Merge inbound to mozilla-central. a=merge

2018-05-24 12:37:58 +03:00 · 2018-05-24 12:37:58 +03:00 · 03394c438d
--- a/accessible/tests/mochitest/states/a11y.ini
+++ b/accessible/tests/mochitest/states/a11y.ini
@ -19,7 +19,6 @@ support-files =
 [test_controls.xul]
 [test_doc.html]
 [test_doc_busy.html]
-skip-if = os == 'mac' && os_version == '10.6'
 [test_docarticle.html]
 [test_editablebody.html]
 [test_expandable.xul]
--- a/dom/canvas/test/webgl-conf/generated-mochitest.ini
+++ b/dom/canvas/test/webgl-conf/generated-mochitest.ini
@ -10695,7 +10695,6 @@ skip-if = (os == 'mac')
 [generated/test_conformance__context__constants-and-properties.html]
 [generated/test_conformance__context__context-attribute-preserve-drawing-buffer.html]
 [generated/test_conformance__context__context-attributes-alpha-depth-stencil-antialias.html]
-fail-if = (os == 'mac' && os_version == '10.6')
 skip-if = (os == 'linux') || (os == 'android')
 [generated/test_conformance__context__context-creation-and-destruction.html]
 [generated/test_conformance__context__context-creation.html]
@ -10859,12 +10858,9 @@ skip-if = (os == 'linux') || (os == 'mac') || (os == 'android')
 [generated/test_conformance__glsl__constructors__glsl-construct-ivec4.html]
 skip-if = (os == 'linux') || (os == 'mac')
 [generated/test_conformance__glsl__constructors__glsl-construct-mat2.html]
-fail-if = (os == 'mac' && os_version == '10.6')
 skip-if = ((os == 'linux') && asan)
 [generated/test_conformance__glsl__constructors__glsl-construct-mat3.html]
-fail-if = (os == 'mac' && os_version == '10.6')
 [generated/test_conformance__glsl__constructors__glsl-construct-mat4.html]
-fail-if = (os == 'mac' && os_version == '10.6')
 [generated/test_conformance__glsl__constructors__glsl-construct-vec-mat-corner-cases.html]
 skip-if = (os == 'linux')
 [generated/test_conformance__glsl__constructors__glsl-construct-vec-mat-index.html]
@ -10905,7 +10901,6 @@ skip-if = (os == 'linux')
 [generated/test_conformance__glsl__functions__glsl-function-sin.html]
 [generated/test_conformance__glsl__functions__glsl-function-smoothstep-float.html]
 [generated/test_conformance__glsl__functions__glsl-function-smoothstep-gentype.html]
-fail-if = (os == 'mac' && os_version == '10.8')
 [generated/test_conformance__glsl__functions__glsl-function-step-float.html]
 [generated/test_conformance__glsl__functions__glsl-function-step-gentype.html]
 skip-if = (os == 'android')
@ -10980,7 +10975,6 @@ skip-if = (os == 'android')
 [generated/test_conformance__glsl__literals__overflow_leak.vert.html]
 [generated/test_conformance__glsl__matrices__glsl-mat3-construction.html]
 [generated/test_conformance__glsl__matrices__glsl-mat4-to-mat3.html]
-fail-if = (os == 'mac' && os_version == '10.6')
 [generated/test_conformance__glsl__matrices__matrix-compound-multiply.html]
 [generated/test_conformance__glsl__misc__attrib-location-length-limits.html]
 [generated/test_conformance__glsl__misc__boolean_precision.html]
@ -10992,7 +10986,6 @@ fail-if = (os == 'mac' && os_version == '10.6')
 [generated/test_conformance__glsl__misc__gl_position_unset.vert.html]
 [generated/test_conformance__glsl__misc__global-variable-init.html]
 [generated/test_conformance__glsl__misc__glsl-function-nodes.html]
-fail-if = (os == 'mac' && os_version == '10.6')
 [generated/test_conformance__glsl__misc__glsl-long-variable-names.html]
 [generated/test_conformance__glsl__misc__glsl-vertex-branch.html]
 [generated/test_conformance__glsl__misc__large-loop-compile.html]
@ -11123,12 +11116,10 @@ skip-if = (os == 'android')
 [generated/test_conformance__glsl__variables__gl-fragdata-and-fragcolor.html]
 [generated/test_conformance__glsl__variables__gl-frontfacing.html]
 [generated/test_conformance__glsl__variables__gl-pointcoord.html]
-fail-if = (os == 'mac' && os_version == '10.8')
 [generated/test_conformance__glsl__variables__glsl-built-ins.html]
 skip-if = (os == 'android')
 [generated/test_conformance__limits__gl-line-width.html]
 [generated/test_conformance__limits__gl-max-texture-dimensions.html]
-fail-if = (os == 'mac' && os_version == '10.8')
 [generated/test_conformance__limits__gl-min-attribs.html]
 [generated/test_conformance__limits__gl-min-textures.html]
 skip-if = (os == 'linux')
@ -11364,11 +11355,8 @@ fail-if = (os == 'android')
 [generated/test_conformance__ogles__GL__struct__struct_017_to_024.html]
 [generated/test_conformance__ogles__GL__struct__struct_025_to_032.html]
 [generated/test_conformance__ogles__GL__struct__struct_033_to_040.html]
-fail-if = (os == 'mac' && os_version == '10.6')
 [generated/test_conformance__ogles__GL__struct__struct_041_to_048.html]
-fail-if = (os == 'mac' && os_version == '10.6')
 [generated/test_conformance__ogles__GL__struct__struct_049_to_056.html]
-fail-if = (os == 'mac' && os_version == '10.6')
 [generated/test_conformance__ogles__GL__swizzlers__swizzlers_001_to_008.html]
 [generated/test_conformance__ogles__GL__swizzlers__swizzlers_009_to_016.html]
 [generated/test_conformance__ogles__GL__swizzlers__swizzlers_017_to_024.html]
@ -11697,7 +11685,7 @@ fail-if = (os == 'mac')
 [generated/test_conformance__uniforms__no-over-optimization-on-uniform-array-17.html]
 [generated/test_conformance__uniforms__null-uniform-location.html]
 [generated/test_conformance__uniforms__out-of-bounds-uniform-array-access.html]
-skip-if = (os == 'android') || (os == 'mac' && os_version == '10.6')
+skip-if = (os == 'android')
 [generated/test_conformance__uniforms__uniform-default-values.html]
 skip-if = (os == 'android') || (os == 'linux') || (os == 'win')
 [generated/test_conformance__uniforms__uniform-location.html]
--- a/dom/canvas/test/webgl-conf/mochitest-errata.ini
+++ b/dom/canvas/test/webgl-conf/mochitest-errata.ini
@ -164,7 +164,6 @@ fail-if = 1
 # Complicated

 [generated/test_conformance__context__context-attributes-alpha-depth-stencil-antialias.html]
-fail-if = (os == 'mac' && os_version == '10.6')
 # Asserts on linux debug. Crashes on Android.
 skip-if = (os == 'linux') || (os == 'android')

@ -189,7 +188,6 @@ skip-if = (os == 'linux') || (os == 'mac') || (os == 'android')
 skip-if = (os == 'linux') || (os == 'mac')

 [generated/test_conformance__glsl__constructors__glsl-construct-mat2.html]
-fail-if = (os == 'mac' && os_version == '10.6')
 # Crashes on Linux ASAN
 skip-if = ((os == 'linux') && asan)

@ -459,7 +457,7 @@ skip-if = (os == 'android') || debug
 skip-if = debug
 [generated/test_conformance__uniforms__out-of-bounds-uniform-array-access.html]
 # Crashes
-skip-if = (os == 'android') || (os == 'mac' && os_version == '10.6')
+skip-if = (os == 'android')
 [generated/test_conformance__glsl__samplers__glsl-function-texture2dproj.html]
 # Crashes
 skip-if = (os == 'android')
@ -665,32 +663,6 @@ skip-if = (os == 'mac')
 skip-if = (os == 'mac')


-####################
-# 10.6
-[generated/test_conformance__glsl__constructors__glsl-construct-mat3.html]
-fail-if = (os == 'mac' && os_version == '10.6')
-[generated/test_conformance__glsl__constructors__glsl-construct-mat4.html]
-fail-if = (os == 'mac' && os_version == '10.6')
-[generated/test_conformance__glsl__matrices__glsl-mat4-to-mat3.html]
-fail-if = (os == 'mac' && os_version == '10.6')
-[generated/test_conformance__glsl__misc__glsl-function-nodes.html]
-fail-if = (os == 'mac' && os_version == '10.6')
-[generated/test_conformance__ogles__GL__struct__struct_033_to_040.html]
-fail-if = (os == 'mac' && os_version == '10.6')
-[generated/test_conformance__ogles__GL__struct__struct_041_to_048.html]
-fail-if = (os == 'mac' && os_version == '10.6')
-[generated/test_conformance__ogles__GL__struct__struct_049_to_056.html]
-fail-if = (os == 'mac' && os_version == '10.6')
-
-####################
-# 10.8
-[generated/test_conformance__glsl__functions__glsl-function-smoothstep-gentype.html]
-fail-if = (os == 'mac' && os_version == '10.8')
-[generated/test_conformance__glsl__variables__gl-pointcoord.html]
-fail-if = (os == 'mac' && os_version == '10.8')
-[generated/test_conformance__limits__gl-max-texture-dimensions.html]
-fail-if = (os == 'mac' && os_version == '10.8')
-
 ####################
 # failure on OSX
 [generated/test_2_conformance2__renderbuffers__multisampled-depth-renderbuffer-initialization.html]
--- a/dom/console/tests/test_timer.html
+++ b/dom/console/tests/test_timer.html
@ -11,6 +11,9 @@

 SimpleTest.waitForExplicitFinish();

+var reduceTimePrecisionPrevPrefValue = SpecialPowers.getBoolPref("privacy.reduceTimerPrecision");
+SpecialPowers.setBoolPref("privacy.reduceTimerPrecision", false);
+
 function ConsoleListener() {
  SpecialPowers.addObserver(this, "console-api-log-event");
 }
@ -103,6 +106,8 @@ async function runTest() {

 runTest().then(() => {
  listener.shutdown();
+
+  SpecialPowers.setBoolPref("privacy.reduceTimerPrecision", reduceTimePrecisionPrevPrefValue);
  SimpleTest.finish();
 });

--- a/dom/html/ImageDocument.cpp
+++ b/dom/html/ImageDocument.cpp
@ -273,7 +273,8 @@ ImageDocument::SetScriptGlobalObject(nsIScriptGlobalObject* aScriptGlobalObject)
  MediaDocument::SetScriptGlobalObject(aScriptGlobalObject);

  if (aScriptGlobalObject) {
-    if (!GetRootElement()) {
+    if (!InitialSetupHasBeenDone()) {
+      MOZ_ASSERT(!GetRootElement(), "Where did the root element come from?");
      // Create synthetic document
 #ifdef DEBUG
      nsresult rv =
@ -290,14 +291,14 @@ ImageDocument::SetScriptGlobalObject(nsIScriptGlobalObject* aScriptGlobalObject)
    target->AddEventListener(NS_LITERAL_STRING("resize"), this, false);
    target->AddEventListener(NS_LITERAL_STRING("keypress"), this, false);

-    if (GetReadyStateEnum() != nsIDocument::READYSTATE_COMPLETE) {
+    if (!InitialSetupHasBeenDone()) {
      LinkStylesheet(NS_LITERAL_STRING("resource://content-accessible/ImageDocument.css"));
      if (!nsContentUtils::IsChildOfSameType(this)) {
        LinkStylesheet(NS_LITERAL_STRING("resource://content-accessible/TopLevelImageDocument.css"));
        LinkStylesheet(NS_LITERAL_STRING("chrome://global/skin/media/TopLevelImageDocument.css"));
      }
+      InitialSetupDone();
    }
-    BecomeInteractive();
  }
 }

--- a/dom/html/MediaDocument.cpp
+++ b/dom/html/MediaDocument.cpp
@ -110,7 +110,7 @@ const char* const MediaDocument::sFormatNames[4] =

 MediaDocument::MediaDocument()
    : nsHTMLDocument(),
-      mDocumentElementInserted(false)
+      mDidInitialDocumentSetup(false)
 {
 }
 MediaDocument::~MediaDocument()
@ -187,21 +187,21 @@ MediaDocument::StartDocumentLoad(const char*         aCommand,
 }

 void
-MediaDocument::BecomeInteractive()
+MediaDocument::InitialSetupDone()
 {
-  // Even though our readyState code isn't really reliable, here we pretend
-  // that it is and conclude that we are restoring from the b/f cache if
-  // GetReadyStateEnum() == nsIDocument::READYSTATE_COMPLETE.
-  if (GetReadyStateEnum() != nsIDocument::READYSTATE_COMPLETE) {
  MOZ_ASSERT(GetReadyStateEnum() == nsIDocument::READYSTATE_LOADING,
-               "Bad readyState");
+             "Bad readyState: we should still be doing our initial load");
+  mDidInitialDocumentSetup = true;
+  nsContentUtils::AddScriptRunner(
+    new nsDocElementCreatedNotificationRunner(this));
  SetReadyStateInternal(nsIDocument::READYSTATE_INTERACTIVE);
 }
-}

 nsresult
 MediaDocument::CreateSyntheticDocument()
 {
+  MOZ_ASSERT(!InitialSetupHasBeenDone());
+
  // Synthesize an empty html document
  nsresult rv;

@ -418,16 +418,5 @@ MediaDocument::UpdateTitleAndCharset(const nsACString& aTypeStr,
  }
 }

-void
-MediaDocument::SetScriptGlobalObject(nsIScriptGlobalObject* aGlobalObject)
-{
-    nsHTMLDocument::SetScriptGlobalObject(aGlobalObject);
-    if (!mDocumentElementInserted && aGlobalObject) {
-        mDocumentElementInserted = true;
-        nsContentUtils::AddScriptRunner(
-            new nsDocElementCreatedNotificationRunner(this));
-    }
-}
-
 } // namespace dom
 } // namespace mozilla
--- a/dom/html/MediaDocument.h
+++ b/dom/html/MediaDocument.h
@ -33,15 +33,23 @@ public:
                                     bool                aReset = true,
                                     nsIContentSink*     aSink = nullptr) override;

-  virtual void SetScriptGlobalObject(nsIScriptGlobalObject* aGlobalObject) override;
-
  virtual bool WillIgnoreCharsetOverride() override
  {
    return true;
  }

 protected:
-  void BecomeInteractive();
+  // Hook to be called once our initial document setup is done.  Subclasses
+  // should call this from SetScriptGlobalObject when setup hasn't been done
+  // yet, a non-null script global is being set, and they have finished whatever
+  // setup work they plan to do for an initial load.
+  void InitialSetupDone();
+
+  // Check whether initial setup has been done.
+  MOZ_MUST_USE bool InitialSetupHasBeenDone() const
+  {
+    return mDidInitialDocumentSetup;
+  }

  virtual nsresult CreateSyntheticDocument();

@ -76,7 +84,11 @@ protected:

 private:
  enum                          {eWithNoInfo, eWithFile, eWithDim, eWithDimAndFile};
-  bool                          mDocumentElementInserted;
+
+  // A boolean that indicates whether we did our initial document setup.  This
+  // will be false initially, become true when we finish setting up the document
+  // during initial load and stay true thereafter.
+  bool                          mDidInitialDocumentSetup;
 };


--- a/dom/html/PluginDocument.cpp
+++ b/dom/html/PluginDocument.cpp
@ -130,15 +130,15 @@ PluginDocument::SetScriptGlobalObject(nsIScriptGlobalObject* aScriptGlobalObject
  MediaDocument::SetScriptGlobalObject(aScriptGlobalObject);

  if (aScriptGlobalObject) {
-    if (!mPluginContent) {
+    if (!InitialSetupHasBeenDone()) {
      // Create synthetic document
 #ifdef DEBUG
      nsresult rv =
 #endif
        CreateSyntheticPluginDocument();
      NS_ASSERTION(NS_SUCCEEDED(rv), "failed to create synthetic document");
+      InitialSetupDone();
    }
-    BecomeInteractive();
  } else {
    mStreamListener = nullptr;
  }
--- a/dom/html/VideoDocument.cpp
+++ b/dom/html/VideoDocument.cpp
@ -79,14 +79,13 @@ VideoDocument::SetScriptGlobalObject(nsIScriptGlobalObject* aScriptGlobalObject)
  // anything that might require it....
  MediaDocument::SetScriptGlobalObject(aScriptGlobalObject);

-  if (aScriptGlobalObject) {
-    if (!nsContentUtils::IsChildOfSameType(this) &&
-        GetReadyStateEnum() != nsIDocument::READYSTATE_COMPLETE) {
+  if (aScriptGlobalObject && !InitialSetupHasBeenDone()) {
+    if (!nsContentUtils::IsChildOfSameType(this)) {
      LinkStylesheet(NS_LITERAL_STRING("resource://content-accessible/TopLevelVideoDocument.css"));
      LinkStylesheet(NS_LITERAL_STRING("chrome://global/skin/media/TopLevelVideoDocument.css"));
      LinkScript(NS_LITERAL_STRING("chrome://global/content/TopLevelVideoDocument.js"));
    }
-    BecomeInteractive();
+    InitialSetupDone();
  }
 }

--- a/dom/media/test/mochitest.ini
+++ b/dom/media/test/mochitest.ini
@ -714,7 +714,7 @@ skip-if = android_version == '15' || android_version == '22' # bug 1308388, andr
 [test_bug465498.html]
 skip-if = toolkit == 'android' # android(bug 1232305)
 [test_bug495145.html]
-skip-if = (os == 'mac' && os_version == '10.6') || (toolkit == 'android')  # bug 1311229, android(bug 1232305)
+skip-if = toolkit == 'android' # android(bug 1232305)
 [test_bug495300.html]
 skip-if = toolkit == 'android' # bug 1243801, android(bug 1232305)
 [test_bug654550.html]
--- a/js/src/builtin/TypedObject.cpp
+++ b/js/src/builtin/TypedObject.cpp
@ -1349,7 +1349,7 @@ bool
 TypedObject::isAttached() const
 {
    if (is<InlineTransparentTypedObject>()) {
-        ObjectWeakMap* table = compartment()->lazyArrayBuffers;
+        ObjectWeakMap* table = compartment()->lazyArrayBuffers.get();
        if (table) {
            JSObject* buffer = table->lookup(this);
            if (buffer)
@ -2143,13 +2143,16 @@ InlineTypedObject::obj_moved(JSObject* dst, JSObject* src)
 ArrayBufferObject*
 InlineTransparentTypedObject::getOrCreateBuffer(JSContext* cx)
 {
-    ObjectWeakMap*& table = cx->compartment()->lazyArrayBuffers;
-    if (!table) {
-        table = cx->new_<ObjectWeakMap>(cx);
+    if (!cx->compartment()->lazyArrayBuffers) {
+        auto table = cx->make_unique<ObjectWeakMap>(cx);
        if (!table || !table->init())
            return nullptr;
+
+        cx->compartment()->lazyArrayBuffers = Move(table);
    }

