Backed out 6 changesets (bug 918828) for mass bustage on a CLOSED TREE.

Backed out changeset b59c02df792f (bug 918828) Backed out changeset 12e7deed1b17 (bug 918828) Backed out changeset b87ca498ea9a (bug 918828) Backed out changeset 621224c58e71 (bug 918828) Backed out changeset 4faff84eb1ba (bug 918828) Backed out changeset 3695c1c812a5 (bug 918828)
2014-09-16 17:26:34 -04:00 · 2014-09-16 17:26:34 -04:00 · 04eba7c166
--- a/addon-sdk/source/lib/sdk/util/iteration.js
+++ b/addon-sdk/source/lib/sdk/util/iteration.js
@ -7,9 +7,20 @@ module.metadata = {
  "stability": "experimental"
 };

-// Legacy binding for Symbol.iterator. (This export existed before Symbols were
-// implemented in the JS engine.)
-exports.iteratorSymbol = Symbol.iterator;
+// This is known as @@iterator in the ES6 spec.  Until it is bound to
+// some well-known name, find the @@iterator object by expecting it as
+// the first property accessed on a for-of iterable.
+const iteratorSymbol = (function() {
+  try {
+    for (var _ of Proxy.create({get: function(_, name) { throw name; } }))
+      break;
+  } catch (name) {
+    return name;
+  }
+  throw new TypeError;
+})();
+
+exports.iteratorSymbol = iteratorSymbol;

 // An adaptor that, given an object that is iterable with for-of, is
 // suitable for being bound to __iterator__ in order to make the object
--- a/browser/components/customizableui/CustomizableUI.jsm
+++ b/browser/components/customizableui/CustomizableUI.jsm
@ -2662,7 +2662,7 @@ this.CustomizableUI = {
   *     for (let window of CustomizableUI.windows) { ... }
   */
  windows: {
-    *[Symbol.iterator]() {
+    "@@iterator": function*() {
      for (let [window,] of gBuildWindows)
        yield window;
    }
--- a/browser/devtools/debugger/debugger-panes.js
+++ b/browser/devtools/debugger/debugger-panes.js
@ -3261,9 +3261,9 @@ LineResults.prototype = {
 /**
 * A generator-iterator over the global, source or line results.
 */
-GlobalResults.prototype[Symbol.iterator] =
-SourceResults.prototype[Symbol.iterator] =
-LineResults.prototype[Symbol.iterator] = function*() {
+GlobalResults.prototype["@@iterator"] =
+SourceResults.prototype["@@iterator"] =
+LineResults.prototype["@@iterator"] = function*() {
  yield* this._store;
 };

--- a/browser/devtools/framework/gDevTools.jsm
+++ b/browser/devtools/framework/gDevTools.jsm
@ -475,14 +475,14 @@ DevTools.prototype = {
    //   for (let [target, toolbox] of this._toolboxes) toolbox.destroy();
    // Is taken care of by the gDevToolsBrowser.forgetBrowserWindow
  },
-};

-/**
- * Iterator that yields each of the toolboxes.
- */
-Devtools.prototype[Symbol.iterator] = function*() {
-  for (let toolbox of this._toolboxes) {
-    yield toolbox;
+  /**
+   * Iterator that yields each of the toolboxes.
+   */
+  '@@iterator': function*() {
+    for (let toolbox of this._toolboxes) {
+      yield toolbox;
+    }
  }
 };

--- a/browser/devtools/shared/widgets/VariablesView.jsm
+++ b/browser/devtools/shared/widgets/VariablesView.jsm
@ -3056,10 +3056,10 @@ Property.prototype = Heritage.extend(Variable.prototype, {
 /**
 * A generator-iterator over the VariablesView, Scopes, Variables and Properties.
 */
-VariablesView.prototype[Symbol.iterator] =
-Scope.prototype[Symbol.iterator] =
-Variable.prototype[Symbol.iterator] =
-Property.prototype[Symbol.iterator] = function*() {
+VariablesView.prototype["@@iterator"] =
+Scope.prototype["@@iterator"] =
+Variable.prototype["@@iterator"] =
+Property.prototype["@@iterator"] = function*() {
  yield* this._store;
 };

--- a/browser/devtools/shared/widgets/ViewHelpers.jsm
+++ b/browser/devtools/shared/widgets/ViewHelpers.jsm
@ -1729,7 +1729,7 @@ this.WidgetMethods = {
 /**
 * A generator-iterator over all the items in this container.
 */
-Item.prototype[Symbol.iterator] =
-WidgetMethods[Symbol.iterator] = function*() {
+Item.prototype["@@iterator"] =
+WidgetMethods["@@iterator"] = function*() {
  yield* this._itemsByElement.values();
 };
--- a/content/html/content/test/test_formelements.html
+++ b/content/html/content/test/test_formelements.html
@ -32,7 +32,7 @@ names = [];
 for (var name in x) {
  names.push(name);
 }
-is(names.length, 9, "Should have 9 enumerated names");
+is(names.length, 10, "Should have 10 enumerated names");
 is(names[0], "0", "Enum entry 1");
 is(names[1], "1", "Enum entry 2");
 is(names[2], "2", "Enum entry 3");
@ -41,7 +41,8 @@ is(names[4], "4", "Enum entry 5");
 is(names[5], "something", "Enum entry 6");
 is(names[6], "namedItem", "Enum entry 7");
 is(names[7], "item", "Enum entry 8");
-is(names[8], "length", "Enum entry 9");
+is(names[8], "@@iterator", "Enum entry 9");
+is(names[9], "length", "Enum entry 10");

 names = Object.getOwnPropertyNames(x);
 is(names.length, 10, "Should have 10 items");
--- a/content/html/content/test/test_htmlcollection.html
+++ b/content/html/content/test/test_htmlcollection.html
@ -28,7 +28,7 @@ var names = [];
 for (var name in x) {
  names.push(name);
 }
-is(names.length, 8, "Should have 8 enumerated names");
+is(names.length, 9, "Should have 9 enumerated names");
 is(names[0], "0", "Enum entry 1")
 is(names[1], "1", "Enum entry 2")
 is(names[2], "2", "Enum entry 3")
@ -36,7 +36,8 @@ is(names[3], "3", "Enum entry 4")
 is(names[4], "something", "Enum entry 5")
 is(names[5], "item", "Enum entry 6")
 is(names[6], "namedItem", "Enum entry 7")
-is(names[7], "length", "Enum entry 8")
+is(names[7], "@@iterator", "Enum entry 8")
+is(names[8], "length", "Enum entry 9")

 names = Object.getOwnPropertyNames(x);
 is(names.length, 9, "Should have 9 items");
--- a/content/html/content/test/test_named_options.html
+++ b/content/html/content/test/test_named_options.html
@ -42,7 +42,7 @@ var names2 = [];
 for (var name in opt) {
  names2.push(name);
 }
-is(names2.length, 11, "Should have eleven enumerated names");
+is(names2.length, 12, "Should have twelve enumerated names");
 is(names2[0], "0", "Enum entry 1")
 is(names2[1], "1", "Enum entry 2")
 is(names2[2], "2", "Enum entry 3")
@ -54,6 +54,7 @@ is(names2[7], "length", "Enum entry 8")
 is(names2[8], "selectedIndex", "Enum entry 9")
 is(names2[9], "item", "Enum entry 10")
 is(names2[10], "namedItem", "Enum entry 11")
+is(names2[11], "@@iterator", "Enum entry 12")

 </script>
 </pre>
--- a/content/html/content/test/test_rowscollection.html
+++ b/content/html/content/test/test_rowscollection.html
@ -38,7 +38,7 @@ var names = [];
 for (var name in x) {
  names.push(name);
 }
-is(names.length, 10, "Should have 10 enumerated names");
+is(names.length, 11, "Should have 11 enumerated names");
 is(names[0], "0", "Enum entry 1")
 is(names[1], "1", "Enum entry 2")
 is(names[2], "2", "Enum entry 3")
@ -48,7 +48,8 @@ is(names[5], "5", "Enum entry 6")
 is(names[6], "something", "Enum entry 7")
 is(names[7], "item", "Enum entry 8")
 is(names[8], "namedItem", "Enum entry 9")
-is(names[9], "length", "Enum entry 10")
+is(names[9], "@@iterator", "Enum entry 10")
+is(names[10], "length", "Enum entry 11")

 names = Object.getOwnPropertyNames(x);
 is(names.length, 11, "Should have 11 items");
--- a/dom/bindings/BindingUtils.h
+++ b/dom/bindings/BindingUtils.h
@ -1661,12 +1661,10 @@ InitIds(JSContext* cx, const Prefable<Spec>* prefableSpecs, jsid* ids)
    // because this is only done once per application runtime.
    Spec* spec = prefableSpecs->specs;
    do {
-      if (!JS::PropertySpecNameIsSymbol(spec->name)) {
-        if (!InternJSString(cx, *ids++, spec->name)) {
-          return false;
-        }
+      if (!InternJSString(cx, *ids, spec->name)) {
+        return false;
      }
-    } while ((++spec)->name);
+    } while (++ids, (++spec)->name);

