Merge last PGO-green changeset of mozilla-inbound to mozilla-central

2012-02-17 11:06:18 +00:00 · 2012-02-17 11:06:18 +00:00 · 0dc60a9892
--- a/aclocal.m4
+++ b/aclocal.m4
@ -17,6 +17,7 @@ builtin(include, build/autoconf/acwinpaths.m4)dnl
 builtin(include, build/autoconf/lto.m4)dnl
 builtin(include, build/autoconf/gcc-pr49911.m4)dnl
 builtin(include, build/autoconf/frameptr.m4)dnl
+builtin(include, build/autoconf/compiler-opts.m4)dnl

 MOZ_PROG_CHECKMSYS()

--- a/b2g/app/b2g.js
+++ b/b2g/app/b2g.js
@ -430,3 +430,5 @@ pref("layout.frame_rate.precise", true);
 pref("power.screen.timeout", 60);

 pref("full-screen-api.enabled", true);
+
+pref("media.volume.steps", 10);
--- a/b2g/chrome/content/shell.js
+++ b/b2g/chrome/content/shell.js
@ -186,6 +186,24 @@ var shell = {
      Services.prefs.setBoolPref("nglayout.debug.paint_flashing", false);
    }
  },
+ 
+  changeVolume: function shell_changeVolume(aDelta) {
+    let audioManager = Cc["@mozilla.org/telephony/audiomanager;1"].getService(Ci.nsIAudioManager);
+
+    let steps = 10;
+    try {
+      steps = Services.prefs.getIntPref("media.volume.steps");
+      if (steps <= 0)
+        steps = 1;
+    } catch(e) {}
+
+    let volume = audioManager.masterVolume + aDelta / steps;
+    if (volume > 1)
+      volume = 1;
+    if (volume < 0)
+      volume = 0;
+    audioManager.masterVolume = volume;
+  },

  handleEvent: function shell_handleEvent(evt) {
    switch (evt.type) {
@ -217,6 +235,12 @@ var shell = {
          case 'Search':
            this.toggleDebug();
            break;
+          case 'VolumeUp':
+            this.changeVolume(1);
+            break;
+          case 'VolumeDown':
+            this.changeVolume(-1);
+            break;
        }
        break;
      case 'load':
--- a/browser/base/content/browser.xul
+++ b/browser/base/content/browser.xul
@ -90,6 +90,7 @@
        lightweightthemes="true"
        lightweightthemesfooter="browser-bottombox"
        windowtype="navigator:browser"
+        macanimationtype="document"
        screenX="4" screenY="4"
        browsingmode="normal"
        persist="screenX screenY width height sizemode">
--- a/browser/base/content/tabbrowser.xml
+++ b/browser/base/content/tabbrowser.xml
@ -1266,6 +1266,12 @@
                else {
                  t._animStartTime = Date.now();
                  t.setAttribute("fadein", "true");
+
+                  // This call to adjustTabstrip is redundant but needed so that
+                  // when opening a second tab, the first tab's close buttons
+                  // appears immediately rather than when the transition ends.
+                  if (tabContainer.childNodes.length == 2)
+                    tabContainer.adjustTabstrip();
                }
              }, 0, this.tabContainer);
            }
@ -4055,7 +4061,7 @@
          let alignRight = false;

          if (getComputedStyle(document.documentElement).direction == "rtl")
-            alighRight = !alignRight;
+            alignRight = !alignRight;

          let rect = this.getBoundingClientRect();
          this._mouseTargetRect = {
--- a/browser/components/sessionstore/src/nsSessionStartup.js
+++ b/browser/components/sessionstore/src/nsSessionStartup.js
@ -72,6 +72,7 @@ const Cr = Components.results;
 const Cu = Components.utils;
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/Services.jsm");
+Cu.import("resource:///modules/TelemetryStopwatch.jsm");

 const STATE_RUNNING_STR = "running";
 const MAX_FILE_SIZE = 100 * 1024 * 1024; // 100 megabytes
@ -127,23 +128,30 @@ SessionStartup.prototype = {
      return;

    // parse the session state into a JS object
+    // remove unneeded braces (added for compatibility with Firefox 2.0 and 3.0)
+    if (iniString.charAt(0) == '(')
+      iniString = iniString.slice(1, -1);
+    let corruptFile = false;
    try {
-      // remove unneeded braces (added for compatibility with Firefox 2.0 and 3.0)
-      if (iniString.charAt(0) == '(')
-        iniString = iniString.slice(1, -1);
+      this._initialState = JSON.parse(iniString);
+    }
+    catch (ex) {
+      debug("The session file contained un-parse-able JSON: " + ex);
+      // Try to eval.
+      // evalInSandbox will throw if iniString is not parse-able.
      try {
-        this._initialState = JSON.parse(iniString);
-      }
-      catch (exJSON) {
        var s = new Cu.Sandbox("about:blank", {sandboxName: 'nsSessionStartup'});
        this._initialState = Cu.evalInSandbox("(" + iniString + ")", s);
+      } catch(ex) {
+        debug("The session file contained un-eval-able JSON: " + ex);
+        corruptFile = true;
      }
-
-      // If this is a normal restore then throw away any previous session
-      if (!doResumeSessionOnce)
-        delete this._initialState.lastSessionState;
    }
-    catch (ex) { debug("The session file is invalid: " + ex); }
+    Services.telemetry.getHistogramById("FX_SESSION_RESTORE_CORRUPT_FILE").add(corruptFile);
+
+    // If this is a normal restore then throw away any previous session
+    if (!doResumeSessionOnce)
+      delete this._initialState.lastSessionState;

    let resumeFromCrash = prefBranch.getBoolPref("sessionstore.resume_from_crash");
    let lastSessionCrashed =
@ -154,8 +162,7 @@ SessionStartup.prototype = {
    // Report shutdown success via telemetry. Shortcoming here are
    // being-killed-by-OS-shutdown-logic, shutdown freezing after
    // session restore was written, etc.
-    let Telemetry = Cc["@mozilla.org/base/telemetry;1"].getService(Ci.nsITelemetry);
-    Telemetry.getHistogramById("SHUTDOWN_OK").add(!lastSessionCrashed);
+    Services.telemetry.getHistogramById("SHUTDOWN_OK").add(!lastSessionCrashed);

    // set the startup type
    if (lastSessionCrashed && resumeFromCrash)
@ -296,9 +303,11 @@ SessionStartup.prototype = {
   * @returns a session state string
   */
  _readStateFile: function sss_readStateFile(aFile) {
+    TelemetryStopwatch.start("FX_SESSION_RESTORE_READ_FILE_MS");
    var stateString = Cc["@mozilla.org/supports-string;1"].
                        createInstance(Ci.nsISupportsString);
    stateString.data = this._readFile(aFile) || "";
+    TelemetryStopwatch.finish("FX_SESSION_RESTORE_READ_FILE_MS");

    Services.obs.notifyObservers(stateString, "sessionstore-state-read", "");

--- a/browser/components/sessionstore/src/nsSessionStore.js
+++ b/browser/components/sessionstore/src/nsSessionStore.js
@ -131,6 +131,7 @@ Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://gre/modules/debug.js");

 Cu.import("resource:///modules/TelemetryTimestamps.jsm");
+Cu.import("resource:///modules/TelemetryStopwatch.jsm");

 XPCOMUtils.defineLazyGetter(this, "NetUtil", function() {
  Cu.import("resource://gre/modules/NetUtil.jsm");
@ -3653,6 +3654,8 @@ SessionStoreService.prototype = {
    // if we crash.
    let pinnedOnly = this._loadState == STATE_RUNNING && !this._resume_from_crash;

+    TelemetryStopwatch.start("FX_SESSION_RESTORE_COLLECT_DATA_MS");
+
    var oState = this._getCurrentState(aUpdateAll, pinnedOnly);
    if (!oState)
      return;
@ -3691,6 +3694,8 @@ SessionStoreService.prototype = {
    if (this._lastSessionState)
      oState.lastSessionState = this._lastSessionState;

+    TelemetryStopwatch.finish("FX_SESSION_RESTORE_COLLECT_DATA_MS");
+
    this._saveStateObject(oState);
  },

@ -3698,9 +3703,11 @@ SessionStoreService.prototype = {
   * write a state object to disk
   */
  _saveStateObject: function sss_saveStateObject(aStateObj) {
+    TelemetryStopwatch.start("FX_SESSION_RESTORE_SERIALIZE_DATA_MS");
    var stateString = Cc["@mozilla.org/supports-string;1"].
                        createInstance(Ci.nsISupportsString);
    stateString.data = this._toJSONString(aStateObj);
+    TelemetryStopwatch.finish("FX_SESSION_RESTORE_SERIALIZE_DATA_MS");

    Services.obs.notifyObservers(stateString, "sessionstore-state-write", "");

@ -3809,7 +3816,7 @@ SessionStoreService.prototype = {
    argString.data = "";

    // Build feature string
-    let features = "chrome,dialog=no,all";
+    let features = "chrome,dialog=no,macsuppressanimation,all";
    let winState = aState.windows[0];
    WINDOW_ATTRIBUTES.forEach(function(aFeature) {
      // Use !isNaN as an easy way to ignore sizemode and check for numbers
@ -4427,6 +4434,7 @@ SessionStoreService.prototype = {
   *        String data
   */
  _writeFile: function sss_writeFile(aFile, aData) {
+    TelemetryStopwatch.start("FX_SESSION_RESTORE_WRITE_FILE_MS");
    // Initialize the file output stream.
    var ostream = Cc["@mozilla.org/network/safe-file-output-stream;1"].
                  createInstance(Ci.nsIFileOutputStream);
@ -4442,6 +4450,7 @@ SessionStoreService.prototype = {
    var self = this;
    NetUtil.asyncCopy(istream, ostream, function(rc) {
      if (Components.isSuccessCode(rc)) {
+        TelemetryStopwatch.finish("FX_SESSION_RESTORE_WRITE_FILE_MS");
        Services.obs.notifyObservers(null,
                                     "sessionstore-state-write-complete",
                                     "");
--- a/browser/devtools/scratchpad/scratchpad.xul
+++ b/browser/devtools/scratchpad/scratchpad.xul
@ -51,6 +51,7 @@
        xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
        title="&window.title;"
        windowtype="devtools:scratchpad"
+        macanimationtype="document"
        screenX="4" screenY="4"
        width="640" height="480"
        persist="screenX screenY width height sizemode">
--- a/browser/makefiles.sh
+++ b/browser/makefiles.sh
@ -88,6 +88,12 @@ browser/themes/Makefile
 $MOZ_BRANDING_DIRECTORY/Makefile
 $MOZ_BRANDING_DIRECTORY/content/Makefile
 $MOZ_BRANDING_DIRECTORY/locales/Makefile
+toolkit/locales/Makefile
+extensions/spellcheck/locales/Makefile
+intl/locales/Makefile
+netwerk/locales/Makefile
+dom/locales/Makefile
+security/manager/locales/Makefile
 "

 if [ "$MOZ_SAFE_BROWSING" ]; then
--- a/build/autoconf/compiler-opts.m4
+++ b/build/autoconf/compiler-opts.m4
@ -0,0 +1,13 @@
+dnl Add compiler specific options
+
+AC_DEFUN([MOZ_COMPILER_OPTS],
+[
+if test "$CLANG_CXX"; then
+    ## We disable return-type-c-linkage because jsval is defined as a C++ type but is
+    ## returned by C functions. This is possible because we use knowledge about the ABI
+    ## to typedef it to a C type with the same layout when the headers are included
+    ## from C.
+    _WARNINGS_CXXFLAGS="${_WARNINGS_CXXFLAGS} -Wno-return-type-c-linkage"
+fi
+])
+
--- a/build/unix/build-toolchain/build-gcc.py
+++ b/build/unix/build-toolchain/build-gcc.py
@ -1,5 +1,18 @@
 #!/usr/bin/python

+# The directories end up in the debug info, so the easy way of getting
+# a reproducible build is to run it in a know absolute directory.
+# We use a directory in /builds/slave because the mozilla infrastructure
+# cleans it up automatically.
+base_dir = "/builds/slave/moz-toolschain"
+
+source_dir = base_dir + "/src"
+build_dir  = base_dir + "/build"
+aux_inst_dir = build_dir + '/aux_inst'
+old_make = aux_inst_dir + '/bin/make'
+
+##############################################
+
 import urllib
 import os
 import os.path
@ -33,17 +46,21 @@ def patch(patch, plevel, srcdir):
    check_run(['patch', '-d', srcdir, '-p%s' % plevel, '-i', patch, '--fuzz=0',
               '-s'])

-def build_package(package_source_dir, package_build_dir, configure_args):
+def build_package(package_source_dir, package_build_dir, configure_args,
+                   make = old_make):
    os.mkdir(package_build_dir)
    run_in(package_build_dir,
           ["%s/configure" % package_source_dir] + configure_args)
-    run_in(package_build_dir, ["make", "-j8"])
-    run_in(package_build_dir, ["make", "install"])
+    run_in(package_build_dir, [make, "-j8"])
+    run_in(package_build_dir, [make, "install"])

-def build_tar(base_dir, tar_inst_dir):
+def build_aux_tools(base_dir):
+    make_build_dir = base_dir + '/make_build'
+    build_package(make_source_dir, make_build_dir,
+                  ["--prefix=%s" % aux_inst_dir], "make")
    tar_build_dir = base_dir + '/tar_build'
    build_package(tar_source_dir, tar_build_dir,
-                  ["--prefix=%s" % tar_inst_dir])
+                  ["--prefix=%s" % aux_inst_dir])

 def with_env(env, f):
    old_env = os.environ.copy()
@ -133,21 +150,13 @@ def build_tar_package(tar, name, base, directory):

 ##############################################

-# The directories end up in the debug info, so the easy way of getting
-# a reproducible build is to run it in a know absolute directory.
-# We use a directory in /builds/slave because the mozilla infrastructure
-# cleans it up automatically.
-base_dir = "/builds/slave/moz-toolschain"
-
-source_dir = base_dir + "/src"
-build_dir  = base_dir + "/build"
-
 def build_source_dir(prefix, version):
    return source_dir + '/' + prefix + version

 binutils_version = "2.21.1"
-glibc_version = "2.12.2" #FIXME: should probably use 2.5.1
+glibc_version = "2.7" #FIXME: should probably use 2.5.1
 tar_version = "1.26"
+make_version = "3.81"
 gcc_version = "4.5.2"
 mpfr_version = "2.4.2"
 gmp_version = "5.0.1"
@ -159,6 +168,8 @@ glibc_source_uri = "http://ftp.gnu.org/gnu/glibc/glibc-%s.tar.bz2" % \
    glibc_version
 tar_source_uri = "http://ftp.gnu.org/gnu/tar/tar-%s.tar.bz2" % \
    tar_version
+make_source_uri = "http://ftp.gnu.org/gnu/make/make-%s.tar.bz2" % \
+    make_version
 gcc_source_uri = "http://ftp.gnu.org/gnu/gcc/gcc-%s/gcc-%s.tar.bz2" % \
    (gcc_version, gcc_version)
 mpfr_source_uri = "http://www.mpfr.org/mpfr-%s/mpfr-%s.tar.bz2" % \
@ -170,6 +181,7 @@ mpc_source_uri = "http://www.multiprecision.org/mpc/download/mpc-%s.tar.gz" % \
 binutils_source_tar = download_uri(binutils_source_uri)
 glibc_source_tar = download_uri(glibc_source_uri)
 tar_source_tar = download_uri(tar_source_uri)
+make_source_tar = download_uri(make_source_uri)
 mpc_source_tar = download_uri(mpc_source_uri)
 mpfr_source_tar = download_uri(mpfr_source_uri)
 gmp_source_tar = download_uri(gmp_source_uri)
@ -178,6 +190,7 @@ gcc_source_tar = download_uri(gcc_source_uri)
 binutils_source_dir  = build_source_dir('binutils-', binutils_version)
 glibc_source_dir  = build_source_dir('glibc-', glibc_version)
 tar_source_dir  = build_source_dir('tar-', tar_version)
+make_source_dir  = build_source_dir('make-', make_version)
 mpc_source_dir  = build_source_dir('mpc-', mpc_version)
 mpfr_source_dir = build_source_dir('mpfr-', mpfr_version)
 gmp_source_dir  = build_source_dir('gmp-', gmp_version)
@ -191,6 +204,7 @@ if not os.path.exists(source_dir):
    patch('glibc-deterministic.patch', 1, glibc_source_dir)
    run_in(glibc_source_dir, ["autoconf"])
    extract(tar_source_tar, source_dir)
+    extract(make_source_tar, source_dir)
    extract(mpc_source_tar, source_dir)
    extract(mpfr_source_tar, source_dir)
    extract(gmp_source_tar, source_dir)
@ -203,8 +217,7 @@ if os.path.exists(build_dir):
    shutil.rmtree(build_dir)
 os.makedirs(build_dir)

-tar_inst_dir = build_dir + '/tar_inst'
-build_tar(build_dir, tar_inst_dir)
+build_aux_tools(build_dir)

 stage1_dir = build_dir + '/stage1'
 build_one_stage({"CC": "gcc", "CXX" : "g++"}, stage1_dir, True)
@ -217,5 +230,5 @@ build_one_stage({"CC"     : stage1_tool_inst_dir + "/bin/gcc",
                 "RANLIB" : "true" },
                stage2_dir, False)

-build_tar_package(tar_inst_dir + "/bin/tar",
+build_tar_package(aux_inst_dir + "/bin/tar",
                  "toolchain.tar", stage2_dir, "inst")
--- a/build/unix/build-toolchain/glibc-deterministic.patch
+++ b/build/unix/build-toolchain/glibc-deterministic.patch
@ -1,7 +1,22 @@
 diff -ru a/configure.in b/configure.in
 --- a/configure.in	2011-01-17 23:34:07.000000000 -0500
 +++ b/configure.in	2012-01-25 20:40:27.919485606 -0500
-@@ -2230,6 +2230,7 @@
+@@ -841,14 +841,6 @@
+ LIBC_PROG_BINUTILS
+ AC_SUBST(MIG)dnl Needed by sysdeps/mach/configure.in
+ 
+-# Accept binutils 2.13 or newer.
+-AC_CHECK_PROG_VER(AS, $AS, --version,
+-		  [GNU assembler.* \([0-9]*\.[0-9.]*\)],
+-		  [2.1[3-9]*], AS=: critic_missing="$critic_missing as")
+-AC_CHECK_PROG_VER(LD, $LD, --version,
+-		  [GNU ld.* \([0-9][0-9]*\.[0-9.]*\)],
+-		  [2.1[3-9]*], LD=: critic_missing="$critic_missing ld")
+-
+ # We need the physical current working directory.  We cannot use the
+ # "pwd -P" shell builtin since that's not portable.  Instead we try to
+ # find a pwd binary.  Note that assigning to the PWD environment
+@@ -2175,6 +2167,7 @@
 fi
 AC_SUBST(old_glibc_headers)
 