+    ObjectWeakMap* table = cx->compartment()->lazyArrayBuffers.get();
+
    JSObject* obj = table->lookup(this);
    if (obj)
        return &obj->as<ArrayBufferObject>();
--- a/js/src/jit/BaselineCacheIRCompiler.cpp
+++ b/js/src/jit/BaselineCacheIRCompiler.cpp
@ -9,6 +9,7 @@
 #include "jit/CacheIR.h"
 #include "jit/Linker.h"
 #include "jit/SharedICHelpers.h"
+#include "proxy/DeadObjectProxy.h"
 #include "proxy/Proxy.h"

 #include "jit/MacroAssembler-inl.h"
@ -286,13 +287,19 @@ bool
 BaselineCacheIRCompiler::emitGuardCompartment()
 {
    Register obj = allocator.useRegister(masm, reader.objOperandId());
-    reader.stubOffset(); // Read global wrapper.
    AutoScratchRegister scratch(allocator, masm);

    FailurePath* failure;
    if (!addFailurePath(&failure))
        return false;

+    // Verify that the global wrapper is still valid, as
+    // it is pre-requisite for doing the compartment check.
+    Address globalWrapper(stubAddress(reader.stubOffset()));
+    masm.loadPtr(globalWrapper, scratch);
+    Address handlerAddr(scratch, ProxyObject::offsetOfHandler());
+    masm.branchPtr(Assembler::Equal, handlerAddr, ImmPtr(&DeadObjectProxy::singleton), failure->label());
+
    Address addr(stubAddress(reader.stubOffset()));
    masm.branchTestObjCompartment(Assembler::NotEqual, obj, addr, scratch, failure->label());
    return true;
--- a/js/src/jit/BaselineIC.cpp
+++ b/js/src/jit/BaselineIC.cpp
@ -4046,11 +4046,11 @@ ICIteratorMore_Native::Compiler::generateStubCode(MacroAssembler& masm)
                            obj, &failure);
    masm.loadObjPrivate(obj, JSObject::ITER_CLASS_NFIXED_SLOTS, nativeIterator);

-    // If props_cursor < props_end, load the next string and advance the cursor.
-    // Else, return MagicValue(JS_NO_ITER_VALUE).
+    // If propertyCursor_ < propertiesEnd_, load the next string and advance
+    // the cursor.  Otherwise return MagicValue(JS_NO_ITER_VALUE).
    Label iterDone;
-    Address cursorAddr(nativeIterator, offsetof(NativeIterator, props_cursor));
-    Address cursorEndAddr(nativeIterator, offsetof(NativeIterator, props_end));
+    Address cursorAddr(nativeIterator, NativeIterator::offsetOfPropertyCursor());
+    Address cursorEndAddr(nativeIterator, NativeIterator::offsetOfPropertiesEnd());
    masm.loadPtr(cursorAddr, scratch);
    masm.branchPtr(Assembler::BelowOrEqual, cursorEndAddr, scratch, &iterDone);

--- a/js/src/jit/CacheIR.cpp
+++ b/js/src/jit/CacheIR.cpp
@ -16,6 +16,7 @@

 #include "jit/MacroAssembler-inl.h"
 #include "vm/EnvironmentObject-inl.h"
+#include "vm/JSContext-inl.h"
 #include "vm/JSObject-inl.h"
 #include "vm/UnboxedObject-inl.h"

@ -31,6 +32,10 @@ const char* js::jit::CacheKindNames[] = {
 #undef DEFINE_KIND
 };

+void
+CacheIRWriter::assertSameCompartment(JSObject* obj) {
+    assertSameCompartmentDebugOnly(cx_, obj);
+}

 IRGenerator::IRGenerator(JSContext* cx, HandleScript script, jsbytecode* pc, CacheKind cacheKind,
                         ICState::Mode mode)
@ -732,6 +737,33 @@ GeneratePrototypeHoleGuards(CacheIRWriter& writer, JSObject* obj, ObjOperandId o
    }
 }

+// Similar to |TestMatchingReceiver|, but for the holder object (when it
+// differs from the receiver). The holder may also be the expando of the
+// receiver if it exists.
+static void
+TestMatchingHolder(CacheIRWriter& writer, JSObject* obj, ObjOperandId objId)
+{
+    // The GeneratePrototypeGuards + TestMatchingHolder checks only support
+    // prototype chains composed of NativeObject (excluding the receiver
+    // itself).
+    MOZ_ASSERT(obj->is<NativeObject>());
+
+    writer.guardShapeForOwnProperties(objId, obj->as<NativeObject>().lastProperty());
+}
+
+static bool
+UncacheableProtoOnChain(JSObject* obj)
+{
+    while (true) {
+        if (obj->hasUncacheableProto())
+            return true;
+
+        obj = obj->staticPrototype();
+        if (!obj)
+            return false;
+    }
+}
+
 static void
 ShapeGuardProtoChain(CacheIRWriter& writer, JSObject* obj, ObjOperandId objId)
 {
@ -750,20 +782,38 @@ ShapeGuardProtoChain(CacheIRWriter& writer, JSObject* obj, ObjOperandId objId)
    }
 }

-// Similar to |TestMatchingReceiver|, but for the holder object (when it
-// differs from the receiver). The holder may also be the expando of the
-// receiver if it exists.
+// For cross compartment guards we shape-guard the prototype chain to avoid
+// referencing the holder object.
+//
+// This peels off the first layer because it's guarded against obj == holder.
 static void
-TestMatchingHolder(CacheIRWriter& writer, JSObject* obj, ObjOperandId objId)
+ShapeGuardProtoChainForCrossCompartmentHolder(CacheIRWriter& writer, JSObject* obj,
+                                              ObjOperandId objId, JSObject* holder,
+                                              Maybe<ObjOperandId>* holderId)
 {
-    // The GeneratePrototypeGuards + TestMatchingHolder checks only support
-    // prototype chains composed of NativeObject (excluding the receiver
-    // itself).
-    MOZ_ASSERT(obj->is<NativeObject>());
+    MOZ_ASSERT(obj != holder);
+    MOZ_ASSERT(holder);
+    while (true) {
+        obj = obj->staticPrototype();
+        MOZ_ASSERT(obj);

-    writer.guardShapeForOwnProperties(objId, obj->as<NativeObject>().lastProperty());
+        objId = writer.loadProto(objId);
+        if (obj == holder) {
+            TestMatchingHolder(writer, obj, objId);
+            holderId->emplace(objId);
+            return;
+        } else {
+            writer.guardShapeForOwnProperties(objId, obj->as<NativeObject>().shape());
+        }
+    }
 }

+enum class SlotReadType {
+    Normal,
+    CrossCompartment
+};
+
+template <SlotReadType MaybeCrossCompartment = SlotReadType::Normal>
 static void
 EmitReadSlotGuard(CacheIRWriter& writer, JSObject* obj, JSObject* holder,
                  ObjOperandId objId, Maybe<ObjOperandId>* holderId)
@ -773,12 +823,20 @@ EmitReadSlotGuard(CacheIRWriter& writer, JSObject* obj, JSObject* holder,

    if (obj != holder) {
        if (holder) {
+            if (MaybeCrossCompartment == SlotReadType::CrossCompartment) {
+                // Guard proto chain integrity.
+                // We use a variant of guards that avoid baking in any cross-compartment
+                // object pointers.
+                ShapeGuardProtoChainForCrossCompartmentHolder(writer, obj, objId, holder,
+                                                              holderId);
+            } else {
                // Guard proto chain integrity.
                GeneratePrototypeGuards(writer, obj, holder, objId);

                // Guard on the holder's shape.
                holderId->emplace(writer.loadObject(holder));
                TestMatchingHolder(writer, holder, holderId->ref());
+            }
        } else {
            // The property does not exist. Guard on everything in the prototype
            // chain. This is guaranteed to see only Native objects because of
@ -792,12 +850,13 @@ EmitReadSlotGuard(CacheIRWriter& writer, JSObject* obj, JSObject* holder,
    }
 }

+template <SlotReadType MaybeCrossCompartment = SlotReadType::Normal>
 static void
 EmitReadSlotResult(CacheIRWriter& writer, JSObject* obj, JSObject* holder,
                   Shape* shape, ObjOperandId objId)
 {
    Maybe<ObjOperandId> holderId;
-    EmitReadSlotGuard(writer, obj, holder, objId, &holderId);
+    EmitReadSlotGuard<MaybeCrossCompartment>(writer, obj, holder, objId, &holderId);

    if (obj == holder && obj->is<UnboxedPlainObject>())
        holder = obj->as<UnboxedPlainObject>().maybeExpando();
@ -1044,23 +1103,31 @@ GetPropIRGenerator::tryAttachCrossCompartmentWrapper(HandleObject obj, ObjOperan
    if (unwrapped->compartment()->zone() != cx_->compartment()->zone())
        return false;

-    RootedObject wrappedGlobal(cx_, &obj->global());
-    if (!cx_->compartment()->wrap(cx_, &wrappedGlobal))
+    // Take the unwrapped object's global, and wrap in a
+    // this-compartment wrapper. This is what will be stored in the IC
+    // keep the compartment alive.
+    RootedObject wrappedTargetGlobal(cx_, &unwrapped->global());
+    if (!cx_->compartment()->wrap(cx_, &wrappedTargetGlobal))
        return false;

+    bool isWindowProxy = false;
+    RootedShape shape(cx_);
+    RootedNativeObject holder(cx_);
+
+    // Enter compartment of target since some checks have side-effects
+    // such as de-lazifying type info.
+    {
        AutoRealm ar(cx_, unwrapped);

        // The first CCW for iframes is almost always wrapping another WindowProxy
        // so we optimize for that case as well.
-    bool isWindowProxy = IsWindowProxy(unwrapped);
+        isWindowProxy = IsWindowProxy(unwrapped);
        if (isWindowProxy) {
            MOZ_ASSERT(ToWindowIfWindowProxy(unwrapped) == unwrapped->realm()->maybeGlobal());
            unwrapped = cx_->global();
            MOZ_ASSERT(unwrapped);
        }

-    RootedShape shape(cx_);
-    RootedNativeObject holder(cx_);
        NativeGetPropCacheability canCache =
            CanAttachNativeGetProp(cx_, unwrapped, id, &holder, &shape, pc_,
                                resultFlags_, isTemporarilyUnoptimizable_);
@ -1068,6 +1135,8 @@ GetPropIRGenerator::tryAttachCrossCompartmentWrapper(HandleObject obj, ObjOperan
            return false;

        if (holder) {
+            // Need to be in the compartment of the holder to
+            // call EnsureTrackPropertyTypes
            EnsureTrackPropertyTypes(cx_, holder, id);
            if (unwrapped == holder) {
                // See the comment in StripPreliminaryObjectStubs.
@ -1076,6 +1145,13 @@ GetPropIRGenerator::tryAttachCrossCompartmentWrapper(HandleObject obj, ObjOperan
                else
                    preliminaryObjectAction_ = PreliminaryObjectAction::Unlink;
            }
+        } else {
+            // UNCACHEABLE_PROTO may result in guards against specific (cross-compartment)
+            // prototype objects, so don't try to attach IC if we see the flag at all.
+            if (UncacheableProtoOnChain(unwrapped)) {
+                return false;
+            }
+        }
    }

    maybeEmitIdGuard(id);
@ -1086,7 +1162,7 @@ GetPropIRGenerator::tryAttachCrossCompartmentWrapper(HandleObject obj, ObjOperan
    ObjOperandId wrapperTargetId = writer.loadWrapperTarget(objId);

    // If the compartment of the wrapped object is different we should fail.
-    writer.guardCompartment(wrapperTargetId, wrappedGlobal, unwrapped->compartment());
+    writer.guardCompartment(wrapperTargetId, wrappedTargetGlobal, unwrapped->compartment());

    ObjOperandId unwrappedId = wrapperTargetId;
    if (isWindowProxy) {
@ -1097,7 +1173,7 @@ GetPropIRGenerator::tryAttachCrossCompartmentWrapper(HandleObject obj, ObjOperan
        unwrappedId = writer.loadWrapperTarget(wrapperTargetId);
    }

-    EmitReadSlotResult(writer, unwrapped, holder, shape, unwrappedId);
+    EmitReadSlotResult<SlotReadType::CrossCompartment>(writer, unwrapped, holder, shape, unwrappedId);
    EmitReadSlotReturn(writer, unwrapped, holder, shape, /* wrapResult = */ true);

    trackAttached("CCWSlot");
--- a/js/src/jit/CacheIR.h
+++ b/js/src/jit/CacheIR.h
@ -395,6 +395,7 @@ void LoadShapeWrapperContents(MacroAssembler& masm, Register obj, Register dst,
 // Class to record CacheIR + some additional metadata for code generation.
 class MOZ_RAII CacheIRWriter : public JS::CustomAutoRooter
 {
+    JSContext* cx_;
    CompactBufferWriter buffer_;

    uint32_t nextOperandId_;
@ -415,6 +416,8 @@ class MOZ_RAII CacheIRWriter : public JS::CustomAutoRooter
    static const size_t MaxStubDataSizeInBytes = 20 * sizeof(uintptr_t);
    bool tooLarge_;

+    void assertSameCompartment(JSObject*);
+
    void writeOp(CacheOp op) {
        MOZ_ASSERT(uint32_t(op) <= UINT8_MAX);
        buffer_.writeByte(uint32_t(op));
@ -471,6 +474,7 @@ class MOZ_RAII CacheIRWriter : public JS::CustomAutoRooter
  public:
    explicit CacheIRWriter(JSContext* cx)
      : CustomAutoRooter(cx),
+        cx_(cx),
        nextOperandId_(0),
        nextInstructionId_(0),
        numInputOperands_(0),
@ -585,8 +589,10 @@ class MOZ_RAII CacheIRWriter : public JS::CustomAutoRooter
        guardShape(obj, shape);
    }
    void guardXrayExpandoShapeAndDefaultProto(ObjOperandId obj, JSObject* shapeWrapper) {
+        assertSameCompartment(shapeWrapper);
        writeOpWithOperandId(CacheOp::GuardXrayExpandoShapeAndDefaultProto, obj);
-        buffer_.writeByte(uint32_t(!!shapeWrapper));        addStubField(uintptr_t(shapeWrapper), StubField::Type::JSObject);
+        buffer_.writeByte(uint32_t(!!shapeWrapper));
+        addStubField(uintptr_t(shapeWrapper), StubField::Type::JSObject);
    }
    // Guard rhs[slot] == prototypeObject
    void guardFunctionPrototype(ObjOperandId rhs, uint32_t slot, ObjOperandId protoId) {
@ -621,6 +627,7 @@ class MOZ_RAII CacheIRWriter : public JS::CustomAutoRooter
        guardGroup(obj, group);
    }
    void guardProto(ObjOperandId obj, JSObject* proto) {
+        assertSameCompartment(proto);
        writeOpWithOperandId(CacheOp::GuardProto, obj);
        addStubField(uintptr_t(proto), StubField::Type::JSObject);
    }
@ -652,6 +659,7 @@ class MOZ_RAII CacheIRWriter : public JS::CustomAutoRooter
        writeOpWithOperandId(CacheOp::GuardNotDOMProxy, obj);
    }
    void guardSpecificObject(ObjOperandId obj, JSObject* expected) {
+        assertSameCompartment(expected);
        writeOpWithOperandId(CacheOp::GuardSpecificObject, obj);
        addStubField(uintptr_t(expected), StubField::Type::JSObject);
    }
@ -676,6 +684,7 @@ class MOZ_RAII CacheIRWriter : public JS::CustomAutoRooter
        buffer_.writeByte(uint32_t(magic));
    }
    void guardCompartment(ObjOperandId obj, JSObject* global, JSCompartment* compartment) {
+        assertSameCompartment(global);
        writeOpWithOperandId(CacheOp::GuardCompartment, obj);
        // Add a reference to the compartment's global to keep it alive.
        addStubField(uintptr_t(global), StubField::Type::JSObject);
@ -752,6 +761,7 @@ class MOZ_RAII CacheIRWriter : public JS::CustomAutoRooter
        return res;
    }
    ObjOperandId loadObject(JSObject* obj) {
+        assertSameCompartment(obj);
        ObjOperandId res(nextOperandId_++);
        writeOpWithOperandId(CacheOp::LoadObject, res);
        addStubField(uintptr_t(obj), StubField::Type::JSObject);
--- a/js/src/jit/CodeGenerator.cpp
+++ b/js/src/jit/CodeGenerator.cpp
@ -4036,16 +4036,20 @@ CodeGenerator::maybeEmitGlobalBarrierCheck(const LAllocation* maybeGlobal, OutOf
 {
    // Check whether an object is a global that we have already barriered before
    // calling into the VM.
+    //
+    // We only check for the script's global, not other globals within the same
+    // compartment, because we bake in a pointer to realm->globalWriteBarriered
+    // and doing that would be invalid for other realms because they could be
+    // collected before the Ion code is discarded.

    if (!maybeGlobal->isConstant())
        return;

    JSObject* obj = &maybeGlobal->toConstant()->toObject();
-    if (!isGlobalObject(obj))
+    if (gen->compartment->maybeGlobal() != obj)
        return;

-    JSCompartment* comp = obj->compartment();
-    auto addr = AbsoluteAddress(&comp->globalWriteBarriered);
+    auto addr = AbsoluteAddress(gen->compartment->addressOfGlobalWriteBarriered());
    masm.branch32(Assembler::NotEqual, addr, Imm32(0), ool->rejoin());
 }

@ -9872,11 +9876,11 @@ CodeGenerator::visitIteratorMore(LIteratorMore* lir)
    Register outputScratch = output.scratchReg();
    LoadNativeIterator(masm, obj, outputScratch, ool->entry());

-    // If props_cursor < props_end, load the next string and advance the cursor.
-    // Else, return MagicValue(JS_NO_ITER_VALUE).
+    // If propertyCursor_ < propertiesEnd_, load the next string and advance
+    // the cursor.  Otherwise return MagicValue(JS_NO_ITER_VALUE).
    Label iterDone;
-    Address cursorAddr(outputScratch, offsetof(NativeIterator, props_cursor));
-    Address cursorEndAddr(outputScratch, offsetof(NativeIterator, props_end));
+    Address cursorAddr(outputScratch, NativeIterator::offsetOfPropertyCursor());
+    Address cursorEndAddr(outputScratch, NativeIterator::offsetOfPropertiesEnd());
    masm.loadPtr(cursorAddr, temp);
    masm.branchPtr(Assembler::BelowOrEqual, cursorEndAddr, temp, &iterDone);