    // We ran out of ids for that pref.  Put a JSID_VOID in on the id
    // corresponding to the list terminator for the pref.
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@ -1942,7 +1942,7 @@ class PropertyDefiner:
                               getAvailableInTestFunc(interfaceMember),
                               descriptor.checkPermissionsIndicesForMembers.get(interfaceMember.identifier.name))

-    def generatePrefableArray(self, array, name, specFormatter, specTerminator,
+    def generatePrefableArray(self, array, name, specTemplate, specTerminator,
                              specType, getCondition, getDataTuple, doIdArrays):
        """
        This method generates our various arrays.
@ -1951,8 +1951,7 @@ class PropertyDefiner:

        name is the name as passed to generateArray

-        specFormatter is a function that takes a single argument, a tuple,
-          and returns a string, a spec array entry
+        specTemplate is a template for each entry of the spec array

        specTerminator is a terminator for the spec array (inserted every time
          our controlling pref changes and at the end of the array)
@ -1963,7 +1962,7 @@ class PropertyDefiner:
          returns the corresponding MemberCondition.

        getDataTuple is a callback function that takes an array entry and
-          returns a tuple suitable to be passed to specFormatter.
+          returns a tuple suitable for substitution into specTemplate.
        """

        # We want to generate a single list of specs, but with specTerminator
@ -2006,7 +2005,7 @@ class PropertyDefiner:
                switchToCondition(self, curCondition)
                lastCondition = curCondition
            # And the actual spec
-            specs.append(specFormatter(getDataTuple(member)))
+            specs.append(specTemplate % getDataTuple(member))
        specs.append(specTerminator)
        prefableSpecs.append("  { false, nullptr }")

@ -2280,15 +2279,9 @@ class MethodDefiner(PropertyDefiner):

            return (m["name"], accessor, jitinfo, m["length"], flags(m), selfHostedName)

-        def formatSpec(fields):
-            if fields[0].startswith("@@"):
-                fields = (fields[0][2:],) + fields[1:]
-                return '  JS_SYM_FNSPEC(%s, %s, %s, %s, %s, %s)' % fields
-            return '  JS_FNSPEC("%s", %s, %s, %s, %s, %s)' % fields
-
        return self.generatePrefableArray(
            array, name,
-            formatSpec,
+            '  JS_FNSPEC("%s", %s, %s, %s, %s, %s)',
            '  JS_FS_END',
            'JSFunctionSpec',
            condition, specData, doIdArrays)
@ -2391,7 +2384,7 @@ class AttrDefiner(PropertyDefiner):

        return self.generatePrefableArray(
            array, name,
-            lambda fields: '  { "%s", %s, %s, %s}' % fields,
+            '  { "%s", %s, %s, %s}',
            '  JS_PS_END',
            'JSPropertySpec',
            PropertyDefiner.getControllingCondition, specData, doIdArrays)
@ -2419,7 +2412,7 @@ class ConstDefiner(PropertyDefiner):

        return self.generatePrefableArray(
            array, name,
-            lambda fields: '  { "%s", %s }' % fields,
+            '  { "%s", %s }',
            '  { 0, JS::UndefinedValue() }',
            'ConstantSpec',
            PropertyDefiner.getControllingCondition, specData, doIdArrays)
--- a/js/src/builtin/Array.js
+++ b/js/src/builtin/Array.js
@ -678,7 +678,7 @@ function ArrayFrom(arrayLike, mapfn=undefined, thisArg=undefined) {
    var attrs = ATTR_CONFIGURABLE | ATTR_ENUMERABLE | ATTR_WRITABLE;

    // Steps 6-8.
-    var usingIterator = items[std_iterator];
+    var usingIterator = items["@@iterator"];
    if (usingIterator !== undefined) {
        // Steps 8.a-c.
        var A = IsConstructor(C) ? new C() : [];
--- a/js/src/builtin/MapObject.cpp
+++ b/js/src/builtin/MapObject.cpp
@ -876,7 +876,7 @@ const Class MapIteratorObject::class_ = {
 };

 const JSFunctionSpec MapIteratorObject::methods[] = {
-    JS_SELF_HOSTED_SYM_FN(iterator, "IteratorIdentity", 0, 0),
+    JS_SELF_HOSTED_FN("@@iterator", "IteratorIdentity", 0, 0),
    JS_FN("next", next, 0, 0),
    JS_FS_END
 };
@ -1074,8 +1074,7 @@ MapObject::initClass(JSContext *cx, JSObject *obj)

        // Define its alias.
        RootedValue funval(cx, ObjectValue(*fun));
-        RootedId iteratorId(cx, SYMBOL_TO_JSID(cx->wellKnownSymbols().iterator));
-        if (!JS_DefinePropertyById(cx, proto, iteratorId, funval, 0))
+        if (!JS_DefineProperty(cx, proto, js_std_iterator_str, funval, 0))
            return nullptr;
    }
    return proto;
@ -1525,7 +1524,7 @@ const Class SetIteratorObject::class_ = {
 };

 const JSFunctionSpec SetIteratorObject::methods[] = {
-    JS_SELF_HOSTED_SYM_FN(iterator, "IteratorIdentity", 0, 0),
+    JS_SELF_HOSTED_FN("@@iterator", "IteratorIdentity", 0, 0),
    JS_FN("next", next, 0, 0),
    JS_FS_END
 };
@ -1698,8 +1697,7 @@ SetObject::initClass(JSContext *cx, JSObject *obj)
        RootedValue funval(cx, ObjectValue(*fun));
        if (!JS_DefineProperty(cx, proto, "keys", funval, 0))
            return nullptr;
-        RootedId iteratorId(cx, SYMBOL_TO_JSID(cx->wellKnownSymbols().iterator));
-        if (!JS_DefinePropertyById(cx, proto, iteratorId, funval, 0))
+        if (!JS_DefineProperty(cx, proto, js_std_iterator_str, funval, 0))
            return nullptr;
    }
    return proto;
--- a/js/src/builtin/Utilities.js
+++ b/js/src/builtin/Utilities.js
@ -83,7 +83,7 @@ var std_WeakMap_clear = WeakMap.prototype.clear;
 var std_WeakMap_delete = WeakMap.prototype.delete;
 var std_Map_has = Map.prototype.has;
 var std_Set_has = Set.prototype.has;
-var std_iterator = Symbol.iterator;
+var std_iterator = '@@iterator'; // FIXME: Change to be a symbol.
 var std_StopIteration = StopIteration;
 var std_Map_iterator = Map.prototype[std_iterator];
 var std_Set_iterator = Set.prototype[std_iterator];
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@ -4657,9 +4657,9 @@ EmitIterator(ExclusiveContext *cx, BytecodeEmitter *bce)
    // Convert iterable to iterator.
    if (Emit1(cx, bce, JSOP_DUP) < 0)                          // OBJ OBJ
        return false;
-    if (Emit2(cx, bce, JSOP_SYMBOL, jsbytecode(JS::SymbolCode::iterator)) < 0) // OBJ OBJ @@ITERATOR
+    if (!EmitAtomOp(cx, cx->names().std_iterator, JSOP_CALLPROP, bce)) // OBJ @@ITERATOR
        return false;
-    if (!EmitElemOpBase(cx, bce, JSOP_CALLELEM))               // FN OBJ
+    if (Emit1(cx, bce, JSOP_SWAP) < 0)                         // @@ITERATOR OBJ
        return false;
    if (EmitCall(cx, bce, JSOP_CALL, 0) < 0)                   // ITER
        return false;
@ -5478,9 +5478,9 @@ EmitYieldStar(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *iter)
    // Convert iterable to iterator.
    if (Emit1(cx, bce, JSOP_DUP) < 0)                            // ITERABLE ITERABLE
        return false;
-    if (Emit2(cx, bce, JSOP_SYMBOL, jsbytecode(JS::SymbolCode::iterator)) < 0) // ITERABLE ITERABLE @@ITERATOR
+    if (!EmitAtomOp(cx, cx->names().std_iterator, JSOP_CALLPROP, bce)) // ITERABLE @@ITERATOR
        return false;
-    if (!EmitElemOpBase(cx, bce, JSOP_CALLELEM))                 // FN ITERABLE
+    if (Emit1(cx, bce, JSOP_SWAP) < 0)                           // @@ITERATOR ITERABLE
        return false;
    if (EmitCall(cx, bce, JSOP_CALL, 0, iter) < 0)               // ITER
        return false;
--- a/js/src/jit-test/lib/iteration.js
+++ b/js/src/jit-test/lib/iteration.js
@ -5,7 +5,8 @@

 load(libdir + "asserts.js");

