObj->lastProperty()->slotSpan(templateObj->getClass()));
     MOZ_ASSERT(nslots > 0);
-    for (uint32_t first = nslots; first != 0; --first) {
-        if (templateObj->getSlot(first - 1) != UndefinedValue())
-            return first;
+    uint32_t first = nslots;
+    for (; first != 0; --first) {
+        if (!IsUninitializedLexical(templateObj->getSlot(first - 1)))
+            break;
     }
-    return 0;
+    *startOfUninitialized = first;
+    for (; first != 0; --first) {
+        if (templateObj->getSlot(first - 1) != UndefinedValue()) {
+            *startOfUndefined = first;
+            return;
+        }
+    }
+    *startOfUndefined = 0;
 }
 
 void
@@ -1011,16 +1039,28 @@ MacroAssembler::initGCSlots(Register obj, Register slots, NativeObject *template
     // logically into independent non-UndefinedValue writes to the head and
     // duplicated writes of UndefinedValue to the tail. For the majority of
     // objects, the "tail" will be the entire slot range.
-    uint32_t startOfUndefined = FindStartOfUndefinedSlots(templateObj, nslots);
+    //
+    // The template object may be a CallObject, in which case we need to
+    // account for uninitialized lexical slots as well as undefined
+    // slots. Unitialized lexical slots always appear at the very end of
+    // slots, after undefined.
+    uint32_t startOfUndefined = nslots;
+    uint32_t startOfUninitialized = nslots;
+    FindStartOfUndefinedAndUninitializedSlots(templateObj, nslots,
+                                              &startOfUndefined, &startOfUninitialized);
     MOZ_ASSERT(startOfUndefined <= nfixed); // Reserved slots must be fixed.
+    MOZ_ASSERT_IF(startOfUndefined != nfixed, startOfUndefined <= startOfUninitialized);
+    MOZ_ASSERT_IF(!templateObj->is<CallObject>(), startOfUninitialized == nslots);
 
     // Copy over any preserved reserved slots.
     copySlotsFromTemplate(obj, templateObj, 0, startOfUndefined);
 
-    // Fill the rest of the fixed slots with undefined.
+    // Fill the rest of the fixed slots with undefined and uninitialized.
     if (initFixedSlots) {
         fillSlotsWithUndefined(Address(obj, NativeObject::getFixedSlotOffset(startOfUndefined)), slots,
-                               startOfUndefined, nfixed);
+                               startOfUndefined, Min(startOfUninitialized, nfixed));
+        size_t offset = NativeObject::getFixedSlotOffset(startOfUninitialized);
+        fillSlotsWithUninitialized(Address(obj, offset), slots, startOfUninitialized, nfixed);
     }
 
     if (ndynamic) {
@@ -1028,7 +1068,14 @@ MacroAssembler::initGCSlots(Register obj, Register slots, NativeObject *template
         // register briefly for our slots base address.
         push(obj);
         loadPtr(Address(obj, NativeObject::offsetOfSlots()), obj);
+
+        // Initially fill all dynamic slots with undefined.
         fillSlotsWithUndefined(Address(obj, 0), slots, 0, ndynamic);
+
+        // Fill uninitialized slots if necessary.
+        fillSlotsWithUninitialized(Address(obj, 0), slots, startOfUninitialized - nfixed,
+                                   nslots - startOfUninitialized);
+
         pop(obj);
     }
 }
diff --git a/js/src/jit/IonMacroAssembler.h b/js/src/jit/IonMacroAssembler.h
index a303a814fd9..7c8edc77a72 100644
--- a/js/src/jit/IonMacroAssembler.h
+++ b/js/src/jit/IonMacroAssembler.h
@@ -810,7 +810,10 @@ class MacroAssembler : public MacroAssemblerSpecific
     void allocateNonObject(Register result, Register temp, gc::AllocKind allocKind, Label *fail);
     void copySlotsFromTemplate(Register obj, const NativeObject *templateObj,
                                uint32_t start, uint32_t end);
+    void fillSlotsWithConstantValue(Address addr, Register temp, uint32_t start, uint32_t end,
+                                    const Value &v);
     void fillSlotsWithUndefined(Address addr, Register temp, uint32_t start, uint32_t end);
+    void fillSlotsWithUninitialized(Address addr, Register temp, uint32_t start, uint32_t end);
     void initGCSlots(Register obj, Register temp, NativeObject *templateObj, bool initFixedSlots);
 
   public:

From 7a3aa6c065dc9d63e82f247c8145c5b417524190 Mon Sep 17 00:00:00 2001
From: Jonathan Hao <jhao@mozilla.com>
Date: Tue, 4 Nov 2014 17:39:29 +0800
Subject: [PATCH 148/153] Bug 1093521 - [RTSP] An extra PLAY request is send
 after end-of-stream. r=ettseng

---
 netwerk/protocol/rtsp/controller/RtspControllerChild.cpp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/netwerk/protocol/rtsp/controller/RtspControllerChild.cpp b/netwerk/protocol/rtsp/controller/RtspControllerChild.cpp
index 163619fa933..38660e9c972 100644
--- a/netwerk/protocol/rtsp/controller/RtspControllerChild.cpp
+++ b/netwerk/protocol/rtsp/controller/RtspControllerChild.cpp
@@ -462,6 +462,8 @@ RtspControllerChild::PlaybackEnded()
 {
   LOG(("RtspControllerChild::PlaybackEnded"));
 
+  StopPlayAndPauseTimer();
+
   if (NS_IsMainThread()) {
     if (!OKToSendIPC() || !SendPlaybackEnded()) {
       return NS_ERROR_FAILURE;

From d65fe73cae4b99f3543f3e2bc8a5adebd8b03ef5 Mon Sep 17 00:00:00 2001
From: "Carsten \"Tomcat\" Book" <cbook@mozilla.com>
Date: Wed, 5 Nov 2014 15:19:53 +0100
Subject: [PATCH 149/153] Backed out changeset 1f590c2c40f0 (bug 1093028) for
 web-platform-2 test failures on a CLOSED TREE

---
 dom/base/ImportManager.cpp                    |  4 ---
 .../file_blocking_DOMContentLoaded_A.html     | 11 ------
 .../file_blocking_DOMContentLoaded_B.html     | 11 ------
 .../file_blocking_DOMContentLoaded_C.html     | 11 ------
 .../file_blocking_DOMContentLoaded_D.html     | 10 ------
 dom/html/test/imports/mochitest.ini           |  6 ----
 .../test_blocking_DOMContentLoaded.html       | 36 -------------------
 7 files changed, 89 deletions(-)
 delete mode 100644 dom/html/test/imports/file_blocking_DOMContentLoaded_A.html
 delete mode 100644 dom/html/test/imports/file_blocking_DOMContentLoaded_B.html
 delete mode 100644 dom/html/test/imports/file_blocking_DOMContentLoaded_C.html
 delete mode 100644 dom/html/test/imports/file_blocking_DOMContentLoaded_D.html
 delete mode 100644 dom/html/test/imports/test_blocking_DOMContentLoaded.html

diff --git a/dom/base/ImportManager.cpp b/dom/base/ImportManager.cpp
index f322a903110..918bae5184a 100644
--- a/dom/base/ImportManager.cpp
+++ b/dom/base/ImportManager.cpp
@@ -149,7 +149,6 @@ ImportLoader::Updater::UpdateMainReferrer(uint32_t aNewIdx)
     // Our import parent is changed, let's block the new one and later unblock
     // the old one.
     newMainReferrer->OwnerDoc()->ScriptLoader()->AddExecuteBlocker();
-    newMainReferrer->OwnerDoc()->BlockDOMContentLoaded();
   }
 
   if (mLoader->mDocument) {
@@ -169,7 +168,6 @@ ImportLoader::Updater::UpdateMainReferrer(uint32_t aNewIdx)
 
   if (mLoader->IsBlocking()) {
     mLoader->mImportParent->ScriptLoader()->RemoveExecuteBlocker();
-    mLoader->mImportParent->UnblockDOMContentLoaded();
   }
 
   // Finally update mMainReferrer to point to the newly added link.
@@ -302,7 +300,6 @@ ImportLoader::BlockScripts()
 {
   MOZ_ASSERT(!mBlockingScripts);
   mImportParent->ScriptLoader()->AddExecuteBlocker();
-  mImportParent->BlockDOMContentLoaded();
   mBlockingScripts = true;
 }
 
@@ -311,7 +308,6 @@ ImportLoader::UnblockScripts()
 {
   MOZ_ASSERT(mBlockingScripts);
   mImportParent->ScriptLoader()->RemoveExecuteBlocker();
-  mImportParent->UnblockDOMContentLoaded();
   for (uint32_t i = 0; i < mBlockedScriptLoaders.Length(); i++) {
     mBlockedScriptLoaders[i]->RemoveExecuteBlocker();
   }
diff --git a/dom/html/test/imports/file_blocking_DOMContentLoaded_A.html b/dom/html/test/imports/file_blocking_DOMContentLoaded_A.html
deleted file mode 100644
index 2a18604ed10..00000000000
--- a/dom/html/test/imports/file_blocking_DOMContentLoaded_A.html
+++ /dev/null
@@ -1,11 +0,0 @@
-<!DOCTYPE html>
-<html lang="en-US">
-<head>
-  <script>
-    order.push("AS0");
-  </script>
-  <link rel="import" href="file_blocking_DOMContentLoaded_B.html" onload="loaded()" onerror="failed()"></link>
-</head>
-<body>
-</body>
-</html>
diff --git a/dom/html/test/imports/file_blocking_DOMContentLoaded_B.html b/dom/html/test/imports/file_blocking_DOMContentLoaded_B.html
deleted file mode 100644
index a69a38d168b..00000000000
--- a/dom/html/test/imports/file_blocking_DOMContentLoaded_B.html
+++ /dev/null
@@ -1,11 +0,0 @@
-<!DOCTYPE html>
-<html lang="en-US">
-<head>
-  <script>
-    order.push("BS0");
-  </script>
-  <link rel="import" href="file_blocking_DOMContentLoaded_C.html" onload="loaded()" onerror="failed()"></link>
-</head>
-<body>
-</body>
-</html>
diff --git a/dom/html/test/imports/file_blocking_DOMContentLoaded_C.html b/dom/html/test/imports/file_blocking_DOMContentLoaded_C.html
deleted file mode 100644
index 76719b1b23e..00000000000
--- a/dom/html/test/imports/file_blocking_DOMContentLoaded_C.html
+++ /dev/null
@@ -1,11 +0,0 @@
-<!DOCTYPE html>
-<html lang="en-US">
-<head>
-  <script>
-    order.push("CS0");
-  </script>
-  <link rel="import" href="file_blocking_DOMContentLoaded_D.html" onload="loaded()" onerror="failed()"></link>
-</head>
-<body>
-</body>
-</html>
diff --git a/dom/html/test/imports/file_blocking_DOMContentLoaded_D.html b/dom/html/test/imports/file_blocking_DOMContentLoaded_D.html
deleted file mode 100644
index 0ae10e702b2..00000000000
--- a/dom/html/test/imports/file_blocking_DOMContentLoaded_D.html
+++ /dev/null
@@ -1,10 +0,0 @@
-<!DOCTYPE html>
-<html lang="en-US">
-<head>
-  <script>
-    order.push("DS0");
-  </script>
-</head>
-<body>
-</body>
-</html>
diff --git a/dom/html/test/imports/mochitest.ini b/dom/html/test/imports/mochitest.ini
index f37fd344a45..10f8ce54594 100644
--- a/dom/html/test/imports/mochitest.ini
+++ b/dom/html/test/imports/mochitest.ini
@@ -33,10 +33,6 @@ support-files =
   file_cycle_4_E.html
   file_encoding.html
   file_simple_import.html
-  file_blocking_DOMContentLoaded_A.html
-  file_blocking_DOMContentLoaded_B.html
-  file_blocking_DOMContentLoaded_C.html
-  file_blocking_DOMContentLoaded_D.html
 