@ -9928,9 +9932,8 @@ CodeGenerator::visitIteratorEnd(LIteratorEnd* lir)
    masm.and32(Imm32(~JSITER_ACTIVE), Address(temp1, offsetof(NativeIterator, flags)));

    // Reset property cursor.
-    Address propCursor(temp1, offsetof(NativeIterator, props_cursor));
-    masm.computeEffectiveAddress(Address(temp1, sizeof(NativeIterator)), temp2);
-    masm.storePtr(temp2, propCursor);
+    masm.loadPtr(Address(temp1, NativeIterator::offsetOfGuardsEnd()), temp2);
+    masm.storePtr(temp2, Address(temp1, NativeIterator::offsetOfPropertyCursor()));

    // Unlink from the iterator list.
    const Register next = temp2;
--- a/js/src/jit/CompileWrappers.cpp
+++ b/js/src/jit/CompileWrappers.cpp
@ -275,6 +275,12 @@ CompileCompartment::maybeGlobal()
    return JS::GetRealmForCompartment(compartment())->unsafeUnbarrieredMaybeGlobal();
 }

+const uint32_t*
+CompileCompartment::addressOfGlobalWriteBarriered()
+{
+    return &JS::GetRealmForCompartment(compartment())->globalWriteBarriered;
+}
+
 bool
 CompileCompartment::hasAllocationMetadataBuilder()
 {
--- a/js/src/jit/CompileWrappers.h
+++ b/js/src/jit/CompileWrappers.h
@ -104,6 +104,7 @@ class CompileCompartment
    const JitCompartment* jitCompartment();

    const GlobalObject* maybeGlobal();
+    const uint32_t* addressOfGlobalWriteBarriered();

    bool hasAllocationMetadataBuilder();

--- a/js/src/jit/IonCacheIRCompiler.cpp
+++ b/js/src/jit/IonCacheIRCompiler.cpp
@ -13,6 +13,7 @@
 #include "jit/JSJitFrameIter.h"
 #include "jit/Linker.h"
 #include "jit/SharedICHelpers.h"
+#include "proxy/DeadObjectProxy.h"
 #include "proxy/Proxy.h"

 #include "jit/JSJitFrameIter-inl.h"
@ -678,15 +679,20 @@ bool
 IonCacheIRCompiler::emitGuardCompartment()
 {
    Register obj = allocator.useRegister(masm, reader.objOperandId());
-    objectStubField(reader.stubOffset()); // Read global wrapper.
+    JSObject* globalWrapper = objectStubField(reader.stubOffset());
    JSCompartment* compartment = compartmentStubField(reader.stubOffset());
-
    AutoScratchRegister scratch(allocator, masm);

    FailurePath* failure;
    if (!addFailurePath(&failure))
        return false;

+    // Verify that the global wrapper is still valid, as
+    // it is pre-requisite for doing the compartment check.
+    masm.movePtr(ImmGCPtr(globalWrapper), scratch);
+    Address handlerAddr(scratch, ProxyObject::offsetOfHandler());
+    masm.branchPtr(Assembler::Equal, handlerAddr, ImmPtr(&DeadObjectProxy::singleton), failure->label());
+
    masm.branchTestObjCompartment(Assembler::NotEqual, obj, compartment, scratch,
                                  failure->label());
    return true;
--- a/js/src/jit/VMFunctions.cpp
+++ b/js/src/jit/VMFunctions.cpp
@ -747,9 +747,9 @@ void
 PostGlobalWriteBarrier(JSRuntime* rt, JSObject* obj)
 {
    MOZ_ASSERT(obj->is<GlobalObject>());
-    if (!obj->compartment()->globalWriteBarriered) {
+    if (!obj->realm()->globalWriteBarriered) {
        PostWriteBarrier(rt, obj);
-        obj->compartment()->globalWriteBarriered = 1;
+        obj->realm()->globalWriteBarriered = 1;
    }
 }

--- a/js/src/jit/arm/MacroAssembler-arm.cpp
+++ b/js/src/jit/arm/MacroAssembler-arm.cpp
@ -5941,25 +5941,14 @@ void
 MacroAssemblerARM::wasmTruncateToInt32(FloatRegister input, Register output, MIRType fromType,
                                       bool isUnsigned, bool isSaturating, Label* oolEntry)
 {
-    // vcvt* converts NaN into 0, so check for NaNs here.
-    if (!isSaturating) {
-        if (fromType == MIRType::Double)
-            asMasm().compareDouble(input, input);
-        else if (fromType == MIRType::Float32)
-            asMasm().compareFloat(input, input);
-        else
-            MOZ_CRASH("unexpected type in visitWasmTruncateToInt32");
-
-        ma_b(oolEntry, Assembler::VFP_Unordered);
-    }
-
    ScratchDoubleScope scratchScope(asMasm());
    ScratchRegisterScope scratchReg(asMasm());
    FloatRegister scratch = scratchScope.uintOverlay();

    // ARM conversion instructions clamp the value to ensure it fits within the
    // target's type bounds, so every time we see those, we need to check the
-    // input.
+    // input. A NaN check is not necessary because NaN is converted to zero and
+    // on a zero result we branch out of line to do further processing anyway.
    if (isUnsigned) {
        if (fromType == MIRType::Double)
            ma_vcvt_F64_U32(input, scratch);
@ -5980,6 +5969,18 @@ MacroAssemblerARM::wasmTruncateToInt32(FloatRegister input, Register output, MIR
        return;
    }

+    // vcvt* converts NaN into 0, so check for NaNs here.
+    if (!isSaturating) {
+        if (fromType == MIRType::Double)
+            asMasm().compareDouble(input, input);
+        else if (fromType == MIRType::Float32)
+            asMasm().compareFloat(input, input);
+        else
+            MOZ_CRASH("unexpected type in visitWasmTruncateToInt32");
+
+        ma_b(oolEntry, Assembler::VFP_Unordered);
+    }
+
    scratch = scratchScope.sintOverlay();

    if (fromType == MIRType::Double)
--- a/js/src/jsapi-tests/testGCGrayMarking.cpp
+++ b/js/src/jsapi-tests/testGCGrayMarking.cpp
@ -13,19 +13,30 @@
 using namespace js;
 using namespace js::gc;

+namespace js {
+
+struct GCManagedObjectWeakMap : public ObjectWeakMap
+{
+    using ObjectWeakMap::ObjectWeakMap;
+};
+
+} // namespace js
+
 namespace JS {

 template <>
-struct DeletePolicy<js::ObjectWeakMap> : public js::GCManagedDeletePolicy<js::ObjectWeakMap>
+struct DeletePolicy<js::GCManagedObjectWeakMap>
+  : public js::GCManagedDeletePolicy<js::GCManagedObjectWeakMap>
 {};

 template <>
-struct MapTypeToRootKind<js::ObjectWeakMap*> {
+struct MapTypeToRootKind<js::GCManagedObjectWeakMap*> {
    static const JS::RootKind kind = JS::RootKind::Traceable;
 };

 template <>
-struct GCPolicy<js::ObjectWeakMap*> : public NonGCPointerPolicy<js::ObjectWeakMap*>
+struct GCPolicy<js::GCManagedObjectWeakMap*>
+  : public NonGCPointerPolicy<js::GCManagedObjectWeakMap*>
 {};

 } // namespace JS
@ -331,12 +342,12 @@ bool
 TestUnassociatedWeakMaps()
 {
    // Make a weakmap that's not associated with a JSObject.
-    auto weakMap = cx->make_unique<ObjectWeakMap>(cx);
+    auto weakMap = cx->make_unique<GCManagedObjectWeakMap>(cx);
    CHECK(weakMap);
    CHECK(weakMap->init());

    // Make sure this gets traced during GC.
-    Rooted<ObjectWeakMap*> rootMap(cx, weakMap.get());
+    Rooted<GCManagedObjectWeakMap*> rootMap(cx, weakMap.get());

    JSObject* key = AllocWeakmapKeyObject();
    CHECK(key);
--- a/js/src/jsfriendapi.cpp
+++ b/js/src/jsfriendapi.cpp
@ -1425,7 +1425,7 @@ js::SetAllocationMetadataBuilder(JSContext* cx, const AllocationMetadataBuilder*
 JS_FRIEND_API(JSObject*)
 js::GetAllocationMetadata(JSObject* obj)
 {
-    ObjectWeakMap* map = obj->compartment()->objectMetadataTable;
+    ObjectWeakMap* map = obj->compartment()->objectMetadataTable.get();
    if (map)
        return map->lookup(obj);
    return nullptr;
@ -1537,7 +1537,7 @@ js::EnableAccessValidation(JSContext* cx, bool enabled)
 JS_FRIEND_API(void)
 js::SetCompartmentValidAccessPtr(JSContext* cx, JS::HandleObject global, bool* accessp)
 {
-    global->compartment()->setValidAccessPtr(accessp);
+    global->realm()->setValidAccessPtr(accessp);
 }

 JS_FRIEND_API(bool)
--- a/js/src/proxy/CrossCompartmentWrapper.cpp
+++ b/js/src/proxy/CrossCompartmentWrapper.cpp
@ -304,7 +304,7 @@ Reify(JSContext* cx, JSCompartment* origin, HandleObject objp)
            RootedId id(cx);
            RootedValue v(cx);
            for (size_t i = 0; i < length; ++i) {
-                v.setString(ni->begin()[i]);
+                v.setString(ni->propertiesBegin()[i]);
                if (!ValueToId<CanGC>(cx, v, &id))
                    return nullptr;
                cx->markId(id);
--- a/js/src/vm/BytecodeUtil.cpp
+++ b/js/src/vm/BytecodeUtil.cpp
@ -2888,18 +2888,18 @@ js::GetPCCountScriptContents(JSContext* cx, size_t index)
 }

 static bool
-GenerateLcovInfo(JSContext* cx, JSCompartment* comp, GenericPrinter& out)
+GenerateLcovInfo(JSContext* cx, JS::Realm* realm, GenericPrinter& out)
 {
    JSRuntime* rt = cx->runtime();

-    // Collect the list of scripts which are part of the current compartment.
+    // Collect the list of scripts which are part of the current realm.
    {
        js::gc::AutoPrepareForTracing apft(cx);
    }
    Rooted<ScriptVector> topScripts(cx, ScriptVector(cx));
    for (ZonesIter zone(rt, SkipAtoms); !zone.done(); zone.next()) {
        for (auto script = zone->cellIter<JSScript>(); !script.done(); script.next()) {
-            if (script->compartment() != comp ||
+            if (script->realm() != realm ||
                !script->isTopLevel() ||
                !script->filename())
            {
@ -2914,8 +2914,8 @@ GenerateLcovInfo(JSContext* cx, JSCompartment* comp, GenericPrinter& out)
    if (topScripts.length() == 0)
        return true;

-    // Collect code coverage info for one compartment.
-    coverage::LCovCompartment compCover;
+    // Collect code coverage info for one realm.
+    coverage::LCovRealm realmCover;
    for (JSScript* topLevel: topScripts) {
        RootedScript topScript(cx, topLevel);

@ -2930,7 +2930,7 @@ GenerateLcovInfo(JSContext* cx, JSCompartment* comp, GenericPrinter& out)
        do {
            script = queue.popCopy();
            if (script->filename())
-                compCover.collectCodeCoverageInfo(comp, script, script->filename());
+                realmCover.collectCodeCoverageInfo(realm, script, script->filename());

            // Iterate from the last to the first object in order to have
            // the functions them visited in the opposite order when popping
@ -2961,7 +2961,7 @@ GenerateLcovInfo(JSContext* cx, JSCompartment* comp, GenericPrinter& out)
    }

    bool isEmpty = true;
-    compCover.exportInto(out, &isEmpty);
+    realmCover.exportInto(out, &isEmpty);
    if (out.hadOutOfMemory())
        return false;
    return true;
@ -2975,7 +2975,7 @@ js::GetCodeCoverageSummary(JSContext* cx, size_t* length)
    if (!out.init())
        return nullptr;

-    if (!GenerateLcovInfo(cx, cx->compartment(), out)) {
+    if (!GenerateLcovInfo(cx, cx->realm(), out)) {
        JS_ReportOutOfMemory(cx);
        return nullptr;
    }
--- a/js/src/vm/CodeCoverage.cpp
+++ b/js/src/vm/CodeCoverage.cpp
@ -455,7 +455,7 @@ LCovSource::writeScript(JSScript* script)
    return true;
 }

-LCovCompartment::LCovCompartment()
+LCovRealm::LCovRealm()
  : alloc_(4096),
    outTN_(&alloc_),
    sources_(nullptr)
@ -464,7 +464,7 @@ LCovCompartment::LCovCompartment()
 }

 void
-LCovCompartment::collectCodeCoverageInfo(JSCompartment* comp, JSScript* script, const char* name)
+LCovRealm::collectCodeCoverageInfo(JS::Realm* realm, JSScript* script, const char* name)
 {
    // Skip any operation if we already some out-of memory issues.
    if (outTN_.hadOutOfMemory())
@ -474,7 +474,7 @@ LCovCompartment::collectCodeCoverageInfo(JSCompartment* comp, JSScript* script,
        return;

    // Get the existing source LCov summary, or create a new one.
-    LCovSource* source = lookupOrAdd(comp, name);
+    LCovSource* source = lookupOrAdd(realm, name);
    if (!source)
        return;

@ -486,12 +486,12 @@ LCovCompartment::collectCodeCoverageInfo(JSCompartment* comp, JSScript* script,
 }

 LCovSource*
-LCovCompartment::lookupOrAdd(JSCompartment* comp, const char* name)
+LCovRealm::lookupOrAdd(JS::Realm* realm, const char* name)
 {
-    // On the first call, write the compartment name, and allocate a LCovSource
+    // On the first call, write the realm name, and allocate a LCovSource
    // vector in the LifoAlloc.
    if (!sources_) {
-        if (!writeCompartmentName(comp))
+        if (!writeRealmName(realm))
            return nullptr;

        LCovSourceVector* raw = alloc_.pod_malloc<LCovSourceVector>();
@ -525,7 +525,7 @@ LCovCompartment::lookupOrAdd(JSCompartment* comp, const char* name)
 }

 void
-LCovCompartment::exportInto(GenericPrinter& out, bool* isEmpty) const
+LCovRealm::exportInto(GenericPrinter& out, bool* isEmpty) const
 {
    if (!sources_ || outTN_.hadOutOfMemory())
        return;
@ -551,12 +551,12 @@ LCovCompartment::exportInto(GenericPrinter& out, bool* isEmpty) const
 }

 bool
-LCovCompartment::writeCompartmentName(JSCompartment* comp)
+LCovRealm::writeRealmName(JS::Realm* realm)
 {
    JSContext* cx = TlsContext.get();

    // lcov trace files are starting with an optional test case name, that we
-    // recycle to be a compartment name.
+    // recycle to be a realm name.
    //
    // Note: The test case name has some constraint in terms of valid character,
    // thus we escape invalid chracters with a "_" symbol in front of its
@ -567,6 +567,7 @@ LCovCompartment::writeCompartmentName(JSCompartment* comp)
        {
            // Hazard analysis cannot tell that the callback does not GC.
            JS::AutoSuppressGCAnalysis nogc;
+            JSCompartment* comp = JS::GetCompartmentForRealm(realm);
            (*cx->runtime()->compartmentNameCallback)(cx, comp, name, sizeof(name));
        }
        for (char *s = name; s < name + sizeof(name) && *s; s++) {
@ -581,7 +582,7 @@ LCovCompartment::writeCompartmentName(JSCompartment* comp)
        }
        outTN_.put("\n", 1);
    } else {
-        outTN_.printf("Compartment_%p%p\n", (void*) size_t('_'), comp);
+        outTN_.printf("Realm_%p%p\n", (void*) size_t('_'), realm);
    }

    return !outTN_.hadOutOfMemory();
@ -649,7 +650,7 @@ LCovRuntime::finishFile()
 }

 void
-LCovRuntime::writeLCovResult(LCovCompartment& comp)
+LCovRuntime::writeLCovResult(LCovRealm& realm)
 {
    if (!out_.isInitialized())
        return;
@ -663,7 +664,7 @@ LCovRuntime::writeLCovResult(LCovCompartment& comp)
            return;
    }

-    comp.exportInto(out_, &isEmpty_);
+    realm.exportInto(out_, &isEmpty_);
    out_.flush();
 }

--- a/js/src/vm/CodeCoverage.h
+++ b/js/src/vm/CodeCoverage.h
@ -22,8 +22,6 @@ class ScriptSourceObject;

 namespace coverage {

-class LCovCompartment;
-
 class LCovSource
 {
  public:
@ -82,13 +80,13 @@ class LCovSource
    bool hasTopLevelScript_ : 1;
 };

-class LCovCompartment
+class LCovRealm
 {
  public:
-    LCovCompartment();
+    LCovRealm();

    // Collect code coverage information for the given source.
-    void collectCodeCoverageInfo(JSCompartment* comp, JSScript* topLevel, const char* name);
+    void collectCodeCoverageInfo(JS::Realm* realm, JSScript* topLevel, const char* name);

    // Write the Lcov output in a buffer, such as the one associated with
    // the runtime code coverage trace file.
@ -96,10 +94,10 @@ class LCovCompartment

  private:
    // Write the script name in out.
-    bool writeCompartmentName(JSCompartment* comp);
+    bool writeRealmName(JS::Realm* realm);

    // Return the LCovSource entry which matches the given ScriptSourceObject.
-    LCovSource* lookupOrAdd(JSCompartment* comp, const char* name);
+    LCovSource* lookupOrAdd(JS::Realm* realm, const char* name);

  private:
    typedef mozilla::Vector<LCovSource, 16, LifoAllocPolicy<Fallible>> LCovSourceVector;
@ -108,10 +106,10 @@ class LCovCompartment
    // strings to be written in the file.
    LifoAlloc alloc_;

-    // LifoAlloc string which hold the name of the compartment.
+    // LifoAlloc string which hold the name of the realm.
    LSprinter outTN_;

-    // Vector of all sources which are used in this compartment.
+    // Vector of all sources which are used in this realm.
    LCovSourceVector* sources_;
 };

@ -133,9 +131,9 @@ class LCovRuntime
    // Check if we should collect code coverage information.
    bool isEnabled() const { return out_.isInitialized(); }