-const std_iterator = Symbol.iterator;
+// FIXME: Import from std::iteration.
+const std_iterator = '@@iterator';

 if (typeof assertIteratorResult === 'undefined') {
    var assertIteratorResult = function assertIteratorResult(result, value, done) {
--- a/js/src/jit-test/tests/arguments/destructuring-exprbody.js
+++ b/js/src/jit-test/tests/arguments/destructuring-exprbody.js
@ -1,7 +1,7 @@
 // See bug 763313
 function f([a]) a
 var i = 0;
-var o = {[Symbol.iterator]: function () { i++; return {
+var o = {'@@iterator': function () { i++; return {
  next: function () { i++; return {value: 42, done: false}; }}}};
 assertEq(f(o), 42);
 assertEq(i, 2);
--- a/js/src/jit-test/tests/basic/expression-autopsy.js
+++ b/js/src/jit-test/tests/basic/expression-autopsy.js
@ -109,8 +109,8 @@ check("o[- (o)]");
 // A few one off tests
 check_one("6", (function () { 6() }), " is not a function");
 check_one("Array.prototype.reverse.call(...)", (function () { Array.prototype.reverse.call('123'); }), " is read-only");
-check_one("(intermediate value)[Symbol.iterator](...).next(...).value", function () { var [{ x }] = [null, {}]; }, " is null");
-check_one("(intermediate value)[Symbol.iterator](...).next(...).value", function () { ieval("let (x) { var [a, b, [c0, c1]] = [x, x, x]; }") }, " is undefined");
+check_one("(intermediate value)['@@iterator'](...).next(...).value", function () { var [{ x }] = [null, {}]; }, " is null");
+check_one("(intermediate value)['@@iterator'](...).next(...).value", function () { ieval("let (x) { var [a, b, [c0, c1]] = [x, x, x]; }") }, " is undefined");

 // Check fallback behavior
 assertThrowsInstanceOf(function () { for (let x of undefined) {} }, TypeError);
--- a/js/src/jit-test/tests/collections/WeakSet-error.js
+++ b/js/src/jit-test/tests/collections/WeakSet-error.js
@ -19,7 +19,7 @@ testMethod("add");
 testMethod("delete");
 testMethod("clear", false);

-assertThrowsInstanceOf(function() { new WeakSet({[Symbol.iterator]: 2}) }, TypeError);
-assertEq(typeof [][Symbol.iterator], "function");
+assertThrowsInstanceOf(function() { new WeakSet({"@@iterator": 2}) }, TypeError);
+assertEq(typeof []["@@iterator"], "function"); // Make sure we fail when @@iterator is removed

 assertThrowsInstanceOf(function() { WeakSet(); }, TypeError);
--- a/js/src/jit-test/tests/collections/iterator-proto-surfaces.js
+++ b/js/src/jit-test/tests/collections/iterator-proto-surfaces.js
@ -6,8 +6,8 @@ load(libdir + "iteration.js");
 function test(constructor) {
    var proto = Object.getPrototypeOf(constructor()[std_iterator]());
    var names = Object.getOwnPropertyNames(proto);
-    assertDeepEq(names, ['next']);
-    assertEq(proto.hasOwnProperty(std_iterator), true);
+    names.sort();
+    assertDeepEq(names, [std_iterator, 'next']);

    var desc = Object.getOwnPropertyDescriptor(proto, 'next');
    assertEq(desc.configurable, true);
--- a/js/src/jit-test/tests/for-of/array-jit.js
+++ b/js/src/jit-test/tests/for-of/array-jit.js
@ -1,6 +0,0 @@
-var arr = [1, 2, 3];
-var y = 0;
-for (var i = 0; i < 10; i++)
-    for (var x of arr)
-        y += x;
-assertEq(y, 60);
--- a/js/src/jit-test/tests/for-of/next-3.js
+++ b/js/src/jit-test/tests/for-of/next-3.js
@ -8,6 +8,6 @@ load(libdir + "asserts.js");
 load(libdir + "iteration.js");

 var g = newGlobal();
-g.eval("var it = [1, 2][Symbol.iterator]();");
+g.eval("var it = [1, 2]['" + std_iterator + "']();");
 assertIteratorNext(g.it, 1);
 assertThrowsInstanceOf([][std_iterator]().next.bind(g.it), TypeError)
--- a/js/src/jit-test/tests/for-of/semantics-08.js
+++ b/js/src/jit-test/tests/for-of/semantics-08.js
@ -3,8 +3,7 @@
 load(libdir + "iteration.js");

 var g = newGlobal();
-g.eval("var obj = {};\n" +
-       "obj[Symbol.iterator] = function () { return this; };\n" +
-       "obj.next = function () { return { done: true }; };\n");
-for (x of g.obj)
+var it = g.eval("({ '" + std_iterator + "': function () { return this; }, " +
+                "next: function () { return { done: true } } });");
+for (x of it)
    throw 'FAIL';
--- a/js/src/jit-test/tests/for-of/string-iterator-surfaces.js
+++ b/js/src/jit-test/tests/for-of/string-iterator-surfaces.js
@ -57,8 +57,7 @@ var iterProto = Object.getPrototypeOf(iter);
 assertEq(Object.getPrototypeOf(iterProto), Object.prototype);

 // Own properties for StringIterator.prototype: "next" and @@iterator
-arraysEqual(Object.getOwnPropertyNames(iterProto), ["next"]);
-assertEq(iterProto.hasOwnProperty(std_iterator), true);
+arraysEqual(Object.getOwnPropertyNames(iterProto).sort(), ["next", std_iterator].sort());

 // StringIterator.prototype[@@iterator] is a built-in function
 assertBuiltinFunction(iterProto, std_iterator, 0);
--- a/js/src/jit-test/tests/symbol/toNumber-2.js
+++ b/js/src/jit-test/tests/symbol/toNumber-2.js
@ -1,14 +0,0 @@
-// |jit-test| error: ReferenceError
-function eq(e, a) {
-    passed = (a == e);
-}
-function f(e, a) {
-    fail();
-    eq(e, a);
-}
-try {
-    f();
-} catch (exc1) {}
-eq(.1, .1);
-var sym = Symbol("method");
-evaluate("f(test, sym, 0)", {compileAndGo: true});
--- a/js/src/jit/BaselineCompiler.cpp
+++ b/js/src/jit/BaselineCompiler.cpp
@ -1258,15 +1258,6 @@ BaselineCompiler::emit_JSOP_STRING()
    return true;
 }

-bool
-BaselineCompiler::emit_JSOP_SYMBOL()
-{
-    unsigned which = GET_UINT8(pc);
-    JS::Symbol *sym = cx->runtime()->wellKnownSymbols->get(which);
-    frame.push(SymbolValue(sym));
-    return true;
-}
-
 typedef JSObject *(*DeepCloneObjectLiteralFn)(JSContext *, HandleObject, NewObjectKind);
 static const VMFunction DeepCloneObjectLiteralInfo =
    FunctionInfo<DeepCloneObjectLiteralFn>(DeepCloneObjectLiteral);
--- a/js/src/jit/BaselineCompiler.h
+++ b/js/src/jit/BaselineCompiler.h
@ -61,7 +61,6 @@ namespace jit {
    _(JSOP_UINT24)             \
    _(JSOP_DOUBLE)             \
    _(JSOP_STRING)             \
-    _(JSOP_SYMBOL)             \
    _(JSOP_OBJECT)             \
    _(JSOP_CALLSITEOBJ)        \
    _(JSOP_REGEXP)             \
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@ -2781,8 +2781,7 @@ JS_AlreadyHasOwnUCProperty(JSContext *cx, HandleObject obj, const char16_t *name
    return JS_AlreadyHasOwnPropertyById(cx, obj, id, foundp);
 }

-/*
- * Wrapper functions to create wrappers with no corresponding JSJitInfo from API
+/* Wrapper functions to create wrappers with no corresponding JSJitInfo from API
 * function arguments.
 */
 static JSPropertyOpWrapper
@ -2826,6 +2825,8 @@ DefinePropertyById(JSContext *cx, HandleObject obj, HandleId id, HandleValue val
        JS_ASSERT(!(attrs & (JSPROP_GETTER | JSPROP_SETTER)));
        JSFunction::Flags zeroFlags = JSAPIToJSFunctionFlags(0);

+        // We can't just use JS_NewFunctionById here because it assumes a
+        // string id.
        RootedAtom atom(cx, JSID_IS_ATOM(id) ? JSID_TO_ATOM(id) : nullptr);
        attrs &= ~JSPROP_NATIVE_ACCESSORS;
        if (getter) {
@ -2862,12 +2863,12 @@ DefinePropertyById(JSContext *cx, HandleObject obj, HandleId id, HandleValue val
    AssertHeapIsIdle(cx);
    CHECK_REQUEST(cx);
    assertSameCompartment(cx, obj, id, value,
-                          (attrs & JSPROP_GETTER)
-                          ? JS_FUNC_TO_DATA_PTR(JSObject *, getter)
-                          : nullptr,
-                          (attrs & JSPROP_SETTER)
-                          ? JS_FUNC_TO_DATA_PTR(JSObject *, setter)
-                          : nullptr);
+                            (attrs & JSPROP_GETTER)
+                            ? JS_FUNC_TO_DATA_PTR(JSObject *, getter)
+                            : nullptr,
+                            (attrs & JSPROP_SETTER)
+                            ? JS_FUNC_TO_DATA_PTR(JSObject *, setter)
+                            : nullptr);

    return JSObject::defineGeneric(cx, obj, id, value, getter, setter, attrs);
 }
@ -3011,22 +3012,30 @@ DefineProperty(JSContext *cx, HandleObject obj, const char *name, HandleValue va
    return DefinePropertyById(cx, obj, id, value, getter, setter, attrs, flags);
 }

