Merge inbound to m-c.

2024-09-13 09:24:08 -07:00 · 2013-11-11 15:41:03 -05:00 · 2013-11-11 15:41:03 -05:00 · d4fc422b45
commit d4fc422b45
parent b0817ed5a7 b9cb6aeb20
104 changed files with 1143 additions and 392 deletions
--- a/2
+++ b/2
@ -19,3 +19,5 @@
 #

 Bug 921718 presumably needed a clobber due to bug 928195.
+and
+Bug 853423 - New code (inc. new function IsIPAddrLocal) is not being included in incremental builds.
--- a/content/base/src/nsGkAtomList.h
+++ b/content/base/src/nsGkAtomList.h
@ -2001,6 +2001,7 @@ GK_ATOM(DisplayPort, "_displayport")
 GK_ATOM(CriticalDisplayPort, "_critical_displayport")

 // Names for system metrics
+GK_ATOM(color_picker_available, "color-picker-available")
 GK_ATOM(scrollbar_start_backward, "scrollbar-start-backward")
 GK_ATOM(scrollbar_start_forward, "scrollbar-start-forward")
 GK_ATOM(scrollbar_end_backward, "scrollbar-end-backward")
@ -2038,6 +2039,7 @@ GK_ATOM(windows_version_win7, "windows-version-win7")
 GK_ATOM(windows_version_win8, "windows-version-win8")

 // And the same again, as media query keywords.
+GK_ATOM(_moz_color_picker_available, "-moz-color-picker-available")
 GK_ATOM(_moz_scrollbar_start_backward, "-moz-scrollbar-start-backward")
 GK_ATOM(_moz_scrollbar_start_forward, "-moz-scrollbar-start-forward")
 GK_ATOM(_moz_scrollbar_end_backward, "-moz-scrollbar-end-backward")
--- a/dom/base/WindowNamedPropertiesHandler.cpp
+++ b/dom/base/WindowNamedPropertiesHandler.cpp
@ -63,8 +63,9 @@ ShouldExposeChildWindow(nsString& aNameBeingResolved, nsIDOMWindow *aChild)
  // computed independently by the parent.
  nsCOMPtr<nsPIDOMWindow> piWin = do_QueryInterface(aChild);
  NS_ENSURE_TRUE(piWin, false);
-  return piWin->GetFrameElementInternal()->AttrValueIs(kNameSpaceID_None, nsGkAtoms::name,
-                                                       aNameBeingResolved, eCaseMatters);
+  Element* e = piWin->GetFrameElementInternal();
+  return e && e->AttrValueIs(kNameSpaceID_None, nsGkAtoms::name,
+                             aNameBeingResolved, eCaseMatters);
 }

 bool
--- a/intl/lwbrk/src/nsCarbonBreaker.cpp
+++ b/intl/lwbrk/src/nsCarbonBreaker.cpp
@ -3,7 +3,7 @@
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

-#include <Carbon/Carbon.h>
+#include <CoreFoundation/CoreFoundation.h>
 #include <stdint.h>
 #include "nsDebug.h"
 #include "nscore.h"
@ -13,33 +13,29 @@ NS_GetComplexLineBreaks(const PRUnichar* aText, uint32_t aLength,
                        uint8_t* aBreakBefore)
 {
  NS_ASSERTION(aText, "aText shouldn't be null");
-  TextBreakLocatorRef breakLocator;

-  memset(aBreakBefore, false, aLength * sizeof(uint8_t));
+  memset(aBreakBefore, 0, aLength * sizeof(uint8_t));

-  OSStatus status = UCCreateTextBreakLocator(nullptr,
-                                             0,
-                                             kUCTextBreakLineMask,
-                                             &breakLocator);
-
-  if (status != noErr)
+  CFStringRef str = ::CFStringCreateWithCharactersNoCopy(kCFAllocatorDefault, reinterpret_cast<const UniChar*>(aText), aLength, kCFAllocatorNull);
+  if (!str) {
    return;
-     
-  for (UniCharArrayOffset position = 0; position < aLength;) {
-    UniCharArrayOffset offset;
-    status = UCFindTextBreak(breakLocator, 
-                  kUCTextBreakLineMask, 
-                  position == 0 ? kUCTextBreakLeadingEdgeMask : 
-                                  (kUCTextBreakLeadingEdgeMask | 
-                                   kUCTextBreakIterateMask),
-                  reinterpret_cast<const UniChar*>(aText),
-                  aLength, 
-                  position, 
-                  &offset);
-    if (status != noErr || offset >= aLength)
-      break;        
-    aBreakBefore[offset] = true;
-    position = offset;
  }
-  UCDisposeTextBreakLocator(&breakLocator);
+
+  CFStringTokenizerRef st = ::CFStringTokenizerCreate(kCFAllocatorDefault, str, ::CFRangeMake(0, aLength), kCFStringTokenizerUnitLineBreak, NULL);
+  if (!st) {
+    ::CFRelease(str);
+    return;
+  }
+
+  CFStringTokenizerTokenType tt = ::CFStringTokenizerAdvanceToNextToken(st);
+  while (tt != kCFStringTokenizerTokenNone) {
+    CFRange r = ::CFStringTokenizerGetCurrentTokenRange(st);
+    if (r.location != 0) { // Ignore leading edge
+      aBreakBefore[r.location] = true;
+    }
+    tt = CFStringTokenizerAdvanceToNextToken(st);
+  }
+
+  ::CFRelease(st);
+  ::CFRelease(str);
 }
--- a/intl/uconv/ucvcn/nsHZToUnicode.cpp
+++ b/intl/uconv/ucvcn/nsHZToUnicode.cpp
@ -33,6 +33,7 @@

 #include "nsHZToUnicode.h"
 #include "gbku.h"
+#include "mozilla/Telemetry.h"

 //----------------------------------------------------------------------
 // Class nsHZToUnicode [implementation]
@ -49,11 +50,14 @@
 #define HZ_ODD_BYTE_STATE (mHZState & (HZ_STATE_ODD_BYTE_FLAG))
 #define HZ_ENCODING_STATE (mHZState & ~(HZ_STATE_ODD_BYTE_FLAG))

+using namespace mozilla;
+
 nsHZToUnicode::nsHZToUnicode() : nsBufferDecoderSupport(1)
 {
  mHZState = HZ_STATE_ASCII;    // per HZ spec, default to ASCII state 
  mRunLength = 0;
  mOddByte = 0;
+  Telemetry::Accumulate(Telemetry::DECODER_INSTANTIATED_HZ, true);
 }

 //Overwriting the ConvertNoBuff() in nsUCvCnSupport.cpp.
--- a/intl/uconv/ucvcn/nsISO2022CNToUnicode.h
+++ b/intl/uconv/ucvcn/nsISO2022CNToUnicode.h
@ -6,6 +6,7 @@
 #define nsISO2022CNToUnicode_h__
 #include "nsCOMPtr.h"
 #include "nsUCSupport.h"
+#include "mozilla/Telemetry.h"

 #define MBYTE       0x8e
 #undef PMASK
@ -17,13 +18,18 @@
 #define SS2         0x4e
 #define SS3         0x4f

+using namespace mozilla;
+
 class nsISO2022CNToUnicode : public nsBasicDecoderSupport
 {
 public:
  nsISO2022CNToUnicode() : 
        mState(eState_ASCII), 
        mPlaneID(0),
-        mRunLength(0) { }
+        mRunLength(0)
+  {
+    Telemetry::Accumulate(Telemetry::DECODER_INSTANTIATED_ISO2022CN, true);
+  }

  virtual ~nsISO2022CNToUnicode() {}

--- a/intl/uconv/ucvibm/nsCP850ToUnicode.cpp
+++ b/intl/uconv/ucvibm/nsCP850ToUnicode.cpp
@ -19,6 +19,9 @@

 #include "nsUCConstructors.h"
 #include "nsCP850ToUnicode.h"
+#include "mozilla/Telemetry.h"
+
+using namespace mozilla;

 //----------------------------------------------------------------------
 // Global functions and data [declaration]
@ -34,6 +37,7 @@ nsCP850ToUnicodeConstructor(nsISupports* aOuter, REFNSIID aIID,
 #include "cp850.ut"
  };

+  Telemetry::Accumulate(Telemetry::DECODER_INSTANTIATED_IBM850, true);
  return CreateOneByteDecoder((uMappingTable*) &g_utMappingTable,
                              aOuter, aIID, aResult);
 }
--- a/intl/uconv/ucvibm/nsCP852ToUnicode.cpp
+++ b/intl/uconv/ucvibm/nsCP852ToUnicode.cpp
@ -19,6 +19,9 @@

 #include "nsUCConstructors.h"
 #include "nsCP852ToUnicode.h"
+#include "mozilla/Telemetry.h"
+
+using namespace mozilla;

 //----------------------------------------------------------------------
 // Global functions and data [declaration]
@ -31,6 +34,7 @@ nsCP852ToUnicodeConstructor(nsISupports *aOuter, REFNSIID aIID,
 #include "cp852.ut"
  };

+  Telemetry::Accumulate(Telemetry::DECODER_INSTANTIATED_IBM852, true);
  return CreateOneByteDecoder((uMappingTable*) &g_utMappingTable,
                              aOuter, aIID, aResult);
 }
--- a/intl/uconv/ucvibm/nsCP855ToUnicode.cpp
+++ b/intl/uconv/ucvibm/nsCP855ToUnicode.cpp
@ -19,6 +19,9 @@

 #include "nsUCConstructors.h"
 #include "nsCP855ToUnicode.h"
+#include "mozilla/Telemetry.h"
+
+using namespace mozilla;

 //----------------------------------------------------------------------
 // Global functions and data [declaration]
@ -31,6 +34,7 @@ nsCP855ToUnicodeConstructor(nsISupports *aOuter, REFNSIID aIID,
 #include "cp855.ut"
  };

+  Telemetry::Accumulate(Telemetry::DECODER_INSTANTIATED_IBM855, true);
  return CreateOneByteDecoder((uMappingTable*) &g_utMappingTable,
                              aOuter, aIID, aResult);
 }
--- a/intl/uconv/ucvibm/nsCP857ToUnicode.cpp
+++ b/intl/uconv/ucvibm/nsCP857ToUnicode.cpp
@ -19,6 +19,9 @@

 #include "nsUCConstructors.h"
 #include "nsCP857ToUnicode.h"
+#include "mozilla/Telemetry.h"
+
+using namespace mozilla;

 //----------------------------------------------------------------------
 // Global functions and data [declaration]
@ -31,6 +34,7 @@ nsCP857ToUnicodeConstructor(nsISupports *aOuter, REFNSIID aIID,
 #include "cp857.ut"
  };

+  Telemetry::Accumulate(Telemetry::DECODER_INSTANTIATED_IBM857, true);
  return CreateOneByteDecoder((uMappingTable*) &g_utMappingTable,
                              aOuter, aIID, aResult);
 }
--- a/intl/uconv/ucvibm/nsCP862ToUnicode.cpp
+++ b/intl/uconv/ucvibm/nsCP862ToUnicode.cpp
@ -19,6 +19,9 @@

 #include "nsUCConstructors.h"
 #include "nsCP862ToUnicode.h"
+#include "mozilla/Telemetry.h"
+
+using namespace mozilla;

 //----------------------------------------------------------------------
 // Global functions and data [declaration]
@ -31,6 +34,7 @@ nsCP862ToUnicodeConstructor(nsISupports *aOuter, REFNSIID aIID,
 #include "cp862.ut"
  };

+  Telemetry::Accumulate(Telemetry::DECODER_INSTANTIATED_IBM862, true);
  return CreateOneByteDecoder((uMappingTable*) &g_utMappingTable,
                              aOuter, aIID, aResult);
 }
--- a/intl/uconv/ucvja/nsJapaneseToUnicode.h
+++ b/intl/uconv/ucvja/nsJapaneseToUnicode.h
@ -5,7 +5,9 @@
 #ifndef nsShiftJISToUnicode_h__
 #define nsShiftJISToUnicode_h__
 #include "nsUCSupport.h"
+#include "mozilla/Telemetry.h"

+using namespace mozilla;

 class nsShiftJISToUnicode : public nsBasicDecoderSupport
 {
@ -83,6 +85,7 @@ public:
        mGB2312Decoder = nullptr;
        mEUCKRDecoder = nullptr;
        mISO88597Decoder = nullptr;
+        Telemetry::Accumulate(Telemetry::DECODER_INSTANTIATED_ISO2022JP, true);
     }
 virtual ~nsISO2022JPToUnicodeV2()
     {
--- a/intl/uconv/ucvko/nsISO2022KRToUnicode.h
+++ b/intl/uconv/ucvko/nsISO2022KRToUnicode.h
@ -5,8 +5,9 @@
 #ifndef nsISO2022KRToUnicode_h__
 #define nsISO2022KRToUnicode_h__
 #include "nsUCSupport.h"
+#include "mozilla/Telemetry.h"

-
+using namespace mozilla;
 
 class nsISO2022KRToUnicode : public nsBasicDecoderSupport
 {
@ -18,6 +19,7 @@ public:
    mData = 0;
    mEUCKRDecoder = nullptr;
    mRunLength = 0;
+    Telemetry::Accumulate(Telemetry::DECODER_INSTANTIATED_ISO2022KR, true);
  }

  virtual ~nsISO2022KRToUnicode()
--- a/intl/uconv/ucvko/nsJohabToUnicode.cpp
+++ b/intl/uconv/ucvko/nsJohabToUnicode.cpp
@ -6,6 +6,9 @@
 #include "nsJohabToUnicode.h"
 #include "nsUCvKODll.h"
 #include "nsUCConstructors.h"
+#include "mozilla/Telemetry.h"
+
+using namespace mozilla;

 //----------------------------------------------------------------------
 // Global functions and data [declaration]
@ -46,6 +49,7 @@ nsresult
 nsJohabToUnicodeConstructor(nsISupports *aOuter, REFNSIID aIID,
                            void **aResult)
 {
+  Telemetry::Accumulate(Telemetry::DECODER_INSTANTIATED_JOHAB, true);
  return CreateMultiTableDecoder(sizeof(g_JOHABRanges) / sizeof(g_JOHABRanges[0]),
                                 (const uRange*) &g_JOHABRanges,
                                 (uScanClassID*) &g_JOHABScanClassIDs,
--- a/intl/uconv/ucvlatin/nsARMSCII8ToUnicode.cpp
+++ b/intl/uconv/ucvlatin/nsARMSCII8ToUnicode.cpp
@ -5,6 +5,9 @@

 #include "nsUCConstructors.h"
 #include "nsARMSCII8ToUnicode.h"
+#include "mozilla/Telemetry.h"
+
+using namespace mozilla;

 //----------------------------------------------------------------------
 // Global functions and data [declaration]
@ -17,6 +20,7 @@ nsARMSCII8ToUnicodeConstructor(nsISupports *aOuter, REFNSIID aIID,
 #include "armscii.ut"
  };

+  Telemetry::Accumulate(Telemetry::DECODER_INSTANTIATED_ARMSCII8, true);
  return CreateOneByteDecoder((uMappingTable*) &g_utMappingTable,
                              aOuter, aIID, aResult);
 }
--- a/intl/uconv/ucvlatin/nsISOIR111ToUnicode.cpp
+++ b/intl/uconv/ucvlatin/nsISOIR111ToUnicode.cpp
@ -5,6 +5,9 @@

 #include "nsUCConstructors.h"
 #include "nsISOIR111ToUnicode.h"
+#include "mozilla/Telemetry.h"
+
+using namespace mozilla;

 //----------------------------------------------------------------------
 // Global functions and data [declaration]
@ -17,6 +20,7 @@ nsISOIR111ToUnicodeConstructor(nsISupports *aOuter, REFNSIID aIID,
 #include "iso-ir-111.ut"
  };

+  Telemetry::Accumulate(Telemetry::DECODER_INSTANTIATED_ISOIR111, true);
  return CreateOneByteDecoder((uMappingTable*) &g_utMappingTable,
                              aOuter, aIID, aResult);
 }
--- a/intl/uconv/ucvlatin/nsMacArabicToUnicode.cpp
+++ b/intl/uconv/ucvlatin/nsMacArabicToUnicode.cpp
@ -5,6 +5,9 @@

 #include "nsUCConstructors.h"
 #include "nsMacArabicToUnicode.h"
+#include "mozilla/Telemetry.h"
+
+using namespace mozilla;

 //----------------------------------------------------------------------
 // Global functions and data [declaration]
@ -17,6 +20,7 @@ nsMacArabicToUnicodeConstructor(nsISupports *aOuter, REFNSIID aIID,
 #include "macarabic.ut"
   };

+   Telemetry::Accumulate(Telemetry::DECODER_INSTANTIATED_MACARABIC, true);
   return CreateOneByteDecoder((uMappingTable*) &g_utMappingTable,
                               aOuter, aIID, aResult);
 }
--- a/intl/uconv/ucvlatin/nsMacCEToUnicode.cpp
+++ b/intl/uconv/ucvlatin/nsMacCEToUnicode.cpp
@ -5,6 +5,9 @@

 #include "nsUCConstructors.h"
 #include "nsMacCEToUnicode.h"
+#include "mozilla/Telemetry.h"
+
+using namespace mozilla;

 //----------------------------------------------------------------------
 // Global functions and data [declaration]
@ -17,6 +20,7 @@ nsMacCEToUnicodeConstructor(nsISupports *aOuter, REFNSIID aIID,
 #include "macce.ut"
  };

+  Telemetry::Accumulate(Telemetry::DECODER_INSTANTIATED_MACCE, true);
  return CreateOneByteDecoder((uMappingTable*) &g_MacCEMappingTable,
                            aOuter, aIID, aResult);
 }
--- a/intl/uconv/ucvlatin/nsMacCroatianToUnicode.cpp
+++ b/intl/uconv/ucvlatin/nsMacCroatianToUnicode.cpp
@ -5,6 +5,9 @@

 #include "nsUCConstructors.h"
 #include "nsMacCroatianToUnicode.h"
+#include "mozilla/Telemetry.h"
+
+using namespace mozilla;

 //----------------------------------------------------------------------
 // Global functions and data [declaration]
@ -17,6 +20,7 @@ nsMacCroatianToUnicodeConstructor(nsISupports *aOuter, REFNSIID aIID,
 #include "maccroat.ut"
  };

+  Telemetry::Accumulate(Telemetry::DECODER_INSTANTIATED_MACCROATIAN, true);
  return CreateOneByteDecoder((uMappingTable*) &g_utMappingTable,
                              aOuter, aIID, aResult);
 }
--- a/intl/uconv/ucvlatin/nsMacDevanagariToUnicode.cpp
+++ b/intl/uconv/ucvlatin/nsMacDevanagariToUnicode.cpp
@ -5,6 +5,9 @@