-    // Write the aggregated result of the code coverage of a compartment
+    // Write the aggregated result of the code coverage of a realm
    // into a file.
-    void writeLCovResult(LCovCompartment& comp);
+    void writeLCovResult(LCovRealm& realm);

  private:
    // When a process forks, the file will remain open, but 2 processes will
--- a/js/src/vm/EnvironmentObject.cpp
+++ b/js/src/vm/EnvironmentObject.cpp
@ -2518,7 +2518,7 @@ DebugEnvironments::ensureCompartmentData(JSContext* cx)
 {
    JSCompartment* c = cx->compartment();
    if (c->debugEnvs)
-        return c->debugEnvs;
+        return c->debugEnvs.get();

    auto debugEnvs = cx->make_unique<DebugEnvironments>(cx, cx->zone());
    if (!debugEnvs || !debugEnvs->init()) {
@ -2526,14 +2526,14 @@ DebugEnvironments::ensureCompartmentData(JSContext* cx)
        return nullptr;
    }

-    c->debugEnvs = debugEnvs.release();
-    return c->debugEnvs;
+    c->debugEnvs = Move(debugEnvs);
+    return c->debugEnvs.get();
 }

 /* static */ DebugEnvironmentProxy*
 DebugEnvironments::hasDebugEnvironment(JSContext* cx, EnvironmentObject& env)
 {
-    DebugEnvironments* envs = env.compartment()->debugEnvs;
+    DebugEnvironments* envs = env.compartment()->debugEnvs.get();
    if (!envs)
        return nullptr;

@ -2567,7 +2567,7 @@ DebugEnvironments::hasDebugEnvironment(JSContext* cx, const EnvironmentIter& ei)
 {
    MOZ_ASSERT(!ei.hasSyntacticEnvironment());

-    DebugEnvironments* envs = cx->compartment()->debugEnvs;
+    DebugEnvironments* envs = cx->compartment()->debugEnvs.get();
    if (!envs)
        return nullptr;

@ -2717,7 +2717,7 @@ DebugEnvironments::onPopCall(JSContext* cx, AbstractFramePtr frame)
 {
    assertSameCompartment(cx, frame);

-    DebugEnvironments* envs = cx->compartment()->debugEnvs;
+    DebugEnvironments* envs = cx->compartment()->debugEnvs.get();
    if (!envs)
        return;

@ -2759,7 +2759,7 @@ DebugEnvironments::onPopLexical(JSContext* cx, AbstractFramePtr frame, jsbytecod
 {
    assertSameCompartment(cx, frame);

-    DebugEnvironments* envs = cx->compartment()->debugEnvs;
+    DebugEnvironments* envs = cx->compartment()->debugEnvs.get();
    if (!envs)
        return;

@ -2771,7 +2771,7 @@ template <typename Environment, typename Scope>
 void
 DebugEnvironments::onPopGeneric(JSContext* cx, const EnvironmentIter& ei)
 {
-    DebugEnvironments* envs = cx->compartment()->debugEnvs;
+    DebugEnvironments* envs = cx->compartment()->debugEnvs.get();
    if (!envs)
        return;

@ -2807,7 +2807,7 @@ DebugEnvironments::onPopVar(JSContext* cx, AbstractFramePtr frame, jsbytecode* p
 {
    assertSameCompartment(cx, frame);

-    DebugEnvironments* envs = cx->compartment()->debugEnvs;
+    DebugEnvironments* envs = cx->compartment()->debugEnvs.get();
    if (!envs)
        return;

@ -2827,14 +2827,14 @@ DebugEnvironments::onPopVar(JSContext* cx, const EnvironmentIter& ei)
 void
 DebugEnvironments::onPopWith(AbstractFramePtr frame)
 {
-    if (DebugEnvironments* envs = frame.compartment()->debugEnvs)
+    if (DebugEnvironments* envs = frame.compartment()->debugEnvs.get())
        envs->liveEnvs.remove(&frame.environmentChain()->as<WithEnvironmentObject>());
 }

 void
 DebugEnvironments::onCompartmentUnsetIsDebuggee(JSCompartment* c)
 {
-    if (DebugEnvironments* envs = c->debugEnvs) {
+    if (DebugEnvironments* envs = c->debugEnvs.get()) {
        envs->proxiedEnvs.clear();
        envs->missingEnvs.clear();
        envs->liveEnvs.clear();
@ -2903,7 +2903,7 @@ DebugEnvironments::updateLiveEnvironments(JSContext* cx)
 LiveEnvironmentVal*
 DebugEnvironments::hasLiveEnvironment(EnvironmentObject& env)
 {
-    DebugEnvironments* envs = env.compartment()->debugEnvs;
+    DebugEnvironments* envs = env.compartment()->debugEnvs.get();
    if (!envs)
        return nullptr;

@ -2942,7 +2942,7 @@ DebugEnvironments::unsetPrevUpToDateUntil(JSContext* cx, AbstractFramePtr until)
 /* static */ void
 DebugEnvironments::forwardLiveFrame(JSContext* cx, AbstractFramePtr from, AbstractFramePtr to)
 {
-    DebugEnvironments* envs = cx->compartment()->debugEnvs;
+    DebugEnvironments* envs = cx->compartment()->debugEnvs.get();
    if (!envs)
        return;

--- a/js/src/vm/EnvironmentObject.h
+++ b/js/src/vm/EnvironmentObject.h
@ -1211,12 +1211,4 @@ AnalyzeEntrainedVariables(JSContext* cx, HandleScript script);

 } // namespace js

-namespace JS {
-
-template <>
-struct DeletePolicy<js::DebugEnvironments> : public js::GCManagedDeletePolicy<js::DebugEnvironments>
-{};
-
-} // namespace JS
-
 #endif /* vm_EnvironmentObject_h */
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@ -387,7 +387,7 @@ js::RunScript(JSContext* cx, RunState& state)
                          cx->runtime()->allowContentJS());

    MOZ_ASSERT(!cx->enableAccessValidation ||
-               cx->compartment()->isAccessValid());
+               cx->realm()->isAccessValid());

    if (!Debugger::checkNoExecute(cx, state.script()))
        return false;
--- a/js/src/vm/Iteration.cpp
+++ b/js/src/vm/Iteration.cpp
@ -14,6 +14,7 @@
 #include "mozilla/PodOperations.h"
 #include "mozilla/Unused.h"

+#include <algorithm>
 #include <new>

 #include "jstypes.h"
@ -56,18 +57,22 @@ static const gc::AllocKind ITERATOR_FINALIZE_KIND = gc::AllocKind::OBJECT2_BACKG
 void
 NativeIterator::trace(JSTracer* trc)
 {
-    for (GCPtrFlatString* str = begin(); str < end(); str++)
-        TraceNullableEdge(trc, str, "prop");
    TraceNullableEdge(trc, &obj, "obj");

-    HeapReceiverGuard* guards = guardArray();
-    for (size_t i = 0; i < guard_length; i++)
-        guards[i].trace(trc);
-
    // The SuppressDeletedPropertyHelper loop can GC, so make sure that if the
    // GC removes any elements from the list, it won't remove this one.
    if (iterObj_)
        TraceManuallyBarrieredEdge(trc, &iterObj_, "iterObj");
+
+    std::for_each(guardsBegin(), guardsEnd(),
+                  [trc](HeapReceiverGuard& guard) {
+                      guard.trace(trc);
+                  });
+
+    std::for_each(propertiesBegin(), propertiesEnd(),
+                  [trc](GCPtrFlatString& prop) {
+                      TraceNullableEdge(trc, &prop, "prop");
+                  });
 }

 typedef HashSet<jsid, DefaultHasher<jsid>> IdSet;
@ -652,11 +657,12 @@ NativeIterator::NativeIterator(JSContext* cx, Handle<PropertyIteratorObject*> pr
                               uint32_t numGuards, uint32_t guardKey, bool* hadError)
  : obj(objBeingIterated),
    iterObj_(propIter),
-    // NativeIterator initially acts as if it contains no properties.
-    props_cursor(begin()),
-    props_end(props_cursor),
-    // ...and no HeapReceiverGuards.
-    guard_length(0),
+    // NativeIterator initially acts (before full initialization) as if it
+    // contains no guards...
+    guardsEnd_(guardsBegin()),
+    // ...and no properties.
+    propertyCursor_(reinterpret_cast<GCPtrFlatString*>(guardsBegin() + numGuards)),
+    propertiesEnd_(propertyCursor_),
    guard_key(guardKey),
    flags(0)
 {
@ -675,12 +681,12 @@ NativeIterator::NativeIterator(JSContext* cx, Handle<PropertyIteratorObject*> pr

        // Placement-new the next property string at the end of the currently
        // computed property strings.
-        GCPtrFlatString* loc = props_end;
+        GCPtrFlatString* loc = propertiesEnd_;

        // Increase the overall property string count before initializing the
        // property string, so this construction isn't on a location not known
        // to the GC yet.
-        props_end++;
+        propertiesEnd_++;

        new (loc) GCPtrFlatString(str);
    }
@ -691,21 +697,26 @@ NativeIterator::NativeIterator(JSContext* cx, Handle<PropertyIteratorObject*> pr
        // changed during a GC triggered in (among other places) |IdToString|
        //. above.
        JSObject* pobj = objBeingIterated;
+#ifdef DEBUG
+        uint32_t i = 0;
+#endif
        uint32_t key = 0;
-        HeapReceiverGuard* guards = guardArray();
        do {
            ReceiverGuard guard(pobj);

            // Placement-new the next HeapReceiverGuard at the end of the
            // currently initialized HeapReceiverGuards.
-            uint32_t index = guard_length;
+            HeapReceiverGuard* loc = guardsEnd_;

            // Increase the overall guard-count before initializing the
            // HeapReceiverGuard, so this construction isn't on a location not
            // known to the GC.
-            guard_length++;
+            guardsEnd_++;
+#ifdef DEBUG
+            i++;
+#endif

-            new (&guards[index]) HeapReceiverGuard(guard);
+            new (loc) HeapReceiverGuard(guard);

            key = mozilla::AddToHash(key, guard.hash());

@ -716,9 +727,10 @@ NativeIterator::NativeIterator(JSContext* cx, Handle<PropertyIteratorObject*> pr
        } while (pobj);

        guard_key = key;
-        MOZ_ASSERT(guard_length == numGuards);
+        MOZ_ASSERT(i == numGuards);
    }

+    MOZ_ASSERT(static_cast<void*>(guardsEnd_) == propertyCursor_);
    MOZ_ASSERT(!*hadError);
 }

@ -751,11 +763,11 @@ js::NewEmptyPropertyIterator(JSContext* cx)
 IteratorHashPolicy::match(PropertyIteratorObject* obj, const Lookup& lookup)
 {
    NativeIterator* ni = obj->getNativeIterator();
-    if (ni->guard_key != lookup.key || ni->guard_length != lookup.numGuards)
+    if (ni->guard_key != lookup.key || ni->guardCount() != lookup.numGuards)
        return false;

-    return PodEqual(reinterpret_cast<ReceiverGuard*>(ni->guardArray()), lookup.guards,
-                    ni->guard_length);
+    return PodEqual(reinterpret_cast<ReceiverGuard*>(ni->guardsBegin()), lookup.guards,
+                    ni->guardCount());
 }

 static inline void
@ -852,10 +864,10 @@ StoreInIteratorCache(JSContext* cx, JSObject* obj, PropertyIteratorObject* itero
    MOZ_ASSERT(CanStoreInIteratorCache(obj));

    NativeIterator* ni = iterobj->getNativeIterator();
-    MOZ_ASSERT(ni->guard_length > 0);
+    MOZ_ASSERT(ni->guardCount() > 0);

-    IteratorHashPolicy::Lookup lookup(reinterpret_cast<ReceiverGuard*>(ni->guardArray()),
-                                      ni->guard_length,
+    IteratorHashPolicy::Lookup lookup(reinterpret_cast<ReceiverGuard*>(ni->guardsBegin()),
+                                      ni->guardCount(),
                                      ni->guard_key);

    JSCompartment::IteratorCache& cache = cx->compartment()->iteratorCache;
@ -1012,10 +1024,11 @@ Realm::getOrCreateIterResultTemplateObject(JSContext* cx)
 MOZ_ALWAYS_INLINE void
 NativeIteratorNext(NativeIterator* ni, MutableHandleValue rval)
 {
-    if (ni->props_cursor >= ni->props_end) {
+    if (ni->propertyCursor_ >= ni->propertiesEnd()) {
+        MOZ_ASSERT(ni->propertyCursor_ == ni->propertiesEnd());
        rval.setMagic(JS_NO_ITER_VALUE);
    } else {
-        rval.setString(*ni->current());
+        rval.setString(*ni->currentProperty());
        ni->incCursor();
    }
 }
@ -1170,7 +1183,7 @@ js::CloseIterator(JSObject* obj)
         * Reset the enumerator; it may still be in the cached iterators
         * for this thread, and can be reused.
         */
-        ni->props_cursor = ni->begin();
+        ni->propertyCursor_ = ni->propertiesBegin();
    }
 }

@ -1248,16 +1261,16 @@ SuppressDeletedProperty(JSContext* cx, NativeIterator* ni, HandleObject obj,
    //
    // Note that usually both strings will be atoms so we only check for pointer
    // equality here.
-    if (ni->props_cursor > ni->begin() && ni->props_cursor[-1] == str)
+    if (ni->propertyCursor_ > ni->propertiesBegin() && ni->propertyCursor_[-1] == str)
        return true;

    while (true) {
        bool restart = false;

        // Check whether id is still to come.
-        GCPtrFlatString* const props_cursor = ni->props_cursor;
-        GCPtrFlatString* const props_end = ni->end();
-        for (GCPtrFlatString* idp = props_cursor; idp < props_end; ++idp) {
+        GCPtrFlatString* const cursor = ni->propertyCursor_;
+        GCPtrFlatString* const end = ni->propertiesEnd();
+        for (GCPtrFlatString* idp = cursor; idp < end; ++idp) {
            // Common case: both strings are atoms.
            if ((*idp)->isAtom() && str->isAtom()) {
                if (*idp != str)
@ -1288,7 +1301,7 @@ SuppressDeletedProperty(JSContext* cx, NativeIterator* ni, HandleObject obj,

            // If GetPropertyDescriptor above removed a property from ni, start
            // over.
-            if (props_end != ni->props_end || props_cursor != ni->props_cursor) {
+            if (end != ni->propertiesEnd() || cursor != ni->propertyCursor_) {
                restart = true;
                break;
            }
@ -1296,17 +1309,17 @@ SuppressDeletedProperty(JSContext* cx, NativeIterator* ni, HandleObject obj,
            // No property along the prototype chain stepped in to take the
            // property's place, so go ahead and delete id from the list.
            // If it is the next property to be enumerated, just skip it.
-            if (idp == props_cursor) {
+            if (idp == cursor) {
                ni->incCursor();
            } else {
-                for (GCPtrFlatString* p = idp; p + 1 != props_end; p++)
+                for (GCPtrFlatString* p = idp; p + 1 != end; p++)
                    *p = *(p + 1);
-                ni->props_end = ni->end() - 1;
+                ni->propertiesEnd_--;

                // This invokes the pre barrier on this element, since
                // it's no longer going to be marked, and ensures that
                // any existing remembered set entry will be dropped.
-                *ni->props_end = nullptr;
+                *ni->propertiesEnd_ = nullptr;
            }

            // Don't reuse modified native iterators.
--- a/js/src/vm/Iteration.h
+++ b/js/src/vm/Iteration.h
@ -11,6 +11,7 @@
 * JavaScript iterators.
 */

+#include "mozilla/ArrayUtils.h"
 #include "mozilla/MemoryReporting.h"

 #include "gc/Barrier.h"
@ -31,22 +32,33 @@ class PropertyIteratorObject;

 struct NativeIterator
 {
+  public:
    // Object being iterated.
    GCPtrObject obj = {};

+  private:
    // Internal iterator object.
    JSObject* iterObj_ = nullptr;

-    // The next property, pointing into an array of strings directly after this
-    // NativeIterator as part of the overall allocation containing |*this|.
-    GCPtrFlatString* props_cursor; // initialized by constructor
+    // The end of HeapReceiverGuards that appear directly after |this|, as part
+    // of an overall allocation that stores |*this|, receiver guards, and
+    // iterated strings.  Once this has been fully initialized, it also equals
+    // the start of iterated strings.
+    HeapReceiverGuard* guardsEnd_; // initialized by constructor

-    // The limit/end of properties to iterate.  (This is also, after casting,
-    // the start of an array of HeapReceiverGuards included in the overall
-    // allocation that stores |*this| and the iterated strings.)
-    GCPtrFlatString* props_end; // initialized by constructor
+  public:
+    // The next property, pointing into an array of strings directly after any
+    // HeapReceiverGuards that appear directly after |*this|, as part of an
+    // overall allocation that stores |*this|, receiver guards, and iterated
+    // strings.
+    GCPtrFlatString* propertyCursor_; // initialized by constructor
+
+    // The limit/end of properties to iterate (and, assuming no error occurred
+    // while constructing this NativeIterator, the end of the full allocation
+    // storing |*this|, receiver guards, and strings).  Beware!  This value may
+    // change as properties are deleted from the observed object.
+    GCPtrFlatString* propertiesEnd_; // initialized by constructor

-    uint32_t guard_length = 0;
    uint32_t guard_key = 0;
    uint32_t flags = 0;

@ -76,42 +88,55 @@ struct NativeIterator
    /** Initialize a |JSCompartment::enumerators| sentinel. */
    NativeIterator();

-    GCPtrFlatString* begin() const {
-        static_assert(alignof(NativeIterator) >= alignof(GCPtrFlatString),
-                      "GCPtrFlatStrings for properties must be able to appear "
-                      "directly after NativeIterator, with no padding space "
-                      "required for correct alignment");
-
-        // Note that JIT code inlines this computation to reset |props_cursor|
-        // when an iterator ends: see |CodeGenerator::visitIteratorEnd|.
+    HeapReceiverGuard* guardsBegin() const {
+        static_assert(alignof(HeapReceiverGuard) <= alignof(NativeIterator),
+                      "NativeIterator must be aligned to begin storing "
+                      "HeapReceiverGuards immediately after it with no "
+                      "required padding");
        const NativeIterator* immediatelyAfter = this + 1;
        auto* afterNonConst = const_cast<NativeIterator*>(immediatelyAfter);
-        return reinterpret_cast<GCPtrFlatString*>(afterNonConst);
+        return reinterpret_cast<HeapReceiverGuard*>(afterNonConst);
    }