 [test_cycle_1.html]
 skip-if = toolkit == 'gonk' # nested imports fail on b2g emulator
@@ -46,7 +42,5 @@ skip-if = toolkit == 'gonk' # nested imports fail on b2g emulator
 skip-if = toolkit == 'gonk' # nested imports fail on b2g emulator
 [test_cycle_4.html]
 skip-if = toolkit == 'gonk' # nested imports fail on b2g emulator
-[test_blocking_DOMContentLoaded.html]
-skip-if = toolkit == 'gonk' # nested imports fail on b2g emulator
 [test_encoding.html]
 [test_defaultView.html]
diff --git a/dom/html/test/imports/test_blocking_DOMContentLoaded.html b/dom/html/test/imports/test_blocking_DOMContentLoaded.html
deleted file mode 100644
index 9fa32e5cab0..00000000000
--- a/dom/html/test/imports/test_blocking_DOMContentLoaded.html
+++ /dev/null
@@ -1,36 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=1093028
--->
-<head>
-  <title>Test for Bug 1093028</title>
-  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
-  <meta http-equiv="Content-Type" content="text/html;charset=utf-8">
-</head>
-<body>
-  <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1093028">Mozilla Bug 1093028</a>
-  <script type="text/javascript">
-    SimpleTest.waitForExplicitFinish();
-    var counter = 0;
-    var fcounter = 0;
-    var order = [];
-    function loaded() {
-      counter++;
-    }
-    function failed() {
-      fcounter++;
-    }
-  </script>
-  <link rel="import" href="file_blocking_DOMContentLoaded_A.html" onload="loaded()" onerror="failed()"></link>
-  <script type="text/javascript">
-    is(counter, 4, "Imports are loaded");
-    is(fcounter, 0, "No error in imports");
-    var expected = ["AS0","BS0","CS0","DS0"];
-    for (i in expected)
-      is(order[i], expected[i], "import " + i + " should be " + expected[i]);
-    SimpleTest.finish();
-  </script>
-</body>
-</html>

From 3bb9fc90ba8732916c7ebb16250dc1f9f7371e93 Mon Sep 17 00:00:00 2001
From: "Carsten \"Tomcat\" Book" <cbook@mozilla.com>
Date: Wed, 5 Nov 2014 15:20:25 +0100
Subject: [PATCH 150/153] Backed out 7 changesets (bug 1084651) for ASAN
 Bustage on a CLOSED TREE

Backed out changeset dd2b3e78b425 (bug 1084651)
Backed out changeset 2711fbd91819 (bug 1084651)
Backed out changeset 59a163addd79 (bug 1084651)
Backed out changeset d36f6dbbf925 (bug 1084651)
Backed out changeset 78102b62a4a0 (bug 1084651)
Backed out changeset 06387a2343a0 (bug 1084651)
Backed out changeset 2f8e7c39573e (bug 1084651)
---
 dom/base/nsJSEnvironment.cpp                  |  14 +--
 .../test_promise_resolved_with_string.html    |   4 +-
 js/public/SliceBudget.h                       |  46 +++----
 js/src/builtin/TestingFunctions.cpp           |  11 +-
 js/src/gc/GCRuntime.h                         |  10 +-
 .../jit-test/tests/auto-regress/bug755639.js  |   2 +-
 .../jit-test/tests/auto-regress/bug758164.js  |   2 +-
 .../jit-test/tests/auto-regress/bug783421.js  |   2 +-
 .../jit-test/tests/auto-regress/bug812235.js  |   2 +-
 .../jit-test/tests/auto-regress/bug813029.js  |   4 +-
 js/src/jit-test/tests/basic/bug754242.js      |   2 +-
 js/src/jit-test/tests/basic/bug767234.js      |   2 +-
 js/src/jit-test/tests/basic/bug782337.js      |   2 +-
 js/src/jit-test/tests/basic/bug808067.js      |   2 +-
 js/src/jit-test/tests/basic/bug817002.js      |   2 +-
 .../jit-test/tests/basic/evaluate-worker.js   |   2 +-
 js/src/jit-test/tests/gc/bug-886551-1.js      |   2 +-
 js/src/jit-test/tests/gc/bug-886551-2.js      |   2 +-
 js/src/jit-test/tests/gc/bug-889682-1.js      |   2 +-
 js/src/jit-test/tests/gc/bug-889682-2.js      |   2 +-
 js/src/jit-test/tests/gc/bug-889682-3.js      |   2 +-
 js/src/jit-test/tests/gc/bug-981295.js        |   2 +-
 js/src/jit-test/tests/gc/incremental-01.js    |   2 +-
 js/src/jit-test/tests/gc/incremental-02.js    |   2 +-
 js/src/jit-test/tests/gc/multi-02.js          |   2 +-
 js/src/jit-test/tests/gc/multi-03.js          |   2 +-
 js/src/jsapi-tests/testGCFinalizeCallback.cpp |   6 +-
 js/src/jsapi-tests/testWeakMap.cpp            |   6 +-
 js/src/jsgc.cpp                               | 117 +++++++++---------
 js/src/tests/js1_8_5/extensions/typedarray.js |   2 +-
 xpcom/base/nsCycleCollector.cpp               |  29 ++++-
 xpcom/base/nsCycleCollector.h                 |  10 +-
 32 files changed, 154 insertions(+), 145 deletions(-)

diff --git a/dom/base/nsJSEnvironment.cpp b/dom/base/nsJSEnvironment.cpp
index c8ee786b2c9..8d3334bd245 100644
--- a/dom/base/nsJSEnvironment.cpp
+++ b/dom/base/nsJSEnvironment.cpp
@@ -45,7 +45,6 @@
 
 #include "jsapi.h"
 #include "jswrapper.h"
-#include "js/SliceBudget.h"
 #include "nsIArray.h"
 #include "nsIObjectInputStream.h"
 #include "nsIObjectOutputStream.h"
@@ -1693,24 +1692,24 @@ nsJSContext::RunCycleCollectorSlice()
 
   // Decide how long we want to budget for this slice. By default,
   // use an unlimited budget.
-  js::SliceBudget budget;
+  int64_t sliceBudget = -1;
 
   if (sIncrementalCC) {
     if (gCCStats.mBeginTime.IsNull()) {
       // If no CC is in progress, use the standard slice time.
-      budget = js::SliceBudget(js::TimeBudget(kICCSliceBudget));
+      sliceBudget = kICCSliceBudget;
     } else {
       TimeStamp now = TimeStamp::Now();
 
       // Only run a limited slice if we're within the max running time.
       if (TimeBetween(gCCStats.mBeginTime, now) < kMaxICCDuration) {
         float sliceMultiplier = std::max(TimeBetween(gCCStats.mEndSliceTime, now) / (float)kICCIntersliceDelay, 1.0f);
-        budget = js::SliceBudget(js::TimeBudget(kICCSliceBudget * sliceMultiplier));
+        sliceBudget = kICCSliceBudget * sliceMultiplier;
       }
     }
   }
 
-  nsCycleCollector_collectSlice(budget);
+  nsCycleCollector_collectSlice(sliceBudget);
 
   gCCStats.FinishCycleCollectionSlice();
 }
@@ -1727,10 +1726,7 @@ nsJSContext::RunCycleCollectorWorkSlice(int64_t aWorkBudget)
     js::ProfileEntry::Category::CC);
 
   gCCStats.PrepareForCycleCollectionSlice();
-
-  js::SliceBudget budget = js::SliceBudget(js::WorkBudget(aWorkBudget));
-  nsCycleCollector_collectSlice(budget);
-
+  nsCycleCollector_collectSliceWork(aWorkBudget);
   gCCStats.FinishCycleCollectionSlice();
 }
 
diff --git a/dom/workers/test/test_promise_resolved_with_string.html b/dom/workers/test/test_promise_resolved_with_string.html
index 28caaaaa820..b63ddb900d7 100644
--- a/dom/workers/test/test_promise_resolved_with_string.html
+++ b/dom/workers/test/test_promise_resolved_with_string.html
@@ -15,12 +15,12 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1027221
     SimpleTest.waitForExplicitFinish();
     var x = "x";
     // Trigger some incremental gc
-    SpecialPowers.Cu.getJSTestingFunctions().gcslice(1);
+    SpecialPowers.Cu.getJSTestingFunctions().gcslice(0);
 