 #include "nsUCConstructors.h"
 #include "nsMacDevanagariToUnicode.h"
+#include "mozilla/Telemetry.h"
+
+using namespace mozilla;

 //----------------------------------------------------------------------
 // Global functions and data [declaration]
@ -17,6 +20,7 @@ nsMacDevanagariToUnicodeConstructor(nsISupports *aOuter, REFNSIID aIID,
 #include "macdevanaga.ut"
   };

+   Telemetry::Accumulate(Telemetry::DECODER_INSTANTIATED_MACDEVANAGARI, true);
   return CreateOneByteDecoder((uMappingTable*) &g_utMappingTable,
                               aOuter, aIID, aResult);
 }
--- a/intl/uconv/ucvlatin/nsMacFarsiToUnicode.cpp
+++ b/intl/uconv/ucvlatin/nsMacFarsiToUnicode.cpp
@ -5,6 +5,9 @@

 #include "nsUCConstructors.h"
 #include "nsMacFarsiToUnicode.h"
+#include "mozilla/Telemetry.h"
+
+using namespace mozilla;

 //----------------------------------------------------------------------
 // Global functions and data [declaration]
@ -17,6 +20,7 @@ nsMacFarsiToUnicodeConstructor(nsISupports *aOuter, REFNSIID aIID,
 #include "macfarsi.ut"
   };

+   Telemetry::Accumulate(Telemetry::DECODER_INSTANTIATED_MACFARSI, true);
   return CreateOneByteDecoder((uMappingTable*) &g_utMappingTable,
                               aOuter, aIID, aResult);
 }
--- a/intl/uconv/ucvlatin/nsMacGreekToUnicode.cpp
+++ b/intl/uconv/ucvlatin/nsMacGreekToUnicode.cpp
@ -5,6 +5,9 @@

 #include "nsUCConstructors.h"
 #include "nsMacGreekToUnicode.h"
+#include "mozilla/Telemetry.h"
+
+using namespace mozilla;

 //----------------------------------------------------------------------
 // Global functions and data [declaration]
@ -17,6 +20,7 @@ nsMacGreekToUnicodeConstructor(nsISupports *aOuter, REFNSIID aIID,
 #include "macgreek.ut"
  };

+  Telemetry::Accumulate(Telemetry::DECODER_INSTANTIATED_MACGREEK, true);
  return CreateOneByteDecoder((uMappingTable*) &g_MacGreekMappingTable,
                            aOuter, aIID, aResult);
 }
--- a/intl/uconv/ucvlatin/nsMacGurmukhiToUnicode.cpp
+++ b/intl/uconv/ucvlatin/nsMacGurmukhiToUnicode.cpp
@ -5,6 +5,9 @@

 #include "nsUCConstructors.h"
 #include "nsMacGurmukhiToUnicode.h"
+#include "mozilla/Telemetry.h"
+
+using namespace mozilla;

 //----------------------------------------------------------------------
 // Global functions and data [declaration]
@ -17,6 +20,7 @@ nsMacGurmukhiToUnicodeConstructor(nsISupports *aOuter, REFNSIID aIID,
 #include "macgurmukhi.ut"
   };

+   Telemetry::Accumulate(Telemetry::DECODER_INSTANTIATED_MACGURMUKHI, true);
   return CreateOneByteDecoder((uMappingTable*) &g_utMappingTable,
                               aOuter, aIID, aResult);
 }
--- a/intl/uconv/ucvlatin/nsMacHebrewToUnicode.cpp
+++ b/intl/uconv/ucvlatin/nsMacHebrewToUnicode.cpp
@ -5,6 +5,9 @@

 #include "nsUCConstructors.h"
 #include "nsMacHebrewToUnicode.h"
+#include "mozilla/Telemetry.h"
+
+using namespace mozilla;

 //----------------------------------------------------------------------
 // Global functions and data [declaration]
@ -17,6 +20,7 @@ nsMacHebrewToUnicodeConstructor(nsISupports *aOuter, REFNSIID aIID,
 #include "machebrew.ut"
   };

+   Telemetry::Accumulate(Telemetry::DECODER_INSTANTIATED_MACHEBREW, true);
   return CreateOneByteDecoder((uMappingTable*) &g_utMappingTable,
                               aOuter, aIID, aResult);
 }
--- a/intl/uconv/ucvlatin/nsMacIcelandicToUnicode.cpp
+++ b/intl/uconv/ucvlatin/nsMacIcelandicToUnicode.cpp
@ -5,6 +5,9 @@

 #include "nsUCConstructors.h"
 #include "nsMacIcelandicToUnicode.h"
+#include "mozilla/Telemetry.h"
+
+using namespace mozilla;

 //----------------------------------------------------------------------
 // Global functions and data [declaration]
@ -17,6 +20,7 @@ nsMacIcelandicToUnicodeConstructor(nsISupports *aOuter, REFNSIID aIID,
 #include "macicela.ut"
  };

+  Telemetry::Accumulate(Telemetry::DECODER_INSTANTIATED_MACICELANDIC, true);
  return CreateOneByteDecoder((uMappingTable*) &g_utMappingTable,
                              aOuter, aIID, aResult);
 }
--- a/intl/uconv/ucvlatin/nsMacRomanianToUnicode.cpp
+++ b/intl/uconv/ucvlatin/nsMacRomanianToUnicode.cpp
@ -5,6 +5,9 @@

 #include "nsUCConstructors.h"
 #include "nsMacRomanianToUnicode.h"
+#include "mozilla/Telemetry.h"
+
+using namespace mozilla;

 //----------------------------------------------------------------------
 // Global functions and data [declaration]
@ -17,6 +20,7 @@ nsMacRomanianToUnicodeConstructor(nsISupports *aOuter, REFNSIID aIID,
 #include "macro.ut"
  };

+  Telemetry::Accumulate(Telemetry::DECODER_INSTANTIATED_MACROMANIAN, true);
  return CreateOneByteDecoder((uMappingTable*) &g_utMappingTable,
                              aOuter, aIID, aResult);
 }
--- a/intl/uconv/ucvlatin/nsMacTurkishToUnicode.cpp
+++ b/intl/uconv/ucvlatin/nsMacTurkishToUnicode.cpp
@ -5,6 +5,9 @@

 #include "nsUCConstructors.h"
 #include "nsMacTurkishToUnicode.h"
+#include "mozilla/Telemetry.h"
+
+using namespace mozilla;

 //----------------------------------------------------------------------
 // Global functions and data [declaration]
@ -17,6 +20,7 @@ nsMacTurkishToUnicodeConstructor(nsISupports *aOuter, REFNSIID aIID,
 #include "macturki.ut"
  };

+  Telemetry::Accumulate(Telemetry::DECODER_INSTANTIATED_MACTURKISH, true);
  return CreateOneByteDecoder((uMappingTable*) &g_MacTurkishMappingTable,
                            aOuter, aIID, aResult);
 }
--- a/intl/uconv/ucvlatin/nsT61ToUnicode.cpp
+++ b/intl/uconv/ucvlatin/nsT61ToUnicode.cpp
@ -5,6 +5,9 @@

 #include "nsUCConstructors.h"
 #include "nsT61ToUnicode.h"
+#include "mozilla/Telemetry.h"
+
+using namespace mozilla;

 //----------------------------------------------------------------------
 // Global functions and data [declaration]
@ -24,6 +27,7 @@ nsT61ToUnicodeConstructor(nsISupports *aOuter, REFNSIID aIID,
      ShiftInCell(u2BytesChar,  2, 0xC0, 0xCF)
  };

+  Telemetry::Accumulate(Telemetry::DECODER_INSTANTIATED_T61, true);
  return CreateTableDecoder(uMultibytesCharset,
                            (uShiftInTable*) &g_T61ShiftInTable, 
                            (uMappingTable*) &g_T61MappingTable, 1,
--- a/intl/uconv/ucvlatin/nsTCVN5712ToUnicode.cpp
+++ b/intl/uconv/ucvlatin/nsTCVN5712ToUnicode.cpp
@ -5,6 +5,9 @@

 #include "nsUCConstructors.h"
 #include "nsTCVN5712ToUnicode.h"
+#include "mozilla/Telemetry.h"
+
+using namespace mozilla;

 //----------------------------------------------------------------------
 // Global functions and data [declaration]
@ -17,6 +20,7 @@ nsTCVN5712ToUnicodeConstructor(nsISupports *aOuter, REFNSIID aIID,
 #include "tcvn5712.ut"
  };

+  Telemetry::Accumulate(Telemetry::DECODER_INSTANTIATED_VIETTCVN5712, true);
  return CreateOneByteDecoder((uMappingTable*) &g_utMappingTable,
                              aOuter, aIID, aResult);
 }
--- a/intl/uconv/ucvlatin/nsVISCIIToUnicode.cpp
+++ b/intl/uconv/ucvlatin/nsVISCIIToUnicode.cpp
@ -5,6 +5,9 @@

 #include "nsVISCIIToUnicode.h"
 #include "nsUCConstructors.h"
+#include "mozilla/Telemetry.h"
+
+using namespace mozilla;

 //----------------------------------------------------------------------
 // Global functions and data [declaration]
@ -17,6 +20,7 @@ nsVISCIIToUnicodeConstructor(nsISupports *aOuter, REFNSIID aIID,
 #include "viscii.ut"
  };

+  Telemetry::Accumulate(Telemetry::DECODER_INSTANTIATED_VISCII, true);
  return CreateOneByteDecoder((uMappingTable*) &g_utMappingTable,
                              aOuter, aIID, aResult);
 }
--- a/intl/uconv/ucvlatin/nsVPSToUnicode.cpp
+++ b/intl/uconv/ucvlatin/nsVPSToUnicode.cpp
@ -5,6 +5,9 @@

 #include "nsVPSToUnicode.h"
 #include "nsUCConstructors.h"
+#include "mozilla/Telemetry.h"
+
+using namespace mozilla;

 //----------------------------------------------------------------------
 // Global functions and data [declaration]
@ -17,6 +20,7 @@ nsVPSToUnicodeConstructor(nsISupports *aOuter, REFNSIID aIID,
 #include "vps.ut"
  };

+  Telemetry::Accumulate(Telemetry::DECODER_INSTANTIATED_VIETVPS, true);
  return CreateOneByteDecoder((uMappingTable*) &g_utMappingTable,
                              aOuter, aIID, aResult);
 }
--- a/js/src/configure.in
+++ b/js/src/configure.in
@ -2916,7 +2916,7 @@ if test "$_USE_SYSTEM_NSPR" || (test "$NSPR_CFLAGS" -o "$NSPR_LIBS"); then
 fi

 case "$target" in
-  *linux*|*darwin*)
+  *linux*|*darwin*|*dragonfly*|*freebsd*|*netbsd*|*openbsd*)
    if test -z "$_HAS_NSPR"; then JS_POSIX_NSPR_DEFAULT=1; fi
    ;;
 esac
--- a/js/src/gc/GCInternals.h
+++ b/js/src/gc/GCInternals.h
@ -26,9 +26,10 @@ BufferGrayRoots(GCMarker *gcmarker);
 class AutoCopyFreeListToArenas
 {
    JSRuntime *runtime;
+    ZoneSelector selector;

  public:
-    AutoCopyFreeListToArenas(JSRuntime *rt);
+    AutoCopyFreeListToArenas(JSRuntime *rt, ZoneSelector selector);
    ~AutoCopyFreeListToArenas();
 };

@ -64,7 +65,7 @@ struct AutoPrepareForTracing
    AutoTraceSession session;
    AutoCopyFreeListToArenas copy;

-    AutoPrepareForTracing(JSRuntime *rt);
+    AutoPrepareForTracing(JSRuntime *rt, ZoneSelector selector);
 };

 class IncrementalSafety
--- a/js/src/gc/Iteration.cpp
+++ b/js/src/gc/Iteration.cpp
@ -11,6 +11,7 @@
 #include "js/HashTable.h"
 #include "vm/Runtime.h"

+#include "jscntxtinlines.h"
 #include "jsgcinlines.h"

 using namespace js;
@ -21,7 +22,8 @@ js::TraceRuntime(JSTracer *trc)
 {
    JS_ASSERT(!IS_GC_MARKING_TRACER(trc));

-    AutoPrepareForTracing prep(trc->runtime);
+    AutoLockForExclusiveAccess lock(trc->runtime);
+    AutoPrepareForTracing prep(trc->runtime, WithAtoms);
    MarkRuntime(trc);
 }

@ -54,9 +56,10 @@ js::IterateZonesCompartmentsArenasCells(JSRuntime *rt, void *data,
                                        IterateArenaCallback arenaCallback,
                                        IterateCellCallback cellCallback)
 {
-    AutoPrepareForTracing prop(rt);
+    AutoLockForExclusiveAccess lock(rt);
+    AutoPrepareForTracing prop(rt, WithAtoms);

-    for (ZonesIter zone(rt); !zone.done(); zone.next()) {
+    for (ZonesIter zone(rt, WithAtoms); !zone.done(); zone.next()) {
        (*zoneCallback)(rt, data, zone);
        IterateCompartmentsArenasCells(rt, zone, data,
                                       compartmentCallback, arenaCallback, cellCallback);
@ -70,7 +73,8 @@ js::IterateZoneCompartmentsArenasCells(JSRuntime *rt, Zone *zone, void *data,
                                       IterateArenaCallback arenaCallback,
                                       IterateCellCallback cellCallback)
 {
-    AutoPrepareForTracing prop(rt);
+    AutoLockForExclusiveAccess lock(rt);
+    AutoPrepareForTracing prop(rt, WithAtoms);

    (*zoneCallback)(rt, data, zone);
    IterateCompartmentsArenasCells(rt, zone, data,
@ -80,7 +84,7 @@ js::IterateZoneCompartmentsArenasCells(JSRuntime *rt, Zone *zone, void *data,
 void
 js::IterateChunks(JSRuntime *rt, void *data, IterateChunkCallback chunkCallback)
 {
-    AutoPrepareForTracing prep(rt);
+    AutoPrepareForTracing prep(rt, SkipAtoms);

    for (js::GCChunkSet::Range r = rt->gcChunkSet.all(); !r.empty(); r.popFront())
        chunkCallback(rt, data, r.front());
@ -90,7 +94,7 @@ void
 js::IterateScripts(JSRuntime *rt, JSCompartment *compartment,
                   void *data, IterateScriptCallback scriptCallback)
 {
-    AutoPrepareForTracing prep(rt);
+    AutoPrepareForTracing prep(rt, SkipAtoms);

    if (compartment) {
        for (CellIterUnderGC i(compartment->zone(), gc::FINALIZE_SCRIPT); !i.done(); i.next()) {
@ -99,7 +103,7 @@ js::IterateScripts(JSRuntime *rt, JSCompartment *compartment,
                scriptCallback(rt, data, script);
        }
    } else {
-        for (ZonesIter zone(rt); !zone.done(); zone.next()) {
+        for (ZonesIter zone(rt, SkipAtoms); !zone.done(); zone.next()) {
            for (CellIterUnderGC i(zone, gc::FINALIZE_SCRIPT); !i.done(); i.next())
                scriptCallback(rt, data, i.get<JSScript>());
        }
@ -109,7 +113,7 @@ js::IterateScripts(JSRuntime *rt, JSCompartment *compartment,
 void
 js::IterateGrayObjects(Zone *zone, GCThingCallback cellCallback, void *data)
 {
-    AutoPrepareForTracing prep(zone->runtimeFromMainThread());
+    AutoPrepareForTracing prep(zone->runtimeFromMainThread(), SkipAtoms);

    for (size_t finalizeKind = 0; finalizeKind <= FINALIZE_OBJECT_LAST; finalizeKind++) {
        for (CellIterUnderGC i(zone, AllocKind(finalizeKind)); !i.done(); i.next()) {
@ -126,9 +130,10 @@ JS_IterateCompartments(JSRuntime *rt, void *data,
 {
    JS_ASSERT(!rt->isHeapBusy());

+    AutoLockForExclusiveAccess lock(rt);
    AutoPauseWorkersForTracing pause(rt);
    AutoTraceSession session(rt);

-    for (CompartmentsIter c(rt); !c.done(); c.next())
+    for (CompartmentsIter c(rt, WithAtoms); !c.done(); c.next())
        (*compartmentCallback)(rt, data, c);
 }
--- a/js/src/gc/Nursery.cpp
+++ b/js/src/gc/Nursery.cpp
@ -602,7 +602,7 @@ js::Nursery::collect(JSRuntime *rt, JS::gcreason::Reason reason)
    rt->gcStoreBuffer.mark(&trc); // This must happen first.
    MarkRuntime(&trc);
    Debugger::markAll(&trc);
-    for (CompartmentsIter comp(rt); !comp.done(); comp.next()) {
+    for (CompartmentsIter comp(rt, SkipAtoms); !comp.done(); comp.next()) {
        comp->markAllCrossCompartmentWrappers(&trc);
        comp->markAllInitialShapeTableEntries(&trc);
    }
--- a/js/src/gc/RootMarking.cpp
+++ b/js/src/gc/RootMarking.cpp
@ -664,7 +664,7 @@ js::gc::MarkRuntime(JSTracer *trc, bool useSavedRoots)
    JS_ASSERT(!rt->mainThread.suppressGC);

    if (IS_GC_MARKING_TRACER(trc)) {
-        for (CompartmentsIter c(rt); !c.done(); c.next()) {
+        for (CompartmentsIter c(rt, SkipAtoms); !c.done(); c.next()) {
            if (!c->zone()->isCollecting())
                c->markCrossCompartmentWrappers(trc);
        }
@ -721,7 +721,7 @@ js::gc::MarkRuntime(JSTracer *trc, bool useSavedRoots)
    for (ContextIter acx(rt); !acx.done(); acx.next())
        acx->mark(trc);

-    for (ZonesIter zone(rt); !zone.done(); zone.next()) {
+    for (ZonesIter zone(rt, SkipAtoms); !zone.done(); zone.next()) {
        if (IS_GC_MARKING_TRACER(trc) && !zone->isCollecting())
            continue;

@ -743,7 +743,7 @@ js::gc::MarkRuntime(JSTracer *trc, bool useSavedRoots)
    }

    /* We can't use GCCompartmentsIter if we're called from TraceRuntime. */
-    for (CompartmentsIter c(rt); !c.done(); c.next()) {
+    for (CompartmentsIter c(rt, SkipAtoms); !c.done(); c.next()) {
        if (trc->runtime->isHeapMinorCollecting())
            c->globalWriteBarriered = false;

@ -773,7 +773,7 @@ js::gc::MarkRuntime(JSTracer *trc, bool useSavedRoots)
         * which have been entered. Globals aren't nursery allocated so there's
         * no need to do this for minor GCs.
         */
-        for (CompartmentsIter c(rt); !c.done(); c.next())
+        for (CompartmentsIter c(rt, SkipAtoms); !c.done(); c.next())
            c->mark(trc);