-    GCPtrFlatString* end() const {
-        return props_end;
+    HeapReceiverGuard* guardsEnd() const {
+        return guardsEnd_;
    }

-    HeapReceiverGuard* guardArray() const {
-        static_assert(alignof(ReceiverGuard) == alignof(GCPtrFlatString),
-                      "the end of all properties must be exactly aligned "
-                      "adequate to begin storing ReceiverGuards, else the "
-                      "full tacked-on memory won't be enough to store all "
-                      "properties/guards");
-        return reinterpret_cast<HeapReceiverGuard*>(props_end);
+    uint32_t guardCount() const {
+        return mozilla::PointerRangeSize(guardsBegin(), guardsEnd());
+    }
+
+    GCPtrFlatString* propertiesBegin() const {
+        static_assert(alignof(HeapReceiverGuard) >= alignof(GCPtrFlatString),
+                      "GCPtrFlatStrings for properties must be able to appear "
+                      "directly after any HeapReceiverGuards after this "
+                      "NativeIterator, with no padding space required for "
+                      "correct alignment");
+        static_assert(alignof(NativeIterator) >= alignof(GCPtrFlatString),
+                      "GCPtrFlatStrings for properties must be able to appear "
+                      "directly after this NativeIterator when no "
+                      "HeapReceiverGuards are present, with no padding space "
+                      "required for correct alignment");
+
+        // Note: JIT code inlines this computation to reset |propertyCursor_|
+        //       when an iterator ends: see |CodeGenerator::visitIteratorEnd|.
+        return reinterpret_cast<GCPtrFlatString*>(guardsEnd_);
+    }
+
+    GCPtrFlatString* propertiesEnd() const {
+        return propertiesEnd_;
    }

    size_t numKeys() const {
-        return end() - begin();
+        return mozilla::PointerRangeSize(propertiesBegin(), propertiesEnd());
    }

    JSObject* iterObj() const {
        return iterObj_;
    }
-    GCPtrFlatString* current() const {
-        MOZ_ASSERT(props_cursor < props_end);
-        return props_cursor;
+    GCPtrFlatString* currentProperty() const {
+        MOZ_ASSERT(propertyCursor_ < propertiesEnd());
+        return propertyCursor_;
    }

    NativeIterator* next() {
@ -126,7 +151,7 @@ struct NativeIterator
    }

    void incCursor() {
-        props_cursor = props_cursor + 1;
+        propertyCursor_++;
    }
    void link(NativeIterator* other) {
        /* A NativeIterator cannot appear in the enumerator list twice. */
@ -147,6 +172,18 @@ struct NativeIterator
    static NativeIterator* allocateSentinel(JSContext* maybecx);

    void trace(JSTracer* trc);
+
+    static constexpr size_t offsetOfGuardsEnd() {
+        return offsetof(NativeIterator, guardsEnd_);
+    }
+
+    static constexpr size_t offsetOfPropertyCursor() {
+        return offsetof(NativeIterator, propertyCursor_);
+    }
+
+    static constexpr size_t offsetOfPropertiesEnd() {
+        return offsetof(NativeIterator, propertiesEnd_);
+    }
 };

 class PropertyIteratorObject : public NativeObject
--- a/js/src/vm/JSCompartment.cpp
+++ b/js/src/vm/JSCompartment.cpp
@ -46,18 +46,10 @@ JSCompartment::JSCompartment(Zone* zone)
    runtime_(zone->runtimeFromAnyThread()),
    data(nullptr),
    regExps(),
-    globalWriteBarriered(0),
    detachedTypedObjects(0),
-    objectMetadataTable(nullptr),
    innerViews(zone),
-    lazyArrayBuffers(nullptr),
-    nonSyntacticLexicalEnvironments_(nullptr),
    gcIncomingGrayPointers(nullptr),
-    validAccessPtr(nullptr),
-    debugEnvs(nullptr),
-    enumerators(nullptr),
-    jitCompartment_(nullptr),
-    lcovOutput()
+    enumerators(nullptr)
 {
    runtime_->numCompartments++;
 }
@ -76,29 +68,21 @@ Realm::Realm(JS::Zone* zone, const JS::RealmOptions& options)
 }

 Realm::~Realm()
-{
-    // Empty destructor: using the default destructor requires adding various
-    // #includes to other files where we destruct Realms.
-}
-
-JSCompartment::~JSCompartment()
 {
    // Write the code coverage information in a file.
    JSRuntime* rt = runtimeFromMainThread();
    if (rt->lcovOutput().isEnabled())
        rt->lcovOutput().writeLCovResult(lcovOutput);
+}

-    js_delete(jitCompartment_);
-    js_delete(debugEnvs);
-    js_delete(objectMetadataTable);
-    js_delete(lazyArrayBuffers);
-    js_delete(nonSyntacticLexicalEnvironments_);
-    js_free(enumerators);
+JSCompartment::~JSCompartment()
+{
+    MOZ_ASSERT(enumerators == iteratorSentinel_.get());

 #ifdef DEBUG
    // Avoid assertion destroying the unboxed layouts list if the embedding
    // leaked GC things.
-    if (!rt->gc.shutdownCollectedEverything())
+    if (!runtime_->gc.shutdownCollectedEverything())
        unboxedLayouts.clear();
 #endif

@ -114,6 +98,13 @@ JSCompartment::init(JSContext* maybecx)
        return false;
    }

+    NativeIteratorSentinel sentinel(NativeIterator::allocateSentinel(maybecx));
+    if (!sentinel)
+        return false;
+
+    iteratorSentinel_ = Move(sentinel);
+    enumerators = iteratorSentinel_.get();
+
    return true;
 }

@ -136,10 +127,6 @@ Realm::init(JSContext* maybecx)
     */
    JS::ResetTimeZone();

-    enumerators = NativeIterator::allocateSentinel(maybecx);
-    if (!enumerators)
-        return false;
-
    if (!savedStacks_.init() ||
        !varNames_.init() ||
        !iteratorCache.init())
@ -196,18 +183,14 @@ JSCompartment::ensureJitCompartmentExists(JSContext* cx)
    if (!zone()->getJitZone(cx))
        return false;

-    /* Set the compartment early, so linking works. */
-    jitCompartment_ = cx->new_<JitCompartment>();
-
-    if (!jitCompartment_)
+    UniquePtr<JitCompartment> jitComp = cx->make_unique<JitCompartment>();
+    if (!jitComp)
        return false;

-    if (!jitCompartment_->initialize(cx)) {
-        js_delete(jitCompartment_);
-        jitCompartment_ = nullptr;
+    if (!jitComp->initialize(cx))
        return false;
-    }

+    jitCompartment_ = Move(jitComp);
    return true;
 }

@ -537,9 +520,11 @@ LexicalEnvironmentObject*
 JSCompartment::getOrCreateNonSyntacticLexicalEnvironment(JSContext* cx, HandleObject enclosing)
 {
    if (!nonSyntacticLexicalEnvironments_) {
-        nonSyntacticLexicalEnvironments_ = cx->new_<ObjectWeakMap>(cx);
-        if (!nonSyntacticLexicalEnvironments_ || !nonSyntacticLexicalEnvironments_->init())
+        auto map = cx->make_unique<ObjectWeakMap>(cx);
+        if (!map || !map->init())
            return nullptr;
+
+        nonSyntacticLexicalEnvironments_ = Move(map);
    }

    // If a wrapped WithEnvironmentObject was passed in, unwrap it, as we may
@ -733,8 +718,6 @@ Realm::finishRoots()
 void
 JSCompartment::sweepAfterMinorGC(JSTracer* trc)
 {
-    globalWriteBarriered = 0;
-
    InnerViewTable& table = innerViews.get();
    if (table.needsSweepAfterMinorGC())
        table.sweepAfterMinorGC();
@ -742,6 +725,7 @@ JSCompartment::sweepAfterMinorGC(JSTracer* trc)
    crossCompartmentWrappers.sweepAfterMinorGC(trc);

    Realm* realm = JS::GetRealmForCompartment(this);
+    realm->globalWriteBarriered = 0;
    realm->dtoaCache.purge();
 }

@ -1028,13 +1012,6 @@ Realm::forgetAllocationMetadataBuilder()
    allocationMetadataBuilder_ = nullptr;
 }

-void
-Realm::clearObjectMetadata()
-{
-    js_delete(objectMetadataTable);
-    objectMetadataTable = nullptr;
-}
-
 void
 Realm::setNewObjectMetadata(JSContext* cx, HandleObject obj)
 {
@ -1044,7 +1021,7 @@ Realm::setNewObjectMetadata(JSContext* cx, HandleObject obj)
    if (JSObject* metadata = allocationMetadataBuilder_->build(cx, obj, oomUnsafe)) {
        assertSameCompartment(cx, metadata);
        if (!objectMetadataTable) {
-            objectMetadataTable = cx->new_<ObjectWeakMap>(cx);
+            objectMetadataTable = cx->make_unique<ObjectWeakMap>(cx);
            if (!objectMetadataTable || !objectMetadataTable->init())
                oomUnsafe.crash("setNewObjectMetadata");
        }
--- a/js/src/vm/JSCompartment.h
+++ b/js/src/vm/JSCompartment.h
@ -597,15 +597,6 @@ struct JSCompartment
                                      js::SystemAllocPolicy>;
    IteratorCache iteratorCache;

-    /*
-     * For generational GC, record whether a write barrier has added this
-     * compartment's global to the store buffer since the last minor GC.
-     *
-     * This is used to avoid calling into the VM every time a nursery object is
-     * written to a property of the global.
-     */
-    uint32_t                     globalWriteBarriered;
-
    // Non-zero if the storage underlying any typed object in this compartment
    // might be detached.
    int32_t                      detachedTypedObjects;
@ -629,7 +620,7 @@ struct JSCompartment
 #endif
    // Keep track of the metadata objects which can be associated with each JS
    // object. Both keys and values are in this compartment.
-    js::ObjectWeakMap* objectMetadataTable;
+    js::UniquePtr<js::ObjectWeakMap> objectMetadataTable;

    // Map from array buffers to views sharing that storage.
    JS::WeakCache<js::InnerViewTable> innerViews;
@ -637,7 +628,7 @@ struct JSCompartment
    // Inline transparent typed objects do not initially have an array buffer,
    // but can have that buffer created lazily if it is accessed later. This
    // table manages references from such typed objects to their buffers.
-    js::ObjectWeakMap* lazyArrayBuffers;
+    js::UniquePtr<js::ObjectWeakMap> lazyArrayBuffers;

    // All unboxed layouts in the compartment.
    mozilla::LinkedList<js::UnboxedLayout> unboxedLayouts;
@ -646,7 +637,7 @@ struct JSCompartment
    // All non-syntactic lexical environments in the compartment. These are kept in
    // a map because when loading scripts into a non-syntactic environment, we need
    // to use the same lexical environment to persist lexical bindings.
-    js::ObjectWeakMap* nonSyntacticLexicalEnvironments_;
+    js::UniquePtr<js::ObjectWeakMap> nonSyntacticLexicalEnvironments_;

  public:
    /*
@ -662,16 +653,6 @@ struct JSCompartment
    bool getNonWrapperObjectForCurrentCompartment(JSContext* cx, js::MutableHandleObject obj);
    bool getOrCreateWrapper(JSContext* cx, js::HandleObject existing, js::MutableHandleObject obj);

-  private:
-    // This pointer is controlled by the embedder. If it is non-null, and if
-    // cx->enableAccessValidation is true, then we assert that *validAccessPtr
-    // is true before running any code in this compartment.
-    bool* validAccessPtr;
-
-  public:
-    bool isAccessValid() const { return validAccessPtr ? *validAccessPtr : true; }
-    void setValidAccessPtr(bool* accessp) { validAccessPtr = accessp; }
-
  protected:
    explicit JSCompartment(JS::Zone* zone);
    ~JSCompartment();
@ -754,12 +735,16 @@ struct JSCompartment
    }

    /* Bookkeeping information for debug scope objects. */
-    js::DebugEnvironments* debugEnvs;
+    js::UniquePtr<js::DebugEnvironments> debugEnvs;

    /*
     * List of potentially active iterators that may need deleted property
     * suppression.
     */
+  private:
+    using NativeIteratorSentinel = js::UniquePtr<js::NativeIterator, JS::FreePolicy>;
+    NativeIteratorSentinel iteratorSentinel_;
+  public:
    js::NativeIterator* enumerators;

    MOZ_ALWAYS_INLINE bool objectMaybeInIteration(JSObject* obj);
@ -772,17 +757,13 @@ struct JSCompartment
    bool maybeAlive = true;

  protected:
-    js::jit::JitCompartment* jitCompartment_;
+    js::UniquePtr<js::jit::JitCompartment> jitCompartment_;

  public:
    bool ensureJitCompartmentExists(JSContext* cx);
    js::jit::JitCompartment* jitCompartment() {
-        return jitCompartment_;
+        return jitCompartment_.get();
    }
-
-    // Aggregated output used to collect JSScript hit counts when code coverage
-    // is enabled.
-    js::coverage::LCovCompartment lcovOutput;
 };

 class JS::Realm : public JSCompartment
@ -820,6 +801,11 @@ class JS::Realm : public JSCompartment
    const js::AllocationMetadataBuilder* allocationMetadataBuilder_ = nullptr;
    void* realmPrivate_ = nullptr;

+    // This pointer is controlled by the embedder. If it is non-null, and if
+    // cx->enableAccessValidation is true, then we assert that *validAccessPtr
+    // is true before running any code in this realm.
+    bool* validAccessPtr_ = nullptr;
+
    js::ReadBarriered<js::ArgumentsObject*> mappedArgumentsTemplate_ { nullptr };
    js::ReadBarriered<js::ArgumentsObject*> unmappedArgumentsTemplate_ { nullptr };
    js::ReadBarriered<js::NativeObject*> iterResultTemplate_ { nullptr };
@ -851,6 +837,10 @@ class JS::Realm : public JSCompartment
    // WebAssembly state for the realm.
    js::wasm::Realm wasm;

+    // Aggregated output used to collect JSScript hit counts when code coverage
+    // is enabled.
+    js::coverage::LCovRealm lcovOutput;
+
    js::DtoaCache dtoaCache;
    js::NewProxyCache newProxyCache;
    js::ArraySpeciesLookup arraySpeciesLookup;
@ -870,6 +860,15 @@ class JS::Realm : public JSCompartment
    // Last time at which an animation was played for this realm.
    int64_t lastAnimationTime = 0;

+    /*
+     * For generational GC, record whether a write barrier has added this
+     * realm's global to the store buffer since the last minor GC.
+     *
+     * This is used to avoid calling into the VM every time a nursery object is
+     * written to a property of the global.
+     */
+    uint32_t globalWriteBarriered = 0;
+
    uint32_t warnedAboutStringGenericsMethods = 0;
 #ifdef DEBUG
    bool firedOnNewGlobalObject = false;
@ -1014,7 +1013,6 @@ class JS::Realm : public JSCompartment
    void setAllocationMetadataBuilder(const js::AllocationMetadataBuilder* builder);
    void forgetAllocationMetadataBuilder();
    void setNewObjectMetadata(JSContext* cx, JS::HandleObject obj);
-    void clearObjectMetadata();

    bool hasObjectPendingMetadata() const {
        return objectMetadataState_.is<js::PendingMetadata>();
@ -1227,6 +1225,13 @@ class JS::Realm : public JSCompartment
    js::HashNumber randomHashCode();

    mozilla::HashCodeScrambler randomHashCodeScrambler();
+
+    bool isAccessValid() const {
+        return validAccessPtr_ ? *validAccessPtr_ : true;
+    }
+    void setValidAccessPtr(bool* accessp) {
+        validAccessPtr_ = accessp;
+    }
 };

 namespace js {
--- a/js/src/vm/JSScript.cpp
+++ b/js/src/vm/JSScript.cpp
@ -3108,10 +3108,10 @@ JSScript::finalize(FreeOp* fop)
    // fullyInitFromEmitter() or fullyInitTrivial().