@ -12,7 +27,7 @@ diff -ru a/configure.in b/configure.in
 diff -ru a/csu/Makefile b/csu/Makefile
 --- a/csu/Makefile	2011-01-17 23:34:07.000000000 -0500
 +++ b/csu/Makefile	2012-01-23 13:58:28.957792633 -0500
-@@ -234,8 +234,7 @@
+@@ -223,8 +223,7 @@
 		   if [ -z "$$os" ]; then \
 		     os=Linux; \
 		   fi; \
@ -22,10 +37,37 @@ diff -ru a/csu/Makefile b/csu/Makefile
 	   *) ;; \
 	 esac; \
 	 files="$(all-Banner-files)";				\
+diff -ru a/elf/Makefile b/elf/Makefile
+--- a/elf/Makefile	2008-10-31 16:35:11.000000000 -0400
+++ b/elf/Makefile	2012-02-16 12:20:00.038593752 -0500
+@@ -295,20 +295,13 @@
+ z-now-yes = -Wl,-z,now
+ 
+ $(objpfx)ld.so: $(objpfx)librtld.os $(ld-map)
+-	@rm -f $@.lds
+-	$(LINK.o) -nostdlib -nostartfiles -shared $(z-now-$(bind-now))	\
+-		  $(LDFLAGS-rtld) -Wl,-z,defs -Wl,--verbose 2>&1 |	\
+-		  LC_ALL=C \
+-		  sed -e '/^=========/,/^=========/!d;/^=========/d'	\
+-		      -e 's/\. = 0 + SIZEOF_HEADERS;/& _begin = . - SIZEOF_HEADERS;/' \
+-		  > $@.lds
+ 	$(LINK.o) -nostdlib -nostartfiles -shared -o $@			\
+ 		  $(LDFLAGS-rtld) -Wl,-z,defs $(z-now-$(bind-now))	\
+ 		  $(filter-out $(map-file),$^) $(load-map-file)		\
+-		  -Wl,-soname=$(rtld-installed-name) -T $@.lds
+-	rm -f $@.lds
+		  -Wl,-soname=$(rtld-installed-name)			\
+		  -Wl,-defsym=_begin=0
+ 	readelf -s $@ \
+-	  | awk '($$7 ~ /^UND(|EF)$$/ && $$1 != "0:" && $$4 != "REGISTER") { print; p=1 } END { exit p != 0 }'
+	  | $(AWK) '($$7 ~ /^UND(|EF)$$/ && $$1 != "0:" && $$4 != "REGISTER") { print; p=1 } END { exit p != 0 }'
+ 
+ # interp.c exists just to get this string into the libraries.
+ CFLAGS-interp.c = -D'RUNTIME_LINKER="$(slibdir)/$(rtld-installed-name)"' \
 diff -ru a/Makerules b/Makerules
 --- a/Makerules	2011-01-17 23:34:07.000000000 -0500
 +++ b/Makerules	2012-01-30 08:47:56.565068903 -0500
-@@ -992,9 +992,9 @@
+@@ -977,9 +977,9 @@
 	 echo '   Use the shared library, but some functions are only in';\
 	 echo '   the static library, so try that secondarily.  */';\
 	 cat $<; \
--- a/config/autoconf.mk.in
+++ b/config/autoconf.mk.in
@ -181,6 +181,7 @@ LIBJPEG_TURBO_AS = @LIBJPEG_TURBO_AS@
 LIBJPEG_TURBO_ASFLAGS = @LIBJPEG_TURBO_ASFLAGS@
 LIBJPEG_TURBO_X86_ASM = @LIBJPEG_TURBO_X86_ASM@
 LIBJPEG_TURBO_X64_ASM = @LIBJPEG_TURBO_X64_ASM@
+LIBJPEG_TURBO_ARM_ASM = @LIBJPEG_TURBO_ARM_ASM@
 NS_PRINTING = @NS_PRINTING@
 MOZ_PDF_PRINTING = @MOZ_PDF_PRINTING@
 MOZ_CRASHREPORTER = @MOZ_CRASHREPORTER@
--- a/configure.in
+++ b/configure.in
@ -3343,6 +3343,7 @@ AC_SUBST(WRAP_SYSTEM_INCLUDES)
 AC_SUBST(VISIBILITY_FLAGS)

 MOZ_GCC_PR49911
+MOZ_COMPILER_OPTS

 dnl Check for __force_align_arg_pointer__ for SSE2 on gcc
 dnl ========================================================
@ -4612,6 +4613,7 @@ LIBJPEG_TURBO_AS=
 LIBJPEG_TURBO_ASFLAGS=
 LIBJPEG_TURBO_X86_ASM=
 LIBJPEG_TURBO_X64_ASM=
+LIBJPEG_TURBO_ARM_ASM=
 MOZ_PANGO=1
 MOZ_PERMISSIONS=1
 MOZ_PLACES=1
@ -6171,38 +6173,51 @@ if test -n "$MOZ_LIBJPEG_TURBO"; then
    LIBJPEG_TURBO_ASFLAGS="-f win64 -rnasm -pnasm -D__x86_64__ -DPIC -DWIN64 -DMSVC"
    LIBJPEG_TURBO_X64_ASM=1
  ;;
+  *:arm*)
+    LIBJPEG_TURBO_ASFLAGS="-march=armv7-a -mfpu=neon"
+    LIBJPEG_TURBO_ARM_ASM=1
+  ;;
  esac

 fi

-dnl If we're on a system which supports libjpeg-turbo's asm routines and
-dnl --disable-libjpeg-turbo wasn't passed, check for yasm, and error out if it
-dnl doesn't exist or we have too old of a version.
+dnl If we're on an x86 or x64 system which supports libjpeg-turbo's asm routines
+dnl and --disable-libjpeg-turbo wasn't passed, check for Yasm, and error out if
+dnl it doesn't exist or we have too old of a version.
 if test -n "$LIBJPEG_TURBO_X86_ASM" -o -n "$LIBJPEG_TURBO_X64_ASM" ; then
-    AC_MSG_CHECKING([for YASM assembler])
+    AC_MSG_CHECKING([for Yasm assembler])
    AC_CHECK_PROGS(LIBJPEG_TURBO_AS, yasm, "")

    if test -z "$LIBJPEG_TURBO_AS" ; then
-        AC_MSG_ERROR([yasm is required to build with libjpeg-turbo's optimized JPEG decoding routines, but you do not appear to have yasm installed.  Either install it or configure with --disable-libjpeg-turbo to use the pure C JPEG decoder.  See https://developer.mozilla.org/en/YASM for more details.])
+        AC_MSG_ERROR([Yasm is required to build with libjpeg-turbo's optimized JPEG decoding routines, but you do not appear to have Yasm installed.  Either install it or configure with --disable-libjpeg-turbo to use the pure C JPEG decoder.  See https://developer.mozilla.org/en/YASM for more details.])
    fi

    dnl Check that we have the right yasm version.  We require 1.0.1 or newer
    dnl on Linux and 1.1 or newer everywhere else.
    if test "$OS_ARCH" = "Linux" ; then
        if test "$_YASM_MAJOR_VERSION" -lt "1" -o \( "$_YASM_MAJOR_VERSION" -eq "1" -a "$_YASM_MINOR_VERSION" -eq "0" -a "$_YASM_RELEASE" -lt "1" \) ; then
-            AC_MSG_ERROR([yasm 1.0.1 or greater is required to build with libjpeg-turbo's optimized JPEG decoding routines, but you appear to have version $_YASM_MAJOR_VERSION.$_YASM_MINOR_VERSION.$_YASM_RELEASE.  Upgrade to the newest version or configure with --disable-libjpeg-turbo to use the pure C JPEG decoder.  See https://developer.mozilla.org/en/YASM for more details.])
+            AC_MSG_ERROR([Yasm 1.0.1 or greater is required to build with libjpeg-turbo's optimized JPEG decoding routines, but you appear to have version $_YASM_MAJOR_VERSION.$_YASM_MINOR_VERSION.$_YASM_RELEASE.  Upgrade to the newest version or configure with --disable-libjpeg-turbo to use the pure C JPEG decoder.  See https://developer.mozilla.org/en/YASM for more details.])
        fi
    else
        if test "$_YASM_MAJOR_VERSION" -lt "1" -o \( "$_YASM_MAJOR_VERSION" -eq "1" -a "$_YASM_MINOR_VERSION" -lt "1" \) ; then
-            AC_MSG_ERROR([yasm 1.1 or greater is required to build with libjpeg-turbo's optimized JPEG decoding routines, but you appear to have version $_YASM_MAJOR_VERSION.$_YASM_MINOR_VERSION.  Upgrade to the newest version or configure with --disable-libjpeg-turbo to use the pure C JPEG decoder.  See https://developer.mozilla.org/en/YASM for more details.])
+            AC_MSG_ERROR([Yasm 1.1 or greater is required to build with libjpeg-turbo's optimized JPEG decoding routines, but you appear to have version $_YASM_MAJOR_VERSION.$_YASM_MINOR_VERSION.  Upgrade to the newest version or configure with --disable-libjpeg-turbo to use the pure C JPEG decoder.  See https://developer.mozilla.org/en/YASM for more details.])
        fi
    fi
 fi

+dnl If we're on an ARM system which supports libjpeg-turbo's asm routines and
+dnl --disable-libjpeg-turbo wasn't passed, use the C compiler as the assembler.
+if test -n "$LIBJPEG_TURBO_ARM_ASM" ; then
+    echo "Using $AS as the assembler for ARM code."
+    LIBJPEG_TURBO_AS=$AS
+fi
+
 if test -n "$LIBJPEG_TURBO_X86_ASM"; then
    AC_DEFINE(LIBJPEG_TURBO_X86_ASM)
 elif test -n "$LIBJPEG_TURBO_X64_ASM"; then
    AC_DEFINE(LIBJPEG_TURBO_X64_ASM)
+elif test -n "$LIBJPEG_TURBO_ARM_ASM"; then
+    AC_DEFINE(LIBJPEG_TURBO_ARM_ASM)
 elif test -n "$MOZ_LIBJPEG_TURBO"; then
    dnl Warn if we're not building the optimized routines, even though the user
    dnl didn't specify --disable-libjpeg-turbo.
@ -8756,6 +8771,7 @@ AC_SUBST(LIBJPEG_TURBO_AS)
 AC_SUBST(LIBJPEG_TURBO_ASFLAGS)
 AC_SUBST(LIBJPEG_TURBO_X86_ASM)
 AC_SUBST(LIBJPEG_TURBO_X64_ASM)
+AC_SUBST(LIBJPEG_TURBO_ARM_ASM)

 AC_MSG_CHECKING([for posix_fallocate])
 AC_TRY_LINK([#define _XOPEN_SOURCE 600
--- a/content/base/crashtests/700512-worker.js
+++ b/content/base/crashtests/700512-worker.js
@ -1,7 +1,7 @@
 onmessage = function(event) {
  var blob = event.data;

-  blob.mozSlice(1, 5);
+  blob.slice(1, 5);

  postMessage("done");
 }
--- a/content/base/public/nsIDOMFile.idl
+++ b/content/base/public/nsIDOMFile.idl
@ -71,9 +71,9 @@ interface nsIDOMBlob : nsISupports
  // blob: protocol handler
  [noscript] DOMString getInternalUrl(in nsIPrincipal principal);

-  [optional_argc] nsIDOMBlob mozSlice([optional] in long long start,
-                                      [optional] in long long end,
-                                      [optional] in DOMString contentType);
+  [optional_argc] nsIDOMBlob slice([optional] in long long start,
+                                   [optional] in long long end,
+                                   [optional] in DOMString contentType);

  // Get internal id of stored file. Returns -1 if it is not a stored file.
  // Intended only for testing. It can be called on any thread.
--- a/content/base/src/nsDOMBlobBuilder.cpp
+++ b/content/base/src/nsDOMBlobBuilder.cpp
@ -122,9 +122,9 @@ nsDOMMultipartFile::CreateSlice(PRUint64 aStart, PRUint64 aLength,
      PRUint64 upperBound = NS_MIN<PRUint64>(l - skipStart, length);

      nsCOMPtr<nsIDOMBlob> firstBlob;
-      rv = blob->MozSlice(skipStart, skipStart + upperBound,
-                          aContentType, 3,
-                          getter_AddRefs(firstBlob));
+      rv = blob->Slice(skipStart, skipStart + upperBound,
+                       aContentType, 3,
+                       getter_AddRefs(firstBlob));
      NS_ENSURE_SUCCESS(rv, nsnull);

      // Avoid wrapping a single blob inside an nsDOMMultipartFile
@ -150,8 +150,8 @@ nsDOMMultipartFile::CreateSlice(PRUint64 aStart, PRUint64 aLength,

    if (length < l) {
      nsCOMPtr<nsIDOMBlob> lastBlob;
-      rv = blob->MozSlice(0, length, aContentType, 3,
-                          getter_AddRefs(lastBlob));
+      rv = blob->Slice(0, length, aContentType, 3,
+                       getter_AddRefs(lastBlob));
      NS_ENSURE_SUCCESS(rv, nsnull);

      blobs.AppendElement(lastBlob);
--- a/content/base/src/nsDOMFile.cpp
+++ b/content/base/src/nsDOMFile.cpp
@ -238,9 +238,9 @@ ParseSize(PRInt64 aSize, PRInt64& aStart, PRInt64& aEnd)
 }

 NS_IMETHODIMP
-nsDOMFileBase::MozSlice(PRInt64 aStart, PRInt64 aEnd,
-                        const nsAString& aContentType, PRUint8 optional_argc,
-                        nsIDOMBlob **aBlob)
+nsDOMFileBase::Slice(PRInt64 aStart, PRInt64 aEnd,
+                     const nsAString& aContentType, PRUint8 optional_argc,
+                     nsIDOMBlob **aBlob)
 {
  *aBlob = nsnull;

--- a/content/base/src/nsGenericElement.cpp
+++ b/content/base/src/nsGenericElement.cpp
@ -1700,9 +1700,29 @@ nsINode::SetExplicitBaseURI(nsIURI* aURI)

 //----------------------------------------------------------------------

+static JSObject*
+GetJSObjectChild(nsWrapperCache* aCache)
+{
+  if (aCache->PreservingWrapper()) {
+    return aCache->GetWrapperPreserveColor();
+  }
+  return aCache->GetExpandoObjectPreserveColor();
+}
+
+static bool
+NeedsScriptTraverse(nsWrapperCache* aCache)
+{
+  JSObject* o = GetJSObjectChild(aCache);
+  return o && xpc_IsGrayGCThing(o);
+}
+
+//----------------------------------------------------------------------
+
 NS_IMPL_CYCLE_COLLECTING_ADDREF(nsChildContentList)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(nsChildContentList)

+// If nsChildContentList is changed so that any additional fields are
+// traversed by the cycle collector, then CAN_SKIP must be updated.
 NS_IMPL_CYCLE_COLLECTION_CLASS(nsChildContentList)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsChildContentList)
  NS_IMPL_CYCLE_COLLECTION_UNLINK_PRESERVED_WRAPPER
@ -1714,6 +1734,20 @@ NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN(nsChildContentList)
  NS_IMPL_CYCLE_COLLECTION_TRACE_PRESERVED_WRAPPER
 NS_IMPL_CYCLE_COLLECTION_TRACE_END

+// nsChildContentList only ever has a single child, its wrapper, so if
+// the wrapper is black, the list can't be part of a garbage cycle.
+NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_BEGIN(nsChildContentList)
+  return !NeedsScriptTraverse(tmp);
+NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_END
+
+NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_IN_CC_BEGIN(nsChildContentList)
+  return !NeedsScriptTraverse(tmp);
+NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_IN_CC_END
+
+// CanSkipThis returns false to avoid problems with incomplete unlinking.
+NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_THIS_BEGIN(nsChildContentList)
+NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_THIS_END
+
 NS_INTERFACE_TABLE_HEAD(nsChildContentList)
  NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
  NS_NODELIST_OFFSET_AND_INTERFACE_TABLE_BEGIN(nsChildContentList)
@ -4405,22 +4439,6 @@ NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN(nsGenericElement)
  nsINode::Trace(tmp, aCallback, aClosure);
 NS_IMPL_CYCLE_COLLECTION_TRACE_END

-static JSObject*
-GetJSObjectChild(nsINode* aNode)
-{
-  if (aNode->PreservingWrapper()) {
-    return aNode->GetWrapperPreserveColor();
-  }
-  return aNode->GetExpandoObjectPreserveColor();
-}
-                                  
-static bool
-NeedsScriptTraverse(nsINode* aNode)
-{
-  JSObject* o = GetJSObjectChild(aNode);
-  return o && xpc_IsGrayGCThing(o);
-}
-
 void
 nsGenericElement::MarkUserData(void* aObject, nsIAtom* aKey, void* aChild,
                               void* aData)
--- a/content/base/src/nsGenericElement.h
+++ b/content/base/src/nsGenericElement.h
@ -102,7 +102,7 @@ public:
  }

  NS_DECL_CYCLE_COLLECTING_ISUPPORTS
-  NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(nsChildContentList)
+  NS_DECL_CYCLE_COLLECTION_SKIPPABLE_SCRIPT_HOLDER_CLASS(nsChildContentList)

  // nsWrapperCache
  virtual JSObject* WrapObject(JSContext *cx, XPCWrappedNativeScope *scope,
--- a/content/base/test/fileutils.js
+++ b/content/base/test/fileutils.js
@ -201,24 +201,24 @@ function testSlice(file, size, type, contents, fileType) {
  ok(file instanceof File, fileType + " file is a File");
  ok(file instanceof Blob, fileType + " file is also a Blob");
  
-  var slice = file.mozSlice(0, size);
+  var slice = file.slice(0, size);
  ok(slice instanceof Blob, fileType + " fullsize slice is a Blob");
  ok(!(slice instanceof File), fileType + " fullsize slice is not a File");
  
-  slice = file.mozSlice(0, 1234);
+  slice = file.slice(0, 1234);
  ok(slice instanceof Blob, fileType + " sized slice is a Blob");
  ok(!(slice instanceof File), fileType + " sized slice is not a File");
  
-  slice = file.mozSlice(0, size, "foo/bar");
+  slice = file.slice(0, size, "foo/bar");
  is(slice.type, "foo/bar", fileType + " fullsize slice foo/bar type");

-  slice = file.mozSlice(0, 5432, "foo/bar");
+  slice = file.slice(0, 5432, "foo/bar");
  is(slice.type, "foo/bar", fileType + " sized slice foo/bar type");
  
-  is(slice.mozSlice(0, 10).type, "", fileType + " slice-slice type");
-  is(slice.mozSlice(0, 10).size, 10, fileType + " slice-slice size");
-  is(slice.mozSlice(0, 10, "hello/world").type, "hello/world", fileType + " slice-slice hello/world type");
-  is(slice.mozSlice(0, 10, "hello/world").size, 10, fileType + " slice-slice hello/world size");
+  is(slice.slice(0, 10).type, "", fileType + " slice-slice type");
+  is(slice.slice(0, 10).size, 10, fileType + " slice-slice size");
+  is(slice.slice(0, 10, "hello/world").type, "hello/world", fileType + " slice-slice hello/world type");
+  is(slice.slice(0, 10, "hello/world").size, 10, fileType + " slice-slice hello/world size");