     // Kick off a worker that uses this same atom
     var w = new Worker("data:text/plain,Promise.resolve('x').then(function() { postMessage(1); });");
     // Maybe trigger some more incremental gc
-    SpecialPowers.Cu.getJSTestingFunctions().gcslice(1);
+    SpecialPowers.Cu.getJSTestingFunctions().gcslice(0);
 
     w.onmessage = function() {
       ok(true, "Got here");
diff --git a/js/public/SliceBudget.h b/js/public/SliceBudget.h
index 22e260fd04e..7c602c5572a 100644
--- a/js/public/SliceBudget.h
+++ b/js/public/SliceBudget.h
@@ -11,25 +11,11 @@
 
 namespace js {
 
-struct JS_PUBLIC_API(TimeBudget)
-{
-    int64_t budget;
-
-    explicit TimeBudget(int64_t milliseconds) { budget = milliseconds; }
-};
-
-struct JS_PUBLIC_API(WorkBudget)
-{
-    int64_t budget;
-
-    explicit WorkBudget(int64_t work) { budget = work; }
-};
-
 /*
- * This class records how much work has been done in a given collection slice,
- * so that we can return before pausing for too long. Some slices are allowed
- * to run for unlimited time, and others are bounded. To reduce the number of
- * gettimeofday calls, we only check the time every 1000 operations.
+ * This class records how much work has been done in a given collection slice, so that
+ * we can return before pausing for too long. Some slices are allowed to run for
+ * unlimited time, and others are bounded. To reduce the number of gettimeofday
+ * calls, we only check the time every 1000 operations.
  */
 struct JS_PUBLIC_API(SliceBudget)
 {
@@ -38,18 +24,17 @@ struct JS_PUBLIC_API(SliceBudget)
 
     static const intptr_t CounterReset = 1000;
 
-    static const int64_t Unlimited = -1;
+    static const int64_t Unlimited = 0;
+    static int64_t TimeBudget(int64_t millis);
+    static int64_t WorkBudget(int64_t work);
 
-    /* Use to create an unlimited budget. */
+    /* Equivalent to SliceBudget(UnlimitedBudget). */
     SliceBudget();
 
-    /* Instantiate as SliceBudget(TimeBudget(n)). */
-    explicit SliceBudget(TimeBudget time);
+    /* Instantiate as SliceBudget(Time/WorkBudget(n)). */
+    explicit SliceBudget(int64_t budget);
 
-    /* Instantiate as SliceBudget(WorkBudget(n)). */
-    explicit SliceBudget(WorkBudget work);
-
-    void makeUnlimited() {
+    void reset() {
         deadline = unlimitedDeadline;
         counter = unlimitedStartCounter;
     }
@@ -58,8 +43,10 @@ struct JS_PUBLIC_API(SliceBudget)
         counter -= amt;
     }
 
+    bool checkOverBudget();
+
     bool isOverBudget() {
-        if (counter > 0)
+        if (counter >= 0)
             return false;
         return checkOverBudget();
     }
@@ -68,11 +55,10 @@ struct JS_PUBLIC_API(SliceBudget)
         return deadline == unlimitedDeadline;
     }
 
-  private:
-    bool checkOverBudget();
-
+private:
     static const int64_t unlimitedDeadline = INT64_MAX;
     static const intptr_t unlimitedStartCounter = INTPTR_MAX;
+
 };
 
 } // namespace js
diff --git a/js/src/builtin/TestingFunctions.cpp b/js/src/builtin/TestingFunctions.cpp
index 1a88fd349be..55b851a7220 100644
--- a/js/src/builtin/TestingFunctions.cpp
+++ b/js/src/builtin/TestingFunctions.cpp
@@ -628,15 +628,16 @@ GCSlice(JSContext *cx, unsigned argc, Value *vp)
         return false;
     }
 
-    SliceBudget budget;
+    bool limit = true;
+    uint32_t budget = 0;
     if (args.length() == 1) {
-        uint32_t work = 0;
-        if (!ToUint32(cx, args[0], &work))
+        if (!ToUint32(cx, args[0], &budget))
             return false;
-        budget = SliceBudget(WorkBudget(work));
+    } else {
+        limit = false;
     }
 
-    cx->runtime()->gc.gcDebugSlice(budget);
+    cx->runtime()->gc.gcDebugSlice(limit, budget);
     args.rval().setUndefined();
     return true;
 }
diff --git a/js/src/gc/GCRuntime.h b/js/src/gc/GCRuntime.h
index faab260bbf4..e09de781dcd 100644
--- a/js/src/gc/GCRuntime.h
+++ b/js/src/gc/GCRuntime.h
@@ -281,7 +281,7 @@ class GCRuntime
     void gc(JSGCInvocationKind gckind, JS::gcreason::Reason reason);
     void gcSlice(JSGCInvocationKind gckind, JS::gcreason::Reason reason, int64_t millis = 0);
     void gcFinalSlice(JSGCInvocationKind gckind, JS::gcreason::Reason reason);
-    void gcDebugSlice(SliceBudget &budget);
+    void gcDebugSlice(bool limit, int64_t objCount);
 
     void runDebugGC();
     inline void poke();
@@ -509,14 +509,14 @@ class GCRuntime
 
     bool initZeal();
     void requestMajorGC(JS::gcreason::Reason reason);
-    void collect(bool incremental, SliceBudget &budget, JSGCInvocationKind gckind,
+    void collect(bool incremental, int64_t budget, JSGCInvocationKind gckind,
                  JS::gcreason::Reason reason);
-    bool gcCycle(bool incremental, SliceBudget &budget, JSGCInvocationKind gckind,
+    bool gcCycle(bool incremental, int64_t budget, JSGCInvocationKind gckind,
                  JS::gcreason::Reason reason);
     gcstats::ZoneGCStats scanZonesBeforeGC();
-    void budgetIncrementalGC(SliceBudget &budget);
+    void budgetIncrementalGC(int64_t *budget);
     void resetIncrementalGC(const char *reason);
-    void incrementalCollectSlice(SliceBudget &budget, JS::gcreason::Reason reason);
+    void incrementalCollectSlice(int64_t budget, JS::gcreason::Reason reason);
     void pushZealSelectedObjects();
     void purgeRuntime();
     bool beginMarkPhase(JS::gcreason::Reason reason);
diff --git a/js/src/jit-test/tests/auto-regress/bug755639.js b/js/src/jit-test/tests/auto-regress/bug755639.js
index dc376f69e69..cc6d9fe20be 100644
--- a/js/src/jit-test/tests/auto-regress/bug755639.js
+++ b/js/src/jit-test/tests/auto-regress/bug755639.js
@@ -28,7 +28,7 @@ gcPreserveCode();
 try {
   mjitChunkLimit(1);
 } catch(exc1) {}
-gcslice(1);
+gcslice(0);
 m(1);
 gc();
 m(2);
diff --git a/js/src/jit-test/tests/auto-regress/bug758164.js b/js/src/jit-test/tests/auto-regress/bug758164.js
index fa94c520a6b..4230db3faa8 100644
--- a/js/src/jit-test/tests/auto-regress/bug758164.js
+++ b/js/src/jit-test/tests/auto-regress/bug758164.js
@@ -3,4 +3,4 @@
 //
 
 gc();
-evaluate("gcslice(1);");
+evaluate("gcslice(0);");
diff --git a/js/src/jit-test/tests/auto-regress/bug783421.js b/js/src/jit-test/tests/auto-regress/bug783421.js
index 920a78f9785..c92a6328f88 100644
--- a/js/src/jit-test/tests/auto-regress/bug783421.js
+++ b/js/src/jit-test/tests/auto-regress/bug783421.js
@@ -20,7 +20,7 @@ function h(code) {
 h("\
   p=m();\
   gcPreserveCode();\
-  gcslice(8);\
+  gcslice(7);\
 ")
 h("\"\"")
 h("")
diff --git a/js/src/jit-test/tests/auto-regress/bug812235.js b/js/src/jit-test/tests/auto-regress/bug812235.js
index e4a355321b2..db57efb41bc 100644
--- a/js/src/jit-test/tests/auto-regress/bug812235.js
+++ b/js/src/jit-test/tests/auto-regress/bug812235.js
@@ -3,7 +3,7 @@
 //
 gc()
 schedulegc(this)
-gcslice(3)
+gcslice(2)
 function f() {
     this["x"] = this["x"] = {}
 }
diff --git a/js/src/jit-test/tests/auto-regress/bug813029.js b/js/src/jit-test/tests/auto-regress/bug813029.js
index 34e2145f6d9..5fed924689a 100644
--- a/js/src/jit-test/tests/auto-regress/bug813029.js
+++ b/js/src/jit-test/tests/auto-regress/bug813029.js
@@ -5,8 +5,8 @@
 function printBugNumber (num) {
   BUGNUMBER = num;
 }
-gcslice(1)
+gcslice(0)
 schedulegc(this);
-gcslice(2);
+gcslice(1);
 var BUGNUMBER = ("one");
 printBugNumber();
diff --git a/js/src/jit-test/tests/basic/bug754242.js b/js/src/jit-test/tests/basic/bug754242.js
index 58d4e0ee0e2..8a0895cb12d 100644
--- a/js/src/jit-test/tests/basic/bug754242.js
+++ b/js/src/jit-test/tests/basic/bug754242.js
@@ -1,6 +1,6 @@
 var g1 = newGlobal();
 schedulegc(g1);
-gcslice(1);
+gcslice(0);
 function testEq(b) {
     var a = deserialize(serialize(b));
 }
diff --git a/js/src/jit-test/tests/basic/bug767234.js b/js/src/jit-test/tests/basic/bug767234.js
index 0c073d1116d..44b1323b1a9 100644
--- a/js/src/jit-test/tests/basic/bug767234.js
+++ b/js/src/jit-test/tests/basic/bug767234.js
@@ -4,7 +4,7 @@ function gen()
     yield 1;
     local = null;
     gc();
-    gcslice(0); // Start IGC, but don't mark anything.
+    gcslice(0);
     yield 2;
 }
 
diff --git a/js/src/jit-test/tests/basic/bug782337.js b/js/src/jit-test/tests/basic/bug782337.js
index 2ddb7bcaf09..8e96ee5a4db 100644
--- a/js/src/jit-test/tests/basic/bug782337.js
+++ b/js/src/jit-test/tests/basic/bug782337.js
@@ -12,5 +12,5 @@ function recur(n)
 }
 