    // Collect code coverage information for this script and all its inner
-    // scripts, and store the aggregated information on the compartment.
+    // scripts, and store the aggregated information on the realm.
    MOZ_ASSERT_IF(hasScriptName(), fop->runtime()->lcovOutput().isEnabled());
    if (fop->runtime()->lcovOutput().isEnabled() && hasScriptName()) {
-        compartment()->lcovOutput.collectCodeCoverageInfo(compartment(), this, getScriptName());
+        realm()->lcovOutput.collectCodeCoverageInfo(realm(), this, getScriptName());
        destroyScriptName();
    }

--- a/layout/reftests/bidi/dirAuto/reftest.list
+++ b/layout/reftests/bidi/dirAuto/reftest.list
@ -1,7 +1,7 @@
 == bdi-auto-dir-default.html bdi-auto-dir-default-ref.html
-== dir_auto-set-contained-dir-L.html dir_auto-contained-dir-L-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == dir_auto-set-contained-dir-L.html dir_auto-contained-dir-L-ref.html
 == dir_auto-set-contained-dir-R.html dir_auto-contained-dir-R-ref.html
-== dir_auto-set-contained-invalid-dir-L.html dir_auto-contained-dir-L-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == dir_auto-set-contained-invalid-dir-L.html dir_auto-contained-dir-L-ref.html
 == dir_auto-set-contained-invalid-dir-R.html dir_auto-contained-dir-R-ref.html
 == dir_auto-unset-contained-dir-L.html dir_auto-unset-contained-dir-L-ref.html
 == dir_auto-unset-contained-dir-R.html dir_auto-unset-contained-dir-R-ref.html
--- a/layout/reftests/bidi/reftest.list
+++ b/layout/reftests/bidi/reftest.list
@ -1,6 +1,6 @@
 include dirAuto/reftest.list
 include numeral/reftest.list
-== bdi-element.html bdi-element-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == bdi-element.html bdi-element-ref.html
 == bidi-000.html bidi-000-ref.html
 == bidi-001.html bidi-001-ref.html
 == bidi-001-j.html bidi-001-ref.html
--- a/layout/reftests/bugs/reftest.list
+++ b/layout/reftests/bugs/reftest.list
@ -656,7 +656,7 @@ fails-if(Android&&!asyncPan) == 371561-1.html 371561-1-ref.html
 == 372768-1.html 372768-1-ref.html
 fuzzy-if(webrender&&winWidget,83-83,2-2) == 373295-1.html 373295-1-ref.html
 == 373298-1.html 373298-1-ref.html
-== 373381-1.html 373381-1-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == 373381-1.html 373381-1-ref.html
 fuzzy-if(skiaContent&&!Android,2,40) == 373381-2.html 373381-2-ref.html
 random-if(d2d) == 373381-3.html 373381-3-ref.html
 == 373381-4.html 373381-4-ref.html
@ -1606,9 +1606,9 @@ fails-if(!haveTestPlugin) HTTP == 599476.html 599476-ref.html
 == 599882-2.html 599882-2-ref.html
 == 600045-1.html 600045-1-ref.html
 == 600803-1.html 600803-1-ref.html
-== 600974-1.html 600974-1-ref.html
-== 600974-2.html 600974-1-ref.html
-== 600974-3.html 600974-1-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == 600974-1.html 600974-1-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == 600974-2.html 600974-1-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == 600974-3.html 600974-1-ref.html
 == 602200-1.html 602200-1-ref.html
 == 602200-2.html 602200-2-ref.html
 fuzzy-if(Android,8,20) == 602200-3.html 602200-3-ref.html
--- a/layout/reftests/counters/reftest.list
+++ b/layout/reftests/counters/reftest.list
@ -8,7 +8,7 @@
 == t1202-counter-06-b-test.html t1202-counter-06-b-reference.html
 == t1202-counter-07-b-test.html t1202-counter-07-b-reference.html
 == t1202-counter-08-b-test.html t1202-counter-08-b-reference.html
-== t1202-counter-09-b-test.html t1202-counter-09-b-reference.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == t1202-counter-09-b-test.html t1202-counter-09-b-reference.html
 == t1202-counter-10-b-test.html t1202-counter-10-b-reference.html
 == t1202-counter-11-b-test.html t1202-counter-11-b-reference.html
 == t1202-counter-12-b-test.html t1202-counter-12-b-reference.html
@ -69,14 +69,14 @@
 == counter-ua-limits-list-01.html counter-ua-limits-list-01-ref.html
 == multiple-thai-counters.html multiple-thai-counters-ref.html
 fuzzy-if(webrender&&cocoaWidget,40-40,6-6) == counter-suffix.html counter-suffix-ref.html
-== counter-cjk-decimal.html counter-cjk-decimal-ref.html
-== counter-japanese-informal.html counter-japanese-informal-ref.html
-== counter-japanese-formal.html counter-japanese-formal-ref.html
-== counter-korean-hangul-formal.html counter-korean-hangul-formal-ref.html
-== counter-korean-hanja-informal.html counter-korean-hanja-informal-ref.html
-== counter-korean-hanja-formal.html counter-korean-hanja-formal-ref.html
-== counter-simp-chinese-informal.html counter-simp-chinese-informal-ref.html
-== counter-simp-chinese-formal.html counter-simp-chinese-formal-ref.html
-== counter-trad-chinese-informal.html counter-trad-chinese-informal-ref.html
-== counter-trad-chinese-formal.html counter-trad-chinese-formal-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == counter-cjk-decimal.html counter-cjk-decimal-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == counter-japanese-informal.html counter-japanese-informal-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == counter-japanese-formal.html counter-japanese-formal-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == counter-korean-hangul-formal.html counter-korean-hangul-formal-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == counter-korean-hanja-informal.html counter-korean-hanja-informal-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == counter-korean-hanja-formal.html counter-korean-hanja-formal-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == counter-simp-chinese-informal.html counter-simp-chinese-informal-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == counter-simp-chinese-formal.html counter-simp-chinese-formal-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == counter-trad-chinese-informal.html counter-trad-chinese-informal-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == counter-trad-chinese-formal.html counter-trad-chinese-formal-ref.html
 == counter-ethiopic-numeric.html counter-ethiopic-numeric-ref.html
--- a/layout/reftests/css-grid/reftest.list
+++ b/layout/reftests/css-grid/reftest.list
@ -108,7 +108,7 @@ skip-if(Android) == grid-auto-min-sizing-percent-001.html grid-auto-min-sizing-p
 == grid-item-intrinsic-size-normal-001.html grid-item-intrinsic-size-normal-001-ref.html
 == grid-item-intrinsic-size-normal-002.html grid-item-intrinsic-size-normal-002-ref.html
 == grid-item-auto-min-size-clamp-001.html grid-item-auto-min-size-clamp-001-ref.html
-== grid-item-auto-min-size-clamp-002.html grid-item-auto-min-size-clamp-002-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == grid-item-auto-min-size-clamp-002.html grid-item-auto-min-size-clamp-002-ref.html
 == grid-item-auto-min-size-clamp-003.html grid-item-auto-min-size-clamp-003-ref.html
 # == grid-item-auto-min-size-clamp-004.html grid-item-auto-min-size-clamp-004-ref.html # bug 1421976
 == grid-item-auto-min-size-clamp-005.html grid-item-auto-min-size-clamp-005-ref.html
--- a/layout/reftests/css-ruby/reftest.list
+++ b/layout/reftests/css-ruby/reftest.list
@ -20,11 +20,11 @@ test-pref(dom.meta-viewport.enabled,true) test-pref(font.size.inflation.emPerLin
 == intra-level-whitespace-1.html intra-level-whitespace-1-ref.html
 == intra-level-whitespace-2.html intra-level-whitespace-2-ref.html
 == intra-level-whitespace-3.html intra-level-whitespace-3-ref.html
-== intrinsic-isize-1.html intrinsic-isize-1-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == intrinsic-isize-1.html intrinsic-isize-1-ref.html
 == intrinsic-isize-2.html intrinsic-isize-2-ref.html
 == justification-1.html justification-1-ref.html
 == justification-2.html justification-2-ref.html
-fuzzy-if(winWidget,255,792) == lang-specific-style-1.html lang-specific-style-1-ref.html # bug 1134947
+fuzzy-if(winWidget,255,792) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == lang-specific-style-1.html lang-specific-style-1-ref.html # bug 1134947
 == line-breaking-1.html line-breaking-1-ref.html
 == line-breaking-2.html line-breaking-2-ref.html
 == line-breaking-3.html line-breaking-3-ref.html
--- a/layout/reftests/font-features/reftest.list
+++ b/layout/reftests/font-features/reftest.list
@ -91,7 +91,7 @@ random-if(!winWidget&&!cocoaWidget) == fwid-spaces.html fwid-spaces-ref.html
 # Arial/Times New Roman on Win7+/OSX 10.6+ have kerning pairs that include spaces
 random-if(!winWidget&&!cocoaWidget) fails-if(winWidget||cocoaWidget) != kerning-spaces-arial-nokern.html kerning-spaces-arial-default.html
 random-if(!winWidget&&!cocoaWidget) fails-if(winWidget||cocoaWidget) == kerning-spaces-arial-kern.html kerning-spaces-arial-default.html
-random-if(!winWidget&&!cocoaWidget) fails-if(winWidget||cocoaWidget) != kerning-spaces-tnr-nokern.html kerning-spaces-tnr-default.html
+random-if(!winWidget&&!cocoaWidget) fails-if(winWidget||cocoaWidget) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) != kerning-spaces-tnr-nokern.html kerning-spaces-tnr-default.html
 random-if(!winWidget&&!cocoaWidget) fails-if(winWidget||cocoaWidget) == kerning-spaces-tnr-kern.html kerning-spaces-tnr-default.html

 # font-variant-caps fallback
--- a/layout/reftests/font-matching/reftest.list
+++ b/layout/reftests/font-matching/reftest.list
@ -19,7 +19,7 @@ pref(font.default.zh-CN,"sans-serif") pref(font.default.zh-TW,"sans-serif") pref

 # Test for bug 1458158: Arabic text in Arial weight 900 should fall back to Bold rather than Regular.
 # Limited to Windows because this is specific to the fonts shipped on Windows by default.
-skip-if(!winWidget) == 1458158-1.html 1458158-1-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) skip-if(!winWidget) == 1458158-1.html 1458158-1-ref.html

 # basic tests for bug 538730
 != synthetic-bold-1.html synthetic-bold-1-ref.html
@ -57,18 +57,18 @@ random-if(cocoaWidget) != impact-bold.html impact.html # bug 539418
 != lucidaconsole-bolditalic.html lucidaconsole-bold.html

 # checking that we don't match fullnames, psnames (see bug 538103)
-== arial-variations-1.html arial-variations-1-ref.html
-== arial-variations-2.html arial-variations-2-ref.html
-== arial-variations-3.html arial-variations-3-ref.html
-== arial-variations-4.html arial-variations-4-ref.html
-== arial-variations-5.html arial-variations-5-ref.html
-== arial-variations-6.html arial-variations-6-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == arial-variations-1.html arial-variations-1-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == arial-variations-2.html arial-variations-2-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == arial-variations-3.html arial-variations-3-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == arial-variations-4.html arial-variations-4-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == arial-variations-5.html arial-variations-5-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == arial-variations-6.html arial-variations-6-ref.html

 # localized font family names should always match just as English names do
-== localized-family-names-001.html localized-family-names-001-ref.html
-== localized-family-names-002.html localized-family-names-002-ref.html
-== localized-family-names-003.html localized-family-names-003-ref.html
-== localized-family-names-004.html localized-family-names-004-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == localized-family-names-001.html localized-family-names-001-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == localized-family-names-002.html localized-family-names-002-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == localized-family-names-003.html localized-family-names-003-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == localized-family-names-004.html localized-family-names-004-ref.html

 # family names with escaped spaces shouldn't match the names without the spaces
 fails-if(gtkWidget) == familyname-escapedidents.html familyname-escapedidents-ref.html # bug 1309425, bug 1328771
@ -86,7 +86,7 @@ fuzzy-if(OSX==1010&&browserIsRemote,1,23) == weightmapping-12.html weightmapping
 == weightmapping-7.html weightmapping-7-ref.html
 fuzzy-if(OSX==1010,1,30) == weightmapping-12579.html weightmapping-12579-ref.html

-== stretchmapping-all.html stretchmapping-all-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == stretchmapping-all.html stretchmapping-all-ref.html
 == stretchmapping-reverse.html stretchmapping-reverse-ref.html
 fuzzy-if(OSX==1010&&browserIsRemote,1,17) fuzzy-if(Android,4,8) == stretchmapping-35.html stretchmapping-35-ref.html
 fuzzy-if(OSX==1010,3,5) == stretchmapping-137.html stretchmapping-137-ref.html
--- a/layout/reftests/mathml/reftest.list
+++ b/layout/reftests/mathml/reftest.list
@ -37,7 +37,7 @@ random-if(smallScreen&&Android) fuzzy(255,200) fuzzy-if(webrender&&!gtkWidget,11
 == mfenced-5b.xhtml mfenced-5-ref.xhtml
 == mfenced-5c.xhtml mfenced-5-ref.xhtml
 == mfenced-5d.xhtml mfenced-5-ref.xhtml
-== mfenced-6.html mfenced-6-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == mfenced-6.html mfenced-6-ref.html
 == mfenced-7.html mfenced-7-ref.html
 != mfenced-8.html mfenced-8-ref.html
 == mfenced-9.html mfenced-9-ref.html
--- a/layout/reftests/svg/reftest.list
+++ b/layout/reftests/svg/reftest.list
@ -159,7 +159,7 @@ fuzzy-if(d2d&&layersGPUAccelerated,3,1200) == dynamic-rect-02.svg dynamic-rect-0
 == dynamic-stroke-opacity-01.svg pass.svg
 == dynamic-stroke-width-01.svg pass.svg
 == dynamic-switch-01.svg pass.svg
-== dynamic-text-01.svg dynamic-text-01-ref.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == dynamic-text-01.svg dynamic-text-01-ref.svg
 fuzzy-if(d2d&&layersGPUAccelerated,3,12739) == dynamic-text-02.svg dynamic-text-02-ref.svg # bug 776038 for Win7, Win8
 fuzzy-if(d2d&&layersGPUAccelerated,2,10539) == dynamic-text-03.svg dynamic-text-03-ref.svg # bug 776038 for Win7
 fuzzy-if(/^Windows\x20NT\x206\.1/.test(http.oscpu),47,89) == dynamic-text-04.svg dynamic-text-04-ref.svg # bug 776038 for Win7
@ -495,14 +495,14 @@ fuzzy-if(skiaContent,1,610) == textPath-03.svg pass.svg
 == tspan-dxdy-05.svg tspan-dxdy-ref.svg
 == tspan-dxdy-06.svg tspan-dxdy-ref.svg
 == tspan-dxdy-textPath-01.svg tspan-dxdy-textPath-01-ref.svg
-== tspan-rotate-01.svg tspan-rotate-ref.svg
-fuzzy-if(skiaContent,1,550) == tspan-rotate-02.svg tspan-rotate-02.svg
-fuzzy-if(skiaContent,1,550) == tspan-rotate-02.svg tspan-rotate-02-ref.svg
-fuzzy-if(skiaContent,1,550) == tspan-rotate-03.svg tspan-rotate-ref.svg
-fuzzy-if(skiaContent,1,550) == tspan-rotate-04.svg tspan-rotate-04.svg
-fuzzy-if(skiaContent,1,550) == tspan-rotate-04.svg tspan-rotate-04-ref.svg
-fuzzy-if(skiaContent,1,550) == tspan-rotate-05.svg tspan-rotate-ref.svg
-fuzzy-if(skiaContent,1,550) == tspan-rotate-06.svg tspan-rotate-ref.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == tspan-rotate-01.svg tspan-rotate-ref.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) fuzzy-if(skiaContent,1,550) == tspan-rotate-02.svg tspan-rotate-02.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) fuzzy-if(skiaContent,1,550) == tspan-rotate-02.svg tspan-rotate-02-ref.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) fuzzy-if(skiaContent,1,550) == tspan-rotate-03.svg tspan-rotate-ref.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) fuzzy-if(skiaContent,1,550) == tspan-rotate-04.svg tspan-rotate-04.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) fuzzy-if(skiaContent,1,550) == tspan-rotate-04.svg tspan-rotate-04-ref.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) fuzzy-if(skiaContent,1,550) == tspan-rotate-05.svg tspan-rotate-ref.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) fuzzy-if(skiaContent,1,550) == tspan-rotate-06.svg tspan-rotate-ref.svg
 == tspan-rotate-07.svg tspan-rotate-07-ref.svg
 == tspan-rotate-textPath-01.svg tspan-rotate-textPath-01-ref.svg
 fuzzy-if(skiaContent,1,100) == tspan-xy-01.svg tspan-xy-ref.svg
--- a/layout/reftests/svg/smil/reftest.list
+++ b/layout/reftests/svg/smil/reftest.list
@ -165,7 +165,7 @@ fuzzy-if(Android,4,1) == anim-svg-viewBox-01.svg lime.svg
 == anim-paintserver-1.svg anim-paintserver-1-ref.svg

 # animate attributes on text content children
-== anim-text-attr-01.svg anim-text-attr-01-ref.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == anim-text-attr-01.svg anim-text-attr-01-ref.svg

 # animate where the base value is non-interpolatable but will be replaced anyway
 == anim-fill-overpaintserver-1.svg lime.svg
@ -207,7 +207,7 @@ fails == anim-strokecolor-1.svg anim-standard-ref.svg # bug 436296
 == anim-targethref-9.svg anim-standard-ref.svg
 == anim-targethref-10.svg anim-standard-ref.svg

-== anim-text-rotate-01.svg anim-text-rotate-01-ref.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == anim-text-rotate-01.svg anim-text-rotate-01-ref.svg
 == anim-feFuncR-tableValues-01.svg anim-feFuncR-tableValues-01-ref.svg

 skip == anim-text-x-y-dx-dy-01.svg anim-text-x-y-dx-dy-01-ref.svg # bug 579588
--- a/layout/reftests/svg/smil/set/reftest.list
+++ b/layout/reftests/svg/smil/set/reftest.list
@ -1,2 +1,2 @@
-== set-css-fontsize-freeze-1.svg set-css-fontsize-freeze-1-ref.svg
-== set-css-fontsize-remove-1.svg set-css-fontsize-remove-1-ref.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == set-css-fontsize-freeze-1.svg set-css-fontsize-freeze-1-ref.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == set-css-fontsize-remove-1.svg set-css-fontsize-remove-1-ref.svg
--- a/layout/reftests/svg/smil/style/reftest.list
+++ b/layout/reftests/svg/smil/style/reftest.list
@ -71,12 +71,12 @@ fuzzy-if(skiaContent,1,365) == anim-css-fillopacity-3-clamp-small.svg   anim-css

 # 'font-size' property, from/by/to with pixel values only
 == anim-css-fontsize-1-from-by-px-px.svg    anim-css-fontsize-1-ref.svg
-== anim-css-fontsize-1-from-to-px-px.svg    anim-css-fontsize-1-ref.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == anim-css-fontsize-1-from-to-px-px.svg    anim-css-fontsize-1-ref.svg

 # 'font-size' property (accepts unitless values)
-== anim-css-fontsize-1-from-to-no-no.svg    anim-css-fontsize-1-ref.svg
-== anim-css-fontsize-1-from-to-no-px.svg    anim-css-fontsize-1-ref.svg
-== anim-css-fontsize-1-from-to-px-no.svg    anim-css-fontsize-1-ref.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == anim-css-fontsize-1-from-to-no-no.svg    anim-css-fontsize-1-ref.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == anim-css-fontsize-1-from-to-no-px.svg    anim-css-fontsize-1-ref.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == anim-css-fontsize-1-from-to-px-no.svg    anim-css-fontsize-1-ref.svg

 # 'font-size' mapped attribute (accepts unitless values)
 == anim-mapped-fontsize-1-from-to-no-no.svg anim-css-fontsize-1-ref.svg
@ -87,9 +87,9 @@ fuzzy-if(skiaContent,1,365) == anim-css-fillopacity-3-clamp-small.svg   anim-css
 == anim-css-fontsize-1-from-by-pct-pct.svg  anim-css-fontsize-1-ref.svg
 == anim-css-fontsize-1-from-by-pct-px.svg   anim-css-fontsize-1-ref.svg
 == anim-css-fontsize-1-from-by-px-pct.svg   anim-css-fontsize-1-ref.svg
-== anim-css-fontsize-1-from-to-pct-pct.svg  anim-css-fontsize-1-ref.svg
-== anim-css-fontsize-1-from-to-pct-px.svg   anim-css-fontsize-1-ref.svg
-== anim-css-fontsize-1-from-to-px-pct.svg   anim-css-fontsize-1-ref.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == anim-css-fontsize-1-from-to-pct-pct.svg  anim-css-fontsize-1-ref.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == anim-css-fontsize-1-from-to-pct-px.svg   anim-css-fontsize-1-ref.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == anim-css-fontsize-1-from-to-px-pct.svg   anim-css-fontsize-1-ref.svg