  // Start, end, expected size
  var indexes = [[0, size, size],
@ -247,17 +247,17 @@ function testSlice(file, size, type, contents, fileType) {
    var sliceContents;
    var testName;
    if (indexes[i][0] == undefined) {
-      slice = file.mozSlice();
+      slice = file.slice();
      sliceContents = contents.slice();
      testName = fileType + " slice()";
    }
    else if (indexes[i][1] == undefined) {
-      slice = file.mozSlice(indexes[i][0]);
+      slice = file.slice(indexes[i][0]);
      sliceContents = contents.slice(indexes[i][0]);
      testName = fileType + " slice(" + indexes[i][0] + ")";
    }
    else {
-      slice = file.mozSlice(indexes[i][0], indexes[i][1]);
+      slice = file.slice(indexes[i][0], indexes[i][1]);
      sliceContents = contents.slice(indexes[i][0], indexes[i][1]);
      testName = fileType + " slice(" + indexes[i][0] + ", " + indexes[i][1] + ")";
    }
@ -268,11 +268,11 @@ function testSlice(file, size, type, contents, fileType) {
  }

  // Slice of slice
-  var slice = file.mozSlice(0, 40000);
-  testFile(slice.mozSlice(5000, 42000), contents.slice(5000, 40000), "file slice slice");
+  var slice = file.slice(0, 40000);
+  testFile(slice.slice(5000, 42000), contents.slice(5000, 40000), "file slice slice");
  
  // ...of slice of slice
-  slice = slice.mozSlice(5000, 42000).mozSlice(400, 700);
+  slice = slice.slice(5000, 42000).slice(400, 700);
  SpecialPowers.gc();
  testFile(slice, contents.slice(5400, 5700), "file slice slice slice");
 }
--- a/content/base/test/test_blobbuilder.html
+++ b/content/base/test/test_blobbuilder.html
@ -151,7 +151,7 @@ function doTest(data) {
    ok(blob instanceof Blob, "Test " + testCounter + " blob is a Blob");
    ok(!(blob instanceof File), "Test " + testCounter + " blob is not a File");

-    let slice = blob.mozSlice(test.start, test.start + test.length);
+    let slice = blob.slice(test.start, test.start + test.length);
    ok(slice, "Test " + testCounter + " got slice");
    ok(slice instanceof Blob, "Test " + testCounter + " slice is a Blob");
    ok(!(slice instanceof File), "Test " + testCounter + " slice is not a File");
--- a/content/base/test/test_fileapi_slice.html
+++ b/content/base/test/test_fileapi_slice.html
@ -104,7 +104,7 @@ function imageLoadHandler(event) {
 var imgfile = createFileWithData(testBinaryData + fileData + testBinaryData);
 is(imgfile.size, size + testBinaryData.length * 2, "correct file size (middle)");
 var img = new Image;
-img.src = URL.createObjectURL(imgfile.mozSlice(testBinaryData.length, testBinaryData.length + size));
+img.src = URL.createObjectURL(imgfile.slice(testBinaryData.length, testBinaryData.length + size));
 img.onload = imageLoadHandler;
 expectedTestCount++;

@ -112,7 +112,7 @@ expectedTestCount++;
 var imgfile = createFileWithData(fileData + testBinaryData);
 is(imgfile.size, size + testBinaryData.length, "correct file size (start)");
 var img = new Image;
-img.src = URL.createObjectURL(imgfile.mozSlice(0, size));
+img.src = URL.createObjectURL(imgfile.slice(0, size));
 img.onload = imageLoadHandler;
 expectedTestCount++;

@ -120,7 +120,7 @@ expectedTestCount++;
 var imgfile = createFileWithData(testBinaryData + fileData);
 is(imgfile.size, size + testBinaryData.length, "correct file size (end)");
 var img = new Image;
-img.src = URL.createObjectURL(imgfile.mozSlice(testBinaryData.length, testBinaryData.length + size));
+img.src = URL.createObjectURL(imgfile.slice(testBinaryData.length, testBinaryData.length + size));
 img.onload = imageLoadHandler;
 expectedTestCount++;

@ -128,7 +128,7 @@ expectedTestCount++;
 var imgfile = createFileWithData(testBinaryData + fileData);
 is(imgfile.size, size + testBinaryData.length, "correct file size (past end)");
 var img = new Image;
-img.src = URL.createObjectURL(imgfile.mozSlice(testBinaryData.length, testBinaryData.length + size + 1000));
+img.src = URL.createObjectURL(imgfile.slice(testBinaryData.length, testBinaryData.length + size + 1000));
 img.onload = imageLoadHandler;
 expectedTestCount++;

--- a/content/canvas/src/WebGLContext.h
+++ b/content/canvas/src/WebGLContext.h
@ -1024,7 +1024,7 @@ struct WebGLVertexAttribData {
    }
 };

-class WebGLBuffer
+class WebGLBuffer MOZ_FINAL
    : public nsIWebGLBuffer
    , public WebGLRefCountedObject<WebGLBuffer>
    , public WebGLContextBoundObject
@ -1158,7 +1158,7 @@ protected:
    void* mData; // in the case of an Element Array Buffer, we keep a copy.
 };

-class WebGLTexture
+class WebGLTexture MOZ_FINAL
    : public nsIWebGLTexture
    , public WebGLRefCountedObject<WebGLTexture>
    , public WebGLContextBoundObject
@ -1608,7 +1608,7 @@ public:
    }
 };

-class WebGLShader
+class WebGLShader MOZ_FINAL
    : public nsIWebGLShader
    , public WebGLRefCountedObject<WebGLShader>
    , public WebGLContextBoundObject
@ -1673,7 +1673,7 @@ protected:
    WebGLMonotonicHandle mMonotonicHandle;
 };

-class WebGLProgram
+class WebGLProgram MOZ_FINAL
    : public nsIWebGLProgram
    , public WebGLRefCountedObject<WebGLProgram>
    , public WebGLContextBoundObject
@ -1795,7 +1795,7 @@ protected:
    WebGLMonotonicHandle mMonotonicHandle;
 };

-class WebGLRenderbuffer
+class WebGLRenderbuffer MOZ_FINAL
    : public nsIWebGLRenderbuffer
    , public WebGLRefCountedObject<WebGLRenderbuffer>
    , public WebGLRectangleObject
@ -2001,7 +2001,7 @@ public:
    }
 };

-class WebGLFramebuffer
+class WebGLFramebuffer MOZ_FINAL
    : public nsIWebGLFramebuffer
    , public WebGLRefCountedObject<WebGLFramebuffer>
    , public WebGLContextBoundObject
@ -2296,7 +2296,7 @@ public:
    WebGLMonotonicHandle mMonotonicHandle;
 };

-class WebGLUniformLocation
+class WebGLUniformLocation MOZ_FINAL
    : public nsIWebGLUniformLocation
    , public WebGLContextBoundObject
    , public WebGLRefCountedObject<WebGLUniformLocation>
@ -2337,7 +2337,7 @@ protected:
    friend class WebGLProgram;
 };

-class WebGLActiveInfo
+class WebGLActiveInfo MOZ_FINAL
    : public nsIWebGLActiveInfo
 {
 public:
@ -2356,7 +2356,7 @@ protected:
    nsString mName;
 };

-class WebGLShaderPrecisionFormat
+class WebGLShaderPrecisionFormat MOZ_FINAL
    : public nsIWebGLShaderPrecisionFormat
 {
 public:
--- a/content/canvas/src/WebGLContextGL.cpp
+++ b/content/canvas/src/WebGLContextGL.cpp
@ -4377,7 +4377,7 @@ WebGLContext::CompileShader(nsIWebGLShader *sobj)
        // ESSL backend
        compiler = ShConstructCompiler((ShShaderType) shader->ShaderType(),
                                       SH_WEBGL_SPEC,
-#ifdef MOZ_WIDGET_ANDROID
+#ifdef ANDROID
                                       SH_GLSL_OUTPUT,
 #else
                                       gl->IsGLES2() ? SH_ESSL_OUTPUT : SH_GLSL_OUTPUT,
--- a/content/canvas/src/nsCanvasRenderingContext2D.cpp
+++ b/content/canvas/src/nsCanvasRenderingContext2D.cpp
@ -180,7 +180,7 @@ CopyContext(gfxContext* dest, gfxContext* src)
 **/
 #define NS_CANVASGRADIENT_PRIVATE_IID \
    { 0x491d39d8, 0x4058, 0x42bd, { 0xac, 0x76, 0x70, 0xd5, 0x62, 0x7f, 0x02, 0x10 } }
-class nsCanvasGradient : public nsIDOMCanvasGradient
+class nsCanvasGradient MOZ_FINAL : public nsIDOMCanvasGradient
 {
 public:
    NS_DECLARE_STATIC_IID_ACCESSOR(NS_CANVASGRADIENT_PRIVATE_IID)
@ -238,7 +238,7 @@ NS_INTERFACE_MAP_END
 **/
 #define NS_CANVASPATTERN_PRIVATE_IID \
    { 0xb85c6c8a, 0x0624, 0x4530, { 0xb8, 0xee, 0xff, 0xdf, 0x42, 0xe8, 0x21, 0x6d } }
-class nsCanvasPattern : public nsIDOMCanvasPattern
+class nsCanvasPattern MOZ_FINAL : public nsIDOMCanvasPattern
 {
 public:
    NS_DECLARE_STATIC_IID_ACCESSOR(NS_CANVASPATTERN_PRIVATE_IID)
--- a/content/canvas/test/webgl/failing_tests_mac.txt
+++ b/content/canvas/test/webgl/failing_tests_mac.txt
@ -7,3 +7,5 @@ conformance/more/conformance/quickCheckAPI-S_V.html
 conformance/glsl/misc/attrib-location-length-limits.html
 conformance/glsl/misc/uniform-location-length-limits.html
 conformance/programs/program-test.html
+conformance/textures/texture-mips.html
+conformance/textures/texture-npot.html
--- a/dom/interfaces/css/nsIDOMCSSStyleDeclaration.idl
+++ b/dom/interfaces/css/nsIDOMCSSStyleDeclaration.idl
@ -60,7 +60,7 @@ interface nsIDOMCSSStyleDeclaration : nsISupports
  DOMString          getPropertyPriority(in DOMString propertyName);
  void               setProperty(in DOMString propertyName, 
                                 in DOMString value, 
-                                 in DOMString priority)
+                                 [optional] in DOMString priority)
                                        raises(DOMException);
  readonly attribute unsigned long    length;
  DOMString          item(in unsigned long index);
--- a/dom/plugins/base/nsPluginHost.cpp
+++ b/dom/plugins/base/nsPluginHost.cpp
@ -3115,8 +3115,13 @@ nsresult nsPluginHost::NewPluginURLStream(const nsString& aURL,
  // deal with headers and post data
  nsCOMPtr<nsIHttpChannel> httpChannel(do_QueryInterface(channel));
  if (httpChannel) {
-    rv = httpChannel->SetReferrer(doc->GetDocumentURI());  
-    NS_ENSURE_SUCCESS(rv,rv);
+    if (!aPostStream) {
+      // Only set the Referer header for GET requests because IIS throws
+      // errors about malformed requests if we include it in POSTs. See
+      // bug 724465.
+      rv = httpChannel->SetReferrer(doc->GetDocumentURI());  
+      NS_ENSURE_SUCCESS(rv,rv);
+    }
      
    if (aPostStream) {
      // XXX it's a bit of a hack to rewind the postdata stream
--- a/dom/plugins/base/nsPluginInstanceOwner.cpp
+++ b/dom/plugins/base/nsPluginInstanceOwner.cpp
@ -1390,7 +1390,19 @@ void nsPluginInstanceOwner::CARefresh(nsITimer *aTimer, void *aClosure) {
  }
 }

-void nsPluginInstanceOwner::AddToCARefreshTimer(nsPluginInstanceOwner *aPluginInstance) {
+void nsPluginInstanceOwner::AddToCARefreshTimer() {
+  if (!mInstance) {
+    return;
+  }
+
+  // Flash invokes InvalidateRect for us.
+  const char* mime = nsnull;
+  if (NS_SUCCEEDED(mInstance->GetMIMEType(&mime)) && mime) {
+    if (strcmp(mime, "application/x-shockwave-flash") == 0) {
+      return;
+    }
+  }
+
  if (!sCARefreshListeners) {
    sCARefreshListeners = new nsTArray<nsPluginInstanceOwner*>();
    if (!sCARefreshListeners) {
@ -1398,9 +1410,11 @@ void nsPluginInstanceOwner::AddToCARefreshTimer(nsPluginInstanceOwner *aPluginIn
    }
  }

-  NS_ASSERTION(!sCARefreshListeners->Contains(aPluginInstance), 
-      "pluginInstanceOwner already registered as a listener");
-  sCARefreshListeners->AppendElement(aPluginInstance);
+  if (sCARefreshListeners->Contains(this)) {
+    return;
+  }
+
+  sCARefreshListeners->AppendElement(this);

  if (!sCATimer) {
    sCATimer = new nsCOMPtr<nsITimer>();
@ -1416,12 +1430,12 @@ void nsPluginInstanceOwner::AddToCARefreshTimer(nsPluginInstanceOwner *aPluginIn
  }
 }

-void nsPluginInstanceOwner::RemoveFromCARefreshTimer(nsPluginInstanceOwner *aPluginInstance) {
-  if (!sCARefreshListeners || sCARefreshListeners->Contains(aPluginInstance) == false) {
+void nsPluginInstanceOwner::RemoveFromCARefreshTimer() {
+  if (!sCARefreshListeners || sCARefreshListeners->Contains(this) == false) {
    return;
  }

-  sCARefreshListeners->RemoveElement(aPluginInstance);
+  sCARefreshListeners->RemoveElement(this);

  if (sCARefreshListeners->Length() == 0) {
    if (sCATimer) {
@ -1434,21 +1448,6 @@ void nsPluginInstanceOwner::RemoveFromCARefreshTimer(nsPluginInstanceOwner *aPlu
  }
 }

-void nsPluginInstanceOwner::SetupCARefresh()
-{
-  if (!mInstance) {
-    return;
-  }
-
-  const char* mime = nsnull;
-  if (NS_SUCCEEDED(mInstance->GetMIMEType(&mime)) && mime) {
-    // Flash invokes InvalidateRect for us.
-    if (strcmp(mime, "application/x-shockwave-flash") != 0) {
-    AddToCARefreshTimer(this);
-  }
-}
-}
-
 void nsPluginInstanceOwner::RenderCoreAnimation(CGContextRef aCGContext,
                                                int aWidth, int aHeight)
 {
@ -2699,7 +2698,7 @@ nsPluginInstanceOwner::Destroy()
  CancelTimer();
 #endif
 #ifdef XP_MACOSX
-  RemoveFromCARefreshTimer(this);
+  RemoveFromCARefreshTimer();
  if (mColorProfile)
    ::CGColorSpaceRelease(mColorProfile);  
 #endif
@ -3277,7 +3276,7 @@ NS_IMETHODIMP nsPluginInstanceOwner::CreateWidget(void)
 {
  NS_ENSURE_TRUE(mPluginWindow, NS_ERROR_NULL_POINTER);

-    nsresult rv = NS_ERROR_FAILURE;
+  nsresult rv = NS_ERROR_FAILURE;
  
  // Can't call this twice!
  if (mWidget) {
@ -3318,6 +3317,21 @@ NS_IMETHODIMP nsPluginInstanceOwner::CreateWidget(void)
    mWidget->EnableDragDrop(true);
    mWidget->Show(false);
    mWidget->Enable(false);
+
+#ifdef XP_MACOSX
+    // Now that we have a widget we want to set the event model before
+    // any events are processed.
+    nsCOMPtr<nsIPluginWidget> pluginWidget = do_QueryInterface(mWidget);
+    if (!pluginWidget) {
+      return NS_ERROR_FAILURE;
+    }
+    pluginWidget->SetPluginEventModel(GetEventModel());
+    pluginWidget->SetPluginDrawingModel(GetDrawingModel());
+
+    if (GetDrawingModel() == NPDrawingModelCoreAnimation) {
+      AddToCARefreshTimer();
+    }
+#endif
  }

  if (mObjectFrame) {
--- a/dom/plugins/base/nsPluginInstanceOwner.h
+++ b/dom/plugins/base/nsPluginInstanceOwner.h
@ -182,9 +182,8 @@ public:
  bool IsRemoteDrawingCoreAnimation();
  NPEventModel GetEventModel();
  static void CARefresh(nsITimer *aTimer, void *aClosure);
-  static void AddToCARefreshTimer(nsPluginInstanceOwner *aPluginInstance);
-  static void RemoveFromCARefreshTimer(nsPluginInstanceOwner *aPluginInstance);
-  void SetupCARefresh();
+  void AddToCARefreshTimer();
+  void RemoveFromCARefreshTimer();
  // This calls into the plugin (NPP_SetWindow) and can run script.
  void* FixUpPluginWindow(PRInt32 inPaintState);
  void HidePluginWindow();
--- a/dom/plugins/test/mochitest/Makefile.in
+++ b/dom/plugins/test/mochitest/Makefile.in
@ -109,6 +109,8 @@ _MOCHITEST_FILES = \
  test_instance_unparent1.html \
  test_instance_unparent2.html \
  test_instance_unparent3.html \
+  test_pluginstream_referer.html \
+  plugin-stream-referer.sjs \
  $(NULL)

 #  test_plugin_scroll_painting.html \ bug 596491
--- a/dom/plugins/test/mochitest/plugin-stream-referer.sjs
+++ b/dom/plugins/test/mochitest/plugin-stream-referer.sjs
@ -0,0 +1,10 @@
+function handleRequest(request, response)
+{
+  response.setHeader('Content-Type', 'text/plain', false);
+  if (request.hasHeader('Referer')) {
+    response.write('Referer found: ' + request.getHeader('Referer'));
+  }
+  else {
+    response.write('No Referer found');
+  }
+}
--- a/dom/plugins/test/mochitest/test_pluginstream_referer.html
+++ b/dom/plugins/test/mochitest/test_pluginstream_referer.html
@ -0,0 +1,42 @@
+<head>
+  <title>Do plugin stream requests send the Referer header correctly?</title>
+  <script type="application/javascript"
+	  src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" 
+        href="/tests/SimpleTest/test.css" />
+
+<body onload="runTests()">
+  <p id="display"></p>
+
+  <embed id="plugin1" type="application/x-test" width="200" height="200"></embed>
+
+  <script class="testbody" type="application/javascript">
+  SimpleTest.waitForExplicitFinish();
+
+  var pending = 2;
+  function testDone() {
+    --pending;
+    if (0 == pending)
+      SimpleTest.finish()
+  }
+
+  function runTests() {
+    var p = document.getElementById('plugin1');
+
+    ok(p.streamTest('plugin-stream-referer.sjs', false, null, null,
+                    function(r, t) {
+                      is(r, 0, "GET plugin-stream-referer.sjs");
+                      is(t, "Referer found: " + window.location,
+                         "GET Referer correct");
+                      testDone();
+                    }, null, true), "referer GET");
+
+    ok(p.streamTest('plugin-stream-referer.sjs', true, "Dummy Data", null,
+                    function(r, t) {
+                      is(r, 0, "POST plugin-stream-referer.sjs");
+                      is(t, "No Referer found", "POST Referer absent");
+                      testDone();
+                    }, null, true), "referer POST");
+  }
+  </script>
+
--- a/dom/workers/File.cpp
+++ b/dom/workers/File.cpp
@ -171,14 +171,14 @@ private:
  }

  static JSBool
-  MozSlice(JSContext* aCx, uintN aArgc, jsval* aVp)
+  Slice(JSContext* aCx, uintN aArgc, jsval* aVp)
  {
    JSObject* obj = JS_THIS_OBJECT(aCx, aVp);
    if (!obj) {
      return false;
    }