        /*
--- a/js/src/gc/Verifier.cpp
+++ b/js/src/gc/Verifier.cpp
@ -16,6 +16,7 @@
 #include "gc/Zone.h"
 #include "js/HashTable.h"

+#include "jscntxtinlines.h"
 #include "jsgcinlines.h"

 using namespace js;
@ -235,13 +236,13 @@ JS::CheckStackRoots(JSContext *cx)

    // Can switch to the atoms compartment during analysis.
    if (IsAtomsCompartment(cx->compartment())) {
-        for (CompartmentsIter c(rt); !c.done(); c.next()) {
+        for (CompartmentsIter c(rt, SkipAtoms); !c.done(); c.next()) {
            if (c.get()->activeAnalysis)
                return;
        }
    }

-    AutoCopyFreeListToArenas copy(rt);
+    AutoCopyFreeListToArenas copy(rt, WithAtoms);

    ConservativeGCData *cgcd = &rt->conservativeGC;
    cgcd->recordStackTop();
@ -447,7 +448,8 @@ gc::StartVerifyPreBarriers(JSRuntime *rt)

    MinorGC(rt, JS::gcreason::API);

-    AutoPrepareForTracing prep(rt);
+    AutoLockForExclusiveAccess lock(rt);
+    AutoPrepareForTracing prep(rt, WithAtoms);

    if (!IsIncrementalGCSafe(rt))
        return;
@ -510,7 +512,7 @@ gc::StartVerifyPreBarriers(JSRuntime *rt)
    rt->gcMarker.start();

    rt->setNeedsBarrier(true);
-    for (ZonesIter zone(rt); !zone.done(); zone.next()) {
+    for (ZonesIter zone(rt, WithAtoms); !zone.done(); zone.next()) {
        PurgeJITCaches(zone);
        zone->setNeedsBarrier(true, Zone::UpdateIon);
        zone->allocator.arenas.purge();
@ -575,7 +577,7 @@ AssertMarkedOrAllocated(const EdgeValue &edge)
 void
 gc::EndVerifyPreBarriers(JSRuntime *rt)
 {
-    AutoPrepareForTracing prep(rt);
+    AutoPrepareForTracing prep(rt, SkipAtoms);

    VerifyPreTracer *trc = (VerifyPreTracer *)rt->gcVerifyPreData;

@ -585,7 +587,7 @@ gc::EndVerifyPreBarriers(JSRuntime *rt)
    bool compartmentCreated = false;

    /* We need to disable barriers before tracing, which may invoke barriers. */
-    for (ZonesIter zone(rt); !zone.done(); zone.next()) {
+    for (ZonesIter zone(rt, WithAtoms); !zone.done(); zone.next()) {
        if (!zone->needsBarrier())
            compartmentCreated = true;

@ -740,7 +742,7 @@ js::gc::EndVerifyPostBarriers(JSRuntime *rt)
 {
 #ifdef JSGC_GENERATIONAL
    VerifyPostTracer::EdgeSet edges;
-    AutoPrepareForTracing prep(rt);
+    AutoPrepareForTracing prep(rt, SkipAtoms);

    VerifyPostTracer *trc = (VerifyPostTracer *)rt->gcVerifyPostData;

--- a/js/src/gc/Zone.h
+++ b/js/src/gc/Zone.h
@ -319,21 +319,39 @@ struct Zone : public JS::shadow::Zone,

 namespace js {

+/*
+ * Using the atoms zone without holding the exclusive access lock is dangerous
+ * because worker threads may be using it simultaneously. Therefore, it's
+ * better to skip the atoms zone when iterating over zones. If you need to
+ * iterate over the atoms zone, consider taking the exclusive access lock first.
+ */
+enum ZoneSelector {
+    WithAtoms,
+    SkipAtoms
+};
+
 class ZonesIter {
  private:
    JS::Zone **it, **end;

  public:
-    ZonesIter(JSRuntime *rt) {
+    ZonesIter(JSRuntime *rt, ZoneSelector selector) {
        it = rt->zones.begin();
        end = rt->zones.end();
+
+        if (selector == SkipAtoms) {
+            JS_ASSERT(rt->isAtomsZone(*it));
+            it++;
+        }
    }

    bool done() const { return it == end; }

    void next() {
        JS_ASSERT(!done());
-        it++;
+        do {
+            it++;
+        } while (!done() && (*it)->usedByExclusiveThread);
    }

    JS::Zone *get() const {
@ -383,8 +401,15 @@ class CompartmentsIterT
    CompartmentsIterT(JSRuntime *rt)
      : zone(rt)
    {
-        JS_ASSERT(!zone.done());
-        comp.construct(zone);
+        if (!zone.done())
+            comp.construct(zone);
+    }
+
+    CompartmentsIterT(JSRuntime *rt, ZoneSelector selector)
+      : zone(rt, selector)
+    {
+        if (!zone.done())
+            comp.construct(zone);
    }

    bool done() const { return zone.done(); }
--- a/js/src/jit-test/tests/basic/bug935294.js
+++ b/js/src/jit-test/tests/basic/bug935294.js
@ -0,0 +1,5 @@
+// |jit-test| error: ReferenceError
+for (var c in foo)
+  try {
+    throw new Error();
+  } catch (e)  {}
--- a/js/src/jit-test/tests/generators/bug931414.js
+++ b/js/src/jit-test/tests/generators/bug931414.js
@ -0,0 +1,11 @@
+// |jit-test| error: is undefined
+
+load(libdir + "iteration.js");
+
+function iterable() {
+  var iterable = {};
+  iterable[std_iterator] = () => ({next: () => void 0});
+  return iterable;
+}
+
+(function*(){yield*iterable()}()).next();
--- a/js/src/jit/BaselineBailouts.cpp
+++ b/js/src/jit/BaselineBailouts.cpp
@ -795,30 +795,31 @@ InitFromBailout(JSContext *cx, HandleScript caller, jsbytecode *callerPC,
    BaselineScript *baselineScript = script->baselineScript();

 #ifdef DEBUG
-    uint32_t expectedDepth = js_ReconstructStackDepth(cx, script,
-                                                      resumeAfter ? GetNextPc(pc) : pc);
-    if (op != JSOP_FUNAPPLY || !iter.moreFrames() || resumeAfter) {
-        if (op == JSOP_FUNCALL) {
-            // For fun.call(this, ...); the reconstructStackDepth will
-            // include the this. When inlining that is not included.
-            // So the exprStackSlots will be one less.
-            JS_ASSERT(expectedDepth - exprStackSlots <= 1);
-        } else if (iter.moreFrames() && (IsGetPropPC(pc) || IsSetPropPC(pc))) {
-            // Accessors coming out of ion are inlined via a complete
-            // lie perpetrated by the compiler internally. Ion just rearranges
-            // the stack, and pretends that it looked like a call all along.
-            // This means that the depth is actually one *more* than expected
-            // by the interpreter, as there is now a JSFunction, |this| and [arg],
-            // rather than the expected |this| and [arg]
-            // Note that none of that was pushed, but it's still reflected
-            // in exprStackSlots.
-            JS_ASSERT(exprStackSlots - expectedDepth == 1);
-        } else {
-            // For fun.apply({}, arguments) the reconstructStackDepth will
-            // have stackdepth 4, but it could be that we inlined the
-            // funapply. In that case exprStackSlots, will have the real
-            // arguments in the slots and not be 4.
-            JS_ASSERT(exprStackSlots == expectedDepth);
+    uint32_t expectedDepth;
+    if (ReconstructStackDepth(cx, script, resumeAfter ? GetNextPc(pc) : pc, &expectedDepth)) {
+        if (op != JSOP_FUNAPPLY || !iter.moreFrames() || resumeAfter) {
+            if (op == JSOP_FUNCALL) {
+                // For fun.call(this, ...); the reconstructStackDepth will
+                // include the this. When inlining that is not included.
+                // So the exprStackSlots will be one less.
+                JS_ASSERT(expectedDepth - exprStackSlots <= 1);
+            } else if (iter.moreFrames() && (IsGetPropPC(pc) || IsSetPropPC(pc))) {
+                // Accessors coming out of ion are inlined via a complete
+                // lie perpetrated by the compiler internally. Ion just rearranges
+                // the stack, and pretends that it looked like a call all along.
+                // This means that the depth is actually one *more* than expected
+                // by the interpreter, as there is now a JSFunction, |this| and [arg],
+                // rather than the expected |this| and [arg]
+                // Note that none of that was pushed, but it's still reflected
+                // in exprStackSlots.
+                JS_ASSERT(exprStackSlots - expectedDepth == 1);
+            } else {
+                // For fun.apply({}, arguments) the reconstructStackDepth will
+                // have stackdepth 4, but it could be that we inlined the
+                // funapply. In that case exprStackSlots, will have the real
+                // arguments in the slots and not be 4.
+                JS_ASSERT(exprStackSlots == expectedDepth);
+            }
        }
    }

--- a/js/src/jit/BaselineJIT.cpp
+++ b/js/src/jit/BaselineJIT.cpp
@ -904,7 +904,7 @@ jit::AddSizeOfBaselineData(JSScript *script, mozilla::MallocSizeOf mallocSizeOf,
 void
 jit::ToggleBaselineSPS(JSRuntime *runtime, bool enable)
 {
-    for (ZonesIter zone(runtime); !zone.done(); zone.next()) {
+    for (ZonesIter zone(runtime, SkipAtoms); !zone.done(); zone.next()) {
        for (gc::CellIter i(zone, gc::FINALIZE_SCRIPT); !i.done(); i.next()) {
            JSScript *script = i.get<JSScript>();
            if (!script->hasBaselineScript())
--- a/js/src/jit/arm/Assembler-arm.h
+++ b/js/src/jit/arm/Assembler-arm.h
@ -1303,12 +1303,17 @@ class Assembler
    void initWithAllocator() {
        m_buffer.initWithAllocator();

+        // Note that the sizes for the double pools are set to 1020 rather than 1024 to
+        // work around a rare edge case that would otherwise bail out - which is not
+        // possible for Asm.js code and causes a compilation failure.  See the comment at
+        // the fail_bail call within IonAssemberBufferWithConstantPools.h: finishPool().
+
        // Set up the backwards double region
-        new (&pools_[2]) Pool (1024, 8, 4, 8, 8, m_buffer.LifoAlloc_, true);
+        new (&pools_[2]) Pool (1020, 8, 4, 8, 8, m_buffer.LifoAlloc_, true);
        // Set up the backwards 32 bit region
        new (&pools_[3]) Pool (4096, 4, 4, 8, 4, m_buffer.LifoAlloc_, true, true);
        // Set up the forwards double region
-        new (doublePool) Pool (1024, 8, 4, 8, 8, m_buffer.LifoAlloc_, false, false, &pools_[2]);
+        new (doublePool) Pool (1020, 8, 4, 8, 8, m_buffer.LifoAlloc_, false, false, &pools_[2]);
        // Set up the forwards 32 bit region
        new (int32Pool) Pool (4096, 4, 4, 8, 4, m_buffer.LifoAlloc_, false, true, &pools_[3]);
        for (int i = 0; i < 4; i++) {
--- a/js/src/jit/shared/CodeGenerator-shared.cpp
+++ b/js/src/jit/shared/CodeGenerator-shared.cpp
@ -279,25 +279,28 @@ CodeGeneratorShared::encode(LSnapshot *snapshot)

 #ifdef DEBUG
        if (GetIonContext()->cx) {
-            uint32_t stackDepth = js_ReconstructStackDepth(GetIonContext()->cx, script, bailPC);
-            if (JSOp(*bailPC) == JSOP_FUNCALL) {
-                // For fun.call(this, ...); the reconstructStackDepth will
-                // include the this. When inlining that is not included.
-                // So the exprStackSlots will be one less.
-                JS_ASSERT(stackDepth - exprStack <= 1);
-            } else if (JSOp(*bailPC) != JSOP_FUNAPPLY &&
-                       !IsGetPropPC(bailPC) && !IsSetPropPC(bailPC))
-            {
-                // For fun.apply({}, arguments) the reconstructStackDepth will
-                // have stackdepth 4, but it could be that we inlined the
-                // funapply. In that case exprStackSlots, will have the real
-                // arguments in the slots and not be 4.
+            uint32_t stackDepth;
+            if (ReconstructStackDepth(GetIonContext()->cx, script, bailPC, &stackDepth)) {
+                if (JSOp(*bailPC) == JSOP_FUNCALL) {
+                    // For fun.call(this, ...); the reconstructStackDepth will
+                    // include the this. When inlining that is not included.
+                    // So the exprStackSlots will be one less.
+                    JS_ASSERT(stackDepth - exprStack <= 1);
+                } else if (JSOp(*bailPC) != JSOP_FUNAPPLY &&
+                           !IsGetPropPC(bailPC) && !IsSetPropPC(bailPC))
+                {
+                    // For fun.apply({}, arguments) the reconstructStackDepth will
+                    // have stackdepth 4, but it could be that we inlined the
+                    // funapply. In that case exprStackSlots, will have the real
+                    // arguments in the slots and not be 4.

-                // With accessors, we have different stack depths depending on whether or not we
-                // inlined the accessor, as the inlined stack contains a callee function that should
-                // never have been there and we might just be capturing an uneventful property site,
-                // in which case there won't have been any violence.
-                JS_ASSERT(exprStack == stackDepth);
+                    // With accessors, we have different stack depths depending on
+                    // whether or not we inlined the accessor, as the inlined stack
+                    // contains a callee function that should never have been there
+                    // and we might just be capturing an uneventful property site, in
+                    // which case there won't have been any violence.
+                    JS_ASSERT(exprStack == stackDepth);
+                }
            }
        }
 #endif
--- a/js/src/jscntxt.cpp
+++ b/js/src/jscntxt.cpp
@ -260,7 +260,7 @@ js::DestroyContext(JSContext *cx, DestroyContextMode mode)
         * Dump remaining type inference results while we still have a context.
         * This printing depends on atoms still existing.
         */
-        for (CompartmentsIter c(rt); !c.done(); c.next())
+        for (CompartmentsIter c(rt, SkipAtoms); !c.done(); c.next())
            c->types.print(cx, false);
    }
    if (mode == DCM_FORCE_GC) {
--- a/js/src/jsfriendapi.cpp
+++ b/js/src/jsfriendapi.cpp
@ -155,7 +155,7 @@ JS::PrepareZoneForGC(Zone *zone)
 JS_FRIEND_API(void)
 JS::PrepareForFullGC(JSRuntime *rt)
 {
-    for (ZonesIter zone(rt); !zone.done(); zone.next())
+    for (ZonesIter zone(rt, WithAtoms); !zone.done(); zone.next())
        zone->scheduleGC();
 }

@ -165,7 +165,7 @@ JS::PrepareForIncrementalGC(JSRuntime *rt)
    if (!JS::IsIncrementalGCInProgress(rt))
        return;

-    for (ZonesIter zone(rt); !zone.done(); zone.next()) {
+    for (ZonesIter zone(rt, WithAtoms); !zone.done(); zone.next()) {
        if (zone->wasGCStarted())
            PrepareZoneForGC(zone);
    }
@ -174,7 +174,7 @@ JS::PrepareForIncrementalGC(JSRuntime *rt)
 JS_FRIEND_API(bool)
 JS::IsGCScheduled(JSRuntime *rt)
 {
-    for (ZonesIter zone(rt); !zone.done(); zone.next()) {
+    for (ZonesIter zone(rt, WithAtoms); !zone.done(); zone.next()) {
        if (zone->isGCScheduled())
            return true;
    }
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@ -1010,7 +1010,7 @@ js_FinishGC(JSRuntime *rt)
 #endif

    /* Delete all remaining zones. */
-    for (ZonesIter zone(rt); !zone.done(); zone.next()) {
+    for (ZonesIter zone(rt, WithAtoms); !zone.done(); zone.next()) {
        for (CompartmentsInZoneIter comp(zone); !comp.done(); comp.next())
            js_delete(comp.get());
        js_delete(zone.get());
@ -1908,7 +1908,7 @@ size_t
 GCMarker::sizeOfExcludingThis(mozilla::MallocSizeOf mallocSizeOf) const
 {
    size_t size = stack.sizeOfExcludingThis(mallocSizeOf);
-    for (ZonesIter zone(runtime); !zone.done(); zone.next())
+    for (ZonesIter zone(runtime, WithAtoms); !zone.done(); zone.next())
        size += zone->gcGrayRoots.sizeOfExcludingThis(mallocSizeOf);
    return size;
 }
@ -2208,7 +2208,7 @@ static void
 AssertBackgroundSweepingFinished(JSRuntime *rt)
 {
    JS_ASSERT(!rt->gcSweepingZones);
-    for (ZonesIter zone(rt); !zone.done(); zone.next()) {
+    for (ZonesIter zone(rt, WithAtoms); !zone.done(); zone.next()) {
        for (unsigned i = 0; i < FINALIZE_LIMIT; ++i) {
            JS_ASSERT(!zone->allocator.arenas.arenaListsToSweep[i]);
            JS_ASSERT(zone->allocator.arenas.doneBackgroundFinalize(AllocKind(i)));
@ -2771,7 +2771,7 @@ CheckForCompartmentMismatches(JSRuntime *rt)
    CompartmentCheckTracer trc;
    JS_TracerInit(&trc, rt, CheckCompartmentCallback);

-    for (ZonesIter zone(rt); !zone.done(); zone.next()) {
+    for (ZonesIter zone(rt, SkipAtoms); !zone.done(); zone.next()) {
        trc.zone = zone;
        for (size_t thingKind = 0; thingKind < FINALIZE_LAST; thingKind++) {
            for (CellIterUnderGC i(zone, AllocKind(thingKind)); !i.done(); i.next()) {
@ -2798,7 +2798,7 @@ BeginMarkPhase(JSRuntime *rt)
    rt->gcIsFull = true;
    bool any = false;

-    for (ZonesIter zone(rt); !zone.done(); zone.next()) {
+    for (ZonesIter zone(rt, WithAtoms); !zone.done(); zone.next()) {
        /* Assert that zone state is as we expect */
        JS_ASSERT(!zone->isCollecting());
        JS_ASSERT(!zone->compartments.empty());
@ -2820,7 +2820,7 @@ BeginMarkPhase(JSRuntime *rt)
        zone->setPreservingCode(false);
    }

-    for (CompartmentsIter c(rt); !c.done(); c.next()) {
+    for (CompartmentsIter c(rt, WithAtoms); !c.done(); c.next()) {
        JS_ASSERT(!c->gcLiveArrayBuffers);
        c->marked = false;
        if (ShouldPreserveJITCode(c, currentTime))
@ -2953,7 +2953,7 @@ BeginMarkPhase(JSRuntime *rt)
     */