+
 static bool
-DefineSelfHostedProperty(JSContext *cx, HandleObject obj, HandleId id,
-                         const char *getterName, const char *setterName,
-                         unsigned attrs, unsigned flags)
+DefineSelfHostedProperty(JSContext *cx,
+                         HandleObject obj,
+                         const char *name,
+                         const char *getterName,
+                         const char *setterName,
+                         unsigned attrs,
+                         unsigned flags)
 {
+    RootedAtom nameAtom(cx, Atomize(cx, name, strlen(name)));
+    if (!nameAtom)
+        return false;
+
    RootedAtom getterNameAtom(cx, Atomize(cx, getterName, strlen(getterName)));
    if (!getterNameAtom)
        return false;

-    RootedAtom name(cx, IdToFunctionName(cx, id));
-    if (!name)
-        return false;
-
    RootedValue getterValue(cx);
-    if (!cx->global()->getSelfHostedFunction(cx, getterNameAtom, name, 0, &getterValue))
+    if (!cx->global()->getSelfHostedFunction(cx, getterNameAtom, nameAtom,
+                                             0, &getterValue))
+    {
        return false;
+    }
    JS_ASSERT(getterValue.isObject() && getterValue.toObject().is<JSFunction>());
    RootedFunction getterFunc(cx, &getterValue.toObject().as<JSFunction>());
    JSPropertyOp getterOp = JS_DATA_TO_FUNC_PTR(PropertyOp, getterFunc.get());
@ -3038,16 +3047,19 @@ DefineSelfHostedProperty(JSContext *cx, HandleObject obj, HandleId id,
            return false;

        RootedValue setterValue(cx);
-        if (!cx->global()->getSelfHostedFunction(cx, setterNameAtom, name, 0, &setterValue))
+        if (!cx->global()->getSelfHostedFunction(cx, setterNameAtom, nameAtom,
+                                                 0, &setterValue))
+        {
            return false;
+        }
        JS_ASSERT(setterValue.isObject() && setterValue.toObject().is<JSFunction>());
        setterFunc = &getterValue.toObject().as<JSFunction>();
    }
    JSStrictPropertyOp setterOp = JS_DATA_TO_FUNC_PTR(StrictPropertyOp, setterFunc.get());

-    return DefinePropertyById(cx, obj, id, JS::UndefinedHandleValue,
-                              GetterWrapper(getterOp), SetterWrapper(setterOp),
-                              attrs, flags);
+    return DefineProperty(cx, obj, name, JS::UndefinedHandleValue,
+                          GetterWrapper(getterOp), SetterWrapper(setterOp),
+                          attrs, flags);
 }

 JS_PUBLIC_API(bool)
@ -3244,69 +3256,46 @@ JS_DefineConstIntegers(JSContext *cx, HandleObject obj, const JSConstIntegerSpec
    return DefineConstScalar(cx, obj, cis);
 }

-static bool
-PropertySpecNameToId(JSContext *cx, const char *name, MutableHandleId id)
-{
-    if (JS::PropertySpecNameIsSymbol(name)) {
-        uintptr_t u = reinterpret_cast<uintptr_t>(name);
-        id.set(SYMBOL_TO_JSID(cx->wellKnownSymbols().get(u - 1)));
-    } else {
-        JSAtom *atom = Atomize(cx, name, strlen(name));
-        if (!atom)
-            return false;
-        id.set(AtomToId(atom));
-    }
-    return true;
-}
-
 JS_PUBLIC_API(bool)
 JS_DefineProperties(JSContext *cx, HandleObject obj, const JSPropertySpec *ps)
 {
-    RootedId id(cx);
-
-    for (; ps->name; ps++) {
-        if (!PropertySpecNameToId(cx, ps->name, &id))
-            return false;
-
+    bool ok;
+    for (ok = true; ps->name; ps++) {
        if (ps->flags & JSPROP_NATIVE_ACCESSORS) {
            // If you declare native accessors, then you should have a native
            // getter.
            JS_ASSERT(ps->getter.propertyOp.op);
-
            // If you do not have a self-hosted getter, you should not have a
            // self-hosted setter. This is the closest approximation to that
            // assertion we can have with our setup.
            JS_ASSERT_IF(ps->setter.propertyOp.info, ps->setter.propertyOp.op);

-            if (!DefinePropertyById(cx, obj, id, JS::UndefinedHandleValue,
-                                    ps->getter.propertyOp, ps->setter.propertyOp, ps->flags, 0))
-            {
-                return false;
-            }
+            ok = DefineProperty(cx, obj, ps->name, JS::UndefinedHandleValue,
+                                ps->getter.propertyOp, ps->setter.propertyOp, ps->flags, 0);
        } else {
            // If you have self-hosted getter/setter, you can't have a
            // native one.
            JS_ASSERT(!ps->getter.propertyOp.op && !ps->setter.propertyOp.op);
            JS_ASSERT(ps->flags & JSPROP_GETTER);
-
-            // During creation of the self-hosting global, we ignore all
-            // self-hosted properties, as that means we're currently setting up
-            // the global object that the self-hosted code is then compiled
-            // in. This means that self-hosted properties can't be used in the
-            // self-hosting global itself.
+            /*
+             * During creation of the self-hosting global, we ignore all
+             * self-hosted properties, as that means we're currently setting up
+             * the global object that the self-hosted code is then compiled
+             * in. That means that Self-hosted properties can't be used in the
+             * self-hosting global itself, right now.
+             */
            if (cx->runtime()->isSelfHostingGlobal(cx->global()))
                continue;

-            if (!DefineSelfHostedProperty(cx, obj, id,
+            ok = DefineSelfHostedProperty(cx, obj, ps->name,
                                          ps->getter.selfHosted.funname,
                                          ps->setter.selfHosted.funname,
-                                          ps->flags, 0))
-            {
-                return false;
-            }
+                                          ps->flags, 0);
        }
+        if (!ok)
+            break;
    }
-    return true;
+    return ok;
 }

 JS_PUBLIC_API(bool)
@ -3923,10 +3912,7 @@ JS::GetSelfHostedFunction(JSContext *cx, const char *selfHostedName, HandleId id
    AssertHeapIsIdle(cx);
    CHECK_REQUEST(cx);

-    RootedAtom name(cx, IdToFunctionName(cx, id));
-    if (!name)
-        return nullptr;
-
+    RootedAtom name(cx, JSID_TO_ATOM(id));
    RootedAtom shName(cx, Atomize(cx, selfHostedName, strlen(selfHostedName)));
    if (!shName)
        return nullptr;
@ -4080,11 +4066,21 @@ JS_DefineFunctions(JSContext *cx, HandleObject obj, const JSFunctionSpec *fs)
    CHECK_REQUEST(cx);
    assertSameCompartment(cx, obj);

-    RootedId id(cx);
    for (; fs->name; fs++) {
-        if (!PropertySpecNameToId(cx, fs->name, &id))
+        RootedAtom atom(cx);
+        // If the name starts with "@@", it must be a well-known symbol.
+        if (fs->name[0] != '@' || fs->name[1] != '@')
+            atom = Atomize(cx, fs->name, strlen(fs->name));
+        else if (strcmp(fs->name, "@@iterator") == 0)
+            // FIXME: This atom should be a symbol: bug 918828.
+            atom = cx->names().std_iterator;
+        else
+            JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_BAD_SYMBOL, fs->name);
+        if (!atom)
            return false;

+        Rooted<jsid> id(cx, AtomToId(atom));
+
        /*
         * Define a generic arity N+1 static method for the arity N prototype
         * method if flags contains JSFUN_GENERIC_NATIVE.
@ -4135,11 +4131,8 @@ JS_DefineFunctions(JSContext *cx, HandleObject obj, const JSFunctionSpec *fs)
            RootedAtom shName(cx, Atomize(cx, fs->selfHostedName, strlen(fs->selfHostedName)));
            if (!shName)
                return false;
-            RootedAtom name(cx, IdToFunctionName(cx, id));
-            if (!name)
-                return false;
            RootedValue funVal(cx);
-            if (!cx->global()->getSelfHostedFunction(cx, shName, name, fs->nargs, &funVal))
+            if (!cx->global()->getSelfHostedFunction(cx, shName, atom, fs->nargs, &funVal))
                return false;
            if (!JSObject::defineGeneric(cx, obj, id, funVal, nullptr, nullptr, flags))
                return false;
@ -5618,7 +5611,7 @@ JS::GetSymbolCode(Handle<Symbol*> symbol)
 JS_PUBLIC_API(JS::Symbol *)
 JS::GetWellKnownSymbol(JSContext *cx, JS::SymbolCode which)
 {
-    return cx->wellKnownSymbols().get(uint32_t(which));
+    return cx->runtime()->wellKnownSymbols->get(uint32_t(which));
 }