-    nsIDOMBlob* blob = GetInstancePrivate(aCx, obj, "mozSlice");
+    nsIDOMBlob* blob = GetInstancePrivate(aCx, obj, "slice");
    if (!blob) {
      return false;
    }
@ -197,10 +197,10 @@ private:

    PRUint8 optionalArgc = aArgc;
    nsCOMPtr<nsIDOMBlob> rtnBlob;
-    if (NS_FAILED(blob->MozSlice(static_cast<PRUint64>(start),
-                                 static_cast<PRUint64>(end),
-                                 contentType, optionalArgc,
-                                 getter_AddRefs(rtnBlob)))) {
+    if (NS_FAILED(blob->Slice(static_cast<PRUint64>(start),
+                              static_cast<PRUint64>(end),
+                              contentType, optionalArgc,
+                              getter_AddRefs(rtnBlob)))) {
      ThrowFileExceptionForCode(aCx, FILE_NOT_READABLE_ERR);
      return false;
    }
@ -230,7 +230,7 @@ JSPropertySpec Blob::sProperties[] = {
 };

 JSFunctionSpec Blob::sFunctions[] = {
-  JS_FN("mozSlice", MozSlice, 1, JSPROP_ENUMERATE),
+  JS_FN("slice", Slice, 1, JSPROP_ENUMERATE),
  JS_FS_END
 };

--- a/dom/workers/test/Makefile.in
+++ b/dom/workers/test/Makefile.in
@ -136,21 +136,21 @@ _CHROME_TEST_FILES = \
  test_extension.xul \
  test_extensionBootstrap.xul \
  test_file.xul \
-  test_fileMozSlice.xul \
+  test_fileSlice.xul \
  test_fileBlobPosting.xul \
  test_filePosting.xul \
  test_fileReaderSync.xul \
  test_fileReaderSyncErrors.xul \
-  test_fileReadMozSlice.xul \
+  test_fileReadSlice.xul \
  test_fileSubWorker.xul \
  test_fileBlobSubWorker.xul \
  file_worker.js \
  fileBlob_worker.js \
-  fileMozSlice_worker.js \
+  fileSlice_worker.js \
  filePosting_worker.js \
  fileReaderSync_worker.js \
  fileReaderSyncErrors_worker.js \
-  fileReadMozSlice_worker.js \
+  fileReadSlice_worker.js \
  fileSubWorker_worker.js \
  fileBlobSubWorker_worker.js \
  WorkerTest.jsm \
--- a/dom/workers/test/fileReadMozSlice_worker.js
+++ b/dom/workers/test/fileReadMozSlice_worker.js
@ -7,7 +7,7 @@ onmessage = function(event) {
  var start = event.data.start;
  var end = event.data.end;

-  var slicedBlob = blob.mozSlice(start, end);
+  var slicedBlob = blob.slice(start, end);

  var fileReader = new FileReaderSync();
  var text = fileReader.readAsText(slicedBlob);
--- a/dom/workers/test/fileMozSlice_worker.js
+++ b/dom/workers/test/fileMozSlice_worker.js
@ -11,11 +11,11 @@ onmessage = function(event) {

  var slicedBlob;
  if (contentType == undefined && end == undefined) {
-    slicedBlob = blob.mozSlice(start);
+    slicedBlob = blob.slice(start);
  } else if (contentType == undefined) {
-    slicedBlob = blob.mozSlice(start, end);
+    slicedBlob = blob.slice(start, end);
  } else {
-    slicedBlob = blob.mozSlice(start, end, contentType);
+    slicedBlob = blob.slice(start, end, contentType);
  }

  var rtnObj = new Object();
--- a/dom/workers/test/test_fileBlobPosting.xul
+++ b/dom/workers/test/test_fileBlobPosting.xul
@ -70,7 +70,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=664783
      finish();
    };

-    var blob = file.mozSlice();
+    var blob = file.slice();
    worker.postMessage(blob);
    waitForWorkerFinish();
  }
--- a/dom/workers/test/test_fileBlobSubWorker.xul
+++ b/dom/workers/test/test_fileBlobSubWorker.xul
@ -72,7 +72,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=664783
      finish();
    };

-    var blob = file.mozSlice();
+    var blob = file.slice();
    worker.postMessage(blob);
    waitForWorkerFinish();
  }
--- a/dom/workers/test/test_fileReadMozSlice.xul
+++ b/dom/workers/test/test_fileReadMozSlice.xul
@ -36,7 +36,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=664783
    var testFile = Components.classes["@mozilla.org/file/directory_service;1"]
                       .getService(Components.interfaces.nsIProperties)
                       .get("ProfD", Components.interfaces.nsIFile);
-    testFile.append("workerReadMozSlice" + fileNum++);
+    testFile.append("workerReadSlice" + fileNum++);

    var outStream = Components.classes["@mozilla.org/network/file-output-stream;1"]
                        .createInstance(Components.interfaces.nsIFileOutputStream);
@ -55,8 +55,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=664783
   * Creates a worker which slices a blob to the given start and end offset and
   * reads the content as text.
   */
-  function readMozSlice(blob, start, end, expectedText) {
-    var worker = new Worker("fileReadMozSlice_worker.js");
+  function readSlice(blob, start, end, expectedText) {
+    var worker = new Worker("fileReadSlice_worker.js");

    worker.onerror = function(event) {
      ok(false, "Worker had an error: " + event.data);
@ -74,16 +74,16 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=664783
  }

  // Empty file.
-  readMozSlice(createFileWithData(""), 0, 0, "");
+  readSlice(createFileWithData(""), 0, 0, "");

  // Typical use case.
-  readMozSlice(createFileWithData("HelloBye"), 5, 8, "Bye");
+  readSlice(createFileWithData("HelloBye"), 5, 8, "Bye");

  // End offset too large.
-  readMozSlice(createFileWithData("HelloBye"), 5, 9, "Bye");
+  readSlice(createFileWithData("HelloBye"), 5, 9, "Bye");

  // Start of file.
-  readMozSlice(createFileWithData("HelloBye"), 0, 5, "Hello");
+  readSlice(createFileWithData("HelloBye"), 0, 5, "Hello");

  ]]>
  </script>
--- a/dom/workers/test/test_fileMozSlice.xul
+++ b/dom/workers/test/test_fileMozSlice.xul
@ -37,7 +37,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=664783
                       .getService(Components.interfaces.nsIProperties)
                       .get("ProfD", Components.interfaces.nsIFile);
    var fileExtension = (extension == undefined) ? "" : "." + extension;
-    testFile.append("workerMozSlice" + fileNum++ + fileExtension);
+    testFile.append("workerSlice" + fileNum++ + fileExtension);

    var outStream = Components.classes["@mozilla.org/network/file-output-stream;1"]
                        .createInstance(Components.interfaces.nsIFileOutputStream);
@ -56,8 +56,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=664783
   * Starts a worker which slices the blob to the given start offset and optional end offset and
   * content type. It then verifies that the size and type of the sliced blob is correct.
   */
-  function createMozSlice(blob, start, expectedLength, /** optional */ end, /** optional */ contentType) {
-    var worker = new Worker("fileMozSlice_worker.js");
+  function createSlice(blob, start, expectedLength, /** optional */ end, /** optional */ contentType) {
+    var worker = new Worker("fileSlice_worker.js");

    worker.onerror = function(event) {
      ok(false, "Worker had an error: " + event.data);
@ -76,30 +76,30 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=664783
  }

  // Empty file.
-  createMozSlice(createFileWithData(""), 0, 0, 0);
+  createSlice(createFileWithData(""), 0, 0, 0);

  // Typical use case.
-  createMozSlice(createFileWithData("Hello"), 1, 1, 2);
+  createSlice(createFileWithData("Hello"), 1, 1, 2);

  // Longish file.
  var text = "";
  for (var i = 0; i < 10000; ++i) {
    text += "long";
  }
-  createMozSlice(createFileWithData(text), 2000, 2000, 4000);
+  createSlice(createFileWithData(text), 2000, 2000, 4000);

  // Slice to different type.
-  createMozSlice(createFileWithData("text", "txt"), 0, 2, 2, "image/png");
+  createSlice(createFileWithData("text", "txt"), 0, 2, 2, "image/png");

  // Length longer than blob.
-  createMozSlice(createFileWithData("text"), 0, 4, 20);
+  createSlice(createFileWithData("text"), 0, 4, 20);

  // Start longer than blob.
-  createMozSlice(createFileWithData("text"), 20, 0, 4);
+  createSlice(createFileWithData("text"), 20, 0, 4);

  // No optional arguments
-  createMozSlice(createFileWithData("text"), 0, 4);
-  createMozSlice(createFileWithData("text"), 2, 2);
+  createSlice(createFileWithData("text"), 0, 4);
+  createSlice(createFileWithData("text"), 2, 2);

  ]]>
  </script>
--- a/editor/composer/src/nsEditorSpellCheck.cpp
+++ b/editor/composer/src/nsEditorSpellCheck.cpp
@ -83,7 +83,7 @@ class UpdateDictionnaryHolder {

 #define CPS_PREF_NAME NS_LITERAL_STRING("spellcheck.lang")

-class LastDictionary {
+class LastDictionary MOZ_FINAL {
 public:
  /**
   * Store current dictionary for editor document url. Use content pref
--- a/editor/libeditor/html/nsHTMLAnonymousUtils.cpp
+++ b/editor/libeditor/html/nsHTMLAnonymousUtils.cpp
@ -102,7 +102,7 @@ static PRInt32 GetCSSFloatValue(nsIDOMCSSStyleDeclaration * aDecl,
  return (PRInt32) f;
 }

-class nsElementDeletionObserver : public nsIMutationObserver
+class nsElementDeletionObserver MOZ_FINAL : public nsIMutationObserver
 {
 public:
  nsElementDeletionObserver(nsINode* aNativeAnonNode, nsINode* aObservedNode)
--- a/embedding/browser/webBrowser/nsIWebBrowserChrome.idl
+++ b/embedding/browser/webBrowser/nsIWebBrowserChrome.idl
@ -47,7 +47,7 @@ interface nsIDocShellTreeItem;
 * containing an embedded Gecko web browser.
 */

-[scriptable, uuid(BA434C60-9D52-11d3-AFB0-00A024FFC08C)]
+[scriptable, uuid(E8C414C4-DC38-4BA3-AB4E-EC4CBBE22907)]
 interface nsIWebBrowserChrome : nsISupports
 {
    const unsigned long STATUS_SCRIPT         = 0x00000001;
@ -75,43 +75,47 @@ interface nsIWebBrowserChrome : nsISupports
    /**
     * Definitions for the chrome flags
     */
-    const unsigned long CHROME_DEFAULT          = 0x00000001;
-    const unsigned long CHROME_WINDOW_BORDERS   = 0x00000002;
-    const unsigned long CHROME_WINDOW_CLOSE     = 0x00000004;
-    const unsigned long CHROME_WINDOW_RESIZE    = 0x00000008;
-    const unsigned long CHROME_MENUBAR          = 0x00000010;
-    const unsigned long CHROME_TOOLBAR          = 0x00000020;
-    const unsigned long CHROME_LOCATIONBAR      = 0x00000040;
-    const unsigned long CHROME_STATUSBAR        = 0x00000080;
-    const unsigned long CHROME_PERSONAL_TOOLBAR = 0x00000100;
-    const unsigned long CHROME_SCROLLBARS       = 0x00000200;
-    const unsigned long CHROME_TITLEBAR         = 0x00000400;
-    const unsigned long CHROME_EXTRA            = 0x00000800;
+    const unsigned long CHROME_DEFAULT                = 0x00000001;
+    const unsigned long CHROME_WINDOW_BORDERS         = 0x00000002;
+    const unsigned long CHROME_WINDOW_CLOSE           = 0x00000004;
+    const unsigned long CHROME_WINDOW_RESIZE          = 0x00000008;
+    const unsigned long CHROME_MENUBAR                = 0x00000010;
+    const unsigned long CHROME_TOOLBAR                = 0x00000020;
+    const unsigned long CHROME_LOCATIONBAR            = 0x00000040;
+    const unsigned long CHROME_STATUSBAR              = 0x00000080;
+    const unsigned long CHROME_PERSONAL_TOOLBAR       = 0x00000100;
+    const unsigned long CHROME_SCROLLBARS             = 0x00000200;
+    const unsigned long CHROME_TITLEBAR               = 0x00000400;
+    const unsigned long CHROME_EXTRA                  = 0x00000800;
    
    // createBrowserWindow specific flags
-    const unsigned long CHROME_WITH_SIZE        = 0x00001000;
-    const unsigned long CHROME_WITH_POSITION    = 0x00002000;
+    const unsigned long CHROME_WITH_SIZE              = 0x00001000;
+    const unsigned long CHROME_WITH_POSITION          = 0x00002000;

    // special cases
-    const unsigned long CHROME_WINDOW_MIN       = 0x00004000;
-    const unsigned long CHROME_WINDOW_POPUP     = 0x00008000;
+    const unsigned long CHROME_WINDOW_MIN             = 0x00004000;
+    const unsigned long CHROME_WINDOW_POPUP           = 0x00008000;

-    const unsigned long CHROME_WINDOW_RAISED    = 0x02000000;
-    const unsigned long CHROME_WINDOW_LOWERED   = 0x04000000;
-    const unsigned long CHROME_CENTER_SCREEN    = 0x08000000;
+    // Prevents new window animations on Mac OS X Lion.  Ignored on other
+    // platforms.
+    const unsigned long CHROME_MAC_SUPPRESS_ANIMATION = 0x01000000;
+
+    const unsigned long CHROME_WINDOW_RAISED          = 0x02000000;
+    const unsigned long CHROME_WINDOW_LOWERED         = 0x04000000;
+    const unsigned long CHROME_CENTER_SCREEN          = 0x08000000;

    // Make the new window dependent on the parent.  This flag is only
    // meaningful if CHROME_OPENAS_CHROME is set; content windows should not be
    // dependent.
-    const unsigned long CHROME_DEPENDENT        = 0x10000000;
+    const unsigned long CHROME_DEPENDENT              = 0x10000000;

    // Note: The modal style bit just affects the way the window looks and does
    //       mean it's actually modal.
-    const unsigned long CHROME_MODAL            = 0x20000000; 
-    const unsigned long CHROME_OPENAS_DIALOG    = 0x40000000;
-    const unsigned long CHROME_OPENAS_CHROME    = 0x80000000;
+    const unsigned long CHROME_MODAL                  = 0x20000000; 
+    const unsigned long CHROME_OPENAS_DIALOG          = 0x40000000;
+    const unsigned long CHROME_OPENAS_CHROME          = 0x80000000;
    
-    const unsigned long CHROME_ALL              = 0x00000ffe;
+    const unsigned long CHROME_ALL                    = 0x00000ffe;
    
    /**
     * The chrome flags for this browser chrome. The implementation should
--- a/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
+++ b/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
@ -1527,6 +1527,9 @@ PRUint32 nsWindowWatcher::CalculateChromeFlags(const char *aFeatures,
  else if (WinHasOption(aFeatures, "alwaysRaised", 0, nsnull))
    chromeFlags |= nsIWebBrowserChrome::CHROME_WINDOW_RAISED;

+  chromeFlags |= WinHasOption(aFeatures, "macsuppressanimation", 0, nsnull) ?
+    nsIWebBrowserChrome::CHROME_MAC_SUPPRESS_ANIMATION : 0;
+
  chromeFlags |= WinHasOption(aFeatures, "chrome", 0, nsnull) ?
    nsIWebBrowserChrome::CHROME_OPENAS_CHROME : 0;
  chromeFlags |= WinHasOption(aFeatures, "extrachrome", 0, nsnull) ?
--- a/gfx/2d/DrawTargetD2D.cpp
+++ b/gfx/2d/DrawTargetD2D.cpp
@ -633,7 +633,7 @@ DrawTargetD2D::DrawSurfaceWithShadow(SourceSurface *aSurface,
  if (mPushedClips.size()) {
    mPrivateData->mEffect->GetVariableByName("mask")->AsShaderResource()->SetResource(maskSRView);
    mPrivateData->mEffect->GetVariableByName("MaskTexCoords")->AsVector()->
-      SetFloatVector(ShaderConstantRectD3D10(shadowDest.x / mSize.width, shadowDest.y / mSize.width,
+      SetFloatVector(ShaderConstantRectD3D10(shadowDest.x / mSize.width, shadowDest.y / mSize.height,
                                             Float(aSurface->GetSize().width) / mSize.width,
                                             Float(aSurface->GetSize().height) / mSize.height));
    mPrivateData->mEffect->GetTechniqueByName("SampleTextureWithShadow")->
@ -658,7 +658,7 @@ DrawTargetD2D::DrawSurfaceWithShadow(SourceSurface *aSurface,

  if (mPushedClips.size()) {
    mPrivateData->mEffect->GetVariableByName("MaskTexCoords")->AsVector()->
-      SetFloatVector(ShaderConstantRectD3D10(aDest.x / mSize.width, aDest.y / mSize.width,
+      SetFloatVector(ShaderConstantRectD3D10(aDest.x / mSize.width, aDest.y / mSize.height,
                                             Float(aSurface->GetSize().width) / mSize.width,
                                             Float(aSurface->GetSize().height) / mSize.height));
    mPrivateData->mEffect->GetTechniqueByName("SampleMaskedTexture")->
--- a/gfx/gl/GLContext.cpp
+++ b/gfx/gl/GLContext.cpp
@ -1452,6 +1452,8 @@ GLContext::ResizeOffscreenFBO(const gfxIntSize& aSize, const bool aUseReadFBO, c