    /* Set the maybeAlive flag based on cross-compartment edges. */
-    for (CompartmentsIter c(rt); !c.done(); c.next()) {
+    for (CompartmentsIter c(rt, SkipAtoms); !c.done(); c.next()) {
        for (JSCompartment::WrapperEnum e(c); !e.empty(); e.popFront()) {
            Cell *dst = e.front().key.wrapped;
            dst->tenuredZone()->maybeAlive = true;
@ -3293,7 +3293,7 @@ AssertNeedsBarrierFlagsConsistent(JSRuntime *rt)
 {
 #ifdef DEBUG
    bool anyNeedsBarrier = false;
-    for (ZonesIter zone(rt); !zone.done(); zone.next())
+    for (ZonesIter zone(rt, WithAtoms); !zone.done(); zone.next())
        anyNeedsBarrier |= zone->needsBarrier();
    JS_ASSERT(rt->needsBarrier() == anyNeedsBarrier);
 #endif
@ -3307,7 +3307,7 @@ DropStringWrappers(JSRuntime *rt)
     * us to sweep the wrappers in all compartments every time we sweep a
     * compartment group.
     */
-    for (CompartmentsIter c(rt); !c.done(); c.next()) {
+    for (CompartmentsIter c(rt, SkipAtoms); !c.done(); c.next()) {
        for (JSCompartment::WrapperEnum e(c); !e.empty(); e.popFront()) {
            if (e.front().key.kind == CrossCompartmentKey::StringWrapper)
                e.removeFront();
@ -3856,7 +3856,7 @@ BeginSweepPhase(JSRuntime *rt, bool lastGC)
 #endif

 #ifdef DEBUG
-    for (CompartmentsIter c(rt); !c.done(); c.next()) {
+    for (CompartmentsIter c(rt, SkipAtoms); !c.done(); c.next()) {
        JS_ASSERT(!c->gcIncomingGrayPointers);
        for (JSCompartment::WrapperEnum e(c); !e.empty(); e.popFront()) {
            if (e.front().key.kind != CrossCompartmentKey::StringWrapper)
@ -3966,7 +3966,7 @@ EndSweepPhase(JSRuntime *rt, JSGCInvocationKind gckind, bool lastGC)
     * newly created zones.  Can only change from full to not full.
     */
    if (rt->gcIsFull) {
-        for (ZonesIter zone(rt); !zone.done(); zone.next()) {
+        for (ZonesIter zone(rt, WithAtoms); !zone.done(); zone.next()) {
            if (!zone->isCollecting()) {
                rt->gcIsFull = false;
                break;
@ -3981,7 +3981,7 @@ EndSweepPhase(JSRuntime *rt, JSGCInvocationKind gckind, bool lastGC)
     * prevent the cycle collector from collecting some dead objects.
     */
    if (rt->gcFoundBlackGrayEdges) {
-        for (ZonesIter zone(rt); !zone.done(); zone.next()) {
+        for (ZonesIter zone(rt, WithAtoms); !zone.done(); zone.next()) {
            if (!zone->isCollecting())
                zone->allocator.arenas.unmarkAll();
        }
@ -4057,7 +4057,7 @@ EndSweepPhase(JSRuntime *rt, JSGCInvocationKind gckind, bool lastGC)
            SweepZones(&fop, lastGC);
    }

-    for (ZonesIter zone(rt); !zone.done(); zone.next()) {
+    for (ZonesIter zone(rt, WithAtoms); !zone.done(); zone.next()) {
        zone->setGCLastBytes(zone->gcBytes, gckind);
        if (zone->isCollecting()) {
            JS_ASSERT(zone->isGCFinished());
@ -4077,7 +4077,7 @@ EndSweepPhase(JSRuntime *rt, JSGCInvocationKind gckind, bool lastGC)
    }

 #ifdef DEBUG
-    for (CompartmentsIter c(rt); !c.done(); c.next()) {
+    for (CompartmentsIter c(rt, SkipAtoms); !c.done(); c.next()) {
        JS_ASSERT(!c->gcIncomingGrayPointers);
        JS_ASSERT(!c->gcLiveArrayBuffers);

@ -4165,7 +4165,7 @@ AutoGCSession::~AutoGCSession()
 #endif

    /* Clear gcMallocBytes for all compartments */
-    for (ZonesIter zone(runtime); !zone.done(); zone.next()) {
+    for (ZonesIter zone(runtime, WithAtoms); !zone.done(); zone.next()) {
        zone->resetGCMallocBytes();
        zone->unscheduleGC();
    }
@ -4173,19 +4173,39 @@ AutoGCSession::~AutoGCSession()
    runtime->resetGCMallocBytes();
 }

-AutoCopyFreeListToArenas::AutoCopyFreeListToArenas(JSRuntime *rt)
-  : runtime(rt)
+AutoCopyFreeListToArenas::AutoCopyFreeListToArenas(JSRuntime *rt, ZoneSelector selector)
+  : runtime(rt),
+    selector(selector)
 {
-    for (ZonesIter zone(rt); !zone.done(); zone.next())
+    for (ZonesIter zone(rt, selector); !zone.done(); zone.next())
        zone->allocator.arenas.copyFreeListsToArenas();
 }

 AutoCopyFreeListToArenas::~AutoCopyFreeListToArenas()
 {
-    for (ZonesIter zone(runtime); !zone.done(); zone.next())
+    for (ZonesIter zone(runtime, selector); !zone.done(); zone.next())
        zone->allocator.arenas.clearFreeListsInArenas();
 }

+class AutoCopyFreeListToArenasForGC
+{
+    JSRuntime *runtime;
+
+  public:
+    AutoCopyFreeListToArenasForGC(JSRuntime *rt) : runtime(rt) {
+        for (ZonesIter zone(rt, WithAtoms); !zone.done(); zone.next()) {
+            //if (zone->canCollect())
+                zone->allocator.arenas.copyFreeListsToArenas();
+        }
+    }
+    ~AutoCopyFreeListToArenasForGC() {
+        for (ZonesIter zone(runtime, WithAtoms); !zone.done(); zone.next()) {
+            //if (zone->canCollect())
+                zone->allocator.arenas.clearFreeListsInArenas();
+        }
+    }
+};
+
 static void
 IncrementalCollectSlice(JSRuntime *rt,
                        int64_t budget,
@ -4201,7 +4221,7 @@ ResetIncrementalGC(JSRuntime *rt, const char *reason)

      case MARK: {
        /* Cancel any ongoing marking. */
-        AutoCopyFreeListToArenas copy(rt);
+        AutoCopyFreeListToArenasForGC copy(rt);

        rt->gcMarker.reset();
        rt->gcMarker.stop();
@ -4229,7 +4249,7 @@ ResetIncrementalGC(JSRuntime *rt, const char *reason)
      case SWEEP:
        rt->gcMarker.reset();

-        for (ZonesIter zone(rt); !zone.done(); zone.next())
+        for (ZonesIter zone(rt, WithAtoms); !zone.done(); zone.next())
            zone->scheduledForDestruction = false;

        /* Finish sweeping the current zone group, then abort. */
@ -4249,10 +4269,10 @@ ResetIncrementalGC(JSRuntime *rt, const char *reason)
    rt->gcStats.reset(reason);

 #ifdef DEBUG
-    for (CompartmentsIter c(rt); !c.done(); c.next())
+    for (CompartmentsIter c(rt, SkipAtoms); !c.done(); c.next())
        JS_ASSERT(!c->gcLiveArrayBuffers);

-    for (ZonesIter zone(rt); !zone.done(); zone.next()) {
+    for (ZonesIter zone(rt, WithAtoms); !zone.done(); zone.next()) {
        JS_ASSERT(!zone->needsBarrier());
        for (unsigned i = 0; i < FINALIZE_LIMIT; ++i)
            JS_ASSERT(!zone->allocator.arenas.arenaListsToSweep[i]);
@ -4307,7 +4327,7 @@ AutoGCSlice::~AutoGCSlice()
 {
    /* We can't use GCZonesIter if this is the end of the last slice. */
    bool haveBarriers = false;
-    for (ZonesIter zone(runtime); !zone.done(); zone.next()) {
+    for (ZonesIter zone(runtime, WithAtoms); !zone.done(); zone.next()) {
        if (zone->isGCMarking()) {
            zone->setNeedsBarrier(true, Zone::UpdateIon);
            zone->allocator.arenas.prepareForIncrementalGC(runtime);
@ -4339,7 +4359,7 @@ IncrementalCollectSlice(JSRuntime *rt,
                        JS::gcreason::Reason reason,
                        JSGCInvocationKind gckind)
 {
-    AutoCopyFreeListToArenas copy(rt);
+    AutoCopyFreeListToArenasForGC copy(rt);
    AutoGCSlice slice(rt);

    bool lastGC = (reason == JS::gcreason::DESTROY_RUNTIME);
@ -4504,7 +4524,7 @@ BudgetIncrementalGC(JSRuntime *rt, int64_t *budget)
    }

    bool reset = false;
-    for (ZonesIter zone(rt); !zone.done(); zone.next()) {
+    for (ZonesIter zone(rt, WithAtoms); !zone.done(); zone.next()) {
        if (zone->gcBytes >= zone->gcTriggerBytes) {
            *budget = SliceBudget::Unlimited;
            rt->gcStats.nonincremental("allocation trigger");
@ -4682,7 +4702,7 @@ Collect(JSRuntime *rt, bool incremental, int64_t budget,
    int zoneCount = 0;
    int compartmentCount = 0;
    int collectedCount = 0;
-    for (ZonesIter zone(rt); !zone.done(); zone.next()) {
+    for (ZonesIter zone(rt, WithAtoms); !zone.done(); zone.next()) {
        if (rt->gcMode == JSGC_MODE_GLOBAL)
            zone->scheduleGC();

@ -4695,7 +4715,7 @@ Collect(JSRuntime *rt, bool incremental, int64_t budget,
            collectedCount++;
    }

-    for (CompartmentsIter c(rt); !c.done(); c.next())
+    for (CompartmentsIter c(rt, WithAtoms); !c.done(); c.next())
        compartmentCount++;

    rt->gcShouldCleanUpEverything = ShouldCleanUpEverything(rt, reason, gckind);
@ -4767,7 +4787,7 @@ js::GCFinalSlice(JSRuntime *rt, JSGCInvocationKind gckind, JS::gcreason::Reason
 static bool
 ZonesSelected(JSRuntime *rt)
 {
-    for (ZonesIter zone(rt); !zone.done(); zone.next()) {
+    for (ZonesIter zone(rt, WithAtoms); !zone.done(); zone.next()) {
        if (zone->isGCScheduled())
            return true;
    }
@ -4836,11 +4856,11 @@ AutoFinishGC::AutoFinishGC(JSRuntime *rt)
    gc::FinishBackgroundFinalize(rt);
 }

-AutoPrepareForTracing::AutoPrepareForTracing(JSRuntime *rt)
+AutoPrepareForTracing::AutoPrepareForTracing(JSRuntime *rt, ZoneSelector selector)
  : finish(rt),
    pause(rt),
    session(rt),
-    copy(rt)
+    copy(rt, selector)
 {
    RecordNativeStackTopForGC(rt);
 }
@ -4896,7 +4916,7 @@ void
 gc::MergeCompartments(JSCompartment *source, JSCompartment *target)
 {
    JSRuntime *rt = source->runtimeFromMainThread();
-    AutoPrepareForTracing prepare(rt);
+    AutoPrepareForTracing prepare(rt, SkipAtoms);

    // Cleanup tables and other state in the source compartment that will be
    // meaningless after merging into the target compartment.
@ -5031,7 +5051,7 @@ void
 js::ReleaseAllJITCode(FreeOp *fop)
 {
 #ifdef JS_ION
-    for (ZonesIter zone(fop->runtime()); !zone.done(); zone.next()) {
+    for (ZonesIter zone(fop->runtime(), SkipAtoms); !zone.done(); zone.next()) {

 # ifdef DEBUG
        /* Assert no baseline scripts are marked as active. */
@ -5059,7 +5079,7 @@ js::ReleaseAllJITCode(FreeOp *fop)
    }

    /* Sweep now invalidated compiler outputs from each compartment. */
-    for (CompartmentsIter comp(fop->runtime()); !comp.done(); comp.next())
+    for (CompartmentsIter comp(fop->runtime(), SkipAtoms); !comp.done(); comp.next())
        comp->types.clearCompilerOutputs(fop);
 #endif
 }
@ -5134,7 +5154,7 @@ js::StopPCCountProfiling(JSContext *cx)
    if (!vec)
        return;

-    for (ZonesIter zone(rt); !zone.done(); zone.next()) {
+    for (ZonesIter zone(rt, SkipAtoms); !zone.done(); zone.next()) {
        for (CellIter i(zone, FINALIZE_SCRIPT); !i.done(); i.next()) {
            JSScript *script = i.get<JSScript>();
            if (script->hasScriptCounts && script->types) {
--- a/js/src/jsgcinlines.h
+++ b/js/src/jsgcinlines.h
@ -306,7 +306,7 @@ class GCZonesIter
    ZonesIter zone;

  public:
-    GCZonesIter(JSRuntime *rt) : zone(rt) {
+    GCZonesIter(JSRuntime *rt) : zone(rt, WithAtoms) {
        if (!zone->isCollecting())
            next();
    }
--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@ -402,12 +402,16 @@ class BytecodeParser

    bool parse();

+#ifdef DEBUG
+    bool isReachable(uint32_t offset) { return maybeCode(offset); }
+    bool isReachable(const jsbytecode *pc) { return maybeCode(pc); }
+#endif
+
    uint32_t stackDepthAtPC(uint32_t offset) {
        // Sometimes the code generator in debug mode asks about the stack depth
        // of unreachable code (bug 932180 comment 22).  Assume that unreachable
        // code has no operands on the stack.
-        Bytecode *code = maybeCode(offset);
-        return code ? code->stackDepth : 0;
+        return getCode(offset).stackDepth;
    }
    uint32_t stackDepthAtPC(const jsbytecode *pc) { return stackDepthAtPC(pc - script_->code); }

@ -697,6 +701,21 @@ BytecodeParser::parse()

 #ifdef DEBUG

+bool
+js::ReconstructStackDepth(JSContext *cx, JSScript *script, jsbytecode *pc, uint32_t *depth)
+{
+    BytecodeParser parser(cx, script);
+    if (!parser.parse())
+        return false;
+
+    if (!parser.isReachable(pc))
+        return false;
+
+    *depth = parser.stackDepthAtPC(pc);
+
+    return true;
+}
+
 /*
 * If pc != nullptr, include a prefix indicating whether the PC is at the
 * current line. If showAll is true, include the source note type and the
@ -707,10 +726,14 @@ js_DisassembleAtPC(JSContext *cx, JSScript *scriptArg, bool lines,
                   jsbytecode *pc, bool showAll, Sprinter *sp)
 {
    RootedScript script(cx, scriptArg);
+    BytecodeParser parser(cx, script);

    jsbytecode *next, *end;
    unsigned len;

+    if (showAll && !parser.parse())
+        return false;
+
    if (showAll)
        Sprint(sp, "%s:%u\n", script->filename(), script->lineno);

@ -757,10 +780,10 @@ js_DisassembleAtPC(JSContext *cx, JSScript *scriptArg, bool lines,
            }
            else
                sp->put("   ");
-            if (script->hasAnalysis() && script->analysis()->maybeCode(next))
-                Sprint(sp, "%05u ", script->analysis()->getCode(next).stackDepth);
+            if (parser.isReachable(next))
+                Sprint(sp, "%05u ", parser.stackDepthAtPC(next));
            else
-                sp->put("      ");
+                Sprint(sp, "      ", parser.stackDepthAtPC(next));
        }
        len = js_Disassemble1(cx, script, next, next - script->code, lines, sp);
        if (!len)
@ -1985,16 +2008,6 @@ js::DecompileArgument(JSContext *cx, int formalIndex, HandleValue v)
    return LossyTwoByteCharsToNewLatin1CharsZ(cx, linear->range()).c_str();
 }

-unsigned
-js_ReconstructStackDepth(JSContext *cx, JSScript *script, jsbytecode *pc)
-{
-    BytecodeParser parser(cx, script);
-    if (!parser.parse())
-        return 0;
-    return parser.stackDepthAtPC(pc);
-}
-
-
 bool
 js::CallResultEscapes(jsbytecode *pc)
 {
--- a/js/src/jsopcode.h
+++ b/js/src/jsopcode.h
@ -351,14 +351,17 @@ StackUses(JSScript *script, jsbytecode *pc);
 extern unsigned
 StackDefs(JSScript *script, jsbytecode *pc);

-}  /* namespace js */
-
+#ifdef DEBUG
 /*
- * Given bytecode address pc in script's main program code, return the operand
- * stack depth just before (JSOp) *pc executes.
+ * Given bytecode address pc in script's main program code, compute the operand
+ * stack depth just before (JSOp) *pc executes.  If *pc is not reachable, return
+ * false.
 */
-extern unsigned
-js_ReconstructStackDepth(JSContext *cx, JSScript *script, jsbytecode *pc);
+extern bool
+ReconstructStackDepth(JSContext *cx, JSScript *script, jsbytecode *pc, uint32_t *depth);
+#endif
+
+}  /* namespace js */

 #ifdef _MSC_VER
 #pragma warning(pop)
--- a/js/src/jswatchpoint.cpp
+++ b/js/src/jswatchpoint.cpp
@ -229,7 +229,7 @@ void
 WatchpointMap::traceAll(WeakMapTracer *trc)
 {
    JSRuntime *rt = trc->runtime;
-    for (CompartmentsIter comp(rt); !comp.done(); comp.next()) {
+    for (CompartmentsIter comp(rt, SkipAtoms); !comp.done(); comp.next()) {
        if (WatchpointMap *wpmap = comp->watchpointMap)
            wpmap->trace(trc);
    }
--- a/js/src/jsweakmap.cpp
+++ b/js/src/jsweakmap.cpp
@ -56,7 +56,7 @@ void
 WeakMapBase::traceAllMappings(WeakMapTracer *tracer)
 {
    JSRuntime *rt = tracer->runtime;
-    for (CompartmentsIter c(rt); !c.done(); c.next()) {
+    for (CompartmentsIter c(rt, SkipAtoms); !c.done(); c.next()) {
        for (WeakMapBase *m = c->gcWeakMapList; m; m = m->next)
            m->traceMappings(tracer);
    }
@ -440,3 +440,4 @@ js_InitWeakMapClass(JSContext *cx, HandleObject obj)
        return nullptr;
    return weakMapProto;
 }
+
--- a/js/src/jswrapper.cpp
+++ b/js/src/jswrapper.cpp
@ -885,7 +885,7 @@ js::NukeCrossCompartmentWrappers(JSContext* cx,
    // Iterate through scopes looking for system cross compartment wrappers
    // that point to an object that shares a global with obj.