 validategc(false);
-gcslice(1);
+gcslice(0);
 recur(10);
diff --git a/js/src/jit-test/tests/basic/bug808067.js b/js/src/jit-test/tests/basic/bug808067.js
index 74f721ec90c..cac3a3944ce 100644
--- a/js/src/jit-test/tests/basic/bug808067.js
+++ b/js/src/jit-test/tests/basic/bug808067.js
@@ -11,8 +11,8 @@ expect = "generator function foo returns a value";
 actual = (function (j)  {}).message;
 reportCompare(expect, actual, summary + ": 1");
 reportCompare(expect, actual, summary + ": 2");
+gcslice(0);
 gcslice(1);
-gcslice(2);
 gc();
 var strings = [ (0), ];
 for (var i = 0; i < strings.length; i++)
diff --git a/js/src/jit-test/tests/basic/bug817002.js b/js/src/jit-test/tests/basic/bug817002.js
index e6839680bff..2eb8fb22032 100644
--- a/js/src/jit-test/tests/basic/bug817002.js
+++ b/js/src/jit-test/tests/basic/bug817002.js
@@ -4,7 +4,7 @@ evalcx("\
       gcslice = function() { };\
     array = new Uint8Array;\
     t0 = array.subarray();\
-    gcslice(12); \
+    gcslice(11); \
     array.subarray();\
     gc();\
     gc();\
diff --git a/js/src/jit-test/tests/basic/evaluate-worker.js b/js/src/jit-test/tests/basic/evaluate-worker.js
index 3c810a43e55..b827d8aca0d 100644
--- a/js/src/jit-test/tests/basic/evaluate-worker.js
+++ b/js/src/jit-test/tests/basic/evaluate-worker.js
@@ -3,7 +3,7 @@
 if (typeof evalInWorker == "undefined")
     quit();
 
-gcslice(11);
+gcslice(10);
 evalInWorker("print('helo world');");
 for (i = 0; i < 100000; i++) {}
 
diff --git a/js/src/jit-test/tests/gc/bug-886551-1.js b/js/src/jit-test/tests/gc/bug-886551-1.js
index b3f2bcd45f8..59df90fe2c9 100644
--- a/js/src/jit-test/tests/gc/bug-886551-1.js
+++ b/js/src/jit-test/tests/gc/bug-886551-1.js
@@ -1,6 +1,6 @@
 if (this.hasOwnProperty('Intl')) {
     gc();
-    gcslice(1);
+    gcslice(0);
     var thisValues = [ "x" ];
     thisValues.forEach(function (value) {
             var format = Intl.DateTimeFormat.call(value);
diff --git a/js/src/jit-test/tests/gc/bug-886551-2.js b/js/src/jit-test/tests/gc/bug-886551-2.js
index 9381c867d5f..750d8f0d3c3 100644
--- a/js/src/jit-test/tests/gc/bug-886551-2.js
+++ b/js/src/jit-test/tests/gc/bug-886551-2.js
@@ -1,5 +1,5 @@
 gc();
-gcslice(1);
+gcslice(0);
 function isClone(a, b) {
         var rmemory = new WeakMap();
             rmemory.set(a,b);
diff --git a/js/src/jit-test/tests/gc/bug-889682-1.js b/js/src/jit-test/tests/gc/bug-889682-1.js
index 75b3f4089bc..ff9c21458da 100644
--- a/js/src/jit-test/tests/gc/bug-889682-1.js
+++ b/js/src/jit-test/tests/gc/bug-889682-1.js
@@ -9,5 +9,5 @@ var recursiveFunctions = [{
         eval(a.text.replace(/@/g, ""))
     }
 })();
-gcslice(2869);
+gcslice(2868);
 Function("v={c:[{x:[[]],N:{x:[{}[d]]}}]}=minorgc(true)")()
diff --git a/js/src/jit-test/tests/gc/bug-889682-2.js b/js/src/jit-test/tests/gc/bug-889682-2.js
index efc47337a22..6539d31eb18 100644
--- a/js/src/jit-test/tests/gc/bug-889682-2.js
+++ b/js/src/jit-test/tests/gc/bug-889682-2.js
@@ -10,5 +10,5 @@ var recursiveFunctions = [{
         eval(a.text.replace(/@/g, ""))
     }
 })();
-gcslice(2869);
+gcslice(2868);
 Function("v={c:[{x:[[]],N:{x:[{}[d]]}}]}=minorgc(true)")()
diff --git a/js/src/jit-test/tests/gc/bug-889682-3.js b/js/src/jit-test/tests/gc/bug-889682-3.js
index 601c8300a4e..0bcf58590cd 100644
--- a/js/src/jit-test/tests/gc/bug-889682-3.js
+++ b/js/src/jit-test/tests/gc/bug-889682-3.js
@@ -10,5 +10,5 @@ var recursiveFunctions = [{
         eval(a.text.replace(/@/g, ""))
     }
 })();
-gcslice(2869);
+gcslice(2868);
 Function("v={c:[{x:[[]],N:{x:[{}[d]]}}]}=minorgc(true)")()
diff --git a/js/src/jit-test/tests/gc/bug-981295.js b/js/src/jit-test/tests/gc/bug-981295.js
index 691c06bde90..80e292c840e 100644
--- a/js/src/jit-test/tests/gc/bug-981295.js
+++ b/js/src/jit-test/tests/gc/bug-981295.js
@@ -4,6 +4,6 @@ var juneDate = new Date(2000, 5, 20, 0, 0, 0, 0);
 for (var i = 0; i < function(x) myObj(Date.prototype.toString.apply(x)); void i) {
     eval(a.text.replace(/@/g, ""))
 }
-gcslice(2601);
+gcslice(2600);
 function testcase() {}
 new Uint16Array(testcase);
diff --git a/js/src/jit-test/tests/gc/incremental-01.js b/js/src/jit-test/tests/gc/incremental-01.js
index d4646c16562..a3ed478faac 100644
--- a/js/src/jit-test/tests/gc/incremental-01.js
+++ b/js/src/jit-test/tests/gc/incremental-01.js
@@ -23,7 +23,7 @@ function init()
  */
 eval("init()");
 
-gcslice(0); // Start IGC, but don't mark anything.
+gcslice(0);
 selectforgc(objs.root2);
 gcslice(1);
 objs.root2.ptr = objs.root1.ptr;
diff --git a/js/src/jit-test/tests/gc/incremental-02.js b/js/src/jit-test/tests/gc/incremental-02.js
index a2a2c8de85f..4e317a42df9 100644
--- a/js/src/jit-test/tests/gc/incremental-02.js
+++ b/js/src/jit-test/tests/gc/incremental-02.js
@@ -22,7 +22,7 @@ function init()
  */
 eval("init()");
 
-gcslice(0); // Start IGC, but don't mark anything.
+gcslice(0);
 selectforgc(objs.root);
 gcslice(1);
 delete objs.root.b;
diff --git a/js/src/jit-test/tests/gc/multi-02.js b/js/src/jit-test/tests/gc/multi-02.js
index 56cae455707..aae22649aac 100644
--- a/js/src/jit-test/tests/gc/multi-02.js
+++ b/js/src/jit-test/tests/gc/multi-02.js
@@ -4,7 +4,7 @@ var g1 = newGlobal();
 var g2 = newGlobal();
 
 schedulegc(g1);
-gcslice(0); // Start IGC, but don't mark anything.
+gcslice(0);
 schedulegc(g2);
 gcslice(1);
 gcslice();
diff --git a/js/src/jit-test/tests/gc/multi-03.js b/js/src/jit-test/tests/gc/multi-03.js
index fd9bd0830a6..aa8c3f4ac11 100644
--- a/js/src/jit-test/tests/gc/multi-03.js
+++ b/js/src/jit-test/tests/gc/multi-03.js
@@ -5,7 +5,7 @@ var g2 = newGlobal();
 
 schedulegc(g1);
 schedulegc(g2);
-gcslice(0); // Start IGC, but don't mark anything.
+gcslice(0);
 schedulegc(g1);
 gcslice(1);
 gcslice();
diff --git a/js/src/jsapi-tests/testGCFinalizeCallback.cpp b/js/src/jsapi-tests/testGCFinalizeCallback.cpp
index 049d2445622..16ec36b58e5 100644
--- a/js/src/jsapi-tests/testGCFinalizeCallback.cpp
+++ b/js/src/jsapi-tests/testGCFinalizeCallback.cpp
@@ -87,14 +87,12 @@ BEGIN_TEST(testGCFinalizeCallback)
     FinalizeCalls = 0;
     JS_SetGCZeal(cx, 9, 1000000);
     JS::PrepareForFullGC(rt);
-    js::SliceBudget budget(js::WorkBudget(1));
-    rt->gc.gcDebugSlice(budget);
+    rt->gc.gcDebugSlice(true, 1);
     CHECK(rt->gc.state() == js::gc::MARK);
     CHECK(rt->gc.isFullGc());
 
     JS::RootedObject global4(cx, createTestGlobal());
-    budget = js::SliceBudget(js::WorkBudget(1));
-    rt->gc.gcDebugSlice(budget);
+    rt->gc.gcDebugSlice(true, 1);
     CHECK(rt->gc.state() == js::gc::NO_INCREMENTAL);
     CHECK(!rt->gc.isFullGc());
     CHECK(checkMultipleGroups());
diff --git a/js/src/jsapi-tests/testWeakMap.cpp b/js/src/jsapi-tests/testWeakMap.cpp
index 74f05538c97..8a85ab3c85f 100644
--- a/js/src/jsapi-tests/testWeakMap.cpp
+++ b/js/src/jsapi-tests/testWeakMap.cpp
@@ -89,8 +89,7 @@ BEGIN_TEST(testWeakMap_keyDelegates)
      * zone to finish marking before the delegate zone.
      */
     CHECK(newCCW(map, delegate));
-    js::SliceBudget budget(js::WorkBudget(1000000));
-    rt->gc.gcDebugSlice(budget);
+    rt->gc.gcDebugSlice(true, 1000000);
 #ifdef DEBUG
     CHECK(map->zone()->lastZoneGroupIndex() < delegate->zone()->lastZoneGroupIndex());
 #endif
@@ -103,8 +102,7 @@ BEGIN_TEST(testWeakMap_keyDelegates)
     /* Check the delegate keeps the entry alive even if the key is not reachable. */
     key = nullptr;
     CHECK(newCCW(map, delegate));
-    budget = js::SliceBudget(js::WorkBudget(100000));
-    rt->gc.gcDebugSlice(budget);
+    rt->gc.gcDebugSlice(true, 100000);
     CHECK(checkSize(map, 1));
 