    // We're good, and the framebuffer is already attached.
    // Now restore the GL state back to what it was before the resize took place.
+    // If the user was using fb 0, this will bind the offscreen framebuffer we
+    // just created.
    BindDrawFBO(curBoundFramebufferDraw);
    BindReadFBO(curBoundFramebufferRead);
    fBindTexture(LOCAL_GL_TEXTURE_2D, curBoundTexture);
--- a/gfx/gl/GLContext.h
+++ b/gfx/gl/GLContext.h
@ -541,8 +541,10 @@ public:
              bool aIsOffscreen = false,
              GLContext *aSharedContext = nsnull)
      : mFlushGuaranteesResolve(false),
-        mBoundDrawFBO(0),
-        mBoundReadFBO(0),
+        mUserBoundDrawFBO(0),
+        mUserBoundReadFBO(0),
+        mInternalBoundDrawFBO(0),
+        mInternalBoundReadFBO(0),
        mOffscreenFBOsDirty(false),
        mInitialized(false),
        mIsOffscreen(aIsOffscreen),
@ -862,23 +864,67 @@ public:


 private:
-    GLuint mBoundDrawFBO;
-    GLuint mBoundReadFBO;
+    GLuint mUserBoundDrawFBO;
+    GLuint mUserBoundReadFBO;
+    GLuint mInternalBoundDrawFBO;
+    GLuint mInternalBoundReadFBO;

 public:
    void fBindFramebuffer(GLenum target, GLuint framebuffer) {
        switch (target) {
-          case LOCAL_GL_FRAMEBUFFER:
-            mBoundDrawFBO = mBoundReadFBO = framebuffer;
-            break;
          case LOCAL_GL_DRAW_FRAMEBUFFER_EXT:
-            mBoundDrawFBO = framebuffer;
+            mUserBoundDrawFBO = framebuffer;
+
+            if (framebuffer == 0) {
+                mInternalBoundDrawFBO = mOffscreenDrawFBO;
+            } else {
+                mInternalBoundDrawFBO = mUserBoundDrawFBO;
+            }
+
+            raw_fBindFramebuffer(LOCAL_GL_DRAW_FRAMEBUFFER_EXT,
+                                 mInternalBoundDrawFBO);
            break;
+
          case LOCAL_GL_READ_FRAMEBUFFER_EXT:
-            mBoundReadFBO = framebuffer;
+            mUserBoundReadFBO = framebuffer;
+
+            if (framebuffer == 0) {
+                mInternalBoundReadFBO = mOffscreenReadFBO;
+            } else {
+                mInternalBoundReadFBO = mUserBoundReadFBO;
+            }
+
+            raw_fBindFramebuffer(LOCAL_GL_READ_FRAMEBUFFER_EXT,
+                                 mInternalBoundReadFBO);
+            break;
+
+          case LOCAL_GL_FRAMEBUFFER:
+            mUserBoundDrawFBO = mUserBoundReadFBO = framebuffer;
+
+            if (framebuffer == 0) {
+                mInternalBoundDrawFBO = mOffscreenDrawFBO;
+                mInternalBoundReadFBO = mOffscreenReadFBO;
+            } else {
+                mInternalBoundDrawFBO = mUserBoundDrawFBO;
+                mInternalBoundReadFBO = mUserBoundReadFBO;
+            }
+
+            if (SupportsOffscreenSplit()) {
+                raw_fBindFramebuffer(LOCAL_GL_DRAW_FRAMEBUFFER_EXT,
+                                     mInternalBoundDrawFBO);
+                raw_fBindFramebuffer(LOCAL_GL_READ_FRAMEBUFFER_EXT,
+                                     mInternalBoundReadFBO);
+            } else {
+                raw_fBindFramebuffer(LOCAL_GL_FRAMEBUFFER,
+                                     mInternalBoundDrawFBO);
+            }
+
+            break;
+
+          default:
+            raw_fBindFramebuffer(target, framebuffer);
            break;
        }
-        raw_fBindFramebuffer(target, framebuffer);
    }

    GLuint GetBoundDrawFBO() {
@ -886,32 +932,38 @@ public:
        GLint ret = 0;
        // Don't need a branch here, because:
        // LOCAL_GL_DRAW_FRAMEBUFFER_BINDING_EXT == LOCAL_GL_FRAMEBUFFER_BINDING == 0x8CA6
-        fGetIntegerv(LOCAL_GL_DRAW_FRAMEBUFFER_BINDING_EXT, &ret);
+        // We use raw_ here because this is debug code and we need to see what
+        // the driver thinks.
+        raw_fGetIntegerv(LOCAL_GL_DRAW_FRAMEBUFFER_BINDING_EXT, &ret);

-        if (mBoundDrawFBO != (GLuint)ret) {
-          printf_stderr("!!! Draw FBO mismatch: Was: %d, Expected: %d\n", ret, mBoundDrawFBO);
+        if (mInternalBoundDrawFBO != (GLuint)ret) {
+          printf_stderr("!!! Draw FBO mismatch: Was: %d, Expected: %d\n", ret, mInternalBoundDrawFBO);
          NS_ABORT();
        }
 #endif

-        return mBoundDrawFBO;
+        // We only ever expose the user's bound FBOs
+        return mUserBoundDrawFBO;
    }

    GLuint GetBoundReadFBO() {
 #ifdef DEBUG
        GLint ret = 0;
+        // We use raw_ here because this is debug code and we need to see what
+        // the driver thinks.
        if (SupportsOffscreenSplit())
-            fGetIntegerv(LOCAL_GL_READ_FRAMEBUFFER_BINDING_EXT, &ret);
+            raw_fGetIntegerv(LOCAL_GL_READ_FRAMEBUFFER_BINDING_EXT, &ret);
        else
-            fGetIntegerv(LOCAL_GL_FRAMEBUFFER_BINDING, &ret);
+            raw_fGetIntegerv(LOCAL_GL_FRAMEBUFFER_BINDING, &ret);

-        if (mBoundReadFBO != (GLuint)ret) {
-          printf_stderr("!!! Read FBO mismatch: Was: %d, Expected: %d\n", ret, mBoundReadFBO);
+        if (mInternalBoundReadFBO != (GLuint)ret) {
+          printf_stderr("!!! Read FBO mismatch: Was: %d, Expected: %d\n", ret, mInternalBoundReadFBO);
          NS_ABORT();
        }
 #endif

-        return mBoundReadFBO;
+        // We only ever expose the user's bound FBOs
+        return mUserBoundReadFBO;
    }

    void BindDrawFBO(GLuint name) {
@ -954,8 +1006,6 @@ public:
    }

 private:
-    GLuint mPrevDrawFBOBinding;
-    GLuint mPrevReadFBOBinding;
    bool mOffscreenFBOsDirty;

    void GetShaderPrecisionFormatNonES2(GLenum shadertype, GLenum precisiontype, GLint* range, GLint* precision) {
@ -980,40 +1030,29 @@ private:
        }
    }

+    // Do whatever setup is necessary to draw to our offscreen FBO, if it's
+    // bound.
    void BeforeGLDrawCall() {
-        // Record and rebind if necessary
-        mPrevDrawFBOBinding = GetBoundDrawFBO();
-        if (mPrevDrawFBOBinding == 0) {
-            BindDrawFBO(mOffscreenDrawFBO);
-        } else if (mPrevDrawFBOBinding != mOffscreenDrawFBO)
+        if (mInternalBoundDrawFBO != mOffscreenDrawFBO)
            return;

-        // Must be after binding the proper FBO
        if (mOffscreenDrawFBO == mOffscreenReadFBO)
            return;

-        // If we're already dirty, no need to set it again
-        if (mOffscreenFBOsDirty)
-            return;
-
        mOffscreenFBOsDirty = true;
    }

+    // Do whatever tear-down is necessary after drawing to our offscreen FBO,
+    // if it's bound.
    void AfterGLDrawCall() {
-        if (mPrevDrawFBOBinding == 0) {
-            BindDrawFBO(0);
-        }
    }

+    // Do whatever setup is necessary to read from our offscreen FBO, if it's
+    // bound.
    void BeforeGLReadCall() {
-        // Record and rebind if necessary
-        mPrevReadFBOBinding = GetBoundReadFBO();
-        if (mPrevReadFBOBinding == 0) {
-            BindReadFBO(mOffscreenReadFBO);
-        } else if (mPrevReadFBOBinding != mOffscreenReadFBO)
+        if (mInternalBoundReadFBO != mOffscreenReadFBO)
            return;

-        // Must be after binding the proper FBO
        if (mOffscreenDrawFBO == mOffscreenReadFBO)
            return;

@ -1027,7 +1066,7 @@ private:

        // flip read/draw for blitting
        GLuint prevDraw = SwapBoundDrawFBO(mOffscreenReadFBO);
-        BindReadFBO(mOffscreenDrawFBO); // We know that Read must already be mOffscreenRead, so no need to write that down
+        GLuint prevRead = SwapBoundReadFBO(mOffscreenDrawFBO);

        GLint width = mOffscreenActualSize.width;
        GLint height = mOffscreenActualSize.height;
@ -1037,7 +1076,7 @@ private:
                             LOCAL_GL_NEAREST);

        BindDrawFBO(prevDraw);
-        BindReadFBO(mOffscreenReadFBO);
+        BindReadFBO(prevRead);

        if (scissor)
            fEnable(LOCAL_GL_SCISSOR_TEST);
@ -1045,10 +1084,9 @@ private:
        mOffscreenFBOsDirty = false;
    }

+    // Do whatever tear-down is necessary after reading from our offscreen FBO,
+    // if it's bound.
    void AfterGLReadCall() {
-        if (mPrevReadFBOBinding == 0) {
-            BindReadFBO(0);
-        }
    }

 public:
@ -1997,12 +2035,34 @@ public:
        return retval;
    }

-    void fGetIntegerv(GLenum pname, GLint *params) {
+private:
+    void raw_fGetIntegerv(GLenum pname, GLint *params) {
        BEFORE_GL_CALL;
        mSymbols.fGetIntegerv(pname, params);
        AFTER_GL_CALL;
    }

+public:
+    void fGetIntegerv(GLenum pname, GLint *params) {
+        switch (pname)
+        {
+            // LOCAL_GL_FRAMEBUFFER_BINDING is equal to
+            // LOCAL_GL_DRAW_FRAMEBUFFER_BINDING_EXT, so we don't need two
+            // cases.
+            case LOCAL_GL_FRAMEBUFFER_BINDING:
+                *params = GetBoundDrawFBO();
+                break;
+
+            case LOCAL_GL_READ_FRAMEBUFFER_BINDING_EXT:
+                *params = GetBoundReadFBO();
+                break;
+
+            default:
+                raw_fGetIntegerv(pname, params);
+                break;
+        }
+    }
+
    void fGetFloatv(GLenum pname, GLfloat *params) {
        BEFORE_GL_CALL;
        mSymbols.fGetFloatv(pname, params);
--- a/gfx/harfbuzz/src/hb-ot-layout.cc
+++ b/gfx/harfbuzz/src/hb-ot-layout.cc
@ -32,6 +32,7 @@
 #include "hb-ot-layout-gsub-table.hh"
 #include "hb-ot-layout-gpos-table.hh"
 #include "hb-ot-maxp-table.hh"
+#include "hb-ot-shape-private.hh"


 #include <stdlib.h>
@ -496,8 +497,46 @@ hb_ot_layout_position_lookup   (hb_font_t    *font,
 }

 void
-hb_ot_layout_position_finish (hb_buffer_t  *buffer)
+hb_ot_layout_position_finish (hb_face_t *face, hb_buffer_t *buffer)
 {
+  /* force diacritics to have zero width */
+  unsigned int count = buffer->len;
+  if (hb_ot_layout_has_glyph_classes (face)) {
+    const GDEF& gdef = _get_gdef (face);
+    if (buffer->props.direction == HB_DIRECTION_RTL) {
+      for (unsigned int i = 1; i < count; i++) {
+        if (gdef.get_glyph_class (buffer->info[i].codepoint) == GDEF::MarkGlyph) {
+          buffer->pos[i].x_advance = 0;
+        }
+      }
+    } else {
+      for (unsigned int i = 1; i < count; i++) {
+        if (gdef.get_glyph_class (buffer->info[i].codepoint) == GDEF::MarkGlyph) {
+          hb_glyph_position_t& pos = buffer->pos[i];
+          pos.x_offset -= pos.x_advance;
+          pos.x_advance = 0;
+        }
+      }
+    }
+  } else {
+    /* no GDEF classes available, so use General Category as a fallback */
+    if (buffer->props.direction == HB_DIRECTION_RTL) {
+      for (unsigned int i = 1; i < count; i++) {
+        if (buffer->info[i].general_category() == HB_UNICODE_GENERAL_CATEGORY_NON_SPACING_MARK) {
+          buffer->pos[i].x_advance = 0;
+        }
+      }
+    } else {
+      for (unsigned int i = 1; i < count; i++) {
+        if (buffer->info[i].general_category() == HB_UNICODE_GENERAL_CATEGORY_NON_SPACING_MARK) {
+          hb_glyph_position_t& pos = buffer->pos[i];
+          pos.x_offset -= pos.x_advance;
+          pos.x_advance = 0;
+        }
+      }
+    }
+  }
+
  GPOS::position_finish (buffer);
 }

--- a/gfx/harfbuzz/src/hb-ot-layout.h
+++ b/gfx/harfbuzz/src/hb-ot-layout.h
@ -199,7 +199,7 @@ hb_ot_layout_position_lookup (hb_font_t    *font,

 /* Should be called after all the position_lookup's are done */
 void
-hb_ot_layout_position_finish (hb_buffer_t  *buffer);
+hb_ot_layout_position_finish (hb_face_t *face, hb_buffer_t *buffer);


 HB_END_DECLS
--- a/gfx/harfbuzz/src/hb-ot-shape-private.hh
+++ b/gfx/harfbuzz/src/hb-ot-shape-private.hh
@ -104,12 +104,40 @@ _hb_unicode_modified_combining_class (hb_unicode_funcs_t *ufuncs,
 {
  int c = hb_unicode_combining_class (ufuncs, unicode);

+  /* For Hebrew, we permute the "fixed-position" classes 10-25 into the order
+   * described in the SBL Hebrew manual http://www.sbl-site.org/Fonts/SBLHebrewUserManual1.5x.pdf
+   * (as recommended by http://forum.fontlab.com/archive-old-microsoft-volt-group/vista-and-diacritic-ordering-t6751.0.html)
+   */
+  static const int permuted_hebrew_classes[25 - 10 + 1] = {
+    /* 10 sheva */        15,
+    /* 11 hataf segol */  16,
+    /* 12 hataf patah */  17,
+    /* 13 hataf qamats */ 18,
+    /* 14 hiriq */        19,
+    /* 15 tsere */        20,
+    /* 16 segol */        21,
+    /* 17 patah */        22,
+    /* 18 qamats */       23,
+    /* 19 holam */        14,
+    /* 20 qubuts */       24,
+    /* 21 dagesh */       12,
+    /* 22 meteg */        25,
+    /* 23 rafe */         13,
+    /* 24 shin dot */     10,
+    /* 25 sin dot */      11,
+  };
+
  /* Modify the combining-class to suit Arabic better.  See:
   * http://unicode.org/faq/normalization.html#8
   * http://unicode.org/faq/normalization.html#9
   */
  if (unlikely (hb_in_range<int> (c, 27, 33)))
    c = c == 33 ? 27 : c + 1;
+  /* The equivalent fix for Hebrew is more complex,
+   * see the SBL Hebrew manual.
+   */
+  else if (unlikely (hb_in_range<int> (c, 10, 25)))
+    c = permuted_hebrew_classes[c - 10];

  return c;
 }
--- a/gfx/harfbuzz/src/hb-ot-shape.cc
+++ b/gfx/harfbuzz/src/hb-ot-shape.cc
@ -299,15 +299,36 @@ hb_ot_position_complex (hb_ot_shape_context_t *c)
    c->applied_position_complex = TRUE;
  }

-  hb_ot_layout_position_finish (c->buffer);
+  hb_ot_layout_position_finish (c->face, c->buffer);

  return;
 }

 static void
-hb_position_complex_fallback (hb_ot_shape_context_t *c HB_UNUSED)
+hb_position_complex_fallback (hb_ot_shape_context_t *c)
 {
-  /* TODO Mark pos */
+  unsigned int count = c->buffer->len;
+  if (c->buffer->props.direction == HB_DIRECTION_RTL) {
+    for (unsigned int i = 1; i < count; i++) {
+      unsigned int gen_cat = c->buffer->info[i].general_category();
+      if ((1<<gen_cat) & ((1<<HB_UNICODE_GENERAL_CATEGORY_NON_SPACING_MARK)|
+                          (1<<HB_UNICODE_GENERAL_CATEGORY_ENCLOSING_MARK)|
+                          (1<<HB_UNICODE_GENERAL_CATEGORY_FORMAT))) {
+        c->buffer->pos[i].x_advance = 0;
+      }
+    }
+  } else {
+    for (unsigned int i = 1; i < count; i++) {
+      unsigned int gen_cat = c->buffer->info[i].general_category();
+      if ((1<<gen_cat) & ((1<<HB_UNICODE_GENERAL_CATEGORY_NON_SPACING_MARK)|
+                          (1<<HB_UNICODE_GENERAL_CATEGORY_ENCLOSING_MARK)|
+                          (1<<HB_UNICODE_GENERAL_CATEGORY_FORMAT))) {
+        hb_glyph_position_t& pos = c->buffer->pos[i];
+        pos.x_offset = -pos.x_advance;
+        pos.x_advance = 0;
+      }
+    }
+  }
 }

 static void
--- a/gfx/thebes/gfxPlatform.cpp
+++ b/gfx/thebes/gfxPlatform.cpp
@ -1358,11 +1358,19 @@ gfxPlatform::FontsPrefsChanged(const char *aPref)
 #ifdef MOZ_GRAPHITE
    } else if (!strcmp(GFX_PREF_GRAPHITE_SHAPING, aPref)) {
        mGraphiteShapingEnabled = UNINITIALIZED_VALUE;
-        gfxFontCache::GetCache()->AgeAllGenerations();
+        gfxFontCache *fontCache = gfxFontCache::GetCache();
+        if (fontCache) {
+            fontCache->AgeAllGenerations();
+            fontCache->FlushShapedWordCaches();
+        }
 #endif
    } else if (!strcmp(GFX_PREF_HARFBUZZ_SCRIPTS, aPref)) {
        mUseHarfBuzzScripts = UNINITIALIZED_VALUE;
-        gfxFontCache::GetCache()->AgeAllGenerations();
+        gfxFontCache *fontCache = gfxFontCache::GetCache();
+        if (fontCache) {
+            fontCache->AgeAllGenerations();
+            fontCache->FlushShapedWordCaches();
+        }
    } else if (!strcmp(BIDI_NUMERAL_PREF, aPref)) {
        mBidiNumeralOption = UNINITIALIZED_VALUE;
    }
--- a/gfx/thebes/nsIOSurface.h
+++ b/gfx/thebes/nsIOSurface.h
@ -44,7 +44,7 @@
 #import <OpenGL/OpenGL.h>

 class gfxASurface;
-class _CGLContextObject;
+struct _CGLContextObject;

 typedef _CGLContextObject* CGLContextObj;
 typedef uint32_t IOSurfaceID;
--- a/hal/gonk/GonkHal.cpp
+++ b/hal/gonk/GonkHal.cpp
@ -268,10 +268,29 @@ GetCurrentBatteryInformation(hal::BatteryInformation *aBatteryInfo)
  }

  FILE *chargingFile = fopen("/sys/class/power_supply/battery/charging_source", "r");
-  int chargingSrc = 1;
+  int chargingSrc = BATTERY_CHARGING_USB;
+  bool done = false;
  if (chargingFile) {
    fscanf(chargingFile, "%d", &chargingSrc);
    fclose(chargingFile);
+    done = true;
+  }
+
+  if (!done) {
+    // toro devices support
+    chargingFile = fopen("/sys/class/power_supply/battery/status", "r");
+    if (chargingFile) {
+      char status[16];
+      fscanf(chargingFile, "%s", &status);
+      if (!strcmp(status, "Charging") || !strcmp(status, "Full")) {
+        // no way here to know if we're charging from USB or AC.
+        chargingSrc = BATTERY_CHARGING_USB;
+      } else {
+        chargingSrc = BATTERY_NOT_CHARGING;
+      }
+      fclose(chargingFile);
+      done = true;
+    }
  }