-    for (CompartmentsIter c(rt); !c.done(); c.next()) {
+    for (CompartmentsIter c(rt, SkipAtoms); !c.done(); c.next()) {
        if (!sourceFilter.match(c))
            continue;

@ -992,7 +992,7 @@ js::RemapAllWrappersForObject(JSContext *cx, JSObject *oldTargetArg,
    if (!toTransplant.reserve(cx->runtime()->numCompartments))
        return false;

-    for (CompartmentsIter c(cx->runtime()); !c.done(); c.next()) {
+    for (CompartmentsIter c(cx->runtime(), SkipAtoms); !c.done(); c.next()) {
        if (WrapperMap::Ptr wp = c->lookupWrapper(origv)) {
            // We found a wrapper. Remember and root it.
            toTransplant.infallibleAppend(WrapperValue(wp));
@ -1017,7 +1017,7 @@ js::RecomputeWrappers(JSContext *cx, const CompartmentFilter &sourceFilter,

    AutoWrapperVector toRecompute(cx);

-    for (CompartmentsIter c(cx->runtime()); !c.done(); c.next()) {
+    for (CompartmentsIter c(cx->runtime(), SkipAtoms); !c.done(); c.next()) {
        // Filter by source compartment.
        if (!sourceFilter.match(c))
            continue;
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@ -1448,7 +1448,7 @@ Debugger::markAllIteratively(GCMarker *trc)
     * convoluted since the easiest way to find them is via their debuggees.
     */
    JSRuntime *rt = trc->runtime;
-    for (CompartmentsIter c(rt); !c.done(); c.next()) {
+    for (CompartmentsIter c(rt, SkipAtoms); !c.done(); c.next()) {
        GlobalObjectSet &debuggees = c->getDebuggees();
        for (GlobalObjectSet::Enum e(debuggees); !e.empty(); e.popFront()) {
            GlobalObject *global = e.front();
@ -1950,7 +1950,7 @@ Debugger::addAllGlobalsAsDebuggees(JSContext *cx, unsigned argc, Value *vp)
 {
    THIS_DEBUGGER(cx, argc, vp, "addAllGlobalsAsDebuggees", args, dbg);
    AutoDebugModeGC dmgc(cx->runtime());
-    for (CompartmentsIter c(cx->runtime()); !c.done(); c.next()) {
+    for (CompartmentsIter c(cx->runtime(), SkipAtoms); !c.done(); c.next()) {
        if (c == dbg->object->compartment() || c->options().invisibleToDebugger)
            continue;
        c->zone()->scheduledForDestruction = false;
@ -2629,7 +2629,7 @@ Debugger::findAllGlobals(JSContext *cx, unsigned argc, Value *vp)
    if (!result)
        return false;

-    for (CompartmentsIter c(cx->runtime()); !c.done(); c.next()) {
+    for (CompartmentsIter c(cx->runtime(), SkipAtoms); !c.done(); c.next()) {
        c->zone()->scheduledForDestruction = false;

        GlobalObject *global = c->maybeGlobal();
--- a/js/src/vm/MemoryMetrics.cpp
+++ b/js/src/vm/MemoryMetrics.cpp
@ -487,7 +487,7 @@ JS::CollectRuntimeStats(JSRuntime *rt, RuntimeStats *rtStats, ObjectPrivateVisit
    JS_ASSERT(totalArenaSize % gc::ArenaSize == 0);
 #endif

-    for (CompartmentsIter comp(rt); !comp.done(); comp.next())
+    for (CompartmentsIter comp(rt, WithAtoms); !comp.done(); comp.next())
        comp->compartmentStats = nullptr;

    size_t numDirtyChunks =
@ -512,7 +512,7 @@ JS_PUBLIC_API(size_t)
 JS::SystemCompartmentCount(JSRuntime *rt)
 {
    size_t n = 0;
-    for (CompartmentsIter comp(rt); !comp.done(); comp.next()) {
+    for (CompartmentsIter comp(rt, WithAtoms); !comp.done(); comp.next()) {
        if (comp->isSystem)
            ++n;
    }
@ -523,7 +523,7 @@ JS_PUBLIC_API(size_t)
 JS::UserCompartmentCount(JSRuntime *rt)
 {
    size_t n = 0;
-    for (CompartmentsIter comp(rt); !comp.done(); comp.next()) {
+    for (CompartmentsIter comp(rt, WithAtoms); !comp.done(); comp.next()) {
        if (!comp->isSystem)
            ++n;
    }
--- a/js/src/vm/OldDebugAPI.cpp
+++ b/js/src/vm/OldDebugAPI.cpp
@ -172,7 +172,7 @@ JS_SetDebugModeForAllCompartments(JSContext *cx, bool debug)
 {
    AutoDebugModeGC dmgc(cx->runtime());

-    for (CompartmentsIter c(cx->runtime()); !c.done(); c.next()) {
+    for (CompartmentsIter c(cx->runtime(), SkipAtoms); !c.done(); c.next()) {
        // Ignore special compartments (atoms, JSD compartments)
        if (c->principals) {
            if (!c->setDebugModeFromC(cx, !!debug, dmgc))
--- a/js/src/vm/PosixNSPR.cpp
+++ b/js/src/vm/PosixNSPR.cpp
@ -14,6 +14,10 @@
 #include <sys/time.h>
 #include <time.h>

+#if defined(__DragonFly__) || defined(__FreeBSD__) || defined(__OpenBSD__)
+#include <pthread_np.h>
+#endif
+
 class nspr::Thread
 {
    pthread_t pthread_;
@ -146,6 +150,11 @@ PR_SetCurrentThreadName(const char *name)
    int result;
 #ifdef XP_MACOSX
    result = pthread_setname_np(name);
+#elif defined(__DragonFly__) || defined(__FreeBSD__) || defined(__OpenBSD__)
+    pthread_set_name_np(pthread_self(), name);
+    result = 0;
+#elif defined(__NetBSD__)
+    result = pthread_setname_np(pthread_self(), "%s", (void *)name);
 #else
    result = pthread_setname_np(pthread_self(), name);
 #endif
--- a/js/src/vm/Runtime.cpp
+++ b/js/src/vm/Runtime.cpp
@ -408,7 +408,7 @@ JSRuntime::~JSRuntime()
    sourceHook = nullptr;

    /* Off thread compilation and parsing depend on atoms still existing. */
-    for (CompartmentsIter comp(this); !comp.done(); comp.next())
+    for (CompartmentsIter comp(this, SkipAtoms); !comp.done(); comp.next())
        CancelOffThreadIonCompile(comp, nullptr);
    WaitForOffThreadParsingToFinish(this);

@ -421,7 +421,7 @@ JSRuntime::~JSRuntime()
    FinishCommonNames(this);

    /* Clear debugging state to remove GC roots. */
-    for (CompartmentsIter comp(this); !comp.done(); comp.next()) {
+    for (CompartmentsIter comp(this, SkipAtoms); !comp.done(); comp.next()) {
        comp->clearTraps(defaultFreeOp());
        if (WatchpointMap *wpmap = comp->watchpointMap)
            wpmap->clear();
@ -713,7 +713,7 @@ JSRuntime::setGCMaxMallocBytes(size_t value)
     */
    gcMaxMallocBytes = (ptrdiff_t(value) >= 0) ? value : size_t(-1) >> 1;
    resetGCMallocBytes();
-    for (ZonesIter zone(this); !zone.done(); zone.next())
+    for (ZonesIter zone(this, WithAtoms); !zone.done(); zone.next())
        zone->setGCMaxMallocBytes(value);
 }

--- a/js/src/vm/Unicode.cpp
+++ b/js/src/vm/Unicode.cpp
@ -110,8 +110,8 @@ const CharacterInfo unicode::js_charinfo[] = {
    {65334, 0, 2},
    {65333, 0, 2},
    {65329, 0, 2},
-    {42893, 613, 10},
-    {42922, 614, 10},
+    {42280, 0, 2},
+    {42308, 0, 2},
    {65327, 0, 2},
    {65325, 0, 2},
    {10743, 0, 2},
@ -152,7 +152,7 @@ const CharacterInfo unicode::js_charinfo[] = {
    {0, 48, 2},
    {65488, 0, 2},
    {0, 7264, 2},
-    {42877, 7545, 10},
+    {35332, 0, 2},
    {3814, 0, 2},
    {65477, 0, 2},
    {0, 57921, 2},
@ -193,6 +193,9 @@ const CharacterInfo unicode::js_charinfo[] = {
    {0, 54754, 2},
    {0, 54721, 2},
    {58272, 0, 2},
+    {0, 30204, 2},
+    {0, 23256, 2},
+    {0, 23228, 2},
 };

 const uint8_t unicode::index1[] = {
@ -687,10 +690,10 @@ const uint8_t unicode::index2[] = {
      0,   5,   5,   5,   5,   5,   5,   5,   5,   5,   0,   0,   8,   9,   8,   9,   8,   9,
      8,   9,   8,   9,   8,   9,   8,   9,   5,   5,   8,   9,   8,   9,   8,   9,   8,   9,
      8,   9,   8,   9,   8,   9,   8,   9,   8,   9,   8,   9,   8,   9,   8,   9,   8,   9,
-      8,   9,   8,   9,   5,   5,   5,   5,   5,   5,   5,   5,   5,   8,   9,   8,   9,  98,
-      8,   9,   8,   9,   8,   9,   8,   9,   8,   9,   5,   0,   0,   8,   9,  56,   5,   0,
+      8,   9,   8,   9,   5,   5,   5,   5,   5,   5,   5,   5,   5,   8,   9,   8,   9, 139,
+      8,   9,   8,   9,   8,   9,   8,   9,   8,   9,   5,   0,   0,   8,   9, 140,   5,   0,
      8,   9,   8,   9,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   8,   9,
-      8,   9,   8,   9,   8,   9,   8,   9,  57,   0,   0,   0,   0,   0,   0,   0,   0,   0,
+      8,   9,   8,   9,   8,   9,   8,   9, 141,   0,   0,   0,   0,   0,   0,   0,   0,   0,
      0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,
      0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,   0,
      5,   5,   5,   5,   5,   5,   5,   5,   5,   5,   2,   5,   5,   5,   2,   5,   5,   5,
--- a/js/src/vm/Unicode.h
+++ b/js/src/vm/Unicode.h
@ -54,8 +54,6 @@ namespace unicode {
 *   if GetFlag(char) & (FLAG_IDENTIFIER_PART | FLAG_LETTER):
 *      return True
 *
- * NO_DELTA
- *   See comment in CharacterInfo
 */

 struct CharFlag {
@ -63,7 +61,6 @@ struct CharFlag {
        SPACE  = 1 << 0,
        LETTER = 1 << 1,
        IDENTIFIER_PART = 1 << 2,
-        NO_DELTA = 1 << 3
    };
 };

@ -82,10 +79,6 @@ class CharacterInfo {
     * For upper case alpha, we would store 0 in upperCase and 32 in
     * lowerCase (65 + 32 = 97).
     *
-     * If the delta between the chars wouldn't fit in a T, the flag
-     * FLAG_NO_DELTA is set, and you can just use upperCase and lowerCase
-     * without adding them the base char. See CharInfo.toUpperCase().
-     *
     * We use deltas to reuse information for multiple characters. For
     * example the whole lower case latin alphabet fits into one entry,
     * because it's always a UnicodeLetter and upperCase contains
@ -200,13 +193,6 @@ ToUpperCase(jschar ch)
 {
    const CharacterInfo &info = CharInfo(ch);

-    /*
-     * The delta didn't fit into T, so we had to store the
-     * actual char code.
-     */
-    if (info.flags & CharFlag::NO_DELTA)
-        return info.upperCase;
-
    return uint16_t(ch) + info.upperCase;
 }

@ -215,9 +201,6 @@ ToLowerCase(jschar ch)
 {
    const CharacterInfo &info = CharInfo(ch);

-    if (info.flags & CharFlag::NO_DELTA)
-        return info.lowerCase;
-
    return uint16_t(ch) + info.lowerCase;
 }

--- a/js/src/vm/make_unicode.py
+++ b/js/src/vm/make_unicode.py
@ -48,7 +48,6 @@ ZWJ = ord(u'\N{ZERO WIDTH JOINER}')
 FLAG_SPACE = 1 << 0
 FLAG_LETTER = 1 << 1
 FLAG_IDENTIFIER_PART = 1 << 2
-FLAG_NO_DELTA = 1 << 3

 MAX = 0xffff

@ -129,11 +128,11 @@ def generate_unicode_stuff(unicode_data, data_file, test_mapping, test_space):
        up_d = upper - code
        low_d = lower - code

-        if -32768 <= up_d <= 32767 and -32768 <= low_d <= 32767:
-            upper = up_d & 0xffff
-            lower = low_d & 0xffff
-        else:
-            flags |= FLAG_NO_DELTA
+        assert up_d > -65535 and up_d < 65535
+        assert low_d > -65535 and low_d < 65535
+
+        upper = up_d & 0xffff
+        lower = low_d & 0xffff

        item = (upper, lower, flags)

@ -248,7 +247,7 @@ if (typeof reportCompare === "function")
 """
    data_file.write('/* Generated by make_unicode.py DO NOT MODIFY */\n')
    data_file.write(public_domain)
-    data_file.write('#include "Unicode.h"\n\n')
+    data_file.write('#include "vm/Unicode.h"\n\n')
    data_file.write('using namespace js;\n')
    data_file.write('using namespace js::unicode;\n')
    data_file.write(comment)
--- a/layout/base/nsDisplayList.cpp
+++ b/layout/base/nsDisplayList.cpp
@ -3874,9 +3874,8 @@ nsDisplayTransform::GetFrameBoundsForTransform(const nsIFrame* aFrame)
  NS_PRECONDITION(aFrame, "Can't get the bounds of a nonexistent frame!");

  if (aFrame->GetStateBits() & NS_FRAME_SVG_LAYOUT) {
-    gfxRect bbox = nsSVGUtils::GetBBox(const_cast<nsIFrame*>(aFrame));
-    return nsLayoutUtils::RoundGfxRectToAppRect(bbox,
-      aFrame->PresContext()->AppUnitsPerCSSPixel()) - aFrame->GetPosition();
+    // TODO: SVG needs to define what percentage translations resolve against.
+    return nsRect();
  }

  return nsRect(nsPoint(0, 0), aFrame->GetSize());
@ -3892,9 +3891,8 @@ nsDisplayTransform::GetFrameBoundsForTransform(const nsIFrame* aFrame)
  nsRect result;

  if (aFrame->GetStateBits() & NS_FRAME_SVG_LAYOUT) {
-    gfxRect bbox = nsSVGUtils::GetBBox(const_cast<nsIFrame*>(aFrame));
-    return nsLayoutUtils::RoundGfxRectToAppRect(bbox,
-      aFrame->PresContext()->AppUnitsPerCSSPixel()) - aFrame->GetPosition();
+    // TODO: SVG needs to define what percentage translations resolve against.
+    return result;
  }

  /* Iterate through the continuation list, unioning together all the
@ -3964,56 +3962,51 @@ nsDisplayTransform::GetDeltaToTransformOrigin(const nsIFrame* aFrame,
   * a distance, it's already computed for us!
   */
  const nsStyleDisplay* display = aFrame->StyleDisplay();
-  nsRect boundingRect;
-  if (aBoundsOverride) {
-    boundingRect = *aBoundsOverride;
-  } else if (display->mTransformOrigin[0].GetUnit() != eStyleUnit_Coord ||
-             display->mTransformOrigin[1].GetUnit() != eStyleUnit_Coord) {
-    // GetFrameBoundsForTransform is expensive for SVG frames and we don't need
-    // it if the origin is coords (which it is by default for SVG).
-    boundingRect = nsDisplayTransform::GetFrameBoundsForTransform(aFrame);
-  }
+  nsRect boundingRect = (aBoundsOverride ? *aBoundsOverride :
+                         nsDisplayTransform::GetFrameBoundsForTransform(aFrame));

  /* Allows us to access named variables by index. */
-  float coords[2];
-  nscoord boundingOffsets[2] = {boundingRect.x, boundingRect.y};
-  nscoord boundingDimensions[2] = {boundingRect.width, boundingRect.height};
-  nscoord frameOffsets[2] = {aFrame->GetPosition().x, aFrame->GetPosition().y};
+  float coords[3];
+  const nscoord* dimensions[2] =
+    {&boundingRect.width, &boundingRect.height};

  for (uint8_t index = 0; index < 2; ++index) {
    /* If the -moz-transform-origin specifies a percentage, take the percentage
     * of the size of the box.
     */
    const nsStyleCoord &coord = display->mTransformOrigin[index];
-    if (coord.GetUnit() == eStyleUnit_Percent) {
+    if (coord.GetUnit() == eStyleUnit_Calc) {
+      const nsStyleCoord::Calc *calc = coord.GetCalcValue();
      coords[index] =
-        NSAppUnitsToFloatPixels(boundingDimensions[index], aAppUnitsPerPixel) *
-          coord.GetPercentValue() +
-        NSAppUnitsToFloatPixels(boundingOffsets[index], aAppUnitsPerPixel);
+        NSAppUnitsToFloatPixels(*dimensions[index], aAppUnitsPerPixel) *
+          calc->mPercent +
+        NSAppUnitsToFloatPixels(calc->mLength, aAppUnitsPerPixel);
+    } else if (coord.GetUnit() == eStyleUnit_Percent) {
+      coords[index] =
+        NSAppUnitsToFloatPixels(*dimensions[index], aAppUnitsPerPixel) *
+        coord.GetPercentValue();
    } else {
-      if (coord.GetUnit() == eStyleUnit_Calc) {
-        const nsStyleCoord::Calc *calc = coord.GetCalcValue();
-        coords[index] =
-          NSAppUnitsToFloatPixels(boundingDimensions[index], aAppUnitsPerPixel) *
-            calc->mPercent +
-          NSAppUnitsToFloatPixels(calc->mLength, aAppUnitsPerPixel);
-      } else {
-        NS_ABORT_IF_FALSE(coord.GetUnit() == eStyleUnit_Coord, "unexpected unit");
-        coords[index] =
-          NSAppUnitsToFloatPixels(coord.GetCoordValue(), aAppUnitsPerPixel);
-      }
-      if (aFrame->GetStateBits() & NS_FRAME_SVG_LAYOUT) {
-        // <length> values represent offsets from the origin of the SVG element's
-        // user space, not the top left of its border-box, so we must
-        // convert them to be relative to the border-box.
-        coords[index] -= NSAppUnitsToFloatPixels(frameOffsets[index], aAppUnitsPerPixel);
-      }
+      NS_ABORT_IF_FALSE(coord.GetUnit() == eStyleUnit_Coord, "unexpected unit");
+      coords[index] =
+        NSAppUnitsToFloatPixels(coord.GetCoordValue(), aAppUnitsPerPixel);
+    }
+    if ((aFrame->GetStateBits() & NS_FRAME_SVG_LAYOUT) &&
+        coord.GetUnit() != eStyleUnit_Percent) {
+      // <length> values represent offsets from the origin of the SVG element's
+      // user space, not the top left of its bounds, so we must adjust for that:
+      nscoord offset =
+        (index == 0) ? aFrame->GetPosition().x : aFrame->GetPosition().y;
+      coords[index] -= NSAppUnitsToFloatPixels(offset, aAppUnitsPerPixel);
    }
  }