 # 'font-size' property, with negative addition
 == anim-css-fontsize-2-from-by-px-px.svg    anim-css-fontsize-2-ref.svg
--- a/layout/reftests/svg/text/reftest.list
+++ b/layout/reftests/svg/text/reftest.list
@ -110,17 +110,17 @@ fuzzy-if(Android,242,81) == multiple-chunks-directions-and-anchor-multiple-dx.sv
 == simple-multiline-pc.svg simple-multiline-pc-ref.svg
 == simple-multiline-anchor-end.svg simple-multiline-anchor-end-ref.svg

-fuzzy-if(skiaContent,1,15) == textpath.svg textpath-ref.svg
-== textpath-a.svg textpath-a-ref.svg
-== textpath-anchor-middle.svg textpath-anchor-middle-ref.svg
-== textpath-anchor-end.svg textpath-anchor-end-ref.svg
-== textpath-invalid-parent.svg textpath-invalid-parent-ref.svg
-== textpath-multiline.svg textpath-multiline-ref.svg
-== textpath-multiline-2.svg textpath-multiline-2-ref.svg
-== textpath-after.svg textpath-after-ref.svg
-== textpath-after-anchor-end.svg textpath-after-anchor-end-ref.svg
-== textpath-reset-position.svg textpath-reset-position-ref.svg
-== textpath-inherit-position.svg textpath-inherit-position-ref.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) fuzzy-if(skiaContent,1,15) == textpath.svg textpath-ref.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == textpath-a.svg textpath-a-ref.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == textpath-anchor-middle.svg textpath-anchor-middle-ref.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == textpath-anchor-end.svg textpath-anchor-end-ref.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == textpath-invalid-parent.svg textpath-invalid-parent-ref.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == textpath-multiline.svg textpath-multiline-ref.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == textpath-multiline-2.svg textpath-multiline-2-ref.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == textpath-after.svg textpath-after-ref.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == textpath-after-anchor-end.svg textpath-after-anchor-end-ref.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == textpath-reset-position.svg textpath-reset-position-ref.svg
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == textpath-inherit-position.svg textpath-inherit-position-ref.svg

 == textLength.svg textLength-ref.svg
 fuzzy-if(skiaContent,1,200) == textLength-2.svg textLength-2-ref.svg
--- a/layout/reftests/text/reftest.list
+++ b/layout/reftests/text/reftest.list
@ -28,7 +28,7 @@ fails-if(cocoaWidget) == lineheight-metrics-1.html lineheight-metrics-1-ref.html
 == lineheight-metrics-2a.html lineheight-metrics-2-ref.html
 == lineheight-metrics-2b.html lineheight-metrics-2-ref.html
 == lineheight-percentage-1.html lineheight-percentage-1-ref.html
-== long-1.html long-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == long-1.html long-ref.html
 fuzzy-if(Android,255,325) == pre-line-1.html pre-line-1-ref.html
 == pre-line-2.html pre-line-2-ref.html
 == pre-line-3.html pre-line-3-ref.html
--- a/layout/reftests/w3c-css/failures.list
+++ b/layout/reftests/w3c-css/failures.list
@ -59,26 +59,26 @@ fails css-writing-modes/float-rgt-orthog-vrl-in-htb-003.xht
 fails css-writing-modes/sizing-orthog-htb-in-vrl-001.xht
 fails css-writing-modes/sizing-orthog-htb-in-vrl-004.xht
 fails css-writing-modes/sizing-orthog-htb-in-vrl-013.xht
-fails-if(OSX||winWidget||Android) css-writing-modes/sizing-orthog-htb-in-vlr-008.xht
-fails-if(OSX||winWidget||Android) css-writing-modes/sizing-orthog-htb-in-vlr-020.xht
-fails-if(OSX||winWidget||Android) css-writing-modes/sizing-orthog-htb-in-vrl-008.xht
-fails-if(OSX||winWidget||Android) css-writing-modes/sizing-orthog-htb-in-vrl-020.xht
-fuzzy-if(winWidget,255,648-713) css-writing-modes/sizing-orthog-vlr-in-htb-008.xht
-fuzzy-if(winWidget,255,648-713) css-writing-modes/sizing-orthog-vlr-in-htb-020.xht
-fuzzy-if(winWidget,255,648-713) css-writing-modes/sizing-orthog-vrl-in-htb-008.xht
-fuzzy-if(winWidget,255,648-713) css-writing-modes/sizing-orthog-vrl-in-htb-020.xht
-fails-if(Android) css-writing-modes/sizing-orthog-htb-in-vlr-003.xht
-fails-if(Android) css-writing-modes/sizing-orthog-htb-in-vlr-009.xht
-fails-if(Android) css-writing-modes/sizing-orthog-htb-in-vlr-015.xht
-fails-if(Android) css-writing-modes/sizing-orthog-htb-in-vlr-021.xht
-fails-if(Android) css-writing-modes/sizing-orthog-vlr-in-htb-003.xht
-fails-if(Android) css-writing-modes/sizing-orthog-vlr-in-htb-009.xht
-fails-if(Android) css-writing-modes/sizing-orthog-vlr-in-htb-015.xht
-fails-if(Android) css-writing-modes/sizing-orthog-vlr-in-htb-021.xht
-fails-if(Android) css-writing-modes/sizing-orthog-vrl-in-htb-003.xht
-fails-if(Android) css-writing-modes/sizing-orthog-vrl-in-htb-009.xht
-fails-if(Android) css-writing-modes/sizing-orthog-vrl-in-htb-015.xht
-fails-if(Android) css-writing-modes/sizing-orthog-vrl-in-htb-021.xht
+fails-if(OSX||winWidget||Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) css-writing-modes/sizing-orthog-htb-in-vlr-008.xht
+fails-if(OSX||winWidget||Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) css-writing-modes/sizing-orthog-htb-in-vlr-020.xht
+fails-if(OSX||winWidget||Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) css-writing-modes/sizing-orthog-htb-in-vrl-008.xht
+fails-if(OSX||winWidget||Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) css-writing-modes/sizing-orthog-htb-in-vrl-020.xht
+fuzzy-if(winWidget,255,648-713) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) css-writing-modes/sizing-orthog-vlr-in-htb-008.xht
+fuzzy-if(winWidget,255,648-713) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) css-writing-modes/sizing-orthog-vlr-in-htb-020.xht
+fuzzy-if(winWidget,255,648-713) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) css-writing-modes/sizing-orthog-vrl-in-htb-008.xht
+fuzzy-if(winWidget,255,648-713) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) css-writing-modes/sizing-orthog-vrl-in-htb-020.xht
+fails-if(Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) css-writing-modes/sizing-orthog-htb-in-vlr-003.xht
+fails-if(Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) css-writing-modes/sizing-orthog-htb-in-vlr-009.xht
+fails-if(Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) css-writing-modes/sizing-orthog-htb-in-vlr-015.xht
+fails-if(Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) css-writing-modes/sizing-orthog-htb-in-vlr-021.xht
+fails-if(Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) css-writing-modes/sizing-orthog-vlr-in-htb-003.xht
+fails-if(Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) css-writing-modes/sizing-orthog-vlr-in-htb-009.xht
+fails-if(Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) css-writing-modes/sizing-orthog-vlr-in-htb-015.xht
+fails-if(Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) css-writing-modes/sizing-orthog-vlr-in-htb-021.xht
+fails-if(Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) css-writing-modes/sizing-orthog-vrl-in-htb-003.xht
+fails-if(Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) css-writing-modes/sizing-orthog-vrl-in-htb-009.xht
+fails-if(Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) css-writing-modes/sizing-orthog-vrl-in-htb-015.xht
+fails-if(Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) css-writing-modes/sizing-orthog-vrl-in-htb-021.xht

 # Fuzzy
 fuzzy-if(OSX||winWidget,255,480)  css-writing-modes/abs-pos-non-replaced-v??-???.xht
@ -112,6 +112,7 @@ fuzzy-if(OSX||winWidget,226,960) fails-if(webrender&&cocoaWidget)  css-writing-m
 fuzzy-if(OSX||winWidget,223,720)  css-writing-modes/vertical-alignment-*.xht
 fuzzy-if(OSX||winWidget,153,612)  css-writing-modes/writing-mode-vertical-??-00?.*
 fuzzy(255,960) css-writing-modes/text-combine-upright-value-all-00?.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) css-writing-modes/text-combine-upright-compression-???.html

 # Bug 1167911
 skip css-writing-modes/abs-pos-non-replaced-icb-vlr-021.xht
--- a/layout/reftests/w3c-css/received/reftest.list
+++ b/layout/reftests/w3c-css/received/reftest.list
@ -917,22 +917,22 @@ fuzzy-if(OSX||winWidget,110,1200) == css-writing-modes/row-progression-vrl-004.x
 fuzzy-if(OSX||winWidget,110,1200) == css-writing-modes/row-progression-vrl-006.xht css-writing-modes/block-flow-direction-001-ref.xht
 fuzzy-if(OSX||winWidget,110,1200) == css-writing-modes/row-progression-vrl-008.xht css-writing-modes/block-flow-direction-001-ref.xht
 == css-writing-modes/sizing-orthog-htb-in-vlr-001.xht css-writing-modes/sizing-orthog-htb-in-vlr-001-ref.xht
-fails-if(Android) == css-writing-modes/sizing-orthog-htb-in-vlr-003.xht css-writing-modes/sizing-orthog-htb-in-vlr-003-ref.xht
+fails-if(Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == css-writing-modes/sizing-orthog-htb-in-vlr-003.xht css-writing-modes/sizing-orthog-htb-in-vlr-003-ref.xht
 == css-writing-modes/sizing-orthog-htb-in-vlr-004.xht css-writing-modes/sizing-orthog-htb-in-vlr-004-ref.xht
 == css-writing-modes/sizing-orthog-htb-in-vlr-006.xht css-writing-modes/sizing-orthog-htb-in-vlr-006-ref.xht
 == css-writing-modes/sizing-orthog-htb-in-vlr-007.xht css-writing-modes/sizing-orthog-htb-in-vlr-007-ref.xht
-fails-if(OSX||winWidget||Android) == css-writing-modes/sizing-orthog-htb-in-vlr-008.xht css-writing-modes/sizing-orthog-htb-in-vlr-008-ref.xht
-fails-if(Android) == css-writing-modes/sizing-orthog-htb-in-vlr-009.xht css-writing-modes/sizing-orthog-htb-in-vlr-003-ref.xht
+fails-if(OSX||winWidget||Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == css-writing-modes/sizing-orthog-htb-in-vlr-008.xht css-writing-modes/sizing-orthog-htb-in-vlr-008-ref.xht
+fails-if(Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == css-writing-modes/sizing-orthog-htb-in-vlr-009.xht css-writing-modes/sizing-orthog-htb-in-vlr-003-ref.xht
 == css-writing-modes/sizing-orthog-htb-in-vlr-010.xht css-writing-modes/sizing-orthog-htb-in-vlr-010-ref.xht
 == css-writing-modes/sizing-orthog-htb-in-vlr-011.xht css-writing-modes/sizing-orthog-htb-in-vlr-011-ref.xht
 == css-writing-modes/sizing-orthog-htb-in-vlr-012.xht css-writing-modes/sizing-orthog-htb-in-vlr-006-ref.xht
 == css-writing-modes/sizing-orthog-htb-in-vlr-013.xht css-writing-modes/sizing-orthog-htb-in-vlr-013-ref.xht
-fails-if(Android) == css-writing-modes/sizing-orthog-htb-in-vlr-015.xht css-writing-modes/sizing-orthog-htb-in-vlr-015-ref.xht
+fails-if(Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == css-writing-modes/sizing-orthog-htb-in-vlr-015.xht css-writing-modes/sizing-orthog-htb-in-vlr-015-ref.xht
 == css-writing-modes/sizing-orthog-htb-in-vlr-016.xht css-writing-modes/sizing-orthog-htb-in-vlr-016-ref.xht
 == css-writing-modes/sizing-orthog-htb-in-vlr-018.xht css-writing-modes/sizing-orthog-htb-in-vlr-018-ref.xht
 == css-writing-modes/sizing-orthog-htb-in-vlr-019.xht css-writing-modes/sizing-orthog-htb-in-vlr-019-ref.xht
-fails-if(OSX||winWidget||Android) == css-writing-modes/sizing-orthog-htb-in-vlr-020.xht css-writing-modes/sizing-orthog-htb-in-vlr-020-ref.xht
-fails-if(Android) == css-writing-modes/sizing-orthog-htb-in-vlr-021.xht css-writing-modes/sizing-orthog-htb-in-vlr-015-ref.xht
+fails-if(OSX||winWidget||Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == css-writing-modes/sizing-orthog-htb-in-vlr-020.xht css-writing-modes/sizing-orthog-htb-in-vlr-020-ref.xht
+fails-if(Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == css-writing-modes/sizing-orthog-htb-in-vlr-021.xht css-writing-modes/sizing-orthog-htb-in-vlr-015-ref.xht
 == css-writing-modes/sizing-orthog-htb-in-vlr-022.xht css-writing-modes/sizing-orthog-htb-in-vlr-022-ref.xht
 == css-writing-modes/sizing-orthog-htb-in-vlr-023.xht css-writing-modes/sizing-orthog-htb-in-vlr-023-ref.xht
 == css-writing-modes/sizing-orthog-htb-in-vlr-024.xht css-writing-modes/sizing-orthog-htb-in-vlr-018-ref.xht
@ -941,7 +941,7 @@ fails == css-writing-modes/sizing-orthog-htb-in-vrl-001.xht css-writing-modes/si
 fails == css-writing-modes/sizing-orthog-htb-in-vrl-004.xht css-writing-modes/sizing-orthog-htb-in-vlr-004-ref.xht
 == css-writing-modes/sizing-orthog-htb-in-vrl-006.xht css-writing-modes/sizing-orthog-htb-in-vrl-006-ref.xht
 == css-writing-modes/sizing-orthog-htb-in-vrl-007.xht css-writing-modes/sizing-orthog-htb-in-vrl-007-ref.xht
-fails-if(OSX||winWidget||Android) == css-writing-modes/sizing-orthog-htb-in-vrl-008.xht css-writing-modes/sizing-orthog-htb-in-vrl-008-ref.xht
+fails-if(OSX||winWidget||Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == css-writing-modes/sizing-orthog-htb-in-vrl-008.xht css-writing-modes/sizing-orthog-htb-in-vrl-008-ref.xht
 == css-writing-modes/sizing-orthog-htb-in-vrl-009.xht css-writing-modes/sizing-orthog-htb-in-vrl-003-ref.xht
 == css-writing-modes/sizing-orthog-htb-in-vrl-010.xht css-writing-modes/sizing-orthog-htb-in-vrl-010-ref.xht
 == css-writing-modes/sizing-orthog-htb-in-vrl-011.xht css-writing-modes/sizing-orthog-htb-in-vrl-011-ref.xht
@ -951,7 +951,7 @@ fails == css-writing-modes/sizing-orthog-htb-in-vrl-013.xht css-writing-modes/si
 == css-writing-modes/sizing-orthog-htb-in-vrl-016.xht css-writing-modes/sizing-orthog-htb-in-vlr-016-ref.xht
 == css-writing-modes/sizing-orthog-htb-in-vrl-018.xht css-writing-modes/sizing-orthog-htb-in-vrl-018-ref.xht
 == css-writing-modes/sizing-orthog-htb-in-vrl-019.xht css-writing-modes/sizing-orthog-htb-in-vrl-019-ref.xht
-fails-if(OSX||winWidget||Android) == css-writing-modes/sizing-orthog-htb-in-vrl-020.xht css-writing-modes/sizing-orthog-htb-in-vrl-020-ref.xht
+fails-if(OSX||winWidget||Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == css-writing-modes/sizing-orthog-htb-in-vrl-020.xht css-writing-modes/sizing-orthog-htb-in-vrl-020-ref.xht
 == css-writing-modes/sizing-orthog-htb-in-vrl-021.xht css-writing-modes/sizing-orthog-htb-in-vrl-015-ref.xht
 == css-writing-modes/sizing-orthog-htb-in-vrl-022.xht css-writing-modes/sizing-orthog-htb-in-vrl-022-ref.xht
 == css-writing-modes/sizing-orthog-htb-in-vrl-023.xht css-writing-modes/sizing-orthog-htb-in-vrl-023-ref.xht
@ -989,42 +989,42 @@ fails-if(OSX||winWidget||Android) == css-writing-modes/sizing-orthog-htb-in-vrl-
 == css-writing-modes/sizing-orthog-prct-vrl-in-htb-007.xht css-writing-modes/sizing-orthog-prct-vrl-in-htb-007-ref.xht
 == css-writing-modes/sizing-orthog-prct-vrl-in-htb-008.xht css-writing-modes/sizing-orthog-prct-vrl-in-htb-008-ref.xht
 == css-writing-modes/sizing-orthog-vlr-in-htb-001.xht css-writing-modes/sizing-orthog-vlr-in-htb-001-ref.xht
-fails-if(Android) == css-writing-modes/sizing-orthog-vlr-in-htb-003.xht css-writing-modes/sizing-orthog-vlr-in-htb-003-ref.xht
+fails-if(Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == css-writing-modes/sizing-orthog-vlr-in-htb-003.xht css-writing-modes/sizing-orthog-vlr-in-htb-003-ref.xht
 == css-writing-modes/sizing-orthog-vlr-in-htb-004.xht css-writing-modes/sizing-orthog-vlr-in-htb-004-ref.xht
 == css-writing-modes/sizing-orthog-vlr-in-htb-006.xht css-writing-modes/sizing-orthog-vlr-in-htb-006-ref.xht
 == css-writing-modes/sizing-orthog-vlr-in-htb-007.xht css-writing-modes/sizing-orthog-vlr-in-htb-007-ref.xht
-fuzzy-if(winWidget,255,648-713) == css-writing-modes/sizing-orthog-vlr-in-htb-008.xht css-writing-modes/sizing-orthog-vlr-in-htb-008-ref.xht
-fails-if(Android) == css-writing-modes/sizing-orthog-vlr-in-htb-009.xht css-writing-modes/sizing-orthog-vlr-in-htb-009-ref.xht
+fuzzy-if(winWidget,255,648-713) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == css-writing-modes/sizing-orthog-vlr-in-htb-008.xht css-writing-modes/sizing-orthog-vlr-in-htb-008-ref.xht
+fails-if(Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == css-writing-modes/sizing-orthog-vlr-in-htb-009.xht css-writing-modes/sizing-orthog-vlr-in-htb-009-ref.xht
 == css-writing-modes/sizing-orthog-vlr-in-htb-010.xht css-writing-modes/sizing-orthog-vlr-in-htb-010-ref.xht
 == css-writing-modes/sizing-orthog-vlr-in-htb-011.xht css-writing-modes/sizing-orthog-vlr-in-htb-011-ref.xht
 == css-writing-modes/sizing-orthog-vlr-in-htb-012.xht css-writing-modes/sizing-orthog-vlr-in-htb-012-ref.xht
 == css-writing-modes/sizing-orthog-vlr-in-htb-013.xht css-writing-modes/sizing-orthog-vlr-in-htb-013-ref.xht
-fails-if(Android) == css-writing-modes/sizing-orthog-vlr-in-htb-015.xht css-writing-modes/sizing-orthog-vlr-in-htb-015-ref.xht
+fails-if(Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == css-writing-modes/sizing-orthog-vlr-in-htb-015.xht css-writing-modes/sizing-orthog-vlr-in-htb-015-ref.xht
 == css-writing-modes/sizing-orthog-vlr-in-htb-016.xht css-writing-modes/sizing-orthog-vlr-in-htb-016-ref.xht
 == css-writing-modes/sizing-orthog-vlr-in-htb-018.xht css-writing-modes/sizing-orthog-vlr-in-htb-018-ref.xht
 == css-writing-modes/sizing-orthog-vlr-in-htb-019.xht css-writing-modes/sizing-orthog-vlr-in-htb-019-ref.xht
-fuzzy-if(winWidget,255,648-713) == css-writing-modes/sizing-orthog-vlr-in-htb-020.xht css-writing-modes/sizing-orthog-vlr-in-htb-020-ref.xht
-fails-if(Android) == css-writing-modes/sizing-orthog-vlr-in-htb-021.xht css-writing-modes/sizing-orthog-vlr-in-htb-015-ref.xht
+fuzzy-if(winWidget,255,648-713) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == css-writing-modes/sizing-orthog-vlr-in-htb-020.xht css-writing-modes/sizing-orthog-vlr-in-htb-020-ref.xht
+fails-if(Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == css-writing-modes/sizing-orthog-vlr-in-htb-021.xht css-writing-modes/sizing-orthog-vlr-in-htb-015-ref.xht
 == css-writing-modes/sizing-orthog-vlr-in-htb-022.xht css-writing-modes/sizing-orthog-vlr-in-htb-022-ref.xht
 == css-writing-modes/sizing-orthog-vlr-in-htb-023.xht css-writing-modes/sizing-orthog-vlr-in-htb-023-ref.xht
 == css-writing-modes/sizing-orthog-vlr-in-htb-024.xht css-writing-modes/sizing-orthog-vlr-in-htb-018-ref.xht
 == css-writing-modes/sizing-orthog-vrl-in-htb-001.xht css-writing-modes/sizing-orthog-vrl-in-htb-001-ref.xht
-fails-if(Android) == css-writing-modes/sizing-orthog-vrl-in-htb-003.xht css-writing-modes/sizing-orthog-vrl-in-htb-003-ref.xht
+fails-if(Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == css-writing-modes/sizing-orthog-vrl-in-htb-003.xht css-writing-modes/sizing-orthog-vrl-in-htb-003-ref.xht
 == css-writing-modes/sizing-orthog-vrl-in-htb-004.xht css-writing-modes/sizing-orthog-vrl-in-htb-004-ref.xht
 == css-writing-modes/sizing-orthog-vrl-in-htb-006.xht css-writing-modes/sizing-orthog-vrl-in-htb-006-ref.xht
 == css-writing-modes/sizing-orthog-vrl-in-htb-007.xht css-writing-modes/sizing-orthog-vrl-in-htb-007-ref.xht
-fuzzy-if(winWidget,255,648-713) == css-writing-modes/sizing-orthog-vrl-in-htb-008.xht css-writing-modes/sizing-orthog-vrl-in-htb-008-ref.xht
-fails-if(Android) == css-writing-modes/sizing-orthog-vrl-in-htb-009.xht css-writing-modes/sizing-orthog-vrl-in-htb-009-ref.xht
+fuzzy-if(winWidget,255,648-713) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == css-writing-modes/sizing-orthog-vrl-in-htb-008.xht css-writing-modes/sizing-orthog-vrl-in-htb-008-ref.xht
+fails-if(Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == css-writing-modes/sizing-orthog-vrl-in-htb-009.xht css-writing-modes/sizing-orthog-vrl-in-htb-009-ref.xht
 == css-writing-modes/sizing-orthog-vrl-in-htb-010.xht css-writing-modes/sizing-orthog-vrl-in-htb-010-ref.xht
 == css-writing-modes/sizing-orthog-vrl-in-htb-011.xht css-writing-modes/sizing-orthog-vrl-in-htb-011-ref.xht
 == css-writing-modes/sizing-orthog-vrl-in-htb-012.xht css-writing-modes/sizing-orthog-vrl-in-htb-012-ref.xht
 == css-writing-modes/sizing-orthog-vrl-in-htb-013.xht css-writing-modes/sizing-orthog-vrl-in-htb-013-ref.xht
-fails-if(Android) == css-writing-modes/sizing-orthog-vrl-in-htb-015.xht css-writing-modes/sizing-orthog-vrl-in-htb-015-ref.xht
+fails-if(Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == css-writing-modes/sizing-orthog-vrl-in-htb-015.xht css-writing-modes/sizing-orthog-vrl-in-htb-015-ref.xht
 == css-writing-modes/sizing-orthog-vrl-in-htb-016.xht css-writing-modes/sizing-orthog-vrl-in-htb-016-ref.xht
 == css-writing-modes/sizing-orthog-vrl-in-htb-018.xht css-writing-modes/sizing-orthog-vrl-in-htb-018-ref.xht
 == css-writing-modes/sizing-orthog-vrl-in-htb-019.xht css-writing-modes/sizing-orthog-vrl-in-htb-019-ref.xht
-fuzzy-if(winWidget,255,648-713) == css-writing-modes/sizing-orthog-vrl-in-htb-020.xht css-writing-modes/sizing-orthog-vrl-in-htb-020-ref.xht
-fails-if(Android) == css-writing-modes/sizing-orthog-vrl-in-htb-021.xht css-writing-modes/sizing-orthog-vrl-in-htb-015-ref.xht
+fuzzy-if(winWidget,255,648-713) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == css-writing-modes/sizing-orthog-vrl-in-htb-020.xht css-writing-modes/sizing-orthog-vrl-in-htb-020-ref.xht
+fails-if(Android) random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == css-writing-modes/sizing-orthog-vrl-in-htb-021.xht css-writing-modes/sizing-orthog-vrl-in-htb-015-ref.xht
 == css-writing-modes/sizing-orthog-vrl-in-htb-022.xht css-writing-modes/sizing-orthog-vrl-in-htb-022-ref.xht
 == css-writing-modes/sizing-orthog-vrl-in-htb-023.xht css-writing-modes/sizing-orthog-vrl-in-htb-023-ref.xht
 == css-writing-modes/sizing-orthog-vrl-in-htb-024.xht css-writing-modes/sizing-orthog-vrl-in-htb-018-ref.xht
--- a/layout/reftests/w3c-css/submitted/flexbox/reftest.list
+++ b/layout/reftests/w3c-css/submitted/flexbox/reftest.list
@ -4,7 +4,7 @@
 == flexbox-abspos-child-002.html flexbox-abspos-child-002-ref.html