 JS_PUBLIC_API(bool)
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@ -2455,27 +2455,15 @@ struct JSFunctionSpec {
 * JSFUN_STUB_GSOPS. JS_FNINFO allows the simple adding of
 * JSJitInfos. JS_SELF_HOSTED_FN declares a self-hosted function. Finally
 * JS_FNSPEC has slots for all the fields.
- *
- * The _SYM variants allow defining a function with a symbol key rather than a
- * string key. For example, use JS_SYM_FN(iterator, ...) to define an
- * @@iterator method.
 */
 #define JS_FS(name,call,nargs,flags)                                          \
    JS_FNSPEC(name, call, nullptr, nargs, flags, nullptr)
 #define JS_FN(name,call,nargs,flags)                                          \
    JS_FNSPEC(name, call, nullptr, nargs, (flags) | JSFUN_STUB_GSOPS, nullptr)
-#define JS_SYM_FN(name,call,nargs,flags)                                      \
-    JS_SYM_FNSPEC(symbol, call, nullptr, nargs, (flags) | JSFUN_STUB_GSOPS, nullptr)
 #define JS_FNINFO(name,call,info,nargs,flags)                                 \
    JS_FNSPEC(name, call, info, nargs, flags, nullptr)
 #define JS_SELF_HOSTED_FN(name,selfHostedName,nargs,flags)                    \
    JS_FNSPEC(name, nullptr, nullptr, nargs, flags, selfHostedName)
-#define JS_SELF_HOSTED_SYM_FN(symbol, selfHostedName, nargs, flags)           \
-    JS_SYM_FNSPEC(symbol, nullptr, nullptr, nargs, flags, selfHostedName)
-#define JS_SYM_FNSPEC(symbol, call, info, nargs, flags, selfHostedName)       \
-    JS_FNSPEC(reinterpret_cast<const char *>(                                 \
-                  uint32_t(::JS::SymbolCode::symbol) + 1),                    \
-              call, info, nargs, flags, selfHostedName)
 #define JS_FNSPEC(name,call,info,nargs,flags,selfHostedName)                  \
    {name, {call, info}, nargs, flags, selfHostedName}

@ -4465,17 +4453,6 @@ GetSymbolCode(Handle<Symbol*> symbol);
 JS_PUBLIC_API(Symbol *)
 GetWellKnownSymbol(JSContext *cx, SymbolCode which);

-/*
- * Return true if the given JSPropertySpec::name or JSFunctionSpec::name value
- * is actually a symbol code and not a string. See JS_SYM_FN.
- */
-inline bool
-PropertySpecNameIsSymbol(const char *name)
-{
-    uintptr_t u = reinterpret_cast<uintptr_t>(name);
-    return u != 0 && u - 1 < WellKnownSymbolLimit;
-}
-
 } /* namespace JS */

 /************************************************************************/
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@ -3020,7 +3020,7 @@ static const JSFunctionSpec array_methods[] = {

    JS_SELF_HOSTED_FN("fill",        "ArrayFill",        3,0),

-    JS_SELF_HOSTED_SYM_FN(iterator,  "ArrayValues",      0,0),
+    JS_SELF_HOSTED_FN("@@iterator",  "ArrayValues",      0,0),
    JS_SELF_HOSTED_FN("entries",     "ArrayEntries",     0,0),
    JS_SELF_HOSTED_FN("keys",        "ArrayKeys",        0,0),
    JS_FS_END
--- a/js/src/jsatom.cpp
+++ b/js/src/jsatom.cpp
@ -157,7 +157,7 @@ JSRuntime::initializeAtoms(JSContext *cx)
    if (!wellKnownSymbols)
        return false;

-    ImmutablePropertyNamePtr *descriptions = commonNames->wellKnownSymbolDescriptions();
+    ImmutablePropertyNamePtr *descriptions = &commonNames->Symbol_iterator;
    ImmutableSymbolPtr *symbols = reinterpret_cast<ImmutableSymbolPtr *>(wellKnownSymbols);
    for (size_t i = 0; i < JS::WellKnownSymbolLimit; i++) {
        JS::Symbol *symbol = JS::Symbol::new_(cx, JS::SymbolCode(i), descriptions[i]);
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@ -284,7 +284,6 @@ struct ThreadSafeContext : ContextFriendFields,
    JSAtomState &names() { return *runtime_->commonNames; }
    StaticStrings &staticStrings() { return *runtime_->staticStrings; }
    AtomSet &permanentAtoms() { return *runtime_->permanentAtoms; }
-    WellKnownSymbols &wellKnownSymbols() { return *runtime_->wellKnownSymbols; }
    const JS::AsmJSCacheOps &asmJSCacheOps() { return runtime_->asmJSCacheOps; }
    PropertyName *emptyString() { return runtime_->emptyString; }
    FreeOp *defaultFreeOp() { return runtime_->defaultFreeOp(); }
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@ -2063,33 +2063,6 @@ js::CloneFunctionObject(JSContext *cx, HandleFunction fun, HandleObject parent,
    return cloneRoot;
 }

-/*
- * Return an atom for use as the name of a builtin method with the given
- * property id.
- *
- * Function names are always strings. If id is the well-known @@iterator
- * symbol, this returns "[Symbol.iterator]".
- *
- * Implements step 4 of SetFunctionName in ES6 draft rev 27 (24 Aug 2014).
- */
-JSAtom *
-js::IdToFunctionName(JSContext *cx, HandleId id)
-{
-    if (JSID_IS_ATOM(id))
-        return JSID_TO_ATOM(id);
-
-    if (JSID_IS_SYMBOL(id)) {
-        RootedAtom desc(cx, JSID_TO_SYMBOL(id)->description());
-        StringBuffer sb(cx);
-        if (!sb.append('[') || !sb.append(desc) || !sb.append(']'))
-            return nullptr;
-        return sb.finishAtom();
-    }
-
-    RootedValue idv(cx, IdToValue(id));
-    return ToAtom<CanGC>(cx, idv);
-}
-
 JSFunction *
 js::DefineFunction(JSContext *cx, HandleObject obj, HandleId id, Native native,
                   unsigned nargs, unsigned flags, AllocKind allocKind /* = FinalizeKind */,
@ -2097,6 +2070,9 @@ js::DefineFunction(JSContext *cx, HandleObject obj, HandleId id, Native native,
 {
    PropertyOp gop;
    StrictPropertyOp sop;
+
+    RootedFunction fun(cx);
+
    if (flags & JSFUN_STUB_GSOPS) {
        /*
         * JSFUN_STUB_GSOPS is a request flag only, not stored in fun->flags or
@ -2117,13 +2093,8 @@ js::DefineFunction(JSContext *cx, HandleObject obj, HandleId id, Native native,
        funFlags = JSFunction::INTERPRETED_LAZY;
    else
        funFlags = JSAPIToJSFunctionFlags(flags);
-
-    RootedAtom atom(cx, IdToFunctionName(cx, id));
-    if (!atom)
-        return nullptr;
-
-    RootedFunction fun(cx, NewFunction(cx, NullPtr(), native, nargs, funFlags, obj, atom,
-                                       allocKind, newKind));
+    RootedAtom atom(cx, JSID_IS_ATOM(id) ? JSID_TO_ATOM(id) : nullptr);
+    fun = NewFunction(cx, NullPtr(), native, nargs, funFlags, obj, atom, allocKind, newKind);
    if (!fun)
        return nullptr;

--- a/js/src/jsfun.h
+++ b/js/src/jsfun.h
@ -521,9 +521,6 @@ NewFunctionWithProto(ExclusiveContext *cx, HandleObject funobj, JSNative native,
                     JSObject *proto, gc::AllocKind allocKind = JSFunction::FinalizeKind,
                     NewObjectKind newKind = GenericObject);

-extern JSAtom *
-IdToFunctionName(JSContext *cx, HandleId id);
-
 extern JSFunction *
 DefineFunction(JSContext *cx, HandleObject obj, HandleId id, JSNative native,
               unsigned nargs, unsigned flags,
@ -572,6 +569,7 @@ CloneFunctionObject(JSContext *cx, HandleFunction fun, HandleObject parent,
                    gc::AllocKind kind = JSFunction::FinalizeKind,
                    NewObjectKind newKindArg = GenericObject);

+
 extern bool
 FindBody(JSContext *cx, HandleFunction fun, HandleLinearString src, size_t *bodyStart,
         size_t *bodyEnd);
@ -663,7 +661,7 @@ js_fun_apply(JSContext *cx, unsigned argc, js::Value *vp);
 extern bool
 js_fun_call(JSContext *cx, unsigned argc, js::Value *vp);

-extern JSObject *
+extern JSObject*
 js_fun_bind(JSContext *cx, js::HandleObject target, js::HandleValue thisArg,
            js::Value *boundArgs, unsigned argslen);