     /*
diff --git a/js/src/jsgc.cpp b/js/src/jsgc.cpp
index 551e9509e57..1ffacbdb245 100644
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@@ -1457,7 +1457,7 @@ GCRuntime::setParameter(JSGCParamKey key, uint32_t value)
         setMaxMallocBytes(value);
         break;
       case JSGC_SLICE_TIME_BUDGET:
-        sliceBudget = value ? value : SliceBudget::Unlimited;
+        sliceBudget = SliceBudget::TimeBudget(value);
         break;
       case JSGC_MARK_STACK_LIMIT:
         setMarkStackLimit(value);
@@ -1554,7 +1554,7 @@ GCRuntime::getParameter(JSGCParamKey key, const AutoLockGC &lock)
       case JSGC_TOTAL_CHUNKS:
         return uint32_t(chunkSet.count() + emptyChunks(lock).count());
       case JSGC_SLICE_TIME_BUDGET:
-        return uint32_t(sliceBudget > 0 ? sliceBudget : 0);
+        return uint32_t(sliceBudget > 0 ? sliceBudget / PRMJ_USEC_PER_MSEC : 0);
       case JSGC_MARK_STACK_LIMIT:
         return marker.maxCapacity();
       case JSGC_HIGH_FREQUENCY_TIME_LIMIT:
@@ -2930,36 +2930,41 @@ GCRuntime::refillFreeListInGC(Zone *zone, AllocKind thingKind)
     return allocator.arenas.allocateFromArena(zone, thingKind);
 }
 
+/* static */ int64_t
+SliceBudget::TimeBudget(int64_t millis)
+{
+    return millis * PRMJ_USEC_PER_MSEC;
+}
+
+/* static */ int64_t
+SliceBudget::WorkBudget(int64_t work)
+{
+    /* For work = 0 not to mean Unlimited, we subtract 1. */
+    return -work - 1;
+}
+
 SliceBudget::SliceBudget()
 {
-    makeUnlimited();
+    reset();
 }
 
-SliceBudget::SliceBudget(TimeBudget time)
+SliceBudget::SliceBudget(int64_t budget)
 {
-    if (time.budget < 0) {
-        makeUnlimited();
-    } else {
-        // Note: TimeBudget(0) is equivalent to WorkBudget(CounterReset).
-        deadline = PRMJ_Now() + time.budget * PRMJ_USEC_PER_MSEC;
+    if (budget == Unlimited) {
+        reset();
+    } else if (budget > 0) {
+        deadline = PRMJ_Now() + budget;
         counter = CounterReset;
-    }
-}
-
-SliceBudget::SliceBudget(WorkBudget work)
-{
-    if (work.budget < 0) {
-        makeUnlimited();
     } else {
         deadline = 0;
-        counter = work.budget;
+        counter = -budget - 1;
     }
 }
 
 bool
 SliceBudget::checkOverBudget()
 {
-    bool over = PRMJ_Now() >= deadline;
+    bool over = PRMJ_Now() > deadline;
     if (!over)
         counter = CounterReset;
     return over;
@@ -5528,7 +5533,7 @@ GCRuntime::resetIncrementalGC(const char *reason)
         break;
       }
 
-      case SWEEP: {
+      case SWEEP:
         marker.reset();
 
         for (CompartmentsIter c(rt, SkipAtoms); !c.done(); c.next())
@@ -5536,15 +5541,13 @@ GCRuntime::resetIncrementalGC(const char *reason)
 
         /* Finish sweeping the current zone group, then abort. */
         abortSweepAfterCurrentGroup = true;
-        SliceBudget budget;
-        incrementalCollectSlice(budget, JS::gcreason::RESET);
+        incrementalCollectSlice(SliceBudget::Unlimited, JS::gcreason::RESET);
 
         {
             gcstats::AutoPhase ap(stats, gcstats::PHASE_WAIT_BACKGROUND_THREAD);
             rt->gc.waitBackgroundSweepOrAllocEnd();
         }
         break;
-      }
 
       default:
         MOZ_CRASH("Invalid incremental GC state");
@@ -5632,7 +5635,8 @@ GCRuntime::pushZealSelectedObjects()
 }
 
 void
-GCRuntime::incrementalCollectSlice(SliceBudget &budget, JS::gcreason::Reason reason)
+GCRuntime::incrementalCollectSlice(int64_t budget,
+                                   JS::gcreason::Reason reason)
 {
     MOZ_ASSERT(rt->currentThreadHasExclusiveAccess());
 
@@ -5645,7 +5649,7 @@ GCRuntime::incrementalCollectSlice(SliceBudget &budget, JS::gcreason::Reason rea
 
     int zeal = 0;
 #ifdef JS_GC_ZEAL
-    if (reason == JS::gcreason::DEBUG_GC && !budget.isUnlimited()) {
+    if (reason == JS::gcreason::DEBUG_GC && budget != SliceBudget::Unlimited) {
         /*
          * Do the incremental collection type specified by zeal mode if the
          * collection was triggered by runDebugGC() and incremental GC has not
@@ -5656,16 +5660,18 @@ GCRuntime::incrementalCollectSlice(SliceBudget &budget, JS::gcreason::Reason rea
 #endif
 
     MOZ_ASSERT_IF(incrementalState != NO_INCREMENTAL, isIncremental);
-    isIncremental = !budget.isUnlimited();
+    isIncremental = budget != SliceBudget::Unlimited;
 
     if (zeal == ZealIncrementalRootsThenFinish || zeal == ZealIncrementalMarkAllThenFinish) {
         /*
          * Yields between slices occurs at predetermined points in these modes;
          * the budget is not used.
          */
-        budget.makeUnlimited();
+        budget = SliceBudget::Unlimited;
     }
 
+    SliceBudget sliceBudget(budget);
+
     if (incrementalState == NO_INCREMENTAL) {
         incrementalState = MARK_ROOTS;
         lastMarkSlice = false;
@@ -5695,11 +5701,11 @@ GCRuntime::incrementalCollectSlice(SliceBudget &budget, JS::gcreason::Reason rea
       case MARK: {
         /* If we needed delayed marking for gray roots, then collect until done. */
         if (!marker.hasBufferedGrayRoots()) {
-            budget.makeUnlimited();
+            sliceBudget.reset();
             isIncremental = false;
         }
 
-        bool finished = drainMarkStack(budget, gcstats::PHASE_MARK);
+        bool finished = drainMarkStack(sliceBudget, gcstats::PHASE_MARK);
         if (!finished)
             break;
 
@@ -5725,7 +5731,7 @@ GCRuntime::incrementalCollectSlice(SliceBudget &budget, JS::gcreason::Reason rea
          * now exhasted.
          */
         beginSweepPhase(lastGC);
-        if (budget.isOverBudget())
+        if (sliceBudget.isOverBudget())
             break;
 
         /*
@@ -5739,7 +5745,7 @@ GCRuntime::incrementalCollectSlice(SliceBudget &budget, JS::gcreason::Reason rea
       }
 
       case SWEEP: {
-        bool finished = sweepPhase(budget);
+        bool finished = sweepPhase(sliceBudget);
         if (!finished)
             break;
 
@@ -5780,32 +5786,32 @@ gc::IsIncrementalGCSafe(JSRuntime *rt)
 }
 
 void
-GCRuntime::budgetIncrementalGC(SliceBudget &budget)
+GCRuntime::budgetIncrementalGC(int64_t *budget)
 {
     IncrementalSafety safe = IsIncrementalGCSafe(rt);
     if (!safe) {
         resetIncrementalGC(safe.reason());
-        budget.makeUnlimited();
+        *budget = SliceBudget::Unlimited;
         stats.nonincremental(safe.reason());
         return;
     }
 
     if (mode != JSGC_MODE_INCREMENTAL) {
         resetIncrementalGC("GC mode change");
-        budget.makeUnlimited();
+        *budget = SliceBudget::Unlimited;
         stats.nonincremental("GC mode");
         return;
     }
 
     if (isTooMuchMalloc()) {
-        budget.makeUnlimited();
+        *budget = SliceBudget::Unlimited;
         stats.nonincremental("malloc bytes trigger");
     }
 
     bool reset = false;
     for (ZonesIter zone(rt, WithAtoms); !zone.done(); zone.next()) {
         if (zone->usage.gcBytes() >= zone->threshold.gcTriggerBytes()) {
-            budget.makeUnlimited();
+            *budget = SliceBudget::Unlimited;
             stats.nonincremental("allocation trigger");
         }
 
@@ -5816,7 +5822,7 @@ GCRuntime::budgetIncrementalGC(SliceBudget &budget)
         }
 
         if (zone->isTooMuchMalloc()) {
-            budget.makeUnlimited();
+            *budget = SliceBudget::Unlimited;
             stats.nonincremental("malloc bytes trigger");
         }
     }
@@ -5862,7 +5868,7 @@ struct AutoDisableStoreBuffer
  * to run another cycle.
  */
 MOZ_NEVER_INLINE bool
-GCRuntime::gcCycle(bool incremental, SliceBudget &budget, JSGCInvocationKind gckind,
+GCRuntime::gcCycle(bool incremental, int64_t budget, JSGCInvocationKind gckind,
                    JS::gcreason::Reason reason)
 {
     minorGC(reason);
@@ -5916,9 +5922,9 @@ GCRuntime::gcCycle(bool incremental, SliceBudget &budget, JSGCInvocationKind gck
             resetIncrementalGC("requested");
 
         stats.nonincremental("requested");
-        budget.makeUnlimited();
+        budget = SliceBudget::Unlimited;
     } else {
-        budgetIncrementalGC(budget);
+        budgetIncrementalGC(&budget);
     }
 