  #ifdef DEBUG
--- a/js/src/aclocal.m4
+++ b/js/src/aclocal.m4
@ -14,5 +14,6 @@ builtin(include, build/autoconf/acwinpaths.m4)dnl
 builtin(include, build/autoconf/lto.m4)dnl
 builtin(include, build/autoconf/gcc-pr49911.m4)dnl
 builtin(include, build/autoconf/frameptr.m4)dnl
+builtin(include, build/autoconf/compiler-opts.m4)dnl

 MOZ_PROG_CHECKMSYS()
--- a/js/src/assembler/wtf/Assertions.h
+++ b/js/src/assembler/wtf/Assertions.h
@ -29,8 +29,16 @@
 #include "Platform.h"
 #include "mozilla/Assertions.h"

+#ifndef DEBUG
+   /*
+    * Prevent unused-variable warnings by defining the macro WTF uses to test
+    * for assertions taking effect.
+    */
+#  define ASSERT_DISABLED 1
+#endif
+
 #define ASSERT(assertion) MOZ_ASSERT(assertion)
-#define ASSERT_UNUSED(variable, assertion) ASSERT(assertion)
+#define ASSERT_UNUSED(variable, assertion) (((void)variable), ASSERT(assertion))
 #define ASSERT_NOT_REACHED() MOZ_NOT_REACHED("")
 #define CRASH() MOZ_Crash()
 #define COMPILE_ASSERT(exp, name) MOZ_STATIC_ASSERT(exp, #name)
--- a/js/src/build/autoconf/compiler-opts.m4
+++ b/js/src/build/autoconf/compiler-opts.m4
@ -0,0 +1,13 @@
+dnl Add compiler specific options
+
+AC_DEFUN([MOZ_COMPILER_OPTS],
+[
+if test "$CLANG_CXX"; then
+    ## We disable return-type-c-linkage because jsval is defined as a C++ type but is
+    ## returned by C functions. This is possible because we use knowledge about the ABI
+    ## to typedef it to a C type with the same layout when the headers are included
+    ## from C.
+    _WARNINGS_CXXFLAGS="${_WARNINGS_CXXFLAGS} -Wno-return-type-c-linkage"
+fi
+])
+
--- a/js/src/builtin/MapObject.cpp
+++ b/js/src/builtin/MapObject.cpp
@ -185,8 +185,11 @@ MapObject::mark(JSTracer *trc, JSObject *obj)
    MapObject *mapobj = static_cast<MapObject *>(obj);
    if (ValueMap *map = mapobj->getData()) {
        for (ValueMap::Range r = map->all(); !r.empty(); r.popFront()) {
-            gc::MarkValue(trc, r.front().key, "key");
-            gc::MarkValue(trc, r.front().value, "value");
+            const HeapValue &key = r.front().key;
+            HeapValue tmp(key);
+            gc::MarkValue(trc, &tmp, "key");
+            JS_ASSERT(tmp.get() == key.get());
+            gc::MarkValue(trc, &r.front().value, "value");
        }
    }
 }
@ -331,8 +334,12 @@ SetObject::mark(JSTracer *trc, JSObject *obj)
 {
    SetObject *setobj = static_cast<SetObject *>(obj);
    if (ValueSet *set = setobj->getData()) {
-        for (ValueSet::Range r = set->all(); !r.empty(); r.popFront())
-            gc::MarkValue(trc, r.front(), "key");
+        for (ValueSet::Range r = set->all(); !r.empty(); r.popFront()) {
+            const HeapValue &key = r.front();
+            HeapValue tmp(key);
+            gc::MarkValue(trc, &tmp, "key");
+            JS_ASSERT(tmp.get() == key.get());
+        }
    }
 }

--- a/js/src/configure.in
+++ b/js/src/configure.in
@ -3133,6 +3133,7 @@ AC_SUBST(WRAP_SYSTEM_INCLUDES)
 AC_SUBST(VISIBILITY_FLAGS)

 MOZ_GCC_PR49911
+MOZ_COMPILER_OPTS

 dnl Check for __force_align_arg_pointer__ for SSE2 on gcc
 dnl ========================================================
--- a/js/src/gc/Barrier-inl.h
+++ b/js/src/gc/Barrier-inl.h
@ -134,8 +134,11 @@ inline void
 HeapValue::writeBarrierPre(JSCompartment *comp, const Value &value)
 {
 #ifdef JSGC_INCREMENTAL
-    if (comp->needsBarrier())
-        js::gc::MarkValueUnbarriered(comp->barrierTracer(), value, "write barrier");
+    if (comp->needsBarrier()) {
+        Value tmp(value);
+        js::gc::MarkValueUnbarriered(comp->barrierTracer(), &tmp, "write barrier");
+        JS_ASSERT(tmp == value);
+    }
 #endif
 }

--- a/js/src/gc/Barrier.h
+++ b/js/src/gc/Barrier.h
@ -319,6 +319,7 @@ class HeapValue
    inline void set(JSCompartment *comp, const Value &v);

    const Value &get() const { return value; }
+    Value *unsafeGet() { return &value; }
    operator const Value &() const { return value; }

    bool isUndefined() const { return value.isUndefined(); }
--- a/js/src/jit-test/lib/prolog.js
+++ b/js/src/jit-test/lib/prolog.js
@ -8,3 +8,6 @@ if (!("gczeal" in this)) {
  gczeal = function() { }
 }

+if (!("schedulegc" in this)) {
+  schedulegc = function() { }
+}
--- a/js/src/jit-test/tests/basic/bug727921.js
+++ b/js/src/jit-test/tests/basic/bug727921.js
@ -0,0 +1,10 @@
+(function() {
+    let(d) {
+        yield
+    }
+})()
+eval("\
+    (function(){\
+        schedulegc(5), 'a'.replace(/a/,function(){yield})\
+    })\
+")()
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@ -4415,20 +4415,13 @@ JS_ElementIteratorStub(JSContext *cx, JSObject *obj, JSBool keysonly)
 JS_PUBLIC_API(jsval)
 JS_GetReservedSlot(JSObject *obj, uint32_t index)
 {
-    if (!obj->isNative())
-        return UndefinedValue();
-
-    return GetReservedSlot(obj, index);
+    return obj->getReservedSlot(index);
 }

 JS_PUBLIC_API(void)
 JS_SetReservedSlot(JSObject *obj, uint32_t index, jsval v)
 {
-    if (!obj->isNative())
-        return;
-
-    SetReservedSlot(obj, index, v);
-    GCPoke(obj->compartment()->rt, NullValue());
+    obj->setReservedSlot(index, v);
 }

 JS_PUBLIC_API(JSObject *)
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@ -1860,7 +1860,11 @@ INTERNED_STRING_TO_JSID(JSContext *cx, JSString *str)
    jsid id;
    JS_ASSERT(str);
    JS_ASSERT(((size_t)str & JSID_TYPE_MASK) == 0);
+#ifdef DEBUG
    JS_ASSERT(JS_StringHasBeenInterned(cx, str));
+#else
+    (void)cx;
+#endif
    JSID_BITS(id) = (size_t)str;
    return id;
 }
@ -5314,6 +5318,8 @@ JS_IsConstructing(JSContext *cx, const jsval *vp)
    } else {
        JS_ASSERT(JS_GetClass(callee)->construct != NULL);
    }
+#else
+    (void)cx;
 #endif

    return JSVAL_IS_MAGIC_IMPL(JSVAL_TO_IMPL(vp[1]));
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@ -1434,23 +1434,22 @@ JSObject::makeDenseArraySlow(JSContext *cx)
 class ArraySharpDetector
 {
    JSContext *cx;
-    JSHashEntry *he;
+    bool success;
    bool alreadySeen;
    bool sharp;

  public:
    ArraySharpDetector(JSContext *cx)
      : cx(cx),
-        he(NULL),
+        success(false),
        alreadySeen(false),
        sharp(false)
    {}

    bool init(JSObject *obj) {
-        he = js_EnterSharpObject(cx, obj, NULL, &alreadySeen);
-        if (!he)
+        success = js_EnterSharpObject(cx, obj, NULL, &alreadySeen, &sharp);
+        if (!success)
            return false;
-        sharp = IS_SHARP(he);
        return true;
    }

@ -1460,7 +1459,7 @@ class ArraySharpDetector
    }

    ~ArraySharpDetector() {
-        if (he && !sharp)
+        if (success && !sharp)
            js_LeaveSharpObject(cx, NULL);
    }
 };
--- a/js/src/jsbool.cpp
+++ b/js/src/jsbool.cpp
@ -157,7 +157,7 @@ js_InitBooleanClass(JSContext *cx, JSObject *obj)
    JSObject *booleanProto = global->createBlankPrototype(cx, &BooleanClass);
    if (!booleanProto)
        return NULL;
-    booleanProto->setPrimitiveThis(BooleanValue(false));
+    booleanProto->setFixedSlot(BooleanObject::PRIMITIVE_VALUE_SLOT, BooleanValue(false));

    JSFunction *ctor = global->createConstructor(cx, Boolean, &BooleanClass,
                                                 CLASS_ATOM(cx, Boolean), 1);
--- a/js/src/jsboolinlines.h
+++ b/js/src/jsboolinlines.h
@ -42,13 +42,15 @@

 #include "jsobjinlines.h"

+#include "vm/BooleanObject-inl.h"
+
 namespace js {

 inline bool
 BooleanGetPrimitiveValue(JSContext *cx, JSObject &obj, Value *vp)
 {
    if (obj.isBoolean()) {
-        *vp = obj.getPrimitiveThis();
+        *vp = BooleanValue(obj.asBoolean().unbox());
        return true;
    }

--- a/js/src/jsclone.cpp
+++ b/js/src/jsclone.cpp
@ -42,7 +42,10 @@

 #include "jstypedarrayinlines.h"

+#include "vm/BooleanObject-inl.h"
+#include "vm/NumberObject-inl.h"
 #include "vm/RegExpObject-inl.h"
+#include "vm/StringObject-inl.h"

 using namespace js;

@ -536,12 +539,12 @@ JSStructuredCloneWriter::startWrite(const js::Value &v)
        } else if (js_IsArrayBuffer(obj)) {
            return writeArrayBuffer(obj);
        } else if (obj->isBoolean()) {
-            return out.writePair(SCTAG_BOOLEAN_OBJECT, obj->getPrimitiveThis().toBoolean());
+            return out.writePair(SCTAG_BOOLEAN_OBJECT, obj->asBoolean().unbox());
        } else if (obj->isNumber()) {
            return out.writePair(SCTAG_NUMBER_OBJECT, 0) &&
-                   out.writeDouble(obj->getPrimitiveThis().toNumber());
+                   out.writeDouble(obj->asNumber().unbox());
        } else if (obj->isString()) {
-            return writeString(SCTAG_STRING_OBJECT, obj->getPrimitiveThis().toString());
+            return writeString(SCTAG_STRING_OBJECT, obj->asString().unbox());
        }

        if (callbacks && callbacks->write)
--- a/js/src/jscntxt.cpp
+++ b/js/src/jscntxt.cpp
@ -970,6 +970,7 @@ JSContext::JSContext(JSRuntime *rt)
    stack(thisDuringConstruction()),  /* depends on cx->thread_ */
    parseMapPool_(NULL),
    globalObject(NULL),
+    sharpObjectMap(this),
    argumentFormatMap(NULL),
    lastMessage(NULL),
    errorReporter(NULL),
@ -1270,6 +1271,26 @@ JSContext::sizeOfIncludingThis(JSMallocSizeOfFun mallocSizeOf) const
    return mallocSizeOf(this) + busyArrays.sizeOfExcludingThis(mallocSizeOf);
 }

+void
+JSContext::mark(JSTracer *trc)
+{
+    /* Stack frames and slots are traced by StackSpace::mark. */
+
+    /* Mark other roots-by-definition in the JSContext. */
+    if (globalObject && !hasRunOption(JSOPTION_UNROOTED_GLOBAL))
+        MarkObjectRoot(trc, globalObject, "global object");
+    if (isExceptionPending())
+        MarkValueRoot(trc, &exception, "exception");
+
+    if (autoGCRooters)
+        autoGCRooters->traceAll(trc);
+
+    if (sharpObjectMap.depth > 0)
+        js_TraceSharpMap(trc, &sharpObjectMap);
+
+    MarkValueRoot(trc, &iterValue, "iterValue");
+}
+
 namespace JS {

 #if defined JS_THREADSAFE && defined DEBUG
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@ -76,12 +76,23 @@ JS_BEGIN_EXTERN_C
 struct DtoaState;
 JS_END_EXTERN_C

-struct JSSharpObjectMap {
-    jsrefcount  depth;
-    uint32_t    sharpgen;
-    JSHashTable *table;
+struct JSSharpInfo {
+    bool hasGen;
+    bool isSharp;

-    JSSharpObjectMap() : depth(0), sharpgen(0), table(NULL) {}
+    JSSharpInfo() : hasGen(false), isSharp(false) {}
+};
+
+typedef js::HashMap<JSObject *, JSSharpInfo> JSSharpTable;
+
+struct JSSharpObjectMap {
+    jsrefcount   depth;
+    uint32_t     sharpgen;
+    JSSharpTable table;
+
+    JSSharpObjectMap(JSContext *cx) : depth(0), sharpgen(0), table(js::TempAllocPolicy(cx)) {
+        table.init();
+    }
 };

 namespace js {
@ -1121,6 +1132,8 @@ struct JSContext : js::ContextFriendFields
        return reinterpret_cast<JSContext *>(uintptr_t(link) - offsetof(JSContext, link));
    }

+    void mark(JSTracer *trc);
+
  private:
    /*
     * The allocation code calls the function to indicate either OOM failure
@ -1558,18 +1571,18 @@ class AutoShapeVector : public AutoVectorRooter<const Shape *>

 class AutoValueArray : public AutoGCRooter
 {
-    const js::Value *start_;
+    js::Value *start_;
    unsigned length_;

  public:
-    AutoValueArray(JSContext *cx, const js::Value *start, unsigned length
+    AutoValueArray(JSContext *cx, js::Value *start, unsigned length
                   JS_GUARD_OBJECT_NOTIFIER_PARAM)
        : AutoGCRooter(cx, VALARRAY), start_(start), length_(length)
    {
        JS_GUARD_OBJECT_NOTIFIER_INIT;
    }

-    const Value *start() const { return start_; }
+    Value *start() { return start_; }
    unsigned length() const { return length_; }

    JS_DECL_USE_GUARD_OBJECT_NOTIFIER
--- a/js/src/jscompartment.cpp
+++ b/js/src/jscompartment.cpp
@ -416,8 +416,11 @@ JSCompartment::markCrossCompartmentWrappers(JSTracer *trc)
 {
    JS_ASSERT(trc->runtime->gcCurrentCompartment);

-    for (WrapperMap::Enum e(crossCompartmentWrappers); !e.empty(); e.popFront())
-        MarkValueRoot(trc, e.front().key, "cross-compartment wrapper");
+    for (WrapperMap::Enum e(crossCompartmentWrappers); !e.empty(); e.popFront()) {
+        Value tmp = e.front().key;
+        MarkValueRoot(trc, &tmp, "cross-compartment wrapper");
+        JS_ASSERT(tmp == e.front().key);
+    }
 }

 void
--- a/js/src/jsexn.cpp
+++ b/js/src/jsexn.cpp
@ -432,9 +432,8 @@ exn_trace(JSTracer *trc, JSObject *obj)
            vcount += elem->argc;
        }
        vp = GetStackTraceValueBuffer(priv);
-        for (i = 0; i != vcount; ++i, ++vp) {
-            MarkValue(trc, *vp, "stack trace argument");
-        }
+        for (i = 0; i != vcount; ++i, ++vp)
+            MarkValue(trc, vp, "stack trace argument");
    }
 }

--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@ -100,12 +100,6 @@ using namespace js;
 using namespace js::gc;
 using namespace js::types;

-inline JSObject *
-JSObject::getThrowTypeError() const
-{
-    return global().getThrowTypeError();
-}
-
 JSBool
 js_GetArgsValue(JSContext *cx, StackFrame *fp, Value *vp)
 {
@ -475,8 +469,8 @@ strictargs_resolve(JSContext *cx, JSObject *obj, jsid id, uintN flags, JSObject
        }

        attrs = JSPROP_PERMANENT | JSPROP_GETTER | JSPROP_SETTER | JSPROP_SHARED;
-        getter = CastAsPropertyOp(argsobj.getThrowTypeError());
-        setter = CastAsStrictPropertyOp(argsobj.getThrowTypeError());
+        getter = CastAsPropertyOp(argsobj.global().getThrowTypeError());
+        setter = CastAsStrictPropertyOp(argsobj.global().getThrowTypeError());
    }

    Value undef = UndefinedValue();
@ -530,7 +524,7 @@ args_trace(JSTracer *trc, JSObject *obj)
 {
    ArgumentsObject &argsobj = obj->asArguments();
    ArgumentsData *data = argsobj.data();
-    MarkValue(trc, data->callee, js_callee_str);
+    MarkValue(trc, &data->callee, js_callee_str);
    MarkValueRange(trc, argsobj.initialLength(), data->slots, js_arguments_str);