--- a/js/src/jsiter.cpp
+++ b/js/src/jsiter.cpp
@ -885,7 +885,7 @@ iterator_next(JSContext *cx, unsigned argc, Value *vp)
 }

 static const JSFunctionSpec iterator_methods[] = {
-    JS_SELF_HOSTED_SYM_FN(iterator, "LegacyIteratorShim", 0, 0),
+    JS_SELF_HOSTED_FN("@@iterator", "LegacyIteratorShim", 0, 0),
    JS_FN("next",      iterator_next,       0, 0),
    JS_FS_END
 };
@ -964,7 +964,7 @@ const Class ArrayIteratorObject::class_ = {
 };

 static const JSFunctionSpec array_iterator_methods[] = {
-    JS_SELF_HOSTED_SYM_FN(iterator, "ArrayIteratorIdentity", 0, 0),
+    JS_SELF_HOSTED_FN("@@iterator", "ArrayIteratorIdentity", 0, 0),
    JS_SELF_HOSTED_FN("next", "ArrayIteratorNext", 0, 0),
    JS_FS_END
 };
@ -1003,7 +1003,7 @@ const Class StringIteratorObject::class_ = {
 };

 static const JSFunctionSpec string_iterator_methods[] = {
-    JS_SELF_HOSTED_SYM_FN(iterator, "StringIteratorIdentity", 0, 0),
+    JS_SELF_HOSTED_FN("@@iterator", "StringIteratorIdentity", 0, 0),
    JS_SELF_HOSTED_FN("next", "StringIteratorNext", 0, 0),
    JS_FS_END
 };
@ -1405,8 +1405,7 @@ ForOfIterator::init(HandleValue iterable, NonIterableBehavior nonIterableBehavio
    args.setThis(ObjectValue(*iterableObj));

    RootedValue callee(cx);
-    RootedId iteratorId(cx, SYMBOL_TO_JSID(cx->wellKnownSymbols().iterator));
-    if (!JSObject::getGeneric(cx, iterableObj, iterableObj, iteratorId, &callee))
+    if (!JSObject::getProperty(cx, iterableObj, iterableObj, cx->names().std_iterator, &callee))
        return false;

    // Throw if obj[@@iterator] isn't callable if we were asked to do so.
@ -2015,14 +2014,14 @@ NativeMethod(JSContext *cx, unsigned argc, Value *vp)
 #define JS_METHOD(name, T, impl, len, attrs) JS_FN(name, (NativeMethod<T,impl>), len, attrs)

 static const JSFunctionSpec star_generator_methods[] = {
-    JS_SELF_HOSTED_SYM_FN(iterator, "IteratorIdentity", 0, 0),
+    JS_SELF_HOSTED_FN("@@iterator", "IteratorIdentity", 0, 0),
    JS_METHOD("next", StarGeneratorObject, star_generator_next, 1, 0),
    JS_METHOD("throw", StarGeneratorObject, star_generator_throw, 1, 0),
    JS_FS_END
 };

 static const JSFunctionSpec legacy_generator_methods[] = {
-    JS_SELF_HOSTED_SYM_FN(iterator, "LegacyGeneratorIteratorShim", 0, 0),
+    JS_SELF_HOSTED_FN("@@iterator", "LegacyGeneratorIteratorShim", 0, 0),
    // "send" is an alias for "next".
    JS_METHOD("next", LegacyGeneratorObject, legacy_generator_next, 1, JSPROP_ROPERM),
    JS_METHOD("send", LegacyGeneratorObject, legacy_generator_next, 1, JSPROP_ROPERM),
--- a/js/src/jsopcode.cpp
+++ b/js/src/jsopcode.cpp
@ -1540,13 +1540,6 @@ ExpressionDecompiler::decompilePC(jsbytecode *pc)
        return sprinter.printf("%d", GetBytecodeInteger(pc)) >= 0;
      case JSOP_STRING:
        return quote(loadAtom(pc), '"');
-      case JSOP_SYMBOL: {
-        unsigned i = uint8_t(pc[1]);
-        MOZ_ASSERT(i < JS::WellKnownSymbolLimit);
-        if (i < JS::WellKnownSymbolLimit)
-            return write(cx->names().wellKnownSymbolDescriptions()[i]);
-        break;
-      }
      case JSOP_UNDEFINED:
        return write(js_undefined_str);
      case JSOP_THIS:
--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@ -4200,7 +4200,7 @@ static const JSFunctionSpec string_methods[] = {
    JS_SELF_HOSTED_FN("fontcolor","String_fontcolor",  1,0),
    JS_SELF_HOSTED_FN("fontsize", "String_fontsize",   1,0),

-    JS_SELF_HOSTED_SYM_FN(iterator, "String_iterator", 0,0),
+    JS_SELF_HOSTED_FN("@@iterator", "String_iterator", 0,0),
    JS_FS_END
 };

--- a/js/src/tests/ecma_6/Array/for_of_2.js
+++ b/js/src/tests/ecma_6/Array/for_of_2.js
@ -25,7 +25,7 @@ function TestChangeArrayIteratorNext() {
        return M2;
    }

-    var iter = ([])[Symbol.iterator]();
+    var iter = ([])['@@iterator']();
    var iterProto = Object.getPrototypeOf(iter);
    var OldNext = iterProto.next;
    var NewNext = function () {
--- a/js/src/tests/ecma_6/Array/for_of_3.js
+++ b/js/src/tests/ecma_6/Array/for_of_3.js
@ -27,7 +27,7 @@ function TestIncreaseArrayLength() {
        return M2;
    }

-    var iter = ([])[Symbol.iterator]();
+    var iter = ([])['@@iterator']();
    var iterProto = Object.getPrototypeOf(iter);
    var OldNext = iterProto.next;
    var NewNext = function () {
--- a/js/src/tests/ecma_6/Array/for_of_4.js
+++ b/js/src/tests/ecma_6/Array/for_of_4.js
@ -26,7 +26,7 @@ function TestDecreaseArrayLength() {
        return M2;
    }

-    var iter = ([])[Symbol.iterator]();
+    var iter = ([])['@@iterator']();
    var iterProto = Object.getPrototypeOf(iter);
    var OldNext = iterProto.next;
    var NewNext = function () {
--- a/js/src/tests/ecma_6/Array/from_errors.js
+++ b/js/src/tests/ecma_6/Array/from_errors.js
@ -132,12 +132,12 @@ assertEq(obj instanceof C, true);

 // It's a TypeError if the iterator's .next() method returns a primitive.
 for (var primitive of [undefined, null, 17]) {
-    var iterable = {};
-    iterable[Symbol.iterator] = () => {
-        next: () => primitive
-    };
    assertThrowsInstanceOf(
-        () => Array.from(iterable),
+        () => Array.from({
+            "@@iterator": () => {
+                next: () => primitive
+            }
+        }),
        TypeError);
 }

--- a/js/src/tests/ecma_6/Array/from_iterable.js
+++ b/js/src/tests/ecma_6/Array/from_iterable.js
@ -8,7 +8,7 @@

 // If an object has both .length and [@@iterator] properties, [@@iterator] is used.
 var a = ['a', 'e', 'i', 'o', 'u'];
-a[Symbol.iterator] = function* () {
+a["@@iterator"] = function* () {
    for (var i = 5; i--; )
        yield this[i];
 };
--- a/js/src/tests/ecma_6/Array/from_proxy.js
+++ b/js/src/tests/ecma_6/Array/from_proxy.js
@ -6,19 +6,19 @@ var log = [];
 function LoggingProxy(target) {
    var h = {
        defineProperty: function (t, id) {
-            log.push("define", id);
+            log.push("define " + id);
            return undefined;
        },
        has: function (t, id) {
-            log.push("has", id);
+            log.push("has " + id);
            return id in t;
        },
        get: function (t, id) {
-            log.push("get", id);
+            log.push("get " + id);
            return t[id];
        },
        set: function (t, id, v) {
-            log.push("set", id);
+            log.push("set " + id);
            t[id] = v;
        }
    };
@ -30,25 +30,23 @@ function LoggingProxy(target) {
 // but handler.set to set the length.
 LoggingProxy.from = Array.from;
 LoggingProxy.from([3, 4, 5]);
-assertDeepEq(log, ["define", "0", "define", "1", "define", "2", "set", "length"]);
+assertDeepEq(log, ["define 0", "define 1", "define 2", "set length"]);

 // When the argument passed to Array.from is a Proxy, Array.from
 // calls handler.get on it.
 log = [];
 assertDeepEq(Array.from(new LoggingProxy([3, 4, 5])), [3, 4, 5]);
-assertDeepEq(log, ["get", Symbol.iterator,
-                   "get", "length", "get", "0",
-                   "get", "length", "get", "1",
-                   "get", "length", "get", "2",
-                   "get", "length"]);
+assertDeepEq(log, ["get @@iterator",
+                   "get length", "get 0", "get length", "get 1", "get length", "get 2",
+                   "get length"]);

 // Array-like iteration only gets the length once.
 log = [];
 var arr = [5, 6, 7];
-arr[Symbol.iterator] = undefined;
+arr["@@iterator"] = undefined;
 assertDeepEq(Array.from(new LoggingProxy(arr)), [5, 6, 7]);
-assertDeepEq(log, ["get", Symbol.iterator,
-                   "get", "length", "get", "0", "get", "1", "get", "2"]);
+assertDeepEq(log, ["get @@iterator",
+                   "get length", "get 0", "get 1", "get 2"]);

 if (typeof reportCompare === 'function')
    reportCompare(0, 0);
--- a/js/src/tests/ecma_6/Array/from_string.js
+++ b/js/src/tests/ecma_6/Array/from_string.js
@ -11,11 +11,11 @@ assertDeepEq(Array.from(gclef), [gclef]);
 assertDeepEq(Array.from(gclef + " G"), [gclef, " ", "G"]);