     /* The GC was reset, so we need a do-over. */
@@ -6011,7 +6017,7 @@ GCRuntime::scanZonesBeforeGC()
 }
 
 void
-GCRuntime::collect(bool incremental, SliceBudget &budget, JSGCInvocationKind gckind,
+GCRuntime::collect(bool incremental, int64_t budget, JSGCInvocationKind gckind,
                    JS::gcreason::Reason reason)
 {
     /* GC shouldn't be running in parallel execution mode */
@@ -6036,7 +6042,7 @@ GCRuntime::collect(bool incremental, SliceBudget &budget, JSGCInvocationKind gck
         return;
 #endif
 
-    MOZ_ASSERT_IF(!incremental || !budget.isUnlimited(), JSGC_INCREMENTAL);
+    MOZ_ASSERT_IF(!incremental || budget != SliceBudget::Unlimited, JSGC_INCREMENTAL);
 
     AutoStopVerifyingBarriers av(rt, reason == JS::gcreason::SHUTDOWN_CC ||
                                      reason == JS::gcreason::DESTROY_RUNTIME);
@@ -6103,22 +6109,21 @@ GCRuntime::collect(bool incremental, SliceBudget &budget, JSGCInvocationKind gck
 void
 GCRuntime::gc(JSGCInvocationKind gckind, JS::gcreason::Reason reason)
 {
-    SliceBudget budget;
-    collect(false, budget, gckind, reason);
+    collect(false, SliceBudget::Unlimited, gckind, reason);
 }
 
 void
 GCRuntime::gcSlice(JSGCInvocationKind gckind, JS::gcreason::Reason reason, int64_t millis)
 {
-    SliceBudget budget;
+    int64_t budget;
     if (millis)
-        budget = SliceBudget(TimeBudget(millis));
+        budget = SliceBudget::TimeBudget(millis);
     else if (reason == JS::gcreason::ALLOC_TRIGGER)
-        budget = SliceBudget(TimeBudget(sliceBudget));
+        budget = sliceBudget;
     else if (schedulingState.inHighFrequencyGCMode() && tunables.isDynamicMarkSliceEnabled())
-        budget = SliceBudget(TimeBudget(sliceBudget * IGC_MARK_SLICE_MULTIPLIER));
+        budget = sliceBudget * IGC_MARK_SLICE_MULTIPLIER;
     else
-        budget = SliceBudget(TimeBudget(sliceBudget));
+        budget = sliceBudget;
 
     collect(true, budget, gckind, reason);
 }
@@ -6126,8 +6131,7 @@ GCRuntime::gcSlice(JSGCInvocationKind gckind, JS::gcreason::Reason reason, int64
 void
 GCRuntime::gcFinalSlice(JSGCInvocationKind gckind, JS::gcreason::Reason reason)
 {
-    SliceBudget budget;
-    collect(true, budget, gckind, reason);
+    collect(true, SliceBudget::Unlimited, gckind, reason);
 }
 
 void
@@ -6170,8 +6174,9 @@ ZonesSelected(JSRuntime *rt)
 }
 
 void
-GCRuntime::gcDebugSlice(SliceBudget &budget)
+GCRuntime::gcDebugSlice(bool limit, int64_t objCount)
 {
+    int64_t budget = limit ? SliceBudget::WorkBudget(objCount) : SliceBudget::Unlimited;
     if (!ZonesSelected(rt)) {
         if (JS::IsIncrementalGCInProgress(rt))
             JS::PrepareForIncrementalGC(rt);
@@ -6422,12 +6427,12 @@ GCRuntime::runDebugGC()
 
     PrepareForDebugGC(rt);
 
-    SliceBudget budget;
     if (type == ZealIncrementalRootsThenFinish ||
         type == ZealIncrementalMarkAllThenFinish ||
         type == ZealIncrementalMultipleSlices)
     {
         js::gc::State initialState = incrementalState;
+        int64_t budget;
         if (type == ZealIncrementalMultipleSlices) {
             /*
              * Start with a small slice limit and double it every slice. This
@@ -6438,10 +6443,10 @@ GCRuntime::runDebugGC()
                 incrementalLimit = zealFrequency / 2;
             else
                 incrementalLimit *= 2;
-            budget = SliceBudget(WorkBudget(incrementalLimit));
+            budget = SliceBudget::WorkBudget(incrementalLimit);
         } else {
             // This triggers incremental GC but is actually ignored by IncrementalMarkSlice.
-            budget = SliceBudget(WorkBudget(1));
+            budget = SliceBudget::WorkBudget(1);
         }
 
         collect(true, budget, GC_NORMAL, JS::gcreason::DEBUG_GC);
@@ -6456,9 +6461,9 @@ GCRuntime::runDebugGC()
             incrementalLimit = zealFrequency / 2;
         }
     } else if (type == ZealCompactValue) {
-        collect(false, budget, GC_SHRINK, JS::gcreason::DEBUG_GC);
+        collect(false, SliceBudget::Unlimited, GC_SHRINK, JS::gcreason::DEBUG_GC);
     } else {
-        collect(false, budget, GC_NORMAL, JS::gcreason::DEBUG_GC);
+        collect(false, SliceBudget::Unlimited, GC_NORMAL, JS::gcreason::DEBUG_GC);
     }
 
 #endif
diff --git a/js/src/tests/js1_8_5/extensions/typedarray.js b/js/src/tests/js1_8_5/extensions/typedarray.js
index 1a6ebfac4ed..35de72944ab 100644
--- a/js/src/tests/js1_8_5/extensions/typedarray.js
+++ b/js/src/tests/js1_8_5/extensions/typedarray.js
@@ -203,7 +203,7 @@ function test()
         gc();
         buffer = null;
         views = null;
-        gcslice(3); gcslice(3); gcslice(3); gcslice(3); gcslice(3); gcslice(3); gc();
+        gcslice(2); gcslice(2); gcslice(2); gcslice(2); gcslice(2); gcslice(2); gc();
     }
 
     var buf, buf2;
diff --git a/xpcom/base/nsCycleCollector.cpp b/xpcom/base/nsCycleCollector.cpp
index b628b202d1f..3373cbb1822 100644
--- a/xpcom/base/nsCycleCollector.cpp
+++ b/xpcom/base/nsCycleCollector.cpp
@@ -3622,9 +3622,7 @@ nsCycleCollector::Collect(ccType aCCType,
         break;
     }
     if (continueSlice) {
-      // Force SliceBudget::isOverBudget to check the time.
-      aBudget.step(SliceBudget::CounterReset);
-      continueSlice = !aBudget.isOverBudget();
+      continueSlice = !aBudget.checkOverBudget();
     }
   } while (continueSlice);
 
@@ -4188,7 +4186,7 @@ nsCycleCollector_collect(nsICycleCollectorListener* aManualListener)
 }
 
 void
-nsCycleCollector_collectSlice(SliceBudget& budget)
+nsCycleCollector_collectSlice(int64_t aSliceTime)
 {
   CollectorData* data = sCollectorData.get();
 
@@ -4199,6 +4197,29 @@ nsCycleCollector_collectSlice(SliceBudget& budget)
   PROFILER_LABEL("nsCycleCollector", "collectSlice",
                  js::ProfileEntry::Category::CC);
 
+  SliceBudget budget;
+  if (aSliceTime >= 0) {
+    budget = SliceBudget(SliceBudget::TimeBudget(aSliceTime));
+  }
+  data->mCollector->Collect(SliceCC, budget, nullptr);
+}
+
+void
+nsCycleCollector_collectSliceWork(int64_t aSliceWork)
+{
+  CollectorData* data = sCollectorData.get();
+
+  // We should have started the cycle collector by now.
+  MOZ_ASSERT(data);
+  MOZ_ASSERT(data->mCollector);
+
+  PROFILER_LABEL("nsCycleCollector", "collectSliceWork",
+                 js::ProfileEntry::Category::CC);
+
+  SliceBudget budget;
+  if (aSliceWork >= 0) {
+    budget = SliceBudget(SliceBudget::WorkBudget(aSliceWork));
+  }
   data->mCollector->Collect(SliceCC, budget, nullptr);
 }
 
diff --git a/xpcom/base/nsCycleCollector.h b/xpcom/base/nsCycleCollector.h
index 129701b77aa..f517aeeac20 100644
--- a/xpcom/base/nsCycleCollector.h
+++ b/xpcom/base/nsCycleCollector.h
@@ -15,8 +15,6 @@ template<class T> struct already_AddRefed;
 #include "nsError.h"
 #include "nsID.h"
 
-namespace js { struct SliceBudget; };
-
 namespace mozilla {
 
 class CycleCollectedJSRuntime;
@@ -58,7 +56,13 @@ already_AddRefed<nsICycleCollectorLogSink> nsCycleCollector_createLogSink();
 
 void nsCycleCollector_collect(nsICycleCollectorListener* aManualListener);
 
-void nsCycleCollector_collectSlice(js::SliceBudget& budget);
+// If aSliceTime is negative, the CC will run to completion. Otherwise,
+// aSliceTime will be used as the time budget for the slice, in ms.
+void nsCycleCollector_collectSlice(int64_t aSliceTime);
+
+// If aSliceTime is negative, the CC will run to completion. Otherwise,
+// aSliceTime will be used as the work budget for the slice.
+void nsCycleCollector_collectSliceWork(int64_t aSliceWork);
 
 uint32_t nsCycleCollector_suspectedCount();
 void nsCycleCollector_shutdown();

From ceded7789e44300b1769f8b58e4936c5a0312c96 Mon Sep 17 00:00:00 2001
From: Henri Sivonen <hsivonen@hsivonen.fi>
Date: Wed, 5 Nov 2014 17:44:37 +0200
Subject: [PATCH 151/153] Bug 1088635. r=smaug.