-  return gfxPoint3D(coords[0], coords[1],
-                    NSAppUnitsToFloatPixels(display->mTransformOrigin[2].GetCoordValue(),
-                                            aAppUnitsPerPixel));
+  coords[2] = NSAppUnitsToFloatPixels(display->mTransformOrigin[2].GetCoordValue(),
+                                      aAppUnitsPerPixel);
+  /* Adjust based on the origin of the rectangle. */
+  coords[0] += NSAppUnitsToFloatPixels(boundingRect.x, aAppUnitsPerPixel);
+  coords[1] += NSAppUnitsToFloatPixels(boundingRect.y, aAppUnitsPerPixel);
+
+  return gfxPoint3D(coords[0], coords[1], coords[2]);
 }

 /* Returns the delta specified by the -moz-perspective-origin property.
@ -4087,6 +4080,7 @@ nsDisplayTransform::FrameTransformProperties::FrameTransformProperties(const nsI
  : mFrame(aFrame)
  , mTransformList(aFrame->StyleDisplay()->mSpecifiedTransform)
  , mToTransformOrigin(GetDeltaToTransformOrigin(aFrame, aAppUnitsPerPixel, aBoundsOverride))
+  , mToPerspectiveOrigin(GetDeltaToPerspectiveOrigin(aFrame, aAppUnitsPerPixel))
  , mChildPerspective(0)
 {
  const nsStyleDisplay* parentDisp = nullptr;
@ -4096,9 +4090,6 @@ nsDisplayTransform::FrameTransformProperties::FrameTransformProperties(const nsI
  }
  if (parentDisp && parentDisp->mChildPerspective.GetUnit() == eStyleUnit_Coord) {
    mChildPerspective = parentDisp->mChildPerspective.GetCoordValue();
-    if (mChildPerspective > 0.0) {
-      mToPerspectiveOrigin = GetDeltaToPerspectiveOrigin(aFrame, aAppUnitsPerPixel);
-    }
  }
 }

@ -4198,7 +4189,7 @@ nsDisplayTransform::GetResultingTransformMatrixInternal(const FrameTransformProp
    /* At the point when perspective is applied, we have been translated to the transform origin.
     * The translation to the perspective origin is the difference between these values.
     */
-    result = result * nsLayoutUtils::ChangeMatrixBasis(aProperties.GetToPerspectiveOrigin() - aProperties.mToTransformOrigin, perspective);
+    result = result * nsLayoutUtils::ChangeMatrixBasis(aProperties.mToPerspectiveOrigin - aProperties.mToTransformOrigin, perspective);
  }

  gfxPoint3D rounded(hasSVGTransforms ? newOrigin.x : NS_round(newOrigin.x),
--- a/layout/base/nsDisplayList.h
+++ b/layout/base/nsDisplayList.h
@ -3061,24 +3061,15 @@ public:
      : mFrame(nullptr)
      , mTransformList(aTransformList)
      , mToTransformOrigin(aToTransformOrigin)
-      , mChildPerspective(aChildPerspective)
      , mToPerspectiveOrigin(aToPerspectiveOrigin)
+      , mChildPerspective(aChildPerspective)
    {}

    const nsIFrame* mFrame;
    const nsCSSValueList* mTransformList;
    const gfxPoint3D mToTransformOrigin;
+    const gfxPoint3D mToPerspectiveOrigin;
    nscoord mChildPerspective;
-
-    const gfxPoint3D& GetToPerspectiveOrigin() const
-    {
-      NS_ASSERTION(mChildPerspective > 0, "Only valid with mChildPerspective > 0");
-      return mToPerspectiveOrigin;
-    }
-
-  private:
-    // mToPerspectiveOrigin is only valid if mChildPerspective > 0.
-    gfxPoint3D mToPerspectiveOrigin;
  };

  /**
--- a/layout/reftests/bugs/reftest.list
+++ b/layout/reftests/bugs/reftest.list
@ -1643,7 +1643,7 @@ fuzzy-if(Android&&AndroidVersion>=15,8,300) == 625409-1.html 625409-1-ref.html
 == 630835-1.html about:blank
 == 631352-1.html 631352-1-ref.html
 skip-if(B2G) fails-if(Android) == 632423-1.html 632423-1-ref.html
-skip-if(Android||B2G) random-if(winWidget&&!d2d) == 632781-verybig.html 632781-ref.html
+skip-if(Android||B2G) random-if(winWidget) == 632781-verybig.html 632781-ref.html
 == 632781-normalsize.html 632781-ref.html
 fails-if(Android) == 633344-1.html 633344-1-ref.html
 == 634232-1.html 634232-1-ref.html
--- a/layout/reftests/transform/reftest.list
+++ b/layout/reftests/transform/reftest.list
@ -124,7 +124,3 @@ skip-if(B2G) == stresstest-1.html stresstest-1-ref.html # bug 773482
 == table-2b.html table-2-ref.html
 # Bug 722463
 == inline-1a.html inline-1-ref.html
-== transform-origin-svg-1a.svg transform-origin-svg-1-ref.svg
-== transform-origin-svg-1b.svg transform-origin-svg-1-ref.svg
-== transform-origin-svg-2a.svg transform-origin-svg-2-ref.svg
-== transform-origin-svg-2b.svg transform-origin-svg-2-ref.svg
--- a/layout/reftests/transform/transform-origin-svg-1-ref.svg
+++ b/layout/reftests/transform/transform-origin-svg-1-ref.svg
@ -1,3 +0,0 @@
-<svg xmlns='http://www.w3.org/2000/svg'>
-<rect x='40' y='140' width='100' height='100' fill='lime'/>
-</svg>
--- a/layout/reftests/transform/transform-origin-svg-1a.svg
+++ b/layout/reftests/transform/transform-origin-svg-1a.svg
@ -1,6 +0,0 @@
-<svg xmlns='http://www.w3.org/2000/svg'>
-<g transform="translate(30,30)">
-  <rect x='10' y='10' width='100' height='100' fill='lime'
-        style="transform:rotate(90deg); transform-origin:left bottom;"/>
-</g>
-</svg>
--- a/layout/reftests/transform/transform-origin-svg-1b.svg
+++ b/layout/reftests/transform/transform-origin-svg-1b.svg
@ -1,7 +0,0 @@
-<svg xmlns='http://www.w3.org/2000/svg'>
-<g transform="translate(30,30)">
-  <rect x='10' y='10' width='100' height='100' fill='lime'
-        style="transform:rotate(90deg); transform-origin:10px 110px;
-               -webkit-transform:rotate(90deg); -webkit-transform-origin:10px 110px;"/>
-</g>
-</svg>
--- a/layout/reftests/transform/transform-origin-svg-2-ref.svg
+++ b/layout/reftests/transform/transform-origin-svg-2-ref.svg
@ -1,3 +0,0 @@
-<svg xmlns='http://www.w3.org/2000/svg'>
-<rect x='40' y='140' width='100' height='100' fill='lime' stroke-width='20' stroke='blue'/>
-</svg>
--- a/layout/reftests/transform/transform-origin-svg-2a.svg
+++ b/layout/reftests/transform/transform-origin-svg-2a.svg
@ -1,6 +0,0 @@
-<svg xmlns='http://www.w3.org/2000/svg'>
-<g transform="translate(30,30)">
-  <rect x='10' y='10' width='100' height='100' fill='lime' stroke-width='20' stroke='blue'
-        style="transform:rotate(90deg); transform-origin:left bottom;"/>
-</g>
-</svg>
--- a/layout/reftests/transform/transform-origin-svg-2b.svg
+++ b/layout/reftests/transform/transform-origin-svg-2b.svg
@ -1,7 +0,0 @@
-<svg xmlns='http://www.w3.org/2000/svg'>
-<g transform="translate(30,30)">
-  <rect x='10' y='10' width='100' height='100' fill='lime' stroke-width='20' stroke='blue'
-        style="transform:rotate(90deg); transform-origin:10px 110px;
-               -webkit-transform:rotate(90deg); -webkit-transform-origin:10px 110px;"/>
-</g>
-</svg>
--- a/layout/style/nsCSSRuleProcessor.cpp
+++ b/layout/style/nsCSSRuleProcessor.cpp
@ -1168,6 +1168,11 @@ InitSystemMetrics()
    sSystemMetrics->AppendElement(nsGkAtoms::windows_glass);
  }

+  rv = LookAndFeel::GetInt(LookAndFeel::eIntID_ColorPickerAvailable, &metricResult);
+  if (NS_SUCCEEDED(rv) && metricResult) {
+    sSystemMetrics->AppendElement(nsGkAtoms::color_picker_available);
+  }
+
  rv = LookAndFeel::GetInt(LookAndFeel::eIntID_WindowsClassic, &metricResult);
  if (NS_SUCCEEDED(rv) && metricResult) {
    sSystemMetrics->AppendElement(nsGkAtoms::windows_classic);
--- a/layout/style/nsMediaFeatures.cpp
+++ b/layout/style/nsMediaFeatures.cpp
@ -495,6 +495,13 @@ nsMediaFeatures::features[] = {
        { nullptr },
        GetIsResourceDocument
    },
+    {
+        &nsGkAtoms::_moz_color_picker_available,
+        nsMediaFeature::eMinMaxNotAllowed,
+        nsMediaFeature::eBoolInteger,
+        { &nsGkAtoms::color_picker_available },
+        GetSystemMetric
+    },
    {
        &nsGkAtoms::_moz_scrollbar_start_backward,
        nsMediaFeature::eMinMaxNotAllowed,
--- a/layout/svg/nsSVGTextFrame2.cpp
+++ b/layout/svg/nsSVGTextFrame2.cpp
@ -3765,16 +3765,14 @@ nsSVGTextFrame2::ReflowSVG()
    nsSVGEffects::UpdateEffects(this);
  }

-  // Now unset the various reflow bits. Do this before calling
-  // FinishAndStoreOverflow since FinishAndStoreOverflow can require glyph
-  // positions (to resolve transform-origin).
-  mState &= ~(NS_FRAME_FIRST_REFLOW | NS_FRAME_IS_DIRTY |
-              NS_FRAME_HAS_DIRTY_CHILDREN);
-
  nsRect overflow = nsRect(nsPoint(0,0), mRect.Size());
  nsOverflowAreas overflowAreas(overflow, overflow);
  FinishAndStoreOverflow(overflowAreas, mRect.Size());

+  // Now unset the various reflow bits:
+  mState &= ~(NS_FRAME_FIRST_REFLOW | NS_FRAME_IS_DIRTY |
+              NS_FRAME_HAS_DIRTY_CHILDREN);
+
  // XXX nsSVGContainerFrame::ReflowSVG only looks at its nsISVGChildFrame
  // children, and calls ConsiderChildOverflow on them.  Does it matter
  // that ConsiderChildOverflow won't be called on our children?
@ -3809,21 +3807,9 @@ nsSVGTextFrame2::GetBBoxContribution(const gfxMatrix &aToBBoxUserspace,
 {
  NS_ASSERTION(GetFirstPrincipalChild(), "must have a child frame");

-  SVGBBox bbox;
-  if (NS_SUBTREE_DIRTY(this)) {
-    // Return an empty bbox if this frame's subtree is dirty. This may be called
-    // in that situation, e.g. when we're building a display list after an
-    // interrupted reflow. This can also be called during reflow before we've
-    // been reflowed, e.g. if an earlier sibling is calling FinishAndStoreOverflow and
-    // needs our parent's perspective matrix, which depends on the SVG bbox
-    // contribution of this frame. In the latter situation, when all siblings have
-    // been reflowed, the parent will compute its perspective and rerun
-    // FinishAndStoreOverflow for all its children.
-    return bbox;
-  }
-
  UpdateGlyphPositioning();

+  SVGBBox bbox;
  nsPresContext* presContext = PresContext();

  TextRenderedRunIterator it(this);
--- a/layout/svg/svg.css
+++ b/layout/svg/svg.css
@ -51,7 +51,7 @@ foreignObject {
  text-indent: 0;
 }

-/* Set |transform-origin:0 0;| for all SVG elements except outer-<svg>,
+/* Set |transform-origin:0% 0%;| for all SVG elements except outer-<svg>,
   noting that 'svg' as a child of 'foreignObject' counts as outer-<svg>.
 */
 *:not(svg),
--- a/media/libpng/moz.build
+++ b/media/libpng/moz.build
@ -12,7 +12,7 @@ EXPORTS += [
    'pngconf.h',
 ]

-SOURCES += [
+UNIFIED_SOURCES += [
    'png.c',
    'pngerror.c',
    'pngget.c',
--- a/mobile/android/base/GeckoApp.java
+++ b/mobile/android/base/GeckoApp.java
@ -1293,6 +1293,7 @@ abstract public class GeckoApp
        });

        GeckoAppShell.setNotificationClient(makeNotificationClient());
+        NotificationHelper.init(getApplicationContext());
    }

    protected void initializeChrome() {
--- a/mobile/android/base/GeckoApplication.java
+++ b/mobile/android/base/GeckoApplication.java
@ -98,7 +98,6 @@ public class GeckoApplication extends Application {
    public void onCreate() {
        HardwareUtils.init(getApplicationContext());
        Clipboard.init(getApplicationContext());
-        NotificationHelper.init(getApplicationContext());
        GeckoLoader.loadMozGlue();
        super.onCreate();
    }
--- a/mobile/android/base/NotificationHelper.java
+++ b/mobile/android/base/NotificationHelper.java
@ -30,7 +30,7 @@ public final class NotificationHelper implements GeckoEventListener {
    public static final String NOTIFICATION_ID = "NotificationHelper_ID";
    private static final String LOGTAG = "GeckoNotificationManager";
    private static final String HELPER_NOTIFICATION = "helperNotif";
-    private static final String HELPER_BROADCAST_ACTION = "helperBroadcastAction";
+    private static final String HELPER_BROADCAST_ACTION = AppConstants.ANDROID_PACKAGE_NAME + ".helperBroadcastAction";

    // Attributes mandatory to be used while sending a notification from js.
    private static final String TITLE_ATTR = "title";
@ -71,6 +71,7 @@ public final class NotificationHelper implements GeckoEventListener {
    public static void init(Context context) {
        if (mInstance != null) {
            Log.w(LOGTAG, "NotificationHelper.init() called twice!");
+            return;
        }
        mInstance = new NotificationHelper();
        mContext = context;
--- a/mobile/android/base/tests/robocop.ini
+++ b/mobile/android/base/tests/robocop.ini
@ -1,65 +1,70 @@
+# [test_bug720538] # disabled on fig - bug 897072
+[testAboutPage]
+[testAddonManager]
+# disabled on x86 only; bug 936216
+skip-if = processor == "x86"
+[testAddSearchEngine]
 [testAwesomebar]
 # [testAwesomebarSwipes] # disabled on fig - bug 880060
-[testBookmark]
+[testAxisLocking]
+# disabled on x86 only; bug 927476
+skip-if = processor == "x86"
+# [testBookmark] # see bug 915350
 [testBookmarksPage]
 [testBookmarkFolders]
 # [testBookmarklets] # see bug 915350
 # [testBookmarkKeyword] # see bug 915350
+[testBrowserProvider]
 [testBrowserSearchVisibility]
-[testJNI]
-[testLoad]
-[testNewTab]
-[testOrderedBroadcast]
-[testPrefsObserver]
-[testPanCorrectness]
-# disabled on x86 only; bug 927476
-skip-if = processor == "x86"
-# [test_bug720538] # disabled on fig - bug 897072
+[testClearPrivateData]
+[testDeviceSearchEngine]
+[testDistribution]
+[testDoorHanger]
+[testFindInPage]
 [testFlingCorrectness]
 # disabled on x86 only; bug 927476
 skip-if = processor == "x86"
-[testOverscroll]
-[testAxisLocking]
-# disabled on x86 only; bug 927476
-skip-if = processor == "x86"
-[testAboutPage]
-[testLinkContextMenu]
-[testMailToContextMenu]
-[testPictureLinkContextMenu]
-[testPasswordProvider]
-[testPromptGridInput]
-# [testPasswordEncrypt] # see bug 824067
 [testFormHistory]
-[testBrowserProvider]
-[testSearchSuggestions]
-[testSharedPreferences]
-# [testThumbnails] # see bug 813107
-[testAddonManager]
+[testGetUserMedia]
 # [testHistory] # see bug 915350
-# [testVkbOverlap] # see bug 907274
-[testDoorHanger]
-# [testTabHistory] # see bug 915350
-[testShareLink]
-[testClearPrivateData]
-[testSettingsMenuItems]
-[testSystemPages]
-# disabled on x86 only; bug 907383
-skip-if = processor == "x86"
-# [testPermissions] # see bug 757475
-[testJarReader]
-[testDistribution]
-[testFindInPage]
-[testInputUrlBar]
-[testAddSearchEngine]
+[testHomeBanner]
 [testImportFromAndroid]
 # disabled on x86 only; bug 900664
 skip-if = processor == "x86"
+[testInputUrlBar]
+[testJarReader]
+[testJNI]
+[testLinkContextMenu]
+[testLoad]
+[testMailToContextMenu]
 [testMasterPassword]
-[testDeviceSearchEngine]
+[testNewTab]
+[testOrderedBroadcast]
+[testOverscroll]
+[testPanCorrectness]
+# disabled on x86 only; bug 927476
+skip-if = processor == "x86"
+# [testPasswordEncrypt] # see bug 824067
+[testPasswordProvider]
+# [testPermissions] # see bug 757475
+[testPictureLinkContextMenu]
+[testPrefsObserver]
 [testPrivateBrowsing]
-[testReaderMode]
-[testGetUserMedia]
-[testHomeBanner]
+[testPromptGridInput]
+# [testReaderMode] # see bug 913254
+# disabled on x86 only; bug 936224
+# skip-if = processor == "x86"
+[testSearchSuggestions]
+[testSettingsMenuItems]
+[testSharedPreferences]
+# [testShareLink] # see bug 915897
+[testSystemPages]
+# disabled on x86 only; bug 907383
+skip-if = processor == "x86"
+# [testTabHistory] # see bug 915350
+# [testThumbnails] # see bug 813107
+# [testVkbOverlap] # see bug 907274
+

 # Used for Talos, please don't use in mochitest
 #[testPan]
--- a/netwerk/base/public/nsISocketTransport.idl
+++ b/netwerk/base/public/nsISocketTransport.idl
@ -176,6 +176,12 @@ interface nsISocketTransport : nsITransport
     */
    const unsigned long DISABLE_IPV4 = (1 << 4);