 // Array.from on a string calls the @@iterator method.
-String.prototype[Symbol.iterator] = function* () { yield 1; yield 2; };
+String.prototype["@@iterator"] = function* () { yield 1; yield 2; };
 assertDeepEq(Array.from("anything"), [1, 2]);

 // If the iterator method is deleted, Strings are still arraylike.
-delete String.prototype[Symbol.iterator];
+delete String.prototype["@@iterator"];
 assertDeepEq(Array.from("works"), ['w', 'o', 'r', 'k', 's']);
 assertDeepEq(Array.from(gclef), ['\uD834', '\uDD1E']);

--- a/js/src/tests/ecma_6/Generators/runtime.js
+++ b/js/src/tests/ecma_6/Generators/runtime.js
@ -17,6 +17,8 @@ function* g() { yield 1; }
 var GeneratorFunctionPrototype = Object.getPrototypeOf(g);
 var GeneratorFunction = GeneratorFunctionPrototype.constructor;
 var GeneratorObjectPrototype = GeneratorFunctionPrototype.prototype;
+// FIXME: This should be a symbol.
+var std_iterator = "@@iterator";


 // A generator function should have the same set of properties as any
@ -64,7 +66,7 @@ function TestGeneratorObjectPrototype() {
    assertEq(Object.getPrototypeOf((function*(){yield 1}).prototype),
               GeneratorObjectPrototype);

-    var expected_property_names = ["next", "throw", "constructor"];
+    var expected_property_names = ["next", "throw", "constructor", std_iterator];
    var found_property_names =
        Object.getOwnPropertyNames(GeneratorObjectPrototype);

--- a/js/src/tests/ecma_6/Symbol/equality.js
+++ b/js/src/tests/ecma_6/Symbol/equality.js
@ -10,8 +10,7 @@ if (typeof Symbol === "function") {
        Symbol(),
        Symbol("Symbol.iterator"),
        Symbol("Symbol.iterator"),  // distinct new symbol with the same description
-        Symbol.for("Symbol.iterator"),
-        Symbol.iterator
+        Symbol.for("Symbol.iterator")
    ];

    // Distinct symbols are never equal to each other, even if they have the same
--- a/js/src/tests/ecma_6/Symbol/property-reflection.js
+++ b/js/src/tests/ecma_6/Symbol/property-reflection.js
@ -67,7 +67,9 @@ if (typeof Symbol === "function") {
    assertEq(descs.hasOwnProperty(s2), true);
    assertEq(descs.hasOwnProperty(s3), false);
    assertEq([].hasOwnProperty(Symbol.iterator), false);
-    assertEq(Array.prototype.hasOwnProperty(Symbol.iterator), true);
+    if (!("@@iterator" in []))
+        throw new Error("Congratulations on implementing Symbol.iterator! Please update this test.");
+    assertEq(Array.prototype.hasOwnProperty(Symbol.iterator), false);  // should be true

    // Object.prototype.propertyIsEnumerable
    assertEq(n.propertyIsEnumerable(s1), true);
--- a/js/src/tests/ecma_6/Symbol/surfaces.js
+++ b/js/src/tests/ecma_6/Symbol/surfaces.js
@ -22,11 +22,6 @@ if (typeof Symbol === "function") {
    assertEq(desc.enumerable, false);
    assertEq(desc.writable, true);

-    desc = Object.getOwnPropertyDescriptor(Symbol, "iterator");
-    assertEq(desc.configurable, false);
-    assertEq(desc.enumerable, false);
-    assertEq(desc.writable, false);
-
    assertEq(Symbol.for.length, 1);
    assertEq(Symbol.prototype.toString.length, 0);
    assertEq(Symbol.prototype.valueOf.length, 0);
--- a/js/src/tests/js1_8/regress/regress-469625-03.js
+++ b/js/src/tests/js1_8/regress/regress-469625-03.js
@ -26,7 +26,7 @@ function test()
    var [a, b, [c0, c1]] = [x, x, x];
  }

-  expect = 'TypeError: (intermediate value)[Symbol.iterator](...).next(...).value is null';
+  expect = 'TypeError: (intermediate value)[\'@@iterator\'](...).next(...).value is null';
  actual = 'No Error';
  try
  {
--- a/js/src/tests/js1_8_5/extensions/decompile-for-of.js
+++ b/js/src/tests/js1_8_5/extensions/decompile-for-of.js
@ -1,26 +0,0 @@
-// The decompiler can handle the implicit call to @@iterator in a for-of loop.
-
-var x;
-function check(code) {
-    var s = "no exception thrown";
-    try {
-        eval(code);
-    } catch (exc) {
-        s = exc.message;
-    }
-    assertEq(s, "x[Symbol.iterator] is not a function");
-}
-
-x = {};
-check("for (var v of x) throw fit;");
-check("[...x]");
-check("Math.hypot(...x)");
-
-x[Symbol.iterator] = "potato";
-check("for (var v of x) throw fit;");
-
-x[Symbol.iterator] = {};
-check("for (var v of x) throw fit;");
-
-if (typeof reportCompare === "function")
-    reportCompare(0, 0, "ok");
--- a/js/src/vm/CommonPropertyNames.h
+++ b/js/src/vm/CommonPropertyNames.h
@ -44,6 +44,7 @@
    macro(count, count, "count") \
    macro(currency, currency, "currency") \
    macro(currencyDisplay, currencyDisplay, "currencyDisplay") \
+    macro(std_iterator, std_iterator, "@@iterator") \
    macro(DateTimeFormat, DateTimeFormat, "DateTimeFormat") \
    macro(DateTimeFormatFormatGet, DateTimeFormatFormatGet, "Intl_DateTimeFormat_format_get") \
    macro(decodeURI, decodeURI, "decodeURI") \
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@ -1133,7 +1133,6 @@ HandleError(JSContext *cx, InterpreterRegs &regs)
 #define PUSH_BOOLEAN(b)          REGS.sp++->setBoolean(b)
 #define PUSH_DOUBLE(d)           REGS.sp++->setDouble(d)
 #define PUSH_INT32(i)            REGS.sp++->setInt32(i)
-#define PUSH_SYMBOL(s)           REGS.sp++->setSymbol(s)
 #define PUSH_STRING(s)           do { REGS.sp++->setString(s); assertSameCompartmentDebugOnly(cx, REGS.sp[-1]); } while (0)
 #define PUSH_OBJECT(obj)         do { REGS.sp++->setObject(obj); assertSameCompartmentDebugOnly(cx, REGS.sp[-1]); } while (0)
 #define PUSH_OBJECT_OR_NULL(obj) do { REGS.sp++->setObjectOrNull(obj); assertSameCompartmentDebugOnly(cx, REGS.sp[-1]); } while (0)
@ -1612,6 +1611,7 @@ CASE(EnableInterruptsPseudoOpcode)
 /* Various 1-byte no-ops. */
 CASE(JSOP_NOP)
 CASE(JSOP_UNUSED2)
+CASE(JSOP_UNUSED45)
 CASE(JSOP_UNUSED46)
 CASE(JSOP_UNUSED47)
 CASE(JSOP_UNUSED48)
@ -2755,10 +2755,6 @@ CASE(JSOP_TOSTRING)
 }
 END_CASE(JSOP_TOSTRING)

-CASE(JSOP_SYMBOL)
-    PUSH_SYMBOL(cx->wellKnownSymbols().get(GET_UINT8(REGS.pc)));
-END_CASE(JSOP_SYMBOL)
-
 CASE(JSOP_OBJECT)
 {
    RootedObject &ref = rootObject0;
--- a/js/src/vm/Opcodes.h
+++ b/js/src/vm/Opcodes.h
@ -416,15 +416,7 @@
     */ \
    macro(JSOP_DUPAT,     44, "dupat",      NULL,         4,  0,  1,  JOF_UINT24) \
    \
-    /*
-     * Push a well-known symbol onto the operand stack.
-     *   Category: Literals
-     *   Type: Constants
-     *   Operands: uint8_t n, the JS::SymbolCode of the symbol to use
-     *   Stack: => symbol
-     */ \
-    macro(JSOP_SYMBOL,    45, "symbol",     NULL,         2,  0,  1,  JOF_UINT8) \
-    \
+    macro(JSOP_UNUSED45,  45, "unused45",   NULL,         1,  0,  0,  JOF_BYTE) \
    macro(JSOP_UNUSED46,  46, "unused46",   NULL,         1,  0,  0,  JOF_BYTE) \
    macro(JSOP_UNUSED47,  47, "unused47",   NULL,         1,  0,  0,  JOF_BYTE) \
    macro(JSOP_UNUSED48,  48, "unused48",   NULL,         1,  0,  0,  JOF_BYTE) \
--- a/js/src/vm/PIC.cpp
+++ b/js/src/vm/PIC.cpp
@ -44,9 +44,8 @@ js::ForOfPIC::Chain::initialize(JSContext *cx)
    // do set disabled_ now, and clear it later when we succeed.
    disabled_ = true;