    /*
@ -1329,7 +1323,7 @@ fun_resolve(JSContext *cx, JSObject *obj, jsid id, uintN flags,
            StrictPropertyOp setter;
            uintN attrs = JSPROP_PERMANENT;
            if (fun->isInterpreted() ? fun->inStrictMode() : fun->isBoundFunction()) {
-                JSObject *throwTypeError = fun->getThrowTypeError();
+                JSObject *throwTypeError = fun->global().getThrowTypeError();

                getter = CastAsPropertyOp(throwTypeError);
                setter = CastAsStrictPropertyOp(throwTypeError);
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@ -1855,7 +1855,7 @@ gc_root_traversal(JSTracer *trc, const RootEntry &entry)
    if (entry.value.type == JS_GC_ROOT_GCTHING_PTR)
        MarkGCThingRoot(trc, *reinterpret_cast<void **>(entry.key), name);
    else
-        MarkValueRoot(trc, *reinterpret_cast<Value *>(entry.key), name);
+        MarkValueRoot(trc, reinterpret_cast<Value *>(entry.key), name);
 }

 static void
@ -1883,7 +1883,7 @@ AutoGCRooter::trace(JSTracer *trc)
 {
    switch (tag) {
      case JSVAL:
-        MarkValueRoot(trc, static_cast<AutoValueRooter *>(this)->val, "JS::AutoValueRooter.val");
+        MarkValueRoot(trc, &static_cast<AutoValueRooter *>(this)->val, "JS::AutoValueRooter.val");
        return;

      case PARSER:
@ -1905,10 +1905,10 @@ AutoGCRooter::trace(JSTracer *trc)
            static_cast<AutoPropDescArrayRooter *>(this)->descriptors;
        for (size_t i = 0, len = descriptors.length(); i < len; i++) {
            PropDesc &desc = descriptors[i];
-            MarkValueRoot(trc, desc.pd, "PropDesc::pd");
-            MarkValueRoot(trc, desc.value, "PropDesc::value");
-            MarkValueRoot(trc, desc.get, "PropDesc::get");
-            MarkValueRoot(trc, desc.set, "PropDesc::set");
+            MarkValueRoot(trc, &desc.pd, "PropDesc::pd");
+            MarkValueRoot(trc, &desc.value, "PropDesc::value");
+            MarkValueRoot(trc, &desc.get, "PropDesc::get");
+            MarkValueRoot(trc, &desc.set, "PropDesc::set");
        }
        return;
      }
@ -1917,7 +1917,7 @@ AutoGCRooter::trace(JSTracer *trc)
        PropertyDescriptor &desc = *static_cast<AutoPropertyDescriptorRooter *>(this);
        if (desc.obj)
            MarkObjectRoot(trc, desc.obj, "Descriptor::obj");
-        MarkValueRoot(trc, desc.value, "Descriptor::value");
+        MarkValueRoot(trc, &desc.value, "Descriptor::value");
        if ((desc.attrs & JSPROP_GETTER) && desc.getter)
            MarkObjectRoot(trc, CastAsObject(desc.getter), "Descriptor::get");
        if (desc.attrs & JSPROP_SETTER && desc.setter)
@ -1996,26 +1996,6 @@ AutoGCRooter::traceAll(JSTracer *trc)

 namespace js {

-JS_FRIEND_API(void)
-MarkContext(JSTracer *trc, JSContext *acx)
-{
-    /* Stack frames and slots are traced by StackSpace::mark. */
-
-    /* Mark other roots-by-definition in acx. */
-    if (acx->globalObject && !acx->hasRunOption(JSOPTION_UNROOTED_GLOBAL))
-        MarkObjectRoot(trc, acx->globalObject, "global object");
-    if (acx->isExceptionPending())
-        MarkValueRoot(trc, acx->getPendingException(), "exception");
-
-    if (acx->autoGCRooters)
-        acx->autoGCRooters->traceAll(trc);
-
-    if (acx->sharpObjectMap.depth > 0)
-        js_TraceSharpMap(trc, &acx->sharpObjectMap);
-
-    MarkValueRoot(trc, acx->iterValue, "iterValue");
-}
-
 void
 MarkWeakReferences(GCMarker *gcmarker)
 {
@ -2053,7 +2033,7 @@ MarkRuntime(JSTracer *trc)

    JSContext *iter = NULL;
    while (JSContext *acx = js_ContextIterator(rt, JS_TRUE, &iter))
-        MarkContext(trc, acx);
+        acx->mark(trc);

    for (GCCompartmentsIter c(rt); !c.done(); c.next()) {
        if (c->activeAnalysis)
--- a/js/src/jsgcmark.cpp
+++ b/js/src/jsgcmark.cpp
@ -45,9 +45,6 @@
 * scanning functions, but they don't push onto an explicit stack.
 */

-using namespace js;
-using namespace js::gc;
-
 namespace js {
 namespace gc {

@ -147,7 +144,8 @@ MarkRoot(JSTracer *trc, T *thing, const char *name)

 template <typename T>
 static void
-MarkRange(JSTracer *trc, size_t len, HeapPtr<T> *vec, const char *name) {
+MarkRange(JSTracer *trc, size_t len, HeapPtr<T> *vec, const char *name)
+{
    for (size_t i = 0; i < len; ++i) {
        if (T *obj = vec[i]) {
            JS_SET_TRACING_INDEX(trc, name, i);
@ -158,7 +156,8 @@ MarkRange(JSTracer *trc, size_t len, HeapPtr<T> *vec, const char *name) {

 template <typename T>
 static void
-MarkRootRange(JSTracer *trc, size_t len, T **vec, const char *name) {
+MarkRootRange(JSTracer *trc, size_t len, T **vec, const char *name)
+{
    for (size_t i = 0; i < len; ++i) {
        JS_SET_TRACING_INDEX(trc, name, i);
        MarkInternal(trc, vec[i]);
@ -299,43 +298,43 @@ MarkIdRootRange(JSTracer *trc, size_t len, jsid *vec, const char *name)
 /*** Value Marking ***/

 static inline void
-MarkValueInternal(JSTracer *trc, const Value &v)
+MarkValueInternal(JSTracer *trc, Value *v)
 {
-    if (v.isMarkable()) {
-        JS_ASSERT(v.toGCThing());
-        return MarkKind(trc, v.toGCThing(), v.gcKind());
+    if (v->isMarkable()) {
+        JS_ASSERT(v->toGCThing());
+        return MarkKind(trc, v->toGCThing(), v->gcKind());
    }
 }

 void
-MarkValue(JSTracer *trc, const js::HeapValue &v, const char *name)
+MarkValue(JSTracer *trc, HeapValue *v, const char *name)
+{
+    JS_SET_TRACING_NAME(trc, name);
+    MarkValueInternal(trc, v->unsafeGet());
+}
+
+void
+MarkValueRoot(JSTracer *trc, Value *v, const char *name)
 {
    JS_SET_TRACING_NAME(trc, name);
    MarkValueInternal(trc, v);
 }

 void
-MarkValueRoot(JSTracer *trc, const Value &v, const char *name)
-{
-    JS_SET_TRACING_NAME(trc, name);
-    MarkValueInternal(trc, v);
-}
-
-void
-MarkValueRange(JSTracer *trc, size_t len, const HeapValue *vec, const char *name)
+MarkValueRange(JSTracer *trc, size_t len, HeapValue *vec, const char *name)
 {
    for (size_t i = 0; i < len; ++i) {
        JS_SET_TRACING_INDEX(trc, name, i);
-        MarkValueInternal(trc, vec[i]);
+        MarkValueInternal(trc, vec[i].unsafeGet());
    }
 }

 void
-MarkValueRootRange(JSTracer *trc, size_t len, const Value *vec, const char *name)
+MarkValueRootRange(JSTracer *trc, size_t len, Value *vec, const char *name)
 {
    for (size_t i = 0; i < len; ++i) {
        JS_SET_TRACING_INDEX(trc, name, i);
-        MarkValueInternal(trc, vec[i]);
+        MarkValueInternal(trc, &vec[i]);
    }
 }

@ -360,17 +359,17 @@ MarkShape(JSTracer *trc, const HeapPtr<const Shape> &thing, const char *name)
 }

 void
-MarkValueUnbarriered(JSTracer *trc, const js::Value &v, const char *name)
+MarkValueUnbarriered(JSTracer *trc, Value *v, const char *name)
 {
    JS_SET_TRACING_NAME(trc, name);
    MarkValueInternal(trc, v);
 }

 void
-MarkCrossCompartmentValue(JSTracer *trc, const js::HeapValue &v, const char *name)
+MarkCrossCompartmentValue(JSTracer *trc, HeapValue *v, const char *name)
 {
-    if (v.isMarkable()) {
-        js::gc::Cell *cell = (js::gc::Cell *)v.toGCThing();
+    if (v->isMarkable()) {
+        Cell *cell = (Cell *)v->toGCThing();
        JSRuntime *rt = trc->runtime;
        if (rt->gcCurrentCompartment && cell->compartment() != rt->gcCurrentCompartment)
            return;
@ -643,7 +642,7 @@ MarkChildren(JSTracer *trc, JSObject *obj)
        uint32_t nslots = obj->slotSpan();
        for (uint32_t i = 0; i < nslots; i++) {
            JS_SET_TRACING_DETAILS(trc, js_PrintObjectSlotName, obj, i);
-            MarkValueInternal(trc, obj->nativeGetSlot(i));
+            MarkValueInternal(trc, obj->nativeGetSlotRef(i).unsafeGet());
        }
    }
 }
@ -672,7 +671,10 @@ MarkChildren(JSTracer *trc, JSScript *script)
    JS_ASSERT_IF(trc->runtime->gcCheckCompartment,
                 script->compartment() == trc->runtime->gcCheckCompartment);

-    MarkStringRootRange(trc, script->natoms, script->atoms, "atoms");
+    for (uint32_t i = 0; i < script->natoms; ++i) {
+        if (JSAtom *p = script->atoms[i])
+            MarkStringUnbarriered(trc, p, "atom");
+    }

    if (JSScript::isValidOffset(script->objectsOffset)) {
        JSObjectArray *objarray = script->objects();
@ -851,6 +853,8 @@ MarkChildren(JSTracer *trc, JSXML *xml)

 } /* namespace gc */

+using namespace js::gc;
+
 inline void
 GCMarker::processMarkStackTop()
 {
@ -916,7 +920,7 @@ GCMarker::processMarkStackTop()
        types::TypeObject *type = obj->typeFromGC();
        PushMarkStack(this, type);

-        js::Shape *shape = obj->lastProperty();
+        Shape *shape = obj->lastProperty();
        PushMarkStack(this, shape);

        /* Call the trace hook if necessary. */
--- a/js/src/jsgcmark.h
+++ b/js/src/jsgcmark.h
@ -97,19 +97,19 @@ MarkIdRootRange(JSTracer *trc, size_t len, jsid *vec, const char *name);
 /*** Value Marking ***/

 void
-MarkValue(JSTracer *trc, const js::HeapValue &v, const char *name);
+MarkValue(JSTracer *trc, HeapValue *v, const char *name);

 void
-MarkValueRange(JSTracer *trc, size_t len, const HeapValue *vec, const char *name);
+MarkValueRange(JSTracer *trc, size_t len, HeapValue *vec, const char *name);

 void
-MarkValueRoot(JSTracer *trc, const Value &v, const char *name);
+MarkValueRoot(JSTracer *trc, Value *v, const char *name);

 void
-MarkValueRootRange(JSTracer *trc, size_t len, const Value *vec, const char *name);
+MarkValueRootRange(JSTracer *trc, size_t len, Value *vec, const char *name);

 inline void
-MarkValueRootRange(JSTracer *trc, const Value *begin, const Value *end, const char *name)
+MarkValueRootRange(JSTracer *trc, Value *begin, Value *end, const char *name)
 {
    MarkValueRootRange(trc, end - begin, begin, name);
 }
@ -122,14 +122,14 @@ MarkShape(JSTracer *trc, const HeapPtr<const Shape> &thing, const char *name);

 /* Direct value access used by the write barriers and the methodjit */
 void
-MarkValueUnbarriered(JSTracer *trc, const js::Value &v, const char *name);
+MarkValueUnbarriered(JSTracer *trc, Value *v, const char *name);

 /*
 * Mark a value that may be in a different compartment from the compartment
 * being GC'd. (Although it won't be marked if it's in the wrong compartment.)
 */
 void
-MarkCrossCompartmentValue(JSTracer *trc, const js::HeapValue &v, const char *name);
+MarkCrossCompartmentValue(JSTracer *trc, HeapValue *v, const char *name);

 /*
 * MarkChildren<JSObject> is exposed solely for preWriteBarrier on
@ -153,7 +153,7 @@ MarkCycleCollectorChildren(JSTracer *trc, const Shape *shape);
 */

 inline void
-Mark(JSTracer *trc, const js::HeapValue &v, const char *name)
+Mark(JSTracer *trc, HeapValue *v, const char *name)
 {
    MarkValue(trc, v, name);
 }
@ -171,7 +171,7 @@ Mark(JSTracer *trc, const HeapPtr<JSXML> &xml, const char *name)
 }

 inline bool
-IsMarked(const js::Value &v)
+IsMarked(const Value &v)
 {
    if (v.isMarkable())
        return !IsAboutToBeFinalized(v);
--- a/js/src/jsnum.cpp
+++ b/js/src/jsnum.cpp
@ -490,10 +490,9 @@ Number(JSContext *cx, uintN argc, Value *vp)
    if (!isConstructing)
        return true;

-    JSObject *obj = NewBuiltinClassInstance(cx, &NumberClass);
+    JSObject *obj = NumberObject::create(cx, vp[0].toNumber());
    if (!obj)
        return false;
-    obj->setPrimitiveThis(vp[0]);
    vp->setObject(*obj);
    return true;
 }
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@ -203,14 +203,8 @@ obj_setProto(JSContext *cx, JSObject *obj, jsid id, JSBool strict, Value *vp)

 #endif /* !JS_HAS_OBJ_PROTO_PROP */

-static JSHashNumber
-js_hash_object(const void *key)
-{
-    return JSHashNumber(uintptr_t(key) >> JS_GCTHING_ALIGN);
-}
-
-static JSHashEntry *
-MarkSharpObjects(JSContext *cx, JSObject *obj, JSIdArray **idap)
+static bool
+MarkSharpObjects(JSContext *cx, JSObject *obj, JSIdArray **idap, JSSharpInfo *value)
 {
    JS_CHECK_RECURSION(cx, return NULL);

@ -218,21 +212,15 @@ MarkSharpObjects(JSContext *cx, JSObject *obj, JSIdArray **idap)

    JSSharpObjectMap *map = &cx->sharpObjectMap;
    JS_ASSERT(map->depth >= 1);
-    JSHashTable *table = map->table;
-    JSHashNumber hash = js_hash_object(obj);
-    JSHashEntry **hep = JS_HashTableRawLookup(table, hash, obj);
-    JSHashEntry *he = *hep;
-    if (!he) {
-        jsatomid sharpid = 0;
-        he = JS_HashTableRawAdd(table, hep, hash, obj, (void *) sharpid);
-        if (!he) {
-            JS_ReportOutOfMemory(cx);
-            return NULL;
-        }
+    JSSharpInfo sharpid;
+    JSSharpTable::Ptr p = map->table.lookup(obj);
+    if (!p) {
+        if (!map->table.put(obj, sharpid))
+            return false;

        ida = JS_Enumerate(cx, obj);
        if (!ida)
-            return NULL;
+            return false;

        bool ok = true;
        for (jsint i = 0, length = ida->length; i < length; i++) {
@ -261,7 +249,7 @@ MarkSharpObjects(JSContext *cx, JSObject *obj, JSIdArray **idap)
            if (hasSetter) {
                /* Mark the getter, then set val to setter. */
                if (hasGetter && v.value().isObject()) {
-                    ok = !!MarkSharpObjects(cx, &v.value().toObject(), NULL);
+                    ok = MarkSharpObjects(cx, &v.value().toObject(), NULL, NULL);
                    if (!ok)
                        break;
                }
@ -271,7 +259,7 @@ MarkSharpObjects(JSContext *cx, JSObject *obj, JSIdArray **idap)
                if (!ok)
                    break;
            }
-            if (v.value().isObject() && !MarkSharpObjects(cx, &v.value().toObject(), NULL)) {
+            if (v.value().isObject() && !MarkSharpObjects(cx, &v.value().toObject(), NULL, NULL)) {
                ok = false;
                break;
            }
@ -279,47 +267,42 @@ MarkSharpObjects(JSContext *cx, JSObject *obj, JSIdArray **idap)
        if (!ok || !idap)
            JS_DestroyIdArray(cx, ida);
        if (!ok)
-            return NULL;
+            return false;
    } else {
-        jsatomid sharpid = uintptr_t(he->value);
-        if (sharpid == 0) {
-            sharpid = ++map->sharpgen << SHARP_ID_SHIFT;
-            he->value = (void *) sharpid;
+        if (!p->value.hasGen && !p->value.isSharp) {
+            p->value.hasGen = true;
        }
+        sharpid = p->value;
        ida = NULL;
    }
    if (idap)
        *idap = ida;
-    return he;
+    if (value)
+        *value = sharpid;
+    return true;
 }

-JSHashEntry *
-js_EnterSharpObject(JSContext *cx, JSObject *obj, JSIdArray **idap, bool *alreadySeen)
+bool
+js_EnterSharpObject(JSContext *cx, JSObject *obj, JSIdArray **idap, bool *alreadySeen, bool *isSharp)
 {
    if (!JS_CHECK_OPERATION_LIMIT(cx))
-        return NULL;
+        return false;

    *alreadySeen = false;

    JSSharpObjectMap *map = &cx->sharpObjectMap;
-    JSHashTable *table = map->table;
-    if (!table) {
-        table = JS_NewHashTable(8, js_hash_object, JS_CompareValues,
-                                JS_CompareValues, NULL, NULL);
-        if (!table) {
-            JS_ReportOutOfMemory(cx);
-            return NULL;
-        }
-        map->table = table;
-        JS_KEEP_ATOMS(cx->runtime);
-    }

-    JSHashEntry *he;
-    jsatomid sharpid;
+    JS_ASSERT_IF(map->depth == 0, map->table.count() == 0);
+    JS_ASSERT_IF(map->table.count() == 0, map->depth == 0);
+
+    JSSharpTable::Ptr p;
+    JSSharpInfo sharpid;
    JSIdArray *ida = NULL;

    /* From this point the control must flow either through out: or bad:. */
    if (map->depth == 0) {
+        JS_KEEP_ATOMS(cx->runtime);
+
        /*
         * Although MarkSharpObjects tries to avoid invoking getters,
         * it ends up doing so anyway under some circumstances; for
@ -332,21 +315,18 @@ js_EnterSharpObject(JSContext *cx, JSObject *obj, JSIdArray **idap, bool *alread
         * ensure that such a call doesn't free the hash table we're
         * still using.
         */
-        ++map->depth;
-        he = MarkSharpObjects(cx, obj, &ida);
-        --map->depth;
-        if (!he)
+        map->depth = 1;
+        bool success = MarkSharpObjects(cx, obj, &ida, &sharpid);
+        JS_ASSERT(map->depth == 1);
+        map->depth = 0;
+        if (!success)
            goto bad;
-        JS_ASSERT((uintptr_t(he->value) & SHARP_BIT) == 0);
+        JS_ASSERT(!sharpid.isSharp);
        if (!idap) {
            JS_DestroyIdArray(cx, ida);
            ida = NULL;
        }
    } else {
-        JSHashNumber hash = js_hash_object(obj);
-        JSHashEntry **hep = JS_HashTableRawLookup(table, hash, obj);
-        he = *hep;
-
        /*
         * It's possible that the value of a property has changed from the
         * first time the object's properties are traversed (when the property
@ -354,24 +334,20 @@ js_EnterSharpObject(JSContext *cx, JSObject *obj, JSIdArray **idap, bool *alread
         * converted to strings), i.e., the JSObject::getProperty() call is not
         * idempotent.
         */
-        if (!he) {
-            he = JS_HashTableRawAdd(table, hep, hash, obj, NULL);
-            if (!he) {
-                JS_ReportOutOfMemory(cx);
+        p = map->table.lookup(obj);
+        if (!p) {
+            if (!map->table.put(obj, sharpid))
                goto bad;
-            }
-            sharpid = 0;
            goto out;
        }
+        sharpid = p->value;
    }