+    /**
+     * If set, indicates that the socket should not connect if the hostname
+     * resolves to an RFC1918 address or IPv6 equivalent.
+     */
+    const unsigned long DISABLE_RFC1918 = (1 << 5);
+
    /**
     * Socket QoS/ToS markings. Valid values are IPTOS_DSCP_AFxx or
     * IPTOS_CLASS_CSx (or IPTOS_DSCP_EF, but currently no supported
--- a/netwerk/base/src/nsSocketTransport2.cpp
+++ b/netwerk/base/src/nsSocketTransport2.cpp
@ -1161,6 +1161,28 @@ nsSocketTransport::InitiateSocket()
            return NS_ERROR_OFFLINE;
    }

+    // Hosts/Proxy Hosts that are Local IP Literals should not be speculatively
+    // connected - Bug 853423.
+    if (mConnectionFlags & nsISocketTransport::DISABLE_RFC1918 &&
+        IsIPAddrLocal(&mNetAddr)) {
+#ifdef PR_LOGGING
+        if (SOCKET_LOG_ENABLED()) {
+            nsAutoCString netAddrCString;
+            netAddrCString.SetCapacity(kIPv6CStrBufSize);
+            if (!NetAddrToString(&mNetAddr,
+                                 netAddrCString.BeginWriting(),
+                                 kIPv6CStrBufSize))
+                netAddrCString = NS_LITERAL_CSTRING("<IP-to-string failed>");
+            SOCKET_LOG(("nsSocketTransport::InitiateSocket skipping "
+                        "speculative connection for host [%s:%d] proxy "
+                        "[%s:%d] with Local IP address [%s]",
+                        mHost.get(), mPort, mProxyHost.get(), mProxyPort,
+                        netAddrCString.get()));
+        }
+#endif
+        return NS_ERROR_CONNECTION_REFUSED;
+    }
+
    //
    // find out if it is going to be ok to attach another socket to the STS.
    // if not then we have to wait for the STS to tell us that it is ok.
--- a/netwerk/dns/DNS.cpp
+++ b/netwerk/dns/DNS.cpp
@ -177,6 +177,32 @@ bool IsIPAddrV4Mapped(const NetAddr *addr)
  return false;
 }

+bool IsIPAddrLocal(const NetAddr *addr)
+{
+  MOZ_ASSERT(addr);
+
+  // IPv4 RFC1918 and Link Local Addresses.
+  if (addr->raw.family == AF_INET) {
+    uint32_t addr32 = ntohl(addr->inet.ip);
+    if (addr32 >> 24 == 0x0A ||    // 10/8 prefix (RFC 1918).
+        addr32 >> 20 == 0xAC1 ||   // 172.16/12 prefix (RFC 1918).
+        addr32 >> 16 == 0xC0A8 ||  // 192.168/16 prefix (RFC 1918).
+        addr32 >> 16 == 0xA9FE) {  // 169.254/16 prefix (Link Local).
+      return true;
+    }
+  }
+  // IPv6 Unique and Link Local Addresses.
+  if (addr->raw.family == AF_INET6) {
+    uint16_t addr16 = ntohs(addr->inet6.ip.u16[0]);
+    if (addr16 >> 9 == 0xfc >> 1 ||   // fc00::/7 Unique Local Address.
+        addr16 >> 6 == 0xfe80 >> 6) { // fe80::/10 Link Local Address.
+      return true;
+    }
+  }
+  // Not an IPv4/6 local address.
+  return false;
+}
+
 NetAddrElement::NetAddrElement(const PRNetAddr *prNetAddr)
 {
  PRNetAddrToNetAddr(prNetAddr, &mAddress);
--- a/netwerk/dns/DNS.h
+++ b/netwerk/dns/DNS.h
@ -160,6 +160,8 @@ bool IsIPAddrAny(const NetAddr *addr);

 bool IsIPAddrV4Mapped(const NetAddr *addr);

+bool IsIPAddrLocal(const NetAddr *addr);
+
 } // namespace net
 } // namespace mozilla

--- a/netwerk/protocol/http/nsHttpConnectionInfo.cpp
+++ b/netwerk/protocol/http/nsHttpConnectionInfo.cpp
@ -8,6 +8,10 @@
 #include "HttpLog.h"

 #include "nsHttpConnectionInfo.h"
+#include "mozilla/net/DNS.h"
+#include "prnetdb.h"
+
+using namespace mozilla::net;

 nsHttpConnectionInfo::nsHttpConnectionInfo(const nsACString &host, int32_t port,
                                           nsProxyInfo* proxyInfo,
@ -113,3 +117,19 @@ nsHttpConnectionInfo::UsingProxy()
    return !mProxyInfo->IsDirect();
 }

+bool
+nsHttpConnectionInfo::HostIsLocalIPLiteral() const
+{
+    PRNetAddr prAddr;
+    // If the host/proxy host is not an IP address literal, return false.
+    if (ProxyHost()) {
+        if (PR_StringToNetAddr(ProxyHost(), &prAddr) != PR_SUCCESS) {
+          return false;
+        }
+    } else if (PR_StringToNetAddr(Host(), &prAddr) != PR_SUCCESS) {
+        return false;
+    }
+    NetAddr netAddr;
+    PRNetAddrToNetAddr(&prAddr, &netAddr);
+    return IsIPAddrLocal(&netAddr);
+}
--- a/netwerk/protocol/http/nsHttpConnectionInfo.h
+++ b/netwerk/protocol/http/nsHttpConnectionInfo.h
@ -92,6 +92,9 @@ public:
    // Returns true for any kind of proxy (http, socks, etc..)
    bool UsingProxy();

+    // Returns true when mHost is an RFC1918 literal.
+    bool HostIsLocalIPLiteral() const;
+
 private:
    mozilla::ThreadSafeAutoRefCnt mRef;
    nsCString              mHashKey;
--- a/netwerk/protocol/http/nsHttpConnectionMgr.cpp
+++ b/netwerk/protocol/http/nsHttpConnectionMgr.cpp
@ -357,6 +357,14 @@ nsHttpConnectionMgr::SpeculativeConnect(nsHttpConnectionInfo *ci,
    LOG(("nsHttpConnectionMgr::SpeculativeConnect [ci=%s]\n",
         ci->HashKey().get()));

+    // Hosts that are Local IP Literals should not be speculatively
+    // connected - Bug 853423.
+    if (ci && ci->HostIsLocalIPLiteral()) {
+        LOG(("nsHttpConnectionMgr::SpeculativeConnect skipping RFC1918 "
+             "address [%s]", ci->Host()));
+        return NS_OK;
+    }
+
    nsRefPtr<SpeculativeConnectArgs> args = new SpeculativeConnectArgs();

    // Wrap up the callbacks and the target to ensure they're released on the target
@ -1984,13 +1992,13 @@ nsHttpConnectionMgr::CreateTransport(nsConnectionEntry *ent,
    MOZ_ASSERT(PR_GetCurrentThread() == gSocketThread);

    nsRefPtr<nsHalfOpenSocket> sock = new nsHalfOpenSocket(ent, trans, caps);
+    if (speculative)
+        sock->SetSpeculative(true);
    nsresult rv = sock->SetupPrimaryStreams();
    NS_ENSURE_SUCCESS(rv, rv);

    ent->mHalfOpens.AppendElement(sock);
    mNumHalfOpenConns++;
-    if (speculative)
-        sock->SetSpeculative(true);
    return NS_OK;
 }

@ -2711,6 +2719,10 @@ nsHalfOpenSocket::SetupStreams(nsISocketTransport **transport,
        tmpFlags |= nsISocketTransport::DISABLE_IPV6;
    }

+    if (IsSpeculative()) {
+        tmpFlags |= nsISocketTransport::DISABLE_RFC1918;
+    }
+
    socketTransport->SetConnectionFlags(tmpFlags);

    socketTransport->SetQoSBits(gHttpHandler->GetQoSBits());
--- a/netwerk/test/unit/test_speculative_connect.js
+++ b/netwerk/test/unit/test_speculative_connect.js
@ -1,11 +1,89 @@
-const CC = Components.Constructor;
+/* -*- Mode: JavaScript; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* vim: set ts=4 sts=4 et sw=4 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

+const CC = Components.Constructor;
 const ServerSocket = CC("@mozilla.org/network/server-socket;1",
                        "nsIServerSocket",
                        "init");
-
 var serv;
+var ios;

+/** Example local IP addresses (literal IP address hostname).
+ *
+ * Note: for IPv6 Unique Local and Link Local, a wider range of addresses is
+ * set aside than those most commonly used. Technically, link local addresses
+ * include those beginning with fe80:: through febf::, although in practise
+ * only fe80:: is used. Necko code blocks speculative connections for the wider
+ * range; hence, this test considers that range too.
+ */
+var localIPv4Literals =
+    [ // IPv4 RFC1918 \
+      "10.0.0.1", "10.10.10.10", "10.255.255.255",         // 10/8
+      "172.16.0.1", "172.23.172.12", "172.31.255.255",     // 172.16/20
+      "192.168.0.1", "192.168.192.168", "192.168.255.255", // 192.168/16
+      // IPv4 Link Local
+      "169.254.0.1", "169.254.192.154", "169.254.255.255"  // 169.254/16
+    ];
+var localIPv6Literals =
+    [ // IPv6 Unique Local fc00::/7
+      "fc00::1", "fdfe:dcba:9876:abcd:ef01:2345:6789:abcd",
+      "fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff",
+      // IPv6 Link Local fe80::/10
+      "fe80::1", "fe80::abcd:ef01:2345:6789",
+      "febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff"
+    ];
+var localIPLiterals = localIPv4Literals.concat(localIPv6Literals);
+
+/** Example remote IP addresses
+ *
+ * Note: The test environment may not have external network access, so
+ * resolving hostnames may not be possible. Thus, literals are used here, and
+ * should be directly converted by the stub resolver to IP addresses.
+ */
+var remoteIPv4Literals =
+    [ "93.184.216.119", // example.com
+      "74.125.239.130", // google.com
+      "63.245.217.105", // mozilla.org
+      "173.252.110.27"  // facebook.com
+    ];
+
+var remoteIPv6Literals =
+    [ "2607:f8b0:4005:802::1009",        // google.com
+      "2620:101:8008:5::2:1",            // mozilla.org
+      "2a03:2880:2110:df07:face:b00c::1" // facebook.com
+    ];
+
+var remoteIPLiterals = remoteIPv4Literals.concat(remoteIPv6Literals);
+
+/** Test function list and descriptions.
+ */
+var testList =
+    [ test_speculative_connect,
+      test_hostnames_resolving_to_local_addresses,
+      test_hostnames_resolving_to_remote_addresses,
+      test_proxies_with_local_addresses,
+      test_proxies_with_remote_addresses
+    ];
+
+var testDescription =
+    [ "Expect pass with localhost",
+      "Expect failure with resolved local IPs",
+      "Expect success with resolved remote IPs",
+      "Expect failure for proxies with local IPs",
+      "Expect success for proxies with remote IPs"
+    ];
+
+var testIdx = 0;
+var hostIdx = 0;
+
+
+/** TestServer
+ *
+ * Implements nsIServerSocket for test_speculative_connect.
+ */
 function TestServer() {
    this.listener = ServerSocket(-1, true, -1);
    this.listener.asyncListen(this);
@ -16,25 +94,310 @@ TestServer.prototype = {
        if (iid.equals(Ci.nsIServerSocket) ||
            iid.equals(Ci.nsISupports))
            return this;
-        throw Components.results.NS_ERROR_NO_INTERFACE;
+        throw Cr.NS_ERROR_NO_INTERFACE;
    },
    onSocketAccepted: function(socket, trans) {
        try { this.listener.close(); } catch(e) {}
        do_check_true(true);
-        do_test_finished();
+        next_test();
    },

    onStopListening: function(socket) {}
+};
+
+/** TestOutputStreamCallback
+ *
+ * Implements nsIOutputStreamCallback for socket layer tests.
+ */
+function TestOutputStreamCallback(transport, hostname, proxied, expectSuccess, next) {
+    this.transport = transport;
+    this.hostname = hostname;
+    this.proxied = proxied;
+    this.expectSuccess = expectSuccess;
+    this.next = next;
+    this.dummyContent = "Dummy content";
 }

-function run_test() {
-    var ios = Cc["@mozilla.org/network/io-service;1"]
-        .getService(Ci.nsIIOService);    
+TestOutputStreamCallback.prototype = {
+    QueryInterface: function(iid) {
+        if (iid.equals(Ci.nsIOutputStreamCallback) ||
+            iid.equals(Ci.nsISupports))
+            return this;
+        throw Cr.NS_ERROR_NO_INTERFACE;
+    },
+    onOutputStreamReady: function(stream) {
+        do_check_neq(typeof(stream), undefined);
+        try {
+            stream.write(this.dummyContent, this.dummyContent.length);
+        } catch (e) {
+            // Spec Connect FAILED.
+            do_check_instanceof(e, Ci.nsIException);
+            if (this.expectSuccess) {
+                // We may expect success, but the address could be unreachable
+                // in the test environment, so expect errors.
+                if (this.proxied) {
+                    do_check_true(e.result == Cr.NS_ERROR_NET_TIMEOUT ||
+                                  e.result == Cr.NS_ERROR_PROXY_CONNECTION_REFUSED);
+                } else {
+                    do_check_true(e.result == Cr.NS_ERROR_NET_TIMEOUT ||
+                                  e.result == Cr.NS_ERROR_CONNECTION_REFUSED);
+                }
+            } else {
+                // A refusal to connect speculatively should throw an error.
+                do_check_eq(e.result, Cr.NS_ERROR_CONNECTION_REFUSED);
+            }
+            this.transport.close(Cr.NS_BINDING_ABORTED);
+            this.next();
+            return;
+        }
+        // Spec Connect SUCCEEDED.
+        if (this.expectSuccess) {
+            do_check_true(true, "Success for " + this.hostname);
+        } else {
+            do_throw("Speculative Connect should have failed for " +
+                     this.hostname);
+        }
+        this.transport.close(Cr.NS_BINDING_ABORTED);
+        this.next();
+    }
+};