-    // Look up Array.prototype[@@iterator], ensure it's a slotful shape.
-    Shape *iterShape =
-        arrayProto->nativeLookup(cx, SYMBOL_TO_JSID(cx->wellKnownSymbols().iterator));
+    // Look up '@@iterator' on Array.prototype, ensure it's a slotful shape.
+    Shape *iterShape = arrayProto->nativeLookup(cx, cx->names().std_iterator);
    if (!iterShape || !iterShape->hasSlot() || !iterShape->hasDefaultGetter())
        return true;

@ -145,8 +144,8 @@ js::ForOfPIC::Chain::tryOptimizeArray(JSContext *cx, HandleObject array, bool *o
    if (!isOptimizableArray(array))
        return true;

-    // Ensure array doesn't define @@iterator directly.
-    if (array->nativeLookup(cx, SYMBOL_TO_JSID(cx->wellKnownSymbols().iterator)))
+    // Ensure array doesn't define '@@iterator' directly.
+    if (array->nativeLookup(cx, cx->names().std_iterator))
        return true;

    // Good to optimize now, create stub to add.
@ -199,7 +198,7 @@ js::ForOfPIC::Chain::isArrayStateStillSane()
    if (arrayProto_->lastProperty() != arrayProtoShape_)
        return false;

-    // Ensure that Array.prototype[@@iterator] contains the
+    // Ensure that Array.prototype['@@iterator'] contains the
    // canonical iterator function.
    if (arrayProto_->getSlot(arrayProtoIteratorSlot_) != canonicalIteratorFunc_)
        return false;
--- a/js/src/vm/PIC.h
+++ b/js/src/vm/PIC.h
@ -130,7 +130,7 @@ struct ForOfPIC

    /*
     * A ForOfPIC has only one kind of stub for now: one that holds the shape
-     * of an array object that does not override its @@iterator property.
+     * of an array object that does not override its '@@iterator' property.
     */
    class Stub : public BaseStub
    {
@ -164,8 +164,8 @@ struct ForOfPIC
     *  ArrayIterator.prototype's shape (arrayIteratorProtoShape_)
     *      To ensure that an ArrayIterator.prototype has not been modified.
     *
-     *  Array.prototype's slot number for @@iterator (arrayProtoIteratorSlot_)
-     *  Array.prototype's canonical value for @@iterator (canonicalIteratorFunc_)
+     *  Array.prototype's slot number for '@@iterator' (arrayProtoIteratorSlot_)
+     *  Array.prototype's canonical value for '@@iterator' (canonicalIteratorFunc_)
     *      To quickly retreive and ensure that the iterator constructor
     *      stored in the slot has not changed.
     *
@ -182,7 +182,7 @@ struct ForOfPIC
        HeapPtrObject arrayIteratorProto_;

        // Shape of matching Array.prototype object, and slot containing
-        // the @@iterator for it, and the canonical value.
+        // the '@@iterator' for it, and the canonical value.
        HeapPtrShape arrayProtoShape_;
        uint32_t arrayProtoIteratorSlot_;
        HeapValue canonicalIteratorFunc_;
--- a/js/src/vm/Runtime.h
+++ b/js/src/vm/Runtime.h
@ -400,10 +400,6 @@ struct JSAtomState
 #define PROPERTYNAME_FIELD(name, code, init, clasp) js::ImmutablePropertyNamePtr name;
    JS_FOR_EACH_PROTOTYPE(PROPERTYNAME_FIELD)
 #undef PROPERTYNAME_FIELD
-
-    js::ImmutablePropertyNamePtr *wellKnownSymbolDescriptions() {
-        return &Symbol_iterator;
-    }
 };

 namespace js {
@ -412,7 +408,7 @@ namespace js {
 * Storage for well-known symbols. It's a separate struct from the Runtime so
 * that it can be shared across multiple runtimes. As in JSAtomState, each
 * field is a smart pointer that's immutable once initialized.
- * `rt->wellKnownSymbols->iterator` is convertible to Handle<Symbol*>.
+ * `rt->wellKnownSymbols.iterator` is convertible to Handle<Symbol*>.
 *
 * Well-known symbols are never GC'd. The description() of each well-known
 * symbol is a permanent atom.
--- a/js/src/vm/SelfHosting.cpp
+++ b/js/src/vm/SelfHosting.cpp
@ -1256,12 +1256,6 @@ CloneValue(JSContext *cx, HandleValue selfHostedValue, MutableHandleValue vp)
        if (!clone)
            return false;
        vp.setString(clone);
-    } else if (selfHostedValue.isSymbol()) {
-        // Well-known symbols are shared.
-        JS::Symbol *sym = selfHostedValue.toSymbol();
-        MOZ_ASSERT(sym->isWellKnownSymbol());
-        MOZ_ASSERT(cx->wellKnownSymbols().get(size_t(sym->code())) == sym);
-        vp.set(selfHostedValue);
    } else {
        MOZ_CRASH("Self-hosting CloneValue can't clone given value.");
    }
--- a/js/src/vm/TypedArrayObject.cpp
+++ b/js/src/vm/TypedArrayObject.cpp
@ -1590,7 +1590,7 @@ TypedArrayObject::setElement(TypedArrayObject &obj, uint32_t index, double d)

 #define IMPL_TYPED_ARRAY_STATICS(_typedArray)                                      \
 const JSFunctionSpec _typedArray##Object::jsfuncs[] = {                            \
-    JS_SELF_HOSTED_SYM_FN(iterator, "ArrayValues", 0, 0),                          \
+    JS_SELF_HOSTED_FN("@@iterator", "ArrayValues", 0, 0),                          \
    JS_FN("subarray", _typedArray##Object::fun_subarray, 2, JSFUN_GENERIC_NATIVE), \
    JS_FN("set", _typedArray##Object::fun_set, 2, JSFUN_GENERIC_NATIVE),           \
    JS_FN("copyWithin", _typedArray##Object::fun_copyWithin, 2, JSFUN_GENERIC_NATIVE), \
--- a/js/xpconnect/tests/chrome/test_xrayToJS.xul
+++ b/js/xpconnect/tests/chrome/test_xrayToJS.xul
@ -174,14 +174,14 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=933681
    ["length", "toSource", "toString", "toLocaleString", "join", "reverse", "sort", "push",
      "pop", "shift", "unshift", "splice", "concat", "slice", "lastIndexOf", "indexOf",
      "forEach", "map", "reduce", "reduceRight", "filter", "some", "every", "find",
-      "findIndex", "copyWithin", "fill", Symbol.iterator, "entries", "keys", "constructor"];
+      "findIndex", "copyWithin", "fill", "@@iterator", "entries", "keys", "constructor"];
  if (isNightlyBuild) {
    let pjsMethods = ['mapPar', 'reducePar', 'scanPar', 'scatterPar', 'filterPar'];
    gPrototypeProperties['Array'] = gPrototypeProperties['Array'].concat(pjsMethods);
  }
  for (var c of typedArrayClasses) {
    gPrototypeProperties[c] = ["constructor", "BYTES_PER_ELEMENT", "length", "buffer",
-                               "byteLength", "byteOffset", "Symbol.iterator", "subarray", "set",
+                               "byteLength", "byteOffset", "@@iterator", "subarray", "set",
                               "copyWithin"];
  }
  for (var c of errorObjectClasses) {
@ -211,13 +211,9 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=933681
    let xrayProto = Object.getPrototypeOf(xray);
    let localProto = window[classname].prototype;
    is(Object.getOwnPropertyNames(localProto).sort().toSource(),
-       gPrototypeProperties[classname].filter(id => typeof id === "string").sort().toSource(),
+       gPrototypeProperties[classname].sort().toSource(),
       "A property on the " + classname +
-       " prototype has been changed! You need a security audit from an XPConnect peer");
-    is(Object.getOwnPropertySymbols(localProto).map(uneval).sort().toSource(),
-       gPrototypeProperties[classname].filter(id => typeof id !== "string").map(uneval).sort().toSource(),
-       "A symbol-keyed property on the " + classname +
-       " prototype has been changed! You need a security audit from an XPConnect peer");
+       " prototype has changed! You need a security audit from an XPConnect peer");

    let protoProps = filterOut(Object.getOwnPropertyNames(localProto), propsToSkip).sort();
    let protoCallables = protoProps.filter(name => Object.getOwnPropertyDescriptor(localProto, name).get ||
--- a/toolkit/modules/Promise-backend.js
+++ b/toolkit/modules/Promise-backend.js
@ -511,7 +511,7 @@ Promise.reject = function (aReason)
 */
 Promise.all = function (aValues)
 {
-  if (aValues == null || typeof(aValues[Symbol.iterator]) != "function") {
+  if (aValues == null || typeof(aValues["@@iterator"]) != "function") {
    throw new Error("Promise.all() expects an iterable.");
  }

@ -562,7 +562,7 @@ Promise.all = function (aValues)
 */
 Promise.race = function (aValues)
 {
-  if (aValues == null || typeof(aValues[Symbol.iterator]) != "function") {
+  if (aValues == null || typeof(aValues["@@iterator"]) != "function") {
    throw new Error("Promise.race() expects an iterable.");
  }