---
 dom/base/nsDocument.cpp                       |  2 +-
 parser/html/nsHtml5Parser.cpp                 | 34 ++++++++++++-------
 parser/html/nsHtml5Parser.h                   |  2 +-
 parser/html/nsHtml5StreamParser.cpp           | 16 +++++----
 parser/html/nsHtml5StreamParser.h             |  2 +-
 parser/html/nsHtml5TreeBuilderCppSupplement.h |  4 +--
 parser/html/nsHtml5TreeBuilderHSupplement.h   |  2 +-
 parser/html/nsHtml5TreeOpExecutor.cpp         | 20 +++++++----
 parser/html/nsHtml5TreeOpExecutor.h           |  2 +-
 parser/html/nsHtml5TreeOperation.cpp          |  7 ++--
 parser/html/nsHtml5TreeOperation.h            | 12 ++++++-
 11 files changed, 67 insertions(+), 36 deletions(-)

diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
index 8f4032e479b..87e1d4d2971 100644
--- a/dom/base/nsDocument.cpp
+++ b/dom/base/nsDocument.cpp
@@ -4016,7 +4016,7 @@ nsDocument::InsertChildAt(nsIContent* aKid, uint32_t aIndex,
                           bool aNotify)
 {
   if (aKid->IsElement() && GetRootElement()) {
-    NS_ERROR("Inserting element child when we already have one");
+    NS_WARNING("Inserting root element when we already have one");
     return NS_ERROR_DOM_HIERARCHY_REQUEST_ERR;
   }
 
diff --git a/parser/html/nsHtml5Parser.cpp b/parser/html/nsHtml5Parser.cpp
index 5bb0c4ca790..3be3389d212 100644
--- a/parser/html/nsHtml5Parser.cpp
+++ b/parser/html/nsHtml5Parser.cpp
@@ -238,7 +238,8 @@ nsHtml5Parser::Parse(const nsAString& aSourceBuffer,
      * WillBuildModel to be called before the document has had its 
      * script global object set.
      */
-    mExecutor->WillBuildModel(eDTDMode_unknown);
+    rv = mExecutor->WillBuildModel(eDTDMode_unknown);
+    NS_ENSURE_SUCCESS(rv, rv);
   }
 
   // Return early if the parser has processed EOF
@@ -256,7 +257,7 @@ nsHtml5Parser::Parse(const nsAString& aSourceBuffer,
     }
     mDocumentClosed = true;
     if (!mBlocked && !mInDocumentWrite) {
-      ParseUntilBlocked();
+      return ParseUntilBlocked();
     }
     return NS_OK;
   }
@@ -379,7 +380,8 @@ nsHtml5Parser::Parse(const nsAString& aSourceBuffer,
 
       if (mTreeBuilder->HasScript()) {
         mTreeBuilder->Flush(); // Move ops to the executor
-        mExecutor->FlushDocumentWrite(); // run the ops
+        rv = mExecutor->FlushDocumentWrite(); // run the ops
+        NS_ENSURE_SUCCESS(rv, rv);
         // Flushing tree ops can cause all sorts of things.
         // Return early if the parser got terminated.
         if (mExecutor->IsComplete()) {
@@ -438,7 +440,8 @@ nsHtml5Parser::Parse(const nsAString& aSourceBuffer,
       "Buffer wasn't tokenized to completion?");
     // Scripting semantics require a forced tree builder flush here
     mTreeBuilder->Flush(); // Move ops to the executor
-    mExecutor->FlushDocumentWrite(); // run the ops
+    rv = mExecutor->FlushDocumentWrite(); // run the ops
+    NS_ENSURE_SUCCESS(rv, rv);
   } else if (stackBuffer.hasMore()) {
     // The buffer wasn't tokenized to completion. Tokenize the untokenized
     // content in order to preload stuff. This content will be retokenized
@@ -596,11 +599,13 @@ nsHtml5Parser::IsScriptCreated()
 /* End nsIParser  */
 
 // not from interface
-void
+nsresult
 nsHtml5Parser::ParseUntilBlocked()
 {
-  if (mBlocked || mExecutor->IsComplete() || NS_FAILED(mExecutor->IsBroken())) {
-    return;
+  nsresult rv = mExecutor->IsBroken();
+  NS_ENSURE_SUCCESS(rv, rv);
+  if (mBlocked || mExecutor->IsComplete()) {
+    return NS_OK;
   }
   NS_ASSERTION(mExecutor->HasStarted(), "Bad life cycle.");
   NS_ASSERTION(!mInDocumentWrite,
@@ -613,7 +618,7 @@ nsHtml5Parser::ParseUntilBlocked()
       if (mFirstBuffer == mLastBuffer) {
         if (mExecutor->IsComplete()) {
           // something like cache manisfests stopped the parse in mid-flight
-          return;
+          return NS_OK;
         }
         if (mDocumentClosed) {
           NS_ASSERTION(!GetStreamParser(),
@@ -622,8 +627,10 @@ nsHtml5Parser::ParseUntilBlocked()
           mTreeBuilder->StreamEnded();
           mTreeBuilder->Flush();
           mExecutor->FlushDocumentWrite();
+          // The below call does memory cleanup, so call it even if the
+          // parser has been marked as broken.
           mTokenizer->end();
-          return;            
+          return NS_OK;
         }
         // never release the last buffer.
         NS_ASSERTION(!mLastBuffer->getStart() && !mLastBuffer->getEnd(),
@@ -645,14 +652,14 @@ nsHtml5Parser::ParseUntilBlocked()
           NS_ASSERTION(mExecutor->IsInFlushLoop(),
               "How did we come here without being in the flush loop?");
         }
-        return; // no more data for now but expecting more
+        return NS_OK; // no more data for now but expecting more
       }
       mFirstBuffer = mFirstBuffer->next;
       continue;
     }
 
     if (mBlocked || mExecutor->IsComplete()) {
-      return;
+      return NS_OK;
     }
 
     // now we have a non-empty buffer
@@ -669,10 +676,11 @@ nsHtml5Parser::ParseUntilBlocked()
       }
       if (mTreeBuilder->HasScript()) {
         mTreeBuilder->Flush();
-        mExecutor->FlushDocumentWrite();
+        nsresult rv = mExecutor->FlushDocumentWrite();
+        NS_ENSURE_SUCCESS(rv, rv);
       }
       if (mBlocked) {
-        return;
+        return NS_OK;
       }
     }
     continue;
diff --git a/parser/html/nsHtml5Parser.h b/parser/html/nsHtml5Parser.h
index d79bdbde463..d9e085be5b4 100644
--- a/parser/html/nsHtml5Parser.h
+++ b/parser/html/nsHtml5Parser.h
@@ -261,7 +261,7 @@ class nsHtml5Parser MOZ_FINAL : public nsIParser,
     /**
      * Parse until pending data is exhausted or a script blocks the parser
      */
-    void ParseUntilBlocked();
+    nsresult ParseUntilBlocked();
 
   private:
 
diff --git a/parser/html/nsHtml5StreamParser.cpp b/parser/html/nsHtml5StreamParser.cpp
index 6eae6d8bd17..9c58ef10e02 100644
--- a/parser/html/nsHtml5StreamParser.cpp
+++ b/parser/html/nsHtml5StreamParser.cpp
@@ -794,7 +794,7 @@ nsHtml5StreamParser::WriteStreamBytes(const uint8_t* aFromSegment,
   // NS_HTML5_STREAM_PARSER_READ_BUFFER_SIZE.
   if (!mLastBuffer) {
     NS_WARNING("mLastBuffer should not be null!");
-    MarkAsBroken();
+    MarkAsBroken(NS_ERROR_NULL_POINTER);
     return NS_ERROR_NULL_POINTER;
   }
   if (mLastBuffer->getEnd() == NS_HTML5_STREAM_PARSER_READ_BUFFER_SIZE) {
@@ -900,7 +900,8 @@ nsHtml5StreamParser::OnStartRequest(nsIRequest* aRequest, nsISupports* aContext)
    * WillBuildModel to be called before the document has had its 
    * script global object set.
    */
-  mExecutor->WillBuildModel(eDTDMode_unknown);
+  rv = mExecutor->WillBuildModel(eDTDMode_unknown);
+  NS_ENSURE_SUCCESS(rv, rv);
   
   nsRefPtr<nsHtml5OwningUTF16Buffer> newBuf =
     nsHtml5OwningUTF16Buffer::FalliblyCreate(
@@ -1009,8 +1010,9 @@ nsHtml5StreamParser::DoStopRequest()
 
   if (!mUnicodeDecoder) {
     uint32_t writeCount;
-    if (NS_FAILED(FinalizeSniffing(nullptr, 0, &writeCount, 0))) {
-      MarkAsBroken();
+    nsresult rv;
+    if (NS_FAILED(rv = FinalizeSniffing(nullptr, 0, &writeCount, 0))) {
+      MarkAsBroken(rv);
       return;
     }
   } else if (mFeedChardet) {
@@ -1082,7 +1084,7 @@ nsHtml5StreamParser::DoDataAvailable(const uint8_t* aBuffer, uint32_t aLength)
     rv = SniffStreamBytes(aBuffer, aLength, &writeCount);
   }
   if (NS_FAILED(rv)) {
-    MarkAsBroken();
+    MarkAsBroken(rv);
     return;
   }
   NS_ASSERTION(writeCount == aLength, "Wrong number of stream bytes written/sniffed.");
@@ -1668,13 +1670,13 @@ nsHtml5StreamParser::TimerFlush()
 }
 
 void
-nsHtml5StreamParser::MarkAsBroken()
+nsHtml5StreamParser::MarkAsBroken(nsresult aRv)
 {
   NS_ASSERTION(IsParserThread(), "Wrong thread!");
   mTokenizerMutex.AssertCurrentThreadOwns();
 
   Terminate();
-  mTreeBuilder->MarkAsBroken();
+  mTreeBuilder->MarkAsBroken(aRv);
   mozilla::DebugOnly<bool> hadOps = mTreeBuilder->Flush(false);
   NS_ASSERTION(hadOps, "Should have had the markAsBroken op!");
   if (NS_FAILED(NS_DispatchToMainThread(mExecutorFlusher))) {
diff --git a/parser/html/nsHtml5StreamParser.h b/parser/html/nsHtml5StreamParser.h
index 6954cf3e8cf..e4ff429194c 100644
--- a/parser/html/nsHtml5StreamParser.h
+++ b/parser/html/nsHtml5StreamParser.h
@@ -217,7 +217,7 @@ class nsHtml5StreamParser : public nsICharsetDetectionObserver {
     }
 #endif
 
-    void MarkAsBroken();
+    void MarkAsBroken(nsresult aRv);
 