+/** test_speculative_connect
+ *
+ * Tests a basic positive case using nsIOService.SpeculativeConnect:
+ * connecting to localhost.
+ */
+function test_speculative_connect() {
    serv = new TestServer();
-    URI = ios.newURI("http://localhost:" + serv.listener.port + "/just/a/test", null, null);
-    ios.QueryInterface(Components.interfaces.nsISpeculativeConnect)
+    var URI = ios.newURI("http://localhost:" + serv.listener.port + "/just/a/test", null, null);
+    ios.QueryInterface(Ci.nsISpeculativeConnect)
        .speculativeConnect(URI, null);
-    do_test_pending();
+}
+
+/* Speculative connections should not be allowed for hosts with local IP
+ * addresses (Bug 853423). That list includes:
+ *  -- IPv4 RFC1918 and Link Local Addresses.
+ *  -- IPv6 Unique and Link Local Addresses.
+ *
+ * Two tests are required:
+ *  1. Verify IP Literals passed to the SpeculativeConnect API.
+ *  2. Verify hostnames that need to be resolved at the socket layer.
+ */
+
+/** test_hostnames_resolving_to_addresses
+ *
+ * Common test function for resolved hostnames. Takes a list of hosts, a
+ * boolean to determine if the test is expected to succeed or fail, and a
+ * function to call the next test case.
+ */
+function test_hostnames_resolving_to_addresses(host, expectSuccess, next) {
+    do_print(host);
+    var sts = Cc["@mozilla.org/network/socket-transport-service;1"]
+              .getService(Ci.nsISocketTransportService);
+    do_check_neq(typeof(sts), undefined);
+    var transport = sts.createTransport(null, 0, host, 80, null);
+    do_check_neq(typeof(transport), undefined);
+
+    transport.connectionFlags = Ci.nsISocketTransport.DISABLE_RFC1918;
+    transport.setTimeout(Ci.nsISocketTransport.TIMEOUT_CONNECT, 1);
+    transport.setTimeout(Ci.nsISocketTransport.TIMEOUT_READ_WRITE, 1);
+    do_check_eq(1, transport.getTimeout(Ci.nsISocketTransport.TIMEOUT_CONNECT));
+
+    var outStream = transport.openOutputStream(Ci.nsITransport.OPEN_UNBUFFERED,0,0);
+    do_check_neq(typeof(outStream), undefined);
+
+    var callback = new TestOutputStreamCallback(transport, host, false,
+                                                expectSuccess,
+                                                next);
+    do_check_neq(typeof(callback), undefined);
+
+    // Need to get main thread pointer to ensure nsSocketTransport::AsyncWait
+    // adds callback to nsOutputStreamReadyEvent on main thread, and doesn't
+    // addref off the main thread.
+    var gThreadManager = Cc["@mozilla.org/thread-manager;1"]
+    .getService(Ci.nsIThreadManager);
+    var mainThread = gThreadManager.currentThread;
+
+    try {
+        outStream.QueryInterface(Ci.nsIAsyncOutputStream)
+                 .asyncWait(callback, 0, 0, mainThread);
+    } catch (e) {
+        do_throw("asyncWait should not fail!");
+    }
+}
+
+/**
+ * test_hostnames_resolving_to_local_addresses
+ *
+ * Creates an nsISocketTransport and simulates a speculative connect request
+ * for a hostname that resolves to a local IP address.
+ * Runs asynchronously; on test success (i.e. failure to connect), the callback
+ * will call this function again until all hostnames in the test list are done.
+ *
+ * Note: This test also uses an IP literal for the hostname. This should be ok,
+ * as the socket layer will ask for the hostname to be resolved anyway, and DNS
+ * code should return a numerical version of the address internally.
+ */
+function test_hostnames_resolving_to_local_addresses() {
+    if (hostIdx >= localIPLiterals.length) {
+        // No more local IP addresses; move on.
+        next_test();
+        return;
+    }
+    var host = localIPLiterals[hostIdx++];
+    // Test another local IP address when the current one is done.
+    var next = test_hostnames_resolving_to_local_addresses;
+    test_hostnames_resolving_to_addresses(host, false, next);
+}
+
+/**
+ * test_hostnames_resolving_to_remote_addresses
+ *
+ * Creates an nsISocketTransport and simulates a speculative connect request
+ * for a hostname that resolves to a local IP address.
+ * Runs asynchronously; on test success (i.e. failure to connect), the callback
+ * will call this function again until all hostnames in the test list are done.
+ *
+ * Note: This test also uses an IP literal for the hostname. This should be ok,
+ * as the socket layer will ask for the hostname to be resolved anyway, and DNS
+ * code should return a numerical version of the address internally.
+ */
+function test_hostnames_resolving_to_remote_addresses() {
+    if (hostIdx >= remoteIPLiterals.length) {
+        // No more remote IP addresses; move on.
+        next_test();
+        return;
+    }
+    var host = remoteIPLiterals[hostIdx++];
+    // Test another remote IP address when the current one is done.
+    var next = test_hostnames_resolving_to_remote_addresses;
+    test_hostnames_resolving_to_addresses(host, true, next);
+}
+
+/** test_speculative_connect_with_host_list
+ *
+ * Common test function for resolved proxy hosts. Takes a list of hosts, a
+ * boolean to determine if the test is expected to succeed or fail, and a
+ * function to call the next test case.
+ */
+function test_proxies(proxyHost, expectSuccess, next) {
+    do_print("Proxy: " + proxyHost);
+    var sts = Cc["@mozilla.org/network/socket-transport-service;1"]
+              .getService(Ci.nsISocketTransportService);
+    do_check_neq(typeof(sts), undefined);
+    var pps = Cc["@mozilla.org/network/protocol-proxy-service;1"]
+              .getService();
+    do_check_neq(typeof(pps), undefined);
+
+    var proxyInfo = pps.newProxyInfo("http", proxyHost, 8080, 0, 1, null);
+    do_check_neq(typeof(proxyInfo), undefined);
+
+    var transport = sts.createTransport(null, 0, "dummyHost", 80, proxyInfo);
+    do_check_neq(typeof(transport), undefined);
+
+    transport.connectionFlags = Ci.nsISocketTransport.DISABLE_RFC1918;
+
+    transport.setTimeout(Ci.nsISocketTransport.TIMEOUT_CONNECT, 1);
+    do_check_eq(1, transport.getTimeout(Ci.nsISocketTransport.TIMEOUT_CONNECT));
+    transport.setTimeout(Ci.nsISocketTransport.TIMEOUT_READ_WRITE, 1);
+
+    var outStream = transport.openOutputStream(Ci.nsITransport.OPEN_UNBUFFERED,0,0);
+    do_check_neq(typeof(outStream), undefined);
+
+    var callback = new TestOutputStreamCallback(transport, proxyHost, true,
+                                                expectSuccess,
+                                                next);
+    do_check_neq(typeof(callback), undefined);
+
+    // Need to get main thread pointer to ensure nsSocketTransport::AsyncWait
+    // adds callback to nsOutputStreamReadyEvent on main thread, and doesn't
+    // addref off the main thread.
+    var gThreadManager = Cc["@mozilla.org/thread-manager;1"]
+    .getService(Ci.nsIThreadManager);
+    var mainThread = gThreadManager.currentThread;
+
+    try {
+        outStream.QueryInterface(Ci.nsIAsyncOutputStream)
+                 .asyncWait(callback, 0, 0, mainThread);
+    } catch (e) {
+        do_throw("asyncWait should not fail!");
+    }
+}
+
+/**
+ * test_proxies_with_local_addresses
+ *
+ * Creates an nsISocketTransport and simulates a speculative connect request
+ * for a proxy that resolves to a local IP address.
+ * Runs asynchronously; on test success (i.e. failure to connect), the callback
+ * will call this function again until all proxies in the test list are done.
+ *
+ * Note: This test also uses an IP literal for the proxy. This should be ok,
+ * as the socket layer will ask for the proxy to be resolved anyway, and DNS
+ * code should return a numerical version of the address internally.
+ */
+function test_proxies_with_local_addresses() {
+    if (hostIdx >= localIPLiterals.length) {
+        // No more local IP addresses; move on.
+        next_test();
+        return;
+    }
+    var host = localIPLiterals[hostIdx++];
+    // Test another local IP address when the current one is done.
+    var next = test_proxies_with_local_addresses;
+    test_proxies(host, false, next);
+}
+
+/**
+ * test_proxies_with_remote_addresses
+ *
+ * Creates an nsISocketTransport and simulates a speculative connect request
+ * for a proxy that resolves to a local IP address.
+ * Runs asynchronously; on test success (i.e. failure to connect), the callback
+ * will call this function again until all proxies in the test list are done.
+ *
+ * Note: This test also uses an IP literal for the proxy. This should be ok,
+ * as the socket layer will ask for the proxy to be resolved anyway, and DNS
+ * code should return a numerical version of the address internally.
+ */
+function test_proxies_with_remote_addresses() {
+    if (hostIdx >= remoteIPLiterals.length) {
+        // No more local IP addresses; move on.
+        next_test();
+        return;
+    }
+    var host = remoteIPLiterals[hostIdx++];
+    // Test another local IP address when the current one is done.
+    var next = test_proxies_with_remote_addresses;
+    test_proxies(host, true, next);
+}
+
+/** next_test
+ *
+ * Calls the next test in testList. Each test is responsible for calling this
+ * function when its test cases are complete.
+ */
+function next_test() {
+    if (testIdx >= testList.length) {
+        // No more tests; we're done.
+        do_test_finished();
+        return;
+    }
+    do_print("SpeculativeConnect: " + testDescription[testIdx]);
+    hostIdx = 0;
+    // Start next test in list.
+    testList[testIdx++]();
+}
+
+/** run_test
+ *
+ * Main entry function for test execution.
+ */
+function run_test() {
+    ios = Cc["@mozilla.org/network/io-service;1"]
+        .getService(Ci.nsIIOService);
+
+    do_test_pending();
+    next_test();
 }

--- a/parser/html/moz.build
+++ b/parser/html/moz.build
@ -47,7 +47,7 @@ EXPORTS += [
    'nsParserUtils.h',
 ]

-SOURCES += [
+UNIFIED_SOURCES += [
    'nsHtml5Atom.cpp',
    'nsHtml5Atoms.cpp',
    'nsHtml5AtomTable.cpp',
--- a/parser/html/nsHtml5TreeOperation.cpp
+++ b/parser/html/nsHtml5TreeOperation.cpp
@ -42,7 +42,7 @@
 #include "mozilla/Likely.h"
 #include "nsTextNode.h"

-namespace dom = mozilla::dom;
+using namespace mozilla;

 static NS_DEFINE_CID(kFormProcessorCID, NS_FORMPROCESSOR_CID);

--- a/parser/htmlparser/src/moz.build
+++ b/parser/htmlparser/src/moz.build
@ -6,7 +6,7 @@

 MODULE = 'htmlparser'

-SOURCES += [
+UNIFIED_SOURCES += [
    'CNavDTD.cpp',
    'CParserContext.cpp',
    'nsElementTable.cpp',
--- a/testing/marionette/client/marionette/tests/unit/test_screenshot.py
+++ b/testing/marionette/client/marionette/tests/unit/test_screenshot.py
@ -7,19 +7,19 @@ class ScreenshotTests(MarionetteTestCase):
        test_url = self.marionette.absolute_url('html5Page.html')
        self.marionette.navigate(test_url)
        el = self.marionette.find_element('id', 'red')
-        self.assertEqual('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADIAAAAyCAYAAAAeP4ixAAAAVUlEQVRoge3PsQ0AIAzAsI78fzBwBhHykD2ePev80LweAAGJB1ILpBZILZBaILVAaoHUAqkFUgukFkgtkFogtUBqgdQCqQVSC6QWSC2QWiC1QGp9A7ma+7nyXgOpzQAAAABJRU5ErkJggg==',
+        self.assertEqual('iVBORw0KGgoAAAANSUhEUgAAADIAAAAyCAYAAAAeP4ixAAAAVUlEQVRoge3PsQ0AIAzAsI78fzBwBhHykD2ePev80LweAAGJB1ILpBZILZBaILVAaoHUAqkFUgukFkgtkFogtUBqgdQCqQVSC6QWSC2QWiC1QGp9A7ma+7nyXgOpzQAAAABJRU5ErkJggg==',
                         self.marionette.screenshot(element=el))

    def testWeCanTakeAScreenShotWithHighlightOfAnElement(self):
        test_url = self.marionette.absolute_url('html5Page.html')
        self.marionette.navigate(test_url)
        el = self.marionette.find_element('id', 'green')
-        self.assertEqual('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADIAAAAyCAYAAAAeP4ixAAAAV0lEQVRoge3PQRGAQAwAsWINvXgsNnI3+4iAzM7sDWZn9vneoxXRFNEU0RTRFNEU0RTRFNEU0RTRFNEU0RTRFNEU0RTRFNEU0RTRFNEU0RTRFNHcF7nBD/Ha5Ye4BbsYAAAAAElFTkSuQmCC',
+        self.assertEqual('iVBORw0KGgoAAAANSUhEUgAAADIAAAAyCAYAAAAeP4ixAAAAV0lEQVRoge3PQRGAQAwAsWINvXgsNnI3+4iAzM7sDWZn9vneoxXRFNEU0RTRFNEU0RTRFNEU0RTRFNEU0RTRFNEU0RTRFNEU0RTRFNEU0RTRFNHcF7nBD/Ha5Ye4BbsYAAAAAElFTkSuQmCC',
                         self.marionette.screenshot(element=el, highlights=[el]))

    def testWeCanTakeAScreenShotEntireCanvas(self):
        test_url = self.marionette.absolute_url('html5Page.html')
        self.marionette.navigate(test_url)
-        self.assertTrue('data:image/png;base64,iVBORw0KGgo' in
+        self.assertTrue('iVBORw0KGgo' in
                        self.marionette.screenshot())

--- a/testing/marionette/client/setup.py
+++ b/testing/marionette/client/setup.py
@ -1,7 +1,7 @@
 import os
 from setuptools import setup, find_packages

-version = '0.6.1'
+version = '0.6.2'

 # get documentation from the README
 try:
--- a/testing/marionette/marionette-listener.js
+++ b/testing/marionette/marionette-listener.js
@ -1937,7 +1937,8 @@ function screenShot(msg) {

  // Return the Base64 String back to the client bindings and they can manage
  // saving the file to disk if it is required
-  sendResponse({value:canvas.toDataURL("image/png","")}, msg.json.command_id);
+  var data_url = canvas.toDataURL("image/png","");
+  sendResponse({value: data_url.substring(data_url.indexOf(",") + 1)}, msg.json.command_id);
 }

 //call register self when we get loaded
--- a/testing/mochitest/android.json
+++ b/testing/mochitest/android.json
@ -211,6 +211,7 @@
 "dom/tests/mochitest/sessionstorage/test_sessionStorageHttpHttps.html": "TIMED_OUT",
 "dom/tests/mochitest/webapps/test_bug_779982.html": "Bug 793211",
 "dom/tests/mochitest/whatwg/test_bug500328.html": "TIMED_OUT",
+ "dom/tests/mochitest/whatwg/test_postMessage_closed.html":"bug 894914 - wrong data - got FAIL, expected message",
 "dom/workers/test/test_closeOnGC.html": "bug 881404",
 "dom/workers/test/test_xhr_timeout.html": "bug 798220",
 "editor/composer/test/test_bug389350.html": "",
--- a/testing/mochitest/androidx86.json
+++ b/testing/mochitest/androidx86.json
@ -280,6 +280,7 @@
 "dom/tests/mochitest/sessionstorage/test_sessionStorageHttpHttps.html": "TIMED_OUT",
 "dom/tests/mochitest/webapps/test_bug_779982.html": "Bug 793211",
 "dom/tests/mochitest/whatwg/test_bug500328.html": "TIMED_OUT",
+ "dom/tests/mochitest/whatwg/test_postMessage_closed.html":"bug 894914 - wrong data - got FAIL, expected message",
 "dom/workers/test/test_closeOnGC.html": "bug 881404",
 "dom/workers/test/test_xhr_timeout.html": "bug 798220",
 "editor/composer/test/test_bug389350.html": "",
--- a/testing/mochitest/b2g-debug.json
+++ b/testing/mochitest/b2g-debug.json
@ -387,6 +387,8 @@
    "dom/tests/mochitest/sessionstorage/test_sessionStorageBase.html":"",
    "dom/tests/mochitest/sessionstorage/test_sessionStorageHttpHttps.html":"needs https to work",
    "dom/tests/mochitest/webapps/test_bug_779982.html":"",
+    "dom/tests/mochitest/whatwg/test_postMessage_closed.html":"bug 894914 - wrong data - got FAIL, expected message",
+
    "dom/workers/test/test_suspend.html":"test timed out, might need more time",
    "dom/workers/test/test_xhr_parameters.html":"",
    "dom/workers/test/test_xhr_system.html":"",
--- a/testing/mochitest/b2g.json
+++ b/testing/mochitest/b2g.json
@ -394,6 +394,8 @@
    "dom/tests/mochitest/sessionstorage/test_sessionStorageBase.html":"",
    "dom/tests/mochitest/sessionstorage/test_sessionStorageHttpHttps.html":"needs https to work",
    "dom/tests/mochitest/webapps/test_bug_779982.html":"",
+    "dom/tests/mochitest/whatwg/test_postMessage_closed.html":"bug 894914 - wrong data - got FAIL, expected message",
+
    "dom/workers/test/test_suspend.html":"test timed out, might need more time",
    "dom/workers/test/test_xhr_parameters.html":"",
    "dom/workers/test/test_xhr_system.html":"",
--- a/toolkit/components/telemetry/Histograms.json
+++ b/toolkit/components/telemetry/Histograms.json
@ -2854,6 +2854,118 @@
    "kind": "flag",
    "description": "Whether the character encoding menu was used to override an encoding in this session."
  },
+  "DECODER_INSTANTIATED_HZ": {
+    "kind": "flag",
+    "description": "Whether the decoder for HZ has been instantiated in this session."
+  },
+  "DECODER_INSTANTIATED_ISO2022CN": {
+    "kind": "flag",
+    "description": "Whether the decoder for ISO-2022-CN has been instantiated in this session."
+  },
+  "DECODER_INSTANTIATED_ISO2022KR": {
+    "kind": "flag",
+    "description": "Whether the decoder for ISO-2022-KR has been instantiated in this session."
+  },
+  "DECODER_INSTANTIATED_ISO2022JP": {
+    "kind": "flag",
+    "description": "Whether the decoder for ISO-2022-JP has been instantiated in this session."
+  },
+  "DECODER_INSTANTIATED_JOHAB": {
+    "kind": "flag",
+    "description": "Whether the decoder for JOHAB has been instantiated in this session."
+  },
+  "DECODER_INSTANTIATED_T61": {
+    "kind": "flag",
+    "description": "Whether the decoder for T.61 has been instantiated in this session."
+  },
+  "DECODER_INSTANTIATED_IBM850": {
+    "kind": "flag",
+    "description": "Whether the decoder for IBM850 has been instantiated in this session."
+  },
+  "DECODER_INSTANTIATED_IBM852": {
+    "kind": "flag",
+    "description": "Whether the decoder for IBM852 has been instantiated in this session."
+  },
+  "DECODER_INSTANTIATED_IBM855": {
+    "kind": "flag",
+    "description": "Whether the decoder for IBM855 has been instantiated in this session."
+  },
+  "DECODER_INSTANTIATED_IBM857": {
+    "kind": "flag",
+    "description": "Whether the decoder for IBM857 has been instantiated in this session."
+  },
+  "DECODER_INSTANTIATED_IBM862": {
+    "kind": "flag",
+    "description": "Whether the decoder for IBM862 has been instantiated in this session."
+  },
+  "DECODER_INSTANTIATED_MACGREEK": {
+    "kind": "flag",
+    "description": "Whether the decoder for MACGREEK has been instantiated in this session."
+  },
+  "DECODER_INSTANTIATED_MACICELANDIC": {
+    "kind": "flag",
+    "description": "Whether the decoder for MACICELANDIC has been instantiated in this session."
+  },
+  "DECODER_INSTANTIATED_MACCE": {
+    "kind": "flag",
+    "description": "Whether the decoder for MACCE has been instantiated in this session."
+  },
+  "DECODER_INSTANTIATED_MACHEBREW": {
+    "kind": "flag",
+    "description": "Whether the decoder for MACHEBREW has been instantiated in this session."
+  },
+  "DECODER_INSTANTIATED_MACARABIC": {
+    "kind": "flag",
+    "description": "Whether the decoder for MACARABIC has been instantiated in this session."
+  },
+  "DECODER_INSTANTIATED_MACFARSI": {
+    "kind": "flag",
+    "description": "Whether the decoder for MACFARSI has been instantiated in this session."
+  },
+  "DECODER_INSTANTIATED_MACCROATIAN": {
+    "kind": "flag",
+    "description": "Whether the decoder for MACCROATIAN has been instantiated in this session."
+  },
+  "DECODER_INSTANTIATED_MACROMANIAN": {
+    "kind": "flag",
+    "description": "Whether the decoder for MACROMANIAN has been instantiated in this session."
+  },
+  "DECODER_INSTANTIATED_MACTURKISH": {
+    "kind": "flag",
+    "description": "Whether the decoder for MACTURKISH has been instantiated in this session."
+  },
+  "DECODER_INSTANTIATED_MACDEVANAGARI": {
+    "kind": "flag",
+    "description": "Whether the decoder for MACDEVANAGARI has been instantiated in this session."
+  },
+  "DECODER_INSTANTIATED_MACGUJARATI": {
+    "kind": "flag",
+    "description": "Whether the decoder for MACGUJARATI has been instantiated in this session."
+  },
+  "DECODER_INSTANTIATED_MACGURMUKHI": {
+    "kind": "flag",
+    "description": "Whether the decoder for MACGURMUKHI has been instantiated in this session."
+  },
+  "DECODER_INSTANTIATED_ISOIR111": {
+    "kind": "flag",
+    "description": "Whether the decoder for ISOIR111 has been instantiated in this session."
+  },
+  "DECODER_INSTANTIATED_ARMSCII8": {
+    "kind": "flag",
+    "description": "Whether the decoder for ARMSCII8 has been instantiated in this session."
+  },
+  "DECODER_INSTANTIATED_VISCII": {
+    "kind": "flag",
+    "description": "Whether the decoder for VISCII has been instantiated in this session."
+  },
+  "DECODER_INSTANTIATED_VIETTCVN5712": {
+    "kind": "flag",
+    "description": "Whether the decoder for VIETTCVN5712 has been instantiated in this session."
+  },
+  "DECODER_INSTANTIATED_VIETVPS": {
+    "kind": "flag",
+    "description": "Whether the decoder for VIETVPS has been instantiated in this session."
+  },
  "XUL_FOREGROUND_REFLOW_MS": {
    "kind": "exponential",
    "high": "3000",
--- a/widget/LookAndFeel.h
+++ b/widget/LookAndFeel.h
@ -356,6 +356,15 @@ public:
     */
    eIntID_SwipeAnimationEnabled,

+    /*
+     * A Boolean value to determine whether we have a color picker available
+     * for <input type="color"> to hook into.
+     *
+     * This lets us selectively enable the style for <input type="color">
+     * based on whether it's functional or not.
+     */
+    eIntID_ColorPickerAvailable,
+
    /*
     * A boolean value indicating whether or not the device has a hardware
     * home button. Used on gaia to determine whether a home button
--- a/Show More
+++ b/Show More