 # Tests for handling anonymous flex items
-fuzzy-if(Android,225,116) == flexbox-anonymous-items-001.html flexbox-anonymous-items-001-ref.html
+== flexbox-anonymous-items-001.html flexbox-anonymous-items-001-ref.html

 # Tests for alignment of flex lines (align-content property)
 == flexbox-align-content-horiz-001a.xhtml flexbox-align-content-horiz-001-ref.xhtml
--- a/layout/reftests/writing-mode/reftest.list
+++ b/layout/reftests/writing-mode/reftest.list
@ -138,7 +138,7 @@ test-pref(dom.meta-viewport.enabled,true) test-pref(font.size.inflation.emPerLin
 == 1156021-text-indent-percent.html 1156021-text-indent-percent-ref.html
 == 1157752-upright-bidi.html 1157752-upright-bidi-ref.html
 == 1157758-1-vertical-arabic.html 1157758-1-vertical-arabic-ref.html
-== 1158549-1-vertical-block-size-constraints.html 1158549-1-vertical-block-size-constraints-ref.html
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == 1158549-1-vertical-block-size-constraints.html 1158549-1-vertical-block-size-constraints-ref.html
 == 1163238-orthogonal-auto-margins.html 1163238-orthogonal-auto-margins-ref.html
 == 1174450-intrinsic-sizing.html 1174450-intrinsic-sizing-ref.html
 skip-if(winWidget&&/^Windows\x20NT\x206\.1/.test(http.oscpu)) == 1175789-underline-overline-1.html 1175789-underline-overline-1-ref.html # bug 1442637
--- a/layout/reftests/xul/reftest.list
+++ b/layout/reftests/xul/reftest.list
@ -11,7 +11,7 @@ fails-if(cocoaWidget) fuzzy-if(xulRuntime.widgetToolkit=="gtk3",1,11) == tree-ro
 skip-if(!cocoaWidget) fails-if(webrender&&cocoaWidget) == mac-tab-toolbar.xul mac-tab-toolbar-ref.xul
 != tree-row-outline-1.xul tree-row-outline-1-notref.xul
 == text-crop.xul text-crop-ref.xul
-== text-small-caps-1.xul text-small-caps-1-ref.xul
+random-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == text-small-caps-1.xul text-small-caps-1-ref.xul
 fuzzy-if(skiaContent,1,60) fuzzy-if(cocoaWidget&&browserIsRemote&&!skiaContent,1,31) fuzzy-if(winWidget&&browserIsRemote&&layersGPUAccelerated,1,50) == inactive-fixed-bg-bug1205630.xul inactive-fixed-bg-bug1205630-ref.html
 fuzzy-if(skiaContent,1,60) fuzzy-if(cocoaWidget&&browserIsRemote&&!skiaContent,1,31) fuzzy-if(winWidget&&browserIsRemote&&layersGPUAccelerated,1,50) == inactive-fixed-bg-bug1272525.xul inactive-fixed-bg-bug1272525-ref.html

--- a/memory/replace/dmd/test/xpcshell.ini
+++ b/memory/replace/dmd/test/xpcshell.ini
@ -29,7 +29,6 @@ support-files =
  script-diff-dark-matter2.json
  script-diff-dark-matter-expected.txt

-# Bug 1077230 explains why this test is disabled on Mac 10.6.
 [test_dmd.js]
 dmd = true
-skip-if = !(os=='linux' || os=='win' || (os=='mac' && os_version!='10.6'))
+skip-if = !(os=='linux' || os=='win' || os=='mac')
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@ -62,8 +62,8 @@ pref("browser.cache.memory.max_entry_size",  5120);
 // (priority) like html, css, fonts and js, and one for other data like images,
 // video, etc.
 // Note: 0 means no limit.
-pref("browser.cache.disk.max_chunks_memory_usage", 10240);
-pref("browser.cache.disk.max_priority_chunks_memory_usage", 10240);
+pref("browser.cache.disk.max_chunks_memory_usage", 40960);
+pref("browser.cache.disk.max_priority_chunks_memory_usage", 40960);

 pref("browser.cache.disk_cache_ssl",        true);
 // 0 = once-per-session, 1 = each-time, 2 = never, 3 = when-appropriate/automatically
--- a/netwerk/cache2/CacheFileIOManager.cpp
+++ b/netwerk/cache2/CacheFileIOManager.cpp
@ -52,10 +52,11 @@ namespace net {
 #define kSmartSizeUpdateInterval 60000 // in milliseconds

 #ifdef ANDROID
-const uint32_t kMaxCacheSizeKB = 200*1024; // 200 MB
+const uint32_t kMaxCacheSizeKB = 512*1024; // 512 MB
 #else
-const uint32_t kMaxCacheSizeKB = 350*1024; // 350 MB
+const uint32_t kMaxCacheSizeKB = 1024*1024; // 1 GB
 #endif
+const uint32_t kMaxClearOnShutdownCacheSizeKB = 150*1024; // 150 MB

 bool
 CacheFileHandle::DispatchRelease()
@ -4168,10 +4169,16 @@ CacheFileIOManager::SyncRemoveAllCacheFiles()
 static uint32_t
 SmartCacheSize(const uint32_t availKB)
 {
-  uint32_t maxSize = kMaxCacheSizeKB;
+  uint32_t maxSize;

-  if (availKB > 100 * 1024 * 1024) {
-    return maxSize;  // skip computing if we're over 100 GB
+  if (CacheObserver::ClearCacheOnShutdown()) {
+    maxSize = kMaxClearOnShutdownCacheSizeKB;
+  } else {
+    maxSize = kMaxCacheSizeKB;
+  }
+
+  if (availKB > 25 * 1024 * 1024) {
+    return maxSize;  // skip computing if we're over 25 GB
  }

  // Grow/shrink in 10 MB units, deliberately, so that in the common case we
@ -4180,19 +4187,14 @@ SmartCacheSize(const uint32_t availKB)
  uint32_t sz10MBs = 0;
  uint32_t avail10MBs = availKB / (1024*10);

-  // .5% of space above 25 GB
-  if (avail10MBs > 2500) {
-    sz10MBs += static_cast<uint32_t>((avail10MBs - 2500)*.005);
-    avail10MBs = 2500;
-  }
-  // 1% of space between 7GB -> 25 GB
+  // 2.5% of space above 7GB
  if (avail10MBs > 700) {
-    sz10MBs += static_cast<uint32_t>((avail10MBs - 700)*.01);
+    sz10MBs += static_cast<uint32_t>((avail10MBs - 700)*.025);
    avail10MBs = 700;
  }
-  // 5% of space between 500 MB -> 7 GB
+  // 7.5% of space between 500 MB -> 7 GB
  if (avail10MBs > 50) {
-    sz10MBs += static_cast<uint32_t>((avail10MBs - 50)*.05);
+    sz10MBs += static_cast<uint32_t>((avail10MBs - 50)*.075);
    avail10MBs = 50;
  }

@ -4201,11 +4203,11 @@ SmartCacheSize(const uint32_t availKB)
  // device owners may be sensitive to storage footprint: Use a smaller
  // percentage of available space and a smaller minimum.

-  // 20% of space up to 500 MB (10 MB min)
-  sz10MBs += std::max<uint32_t>(1, static_cast<uint32_t>(avail10MBs * .2));
+  // 16% of space up to 500 MB (10 MB min)
+  sz10MBs += std::max<uint32_t>(1, static_cast<uint32_t>(avail10MBs * .16));
 #else
-  // 40% of space up to 500 MB (50 MB min)
-  sz10MBs += std::max<uint32_t>(5, static_cast<uint32_t>(avail10MBs * .4));
+  // 30% of space up to 500 MB (50 MB min)
+  sz10MBs += std::max<uint32_t>(5, static_cast<uint32_t>(avail10MBs * .3));
 #endif

  return std::min<uint32_t>(maxSize, sz10MBs * 10 * 1024);
--- a/netwerk/cache2/CacheObserver.cpp
+++ b/netwerk/cache2/CacheObserver.cpp
@ -62,10 +62,10 @@ int32_t CacheObserver::sMaxMemoryEntrySize = kDefaultMaxMemoryEntrySize;
 static int32_t const kDefaultMaxDiskEntrySize = 50 * 1024; // 50 MB
 int32_t CacheObserver::sMaxDiskEntrySize = kDefaultMaxDiskEntrySize;

-static uint32_t const kDefaultMaxDiskChunksMemoryUsage = 10 * 1024; // 10MB
+static uint32_t const kDefaultMaxDiskChunksMemoryUsage = 40 * 1024; // 40MB
 uint32_t CacheObserver::sMaxDiskChunksMemoryUsage = kDefaultMaxDiskChunksMemoryUsage;

-static uint32_t const kDefaultMaxDiskPriorityChunksMemoryUsage = 10 * 1024; // 10MB
+static uint32_t const kDefaultMaxDiskPriorityChunksMemoryUsage = 40 * 1024; // 40MB
 uint32_t CacheObserver::sMaxDiskPriorityChunksMemoryUsage = kDefaultMaxDiskPriorityChunksMemoryUsage;

 static uint32_t const kDefaultCompressionLevel = 1;
--- a/netwerk/protocol/websocket/WebSocketChannelParent.cpp
+++ b/netwerk/protocol/websocket/WebSocketChannelParent.cpp
@ -283,6 +283,14 @@ void
 WebSocketChannelParent::ActorDestroy(ActorDestroyReason why)
 {
  LOG(("WebSocketChannelParent::ActorDestroy() %p\n", this));
+
+  // Make sure we close the channel if the content process dies without going
+  // through a clean shutdown.
+  if (mChannel) {
+    Unused << mChannel->Close(nsIWebSocketChannel::CLOSE_GOING_AWAY,
+                              NS_LITERAL_CSTRING("Child was killed"));
+  }
+
  mIPCOpen = false;
 }

--- a/taskcluster/taskgraph/util/perfile.py
+++ b/taskcluster/taskgraph/util/perfile.py
@ -10,6 +10,7 @@ import math
 from mozbuild.util import memoize
 from mozpack.path import match as mozpackmatch
 from mozversioncontrol import get_repository_object, InvalidRepoPath
+from subprocess import CalledProcessError
 from taskgraph import files_changed
 from .. import GECKO

@ -51,6 +52,8 @@ def perfile_number_of_chunks(try_task_config, head_repository, head_rev, type):
        changed_files.update(vcs.get_outgoing_files('AM'))
    except InvalidRepoPath:
        vcs = None
+    except CalledProcessError:
+        return 0

    if not changed_files:
        changed_files.update(files_changed.get_changed_files(head_repository,
--- a/testing/web-platform/meta/html/dom/dynamic-markup-insertion/document-write/contentType.window.js.ini
+++ b/testing/web-platform/meta/html/dom/dynamic-markup-insertion/document-write/contentType.window.js.ini
@ -1,8 +0,0 @@
-[contentType.window.html]
-  expected:
-    if debug and not webrender and e10s and (os == "linux") and (version == "Ubuntu 16.04") and (processor == "x86") and (bits == 32): CRASH
-    if debug and not webrender and not e10s and (os == "linux") and (version == "Ubuntu 16.04") and (processor == "x86") and (bits == 32): CRASH
-    if debug and not webrender and e10s and (os == "linux") and (version == "Ubuntu 16.04") and (processor == "x86_64") and (bits == 64): CRASH
-    if debug and not webrender and e10s and (os == "win") and (version == "6.1.7601") and (processor == "x86") and (bits == 32): CRASH
-    if debug and not webrender and e10s and (os == "win") and (version == "10.0.15063") and (processor == "x86_64") and (bits == 64): CRASH
-    if debug and not webrender and e10s and (os == "mac") and (version == "OS X 10.10.5") and (processor == "x86_64") and (bits == 64): CRASH