     /**
      * Marks the stream parser as interrupted. If you ever add calls to this
diff --git a/parser/html/nsHtml5TreeBuilderCppSupplement.h b/parser/html/nsHtml5TreeBuilderCppSupplement.h
index 9908371a4ce..553532fda02 100644
--- a/parser/html/nsHtml5TreeBuilderCppSupplement.h
+++ b/parser/html/nsHtml5TreeBuilderCppSupplement.h
@@ -929,14 +929,14 @@ nsHtml5TreeBuilder::DropHandles()
 }
 
 void
-nsHtml5TreeBuilder::MarkAsBroken()
+nsHtml5TreeBuilder::MarkAsBroken(nsresult aRv)
 {
   if (MOZ_UNLIKELY(mBuilder)) {
     MOZ_ASSERT_UNREACHABLE("Must not call this with builder.");
     return;
   }
   mOpQueue.Clear(); // Previous ops don't matter anymore
-  mOpQueue.AppendElement()->Init(eTreeOpMarkAsBroken);
+  mOpQueue.AppendElement()->Init(aRv);
 }
 
 void
diff --git a/parser/html/nsHtml5TreeBuilderHSupplement.h b/parser/html/nsHtml5TreeBuilderHSupplement.h
index 6ffa71b9d7b..c47fe562670 100644
--- a/parser/html/nsHtml5TreeBuilderHSupplement.h
+++ b/parser/html/nsHtml5TreeBuilderHSupplement.h
@@ -223,4 +223,4 @@
 
     void errEndWithUnclosedElements(nsIAtom* aName);
 
-    void MarkAsBroken();
+    void MarkAsBroken(nsresult aRv);
diff --git a/parser/html/nsHtml5TreeOpExecutor.cpp b/parser/html/nsHtml5TreeOpExecutor.cpp
index fef3c4987b6..007b6904216 100644
--- a/parser/html/nsHtml5TreeOpExecutor.cpp
+++ b/parser/html/nsHtml5TreeOpExecutor.cpp
@@ -413,7 +413,11 @@ nsHtml5TreeOpExecutor::RunFlushLoop()
         GetParser()->GetStreamParser();
       // Now parse content left in the document.write() buffer queue if any.
       // This may generate tree ops on its own or dequeue a speculation.
-      GetParser()->ParseUntilBlocked();
+      nsresult rv = GetParser()->ParseUntilBlocked();
+      if (NS_FAILED(rv)) {
+        MarkAsBroken(rv);
+        return;
+      }
     }
 
     if (mOpQueue.IsEmpty()) {
@@ -496,21 +500,24 @@ nsHtml5TreeOpExecutor::RunFlushLoop()
   }
 }
 
-void
+nsresult
 nsHtml5TreeOpExecutor::FlushDocumentWrite()
 {
+  nsresult rv = IsBroken();
+  NS_ENSURE_SUCCESS(rv, rv);
+
   FlushSpeculativeLoads(); // Make sure speculative loads never start after the
                 // corresponding normal loads for the same URLs.
 
   if (MOZ_UNLIKELY(!mParser)) {
     // The parse has ended.
     mOpQueue.Clear(); // clear in order to be able to assert in destructor
-    return;
+    return rv;
   }
   
   if (mFlushState != eNotFlushing) {
     // XXX Can this happen? In case it can, let's avoid crashing.
-    return;
+    return rv;
   }
 
   mFlushState = eInFlush;
@@ -543,7 +550,7 @@ nsHtml5TreeOpExecutor::FlushDocumentWrite()
     }
     NS_ASSERTION(mFlushState == eInDocUpdate, 
       "Tried to perform tree op outside update batch.");
-    nsresult rv = iter->Perform(this, &scriptElement);
+    rv = iter->Perform(this, &scriptElement);
     if (NS_FAILED(rv)) {
       MarkAsBroken(rv);
       break;
@@ -558,13 +565,14 @@ nsHtml5TreeOpExecutor::FlushDocumentWrite()
 
   if (MOZ_UNLIKELY(!mParser)) {
     // Ending the doc update caused a call to nsIParser::Terminate().
-    return;
+    return rv;
   }
 
   if (scriptElement) {
     // must be tail call when mFlushState is eNotFlushing
     RunScript(scriptElement);
   }
+  return rv;
 }
 
 // copied from HTML content sink
diff --git a/parser/html/nsHtml5TreeOpExecutor.h b/parser/html/nsHtml5TreeOpExecutor.h
index 2d739b63986..eecba61469d 100644
--- a/parser/html/nsHtml5TreeOpExecutor.h
+++ b/parser/html/nsHtml5TreeOpExecutor.h
@@ -178,7 +178,7 @@ class nsHtml5TreeOpExecutor MOZ_FINAL : public nsHtml5DocumentBuilder,
                   
     void RunFlushLoop();
 
-    void FlushDocumentWrite();
+    nsresult FlushDocumentWrite();
 
     void MaybeSuspend();
 
diff --git a/parser/html/nsHtml5TreeOperation.cpp b/parser/html/nsHtml5TreeOperation.cpp
index ead4bc3b4a8..162eb772155 100644
--- a/parser/html/nsHtml5TreeOperation.cpp
+++ b/parser/html/nsHtml5TreeOperation.cpp
@@ -197,6 +197,10 @@ nsHtml5TreeOperation::AppendToDocument(nsIContent* aNode,
   nsIDocument* doc = aBuilder->GetDocument();
   uint32_t childCount = doc->GetChildCount();
   rv = doc->AppendChildTo(aNode, false);
+  if (rv == NS_ERROR_DOM_HIERARCHY_REQUEST_ERR) {
+    aNode->SetParserHasNotified();
+    return NS_OK;
+  }
   NS_ENSURE_SUCCESS(rv, rv);
   aNode->SetParserHasNotified();
   nsNodeUtils::ContentInserted(doc, aNode, childCount);
@@ -726,8 +730,7 @@ nsHtml5TreeOperation::Perform(nsHtml5TreeOpExecutor* aBuilder,
       return NS_OK;
     }
     case eTreeOpMarkAsBroken: {
-      aBuilder->MarkAsBroken(NS_ERROR_OUT_OF_MEMORY);
-      return NS_OK;
+      return mOne.result;
     }
     case eTreeOpRunScript: {
       nsIContent* node = *(mOne.node);
diff --git a/parser/html/nsHtml5TreeOperation.h b/parser/html/nsHtml5TreeOperation.h
index 95861c041ee..0ff354f2859 100644
--- a/parser/html/nsHtml5TreeOperation.h
+++ b/parser/html/nsHtml5TreeOperation.h
@@ -432,6 +432,15 @@ class nsHtml5TreeOperation {
       mFour.integer = aInt;
     }
 
+    inline void Init(nsresult aRv)
+    {
+      NS_PRECONDITION(mOpCode == eTreeOpUninitialized,
+        "Op code must be uninitialized when initializing.");
+      NS_PRECONDITION(NS_FAILED(aRv), "Initialized tree op with non-failure.");
+      mOpCode = eTreeOpMarkAsBroken;
+      mOne.result = aRv;
+    }
+
     inline void InitAddClass(nsIContentHandle* aNode, const char16_t* aClass)
     {
       NS_PRECONDITION(mOpCode == eTreeOpUninitialized,
@@ -484,11 +493,12 @@ class nsHtml5TreeOperation {
       nsIAtom*                        atom;
       nsHtml5HtmlAttributes*          attributes;
       nsHtml5DocumentMode             mode;
-      char16_t*                      unicharPtr;
+      char16_t*                       unicharPtr;
       char*                           charPtr;
       nsHtml5TreeOperationStringPair* stringPair;
       nsAHtml5TreeBuilderState*       state;
       int32_t                         integer;
+      nsresult                        result;
     }                   mOne, mTwo, mThree, mFour;
 };
 

From 46cadf46c10376d79faea79d0eb2c2731a2cafe3 Mon Sep 17 00:00:00 2001
From: Dave Townsend <dtownsend@oxymoronical.com>
Date: Wed, 5 Nov 2014 10:05:57 -0800
Subject: [PATCH 152/153] Bug 1094312: Disable browser_bug553455 for high
 intermittent failures.

---
 browser/base/content/test/general/browser.ini | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/browser/base/content/test/general/browser.ini b/browser/base/content/test/general/browser.ini
index bb358c9745c..5d209e4f738 100644
--- a/browser/base/content/test/general/browser.ini
+++ b/browser/base/content/test/general/browser.ini
@@ -202,7 +202,8 @@ skip-if = buildapp == 'mulet' || e10s # Bug 1093206 - need to re-enable tests re
 skip-if = e10s # Bug ?????? - test doesn't wait for document to be created before it checks it
 [browser_bug550565.js]
 [browser_bug553455.js]
-skip-if = buildapp == 'mulet' || e10s # Bug 1066070 - I don't think either popup notifications nor addon install stuff works on mulet? ; for e10s, indefinite waiting halfway through the test, tracked in bug 1093586
+skip-if = true # Bug 1094312
+#skip-if = buildapp == 'mulet' || e10s # Bug 1066070 - I don't think either popup notifications nor addon install stuff works on mulet? ; for e10s, indefinite waiting halfway through the test, tracked in bug 1093586
 [browser_bug555224.js]
 skip-if = e10s # Bug 1056146 - zoom tests use FullZoomHelper and break in e10s
 [browser_bug555767.js]

From e974aa970652ccb603bdaa593a52d17fae92344c Mon Sep 17 00:00:00 2001
From: Sean Lin <selin@mozilla.com>
Date: Wed, 5 Nov 2014 14:03:37 -0500
Subject: [PATCH 153/153] Bug 1091322 - Disable the TV mochitests on Linux
 debug e10s to wallpaper over gfx shutdown crashes.

---
 dom/tv/test/mochitest/mochitest.ini | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dom/tv/test/mochitest/mochitest.ini b/dom/tv/test/mochitest/mochitest.ini
index 4a9b3af5ee9..eaa39eb8963 100644
--- a/dom/tv/test/mochitest/mochitest.ini
+++ b/dom/tv/test/mochitest/mochitest.ini
@@ -1,4 +1,5 @@
 [DEFAULT]
+skip-if = os == "linux" && e10s && debug # bug 1091322 - wallpaper over an e10s crash
 support-files =
   file_app.sjs
   file_app.template.webapp