-    sharpid = uintptr_t(he->value);
-    if (sharpid != 0)
+    if (sharpid.isSharp || sharpid.hasGen)
        *alreadySeen = true;

 out:
-    JS_ASSERT(he);
-    if ((sharpid & SHARP_BIT) == 0) {
+    if (!sharpid.isSharp) {
        if (idap && !ida) {
            ida = JS_Enumerate(cx, obj);
            if (!ida)
@ -382,17 +358,17 @@ out:

    if (idap)
        *idap = ida;
-    return he;
+    *isSharp = sharpid.isSharp;
+    return true;

 bad:
    /* Clean up the sharpObjectMap table on outermost error. */
    if (map->depth == 0) {
        JS_UNKEEP_ATOMS(cx->runtime);
        map->sharpgen = 0;
-        JS_HashTableDestroy(map->table);
-        map->table = NULL;
+        map->table.clear();
    }
-    return NULL;
+    return false;
 }

 void
@ -403,8 +379,7 @@ js_LeaveSharpObject(JSContext *cx, JSIdArray **idap)
    if (--map->depth == 0) {
        JS_UNKEEP_ATOMS(cx->runtime);
        map->sharpgen = 0;
-        JS_HashTableDestroy(map->table);
-        map->table = NULL;
+        map->table.clear();
    }
    if (idap) {
        if (JSIdArray *ida = *idap) {
@ -414,18 +389,10 @@ js_LeaveSharpObject(JSContext *cx, JSIdArray **idap)
    }
 }

-static intN
-gc_sharp_table_entry_marker(JSHashEntry *he, intN i, void *arg)
-{
-    MarkObjectRoot((JSTracer *)arg, (JSObject *)he->key, "sharp table entry");
-    return JS_DHASH_NEXT;
-}
-
 void
 js_TraceSharpMap(JSTracer *trc, JSSharpObjectMap *map)
 {
    JS_ASSERT(map->depth > 0);
-    JS_ASSERT(map->table);

    /*
     * During recursive calls to MarkSharpObjects a non-native object or
@ -447,7 +414,8 @@ js_TraceSharpMap(JSTracer *trc, JSSharpObjectMap *map)
     * with otherwise unreachable objects. But this is way too complex
     * to justify spending efforts.
     */
-    JS_HashTableEnumerateEntries(map->table, gc_sharp_table_entry_marker, trc);
+    for (JSSharpTable::Range r = map->table.all(); !r.empty(); r.popFront())
+        MarkObjectRoot(trc, r.front().key, "sharp table entry");
 }

 #if JS_HAS_TOSOURCE
@ -475,8 +443,8 @@ obj_toSource(JSContext *cx, uintN argc, Value *vp)

    JSIdArray *ida;
    bool alreadySeen = false;
-    JSHashEntry *he = js_EnterSharpObject(cx, obj, &ida, &alreadySeen);
-    if (!he)
+    bool isSharp = false;
+    if (!js_EnterSharpObject(cx, obj, &ida, &alreadySeen, &isSharp))
        return false;

    if (!ida) {
@ -491,10 +459,14 @@ obj_toSource(JSContext *cx, uintN argc, Value *vp)
        vp->setString(str);
        return true;
    }
-    JS_ASSERT(!IS_SHARP(he));

-    if (alreadySeen)
-        MAKE_SHARP(he);
+    JS_ASSERT(!isSharp);
+    if (alreadySeen) {
+        JSSharpTable::Ptr p = cx->sharpObjectMap.table.lookup(obj);
+        JS_ASSERT(p);
+        JS_ASSERT(!p->value.isSharp);
+        p->value.isSharp = true;
+    }

    /* Automatically call js_LeaveSharpObject when we leave this frame. */
    class AutoLeaveSharpObject {
@ -537,7 +509,6 @@ obj_toSource(JSContext *cx, uintN argc, Value *vp)
        JSString *s = ToString(cx, IdToValue(id));
        if (!s || !(idstr = s->ensureLinear(cx)))
            return false;
-        vp->setString(idstr);                           /* local root */

        int valcnt = 0;
        if (prop) {
@ -576,7 +547,6 @@ obj_toSource(JSContext *cx, uintN argc, Value *vp)
            s = js_QuoteString(cx, idstr, jschar('\''));
            if (!s || !(idstr = s->ensureLinear(cx)))
                return false;
-            vp->setString(idstr);                       /* local root */
        }

        for (int j = 0; j < valcnt; j++) {
@ -3525,6 +3495,11 @@ JSObject::TradeGuts(JSContext *cx, JSObject *a, JSObject *b, TradeGutsReserved &
    types::TypeObject::writeBarrierPost(a->type_, &a->type_);
    types::TypeObject::writeBarrierPost(b->type_, &b->type_);
 #endif
+
+    if (a->inDictionaryMode())
+        a->lastProperty()->listp = &a->shape_;
+    if (b->inDictionaryMode())
+        b->lastProperty()->listp = &b->shape_;
 }

 /*
@ -3595,7 +3570,7 @@ DefineStandardSlot(JSContext *cx, JSObject *obj, JSProtoKey key, JSAtom *atom,
        const Shape *shape = obj->nativeLookup(cx, id);
        if (!shape) {
            uint32_t slot = 2 * JSProto_LIMIT + key;
-            SetReservedSlot(obj, slot, v);
+            obj->setReservedSlot(slot, v);
            if (!obj->addProperty(cx, id, JS_PropertyStub, JS_StrictPropertyStub, slot, attrs, 0, 0))
                return false;
            AddTypePropertyId(cx, obj, id, v);
@ -3618,8 +3593,8 @@ SetClassObject(JSObject *obj, JSProtoKey key, JSObject *cobj, JSObject *proto)
    if (!obj->isGlobal())
        return;

-    SetReservedSlot(obj, key, ObjectOrNullValue(cobj));
-    SetReservedSlot(obj, JSProto_LIMIT + key, ObjectOrNullValue(proto));
+    obj->setReservedSlot(key, ObjectOrNullValue(cobj));
+    obj->setReservedSlot(JSProto_LIMIT + key, ObjectOrNullValue(proto));
 }

 static void
@ -5887,7 +5862,7 @@ DefaultValue(JSContext *cx, JSObject *obj, JSType hint, Value *vp)
                                 &StringClass,
                                 ATOM_TO_JSID(cx->runtime->atomState.toStringAtom),
                                 js_str_toString)) {
-            *vp = obj->getPrimitiveThis();
+            *vp = StringValue(obj->asString().unbox());
            return true;
        }

@ -5910,7 +5885,9 @@ DefaultValue(JSContext *cx, JSObject *obj, JSType hint, Value *vp)
             ClassMethodIsNative(cx, obj, &NumberClass,
                                 ATOM_TO_JSID(cx->runtime->atomState.valueOfAtom),
                                 js_num_valueOf))) {
-            *vp = obj->getPrimitiveThis();
+            *vp = obj->isString()
+                  ? StringValue(obj->asString().unbox())
+                  : NumberValue(obj->asNumber().unbox());
            return true;
        }

--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@ -998,22 +998,6 @@ struct JSObject : js::gc::Cell
    bool isSealed(JSContext *cx, bool *resultp) { return isSealedOrFrozen(cx, SEAL, resultp); }
    bool isFrozen(JSContext *cx, bool *resultp) { return isSealedOrFrozen(cx, FREEZE, resultp); }

-    /*
-     * Primitive-specific getters and setters.
-     */
-
-  private:
-    static const uint32_t JSSLOT_PRIMITIVE_THIS = 0;
-
-  public:
-    inline const js::Value &getPrimitiveThis() const;
-    inline void setPrimitiveThis(const js::Value &pthis);
-
-    static size_t getPrimitiveThisOffset() {
-        /* All primitive objects have their value in a fixed slot. */
-        return getFixedSlotOffset(JSSLOT_PRIMITIVE_THIS);
-    }
-
    /* Accessors for elements. */

    js::ObjectElements *getElementsHeader() const {
@ -1365,8 +1349,6 @@ struct JSObject : js::gc::Cell

    static bool thisObject(JSContext *cx, const js::Value &v, js::Value *vp);

-    inline JSObject *getThrowTypeError() const;
-
    bool swap(JSContext *cx, JSObject *other);

    inline void initArrayClass();
@ -1554,13 +1536,8 @@ class ValueArray {
 };

 /* For manipulating JSContext::sharpObjectMap. */
-#define SHARP_BIT       ((jsatomid) 1)
-#define SHARP_ID_SHIFT  2
-#define IS_SHARP(he)    (uintptr_t((he)->value) & SHARP_BIT)
-#define MAKE_SHARP(he)  ((he)->value = (void *) (uintptr_t((he)->value)|SHARP_BIT))
-
-extern JSHashEntry *
-js_EnterSharpObject(JSContext *cx, JSObject *obj, JSIdArray **idap, bool *alreadySeen);
+extern bool
+js_EnterSharpObject(JSContext *cx, JSObject *obj, JSIdArray **idap, bool *alreadySeen, bool *isSharp);

 extern void
 js_LeaveSharpObject(JSContext *cx, JSIdArray **idap);
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@ -65,8 +65,12 @@

 #include "gc/Barrier.h"
 #include "js/TemplateLib.h"
+
+#include "vm/BooleanObject.h"
 #include "vm/GlobalObject.h"
+#include "vm/NumberObject.h"
 #include "vm/RegExpStatics.h"
+#include "vm/StringObject.h"

 #include "jsatominlines.h"
 #include "jsfuninlines.h"
@ -436,20 +440,6 @@ JSObject::setReservedSlot(uintN index, const js::Value &v)
    setSlot(index, v);
 }

-inline const js::Value &
-JSObject::getPrimitiveThis() const
-{
-    JS_ASSERT(isPrimitive());
-    return getFixedSlot(JSSLOT_PRIMITIVE_THIS);
-}
-
-inline void
-JSObject::setPrimitiveThis(const js::Value &pthis)
-{
-    JS_ASSERT(isPrimitive());
-    setFixedSlot(JSSLOT_PRIMITIVE_THIS, pthis);
-}
-
 inline bool
 JSObject::hasContiguousSlots(size_t start, size_t count) const
 {
@ -1916,6 +1906,7 @@ class PrimitiveBehavior<JSString *> {
  public:
    static inline bool isType(const Value &v) { return v.isString(); }
    static inline JSString *extract(const Value &v) { return v.toString(); }
+    static inline JSString *extract(JSObject &obj) { return obj.asString().unbox(); }
    static inline Class *getClass() { return &StringClass; }
 };

@ -1924,6 +1915,7 @@ class PrimitiveBehavior<bool> {
  public:
    static inline bool isType(const Value &v) { return v.isBoolean(); }
    static inline bool extract(const Value &v) { return v.toBoolean(); }
+    static inline bool extract(JSObject &obj) { return obj.asBoolean().unbox(); }
    static inline Class *getClass() { return &BooleanClass; }
 };

@ -1932,6 +1924,7 @@ class PrimitiveBehavior<double> {
  public:
    static inline bool isType(const Value &v) { return v.isNumber(); }
    static inline double extract(const Value &v) { return v.toNumber(); }
+    static inline double extract(JSObject &obj) { return obj.asNumber().unbox(); }
    static inline Class *getClass() { return &NumberClass; }
 };

@ -1968,7 +1961,7 @@ BoxedPrimitiveMethodGuard(JSContext *cx, CallArgs args, Native native, T *v, boo
    if (!NonGenericMethodGuard(cx, args, native, Behavior::getClass(), ok))
        return false;

-    *v = Behavior::extract(thisv.toObject().getPrimitiveThis());
+    *v = Behavior::extract(thisv.toObject());
    return true;
 }

--- a/js/src/jsproxy.cpp
+++ b/js/src/jsproxy.cpp
@ -57,7 +57,7 @@
 using namespace js;
 using namespace js::gc;

-static inline const HeapValue &
+static inline HeapValue &
 GetCall(JSObject *proxy)
 {
    JS_ASSERT(IsFunctionProxy(proxy));
@ -72,7 +72,7 @@ GetConstruct(JSObject *proxy)
    return proxy->getSlot(JSSLOT_PROXY_CONSTRUCT);
 }

-static inline const HeapValue &
+static inline HeapValue &
 GetFunctionProxyConstruct(JSObject *proxy)
 {
    JS_ASSERT(IsFunctionProxy(proxy));
@ -92,6 +92,9 @@ OperationInProgress(JSContext *cx, JSObject *proxy)
    return false;
 }

+static bool
+FixProxy(JSContext *cx, JSObject *proxy, JSBool *bp);
+
 ProxyHandler::ProxyHandler(void *family) : mFamily(family)
 {
 }
@ -1243,12 +1246,12 @@ static void
 proxy_TraceObject(JSTracer *trc, JSObject *obj)
 {
    GetProxyHandler(obj)->trace(trc, obj);
-    MarkCrossCompartmentValue(trc, obj->getReservedSlotRef(JSSLOT_PROXY_PRIVATE), "private");
-    MarkCrossCompartmentValue(trc, obj->getReservedSlotRef(JSSLOT_PROXY_EXTRA + 0), "extra0");
-    MarkCrossCompartmentValue(trc, obj->getReservedSlotRef(JSSLOT_PROXY_EXTRA + 1), "extra1");
+    MarkCrossCompartmentValue(trc, &obj->getReservedSlotRef(JSSLOT_PROXY_PRIVATE), "private");
+    MarkCrossCompartmentValue(trc, &obj->getReservedSlotRef(JSSLOT_PROXY_EXTRA + 0), "extra0");
+    MarkCrossCompartmentValue(trc, &obj->getReservedSlotRef(JSSLOT_PROXY_EXTRA + 1), "extra1");
    if (IsFunctionProxy(obj)) {
-        MarkCrossCompartmentValue(trc, GetCall(obj), "call");
-        MarkCrossCompartmentValue(trc, GetFunctionProxyConstruct(obj), "construct");
+        MarkCrossCompartmentValue(trc, &GetCall(obj), "call");
+        MarkCrossCompartmentValue(trc, &GetFunctionProxyConstruct(obj), "construct");
    }
 }

@ -1256,8 +1259,8 @@ static void
 proxy_TraceFunction(JSTracer *trc, JSObject *obj)
 {
    proxy_TraceObject(trc, obj);
-    MarkCrossCompartmentValue(trc, GetCall(obj), "call");
-    MarkCrossCompartmentValue(trc, GetFunctionProxyConstruct(obj), "construct");
+    MarkCrossCompartmentValue(trc, &GetCall(obj), "call");
+    MarkCrossCompartmentValue(trc, &GetFunctionProxyConstruct(obj), "construct");
 }

 static JSBool
@ -1735,8 +1738,8 @@ Class js::CallableObjectClass = {
    callable_Construct,
 };

-JS_FRIEND_API(JSBool)
-js::FixProxy(JSContext *cx, JSObject *proxy, JSBool *bp)
+static bool
+FixProxy(JSContext *cx, JSObject *proxy, JSBool *bp)
 {
    if (OperationInProgress(cx, proxy)) {
        JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_BAD_PROXY_FIX);
--- a/js/src/jsproxy.h
+++ b/js/src/jsproxy.h
@ -183,13 +183,6 @@ GetProxyPrivate(const JSObject *obj)
    return GetReservedSlot(obj, JSSLOT_PROXY_PRIVATE);
 }

-inline void
-SetProxyPrivate(JSObject *obj, const Value &priv)
-{
-    JS_ASSERT(IsProxy(obj));
-    SetReservedSlot(obj, JSSLOT_PROXY_PRIVATE, priv);
-}
-
 inline const Value &
 GetProxyExtra(const JSObject *obj, size_t n)
 {
@ -210,9 +203,6 @@ NewProxyObject(JSContext *cx, ProxyHandler *handler, const Value &priv,
               JSObject *proto, JSObject *parent,
               JSObject *call = NULL, JSObject *construct = NULL);

-JS_FRIEND_API(JSBool)
-FixProxy(JSContext *cx, JSObject *proxy, JSBool *bp);
-
 } /* namespace js */

 JS_BEGIN_EXTERN_C
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@ -1903,6 +1903,6 @@ JSScript::markTrapClosures(JSTracer *trc)
    for (unsigned i = 0; i < length; i++) {
        BreakpointSite *site = debug->breakpoints[i];
        if (site && site->trapHandler)
-            MarkValue(trc, site->trapClosure, "trap closure");
+            MarkValue(trc, &site->trapClosure, "trap closure");
    }
 }
--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@ -399,7 +399,7 @@ static const uintN STRING_ELEMENT_ATTRS = JSPROP_ENUMERATE | JSPROP_READONLY | J
 static JSBool
 str_enumerate(JSContext *cx, JSObject *obj)
 {
-    JSString *str = obj->getPrimitiveThis().toString();
+    JSString *str = obj->asString().unbox();
    for (size_t i = 0, length = str->length(); i < length; i++) {
        JSString *str1 = js_NewDependentString(cx, str, i, 1);
        if (!str1)
@ -421,7 +421,7 @@ str_resolve(JSContext *cx, JSObject *obj, jsid id, uintN flags,
    if (!JSID_IS_INT(id))
        return JS_TRUE;

-    JSString *str = obj->getPrimitiveThis().toString();
+    JSString *str = obj->asString().unbox();

    jsint slot = JSID_TO_INT(id);
    if ((size_t)slot < str->length()) {
@ -472,8 +472,9 @@ ThisToStringForStringProto(JSContext *cx, CallReceiver call)
                                ATOM_TO_JSID(cx->runtime->atomState.toStringAtom),
                                js_str_toString))
        {
-            call.thisv() = obj->getPrimitiveThis();
-            return call.thisv().toString();
+            JSString *str = obj->asString().unbox();
+            call.thisv().setString(str);
+            return str;
        }
    } else if (call.thisv().isNullOrUndefined()) {
        JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_CANT_CONVERT_TO,
--- a/js/src/jstypedarray.cpp
+++ b/js/src/jstypedarray.cpp
@ -1097,7 +1097,7 @@ class TypedArrayTemplate
    static void
    obj_trace(JSTracer *trc, JSObject *obj)
    {
-        MarkValue(trc, obj->getFixedSlotRef(FIELD_BUFFER), "typedarray.buffer");
+        MarkValue(trc, &obj->getFixedSlotRef(FIELD_BUFFER), "typedarray.buffer");
    }

    static JSBool
--- a/js/src/jsweakmap.h
+++ b/js/src/jsweakmap.h
@ -91,7 +91,7 @@ namespace js {
 //     bool isMarked(const Type &x)
 //        Return true if x has been marked as live by the garbage collector.
 //
-//     bool mark(const Type &x)
+//     bool mark(Type &x)
 //        Return false if x is already marked. Otherwise, mark x and return true.
 //
 //   If omitted, the MarkPolicy parameter defaults to js::DefaultMarkPolicy<Type>,
@ -213,7 +213,7 @@ class WeakMap : public HashMap<Key, Value, HashPolicy, RuntimeAllocPolicy>, publ
        bool markedAny = false;
        for (Range r = Base::all(); !r.empty(); r.popFront()) {
            const Key &k = r.front().key;
-            const Value &v = r.front().value;
+            Value &v = r.front().value;
            /* If the entry is live, ensure its key and value are marked. */
            if (kp.isMarked(k)) {
                markedAny |= vp.mark(v);
@ -264,10 +264,10 @@ class DefaultMarkPolicy<HeapValue> {
            return !IsAboutToBeFinalized(x);
        return true;
    }
-    bool mark(const HeapValue &x) {
+    bool mark(HeapValue &x) {
        if (isMarked(x))
            return false;
-        js::gc::MarkValue(tracer, x, "WeakMap entry");
+        js::gc::MarkValue(tracer, &x, "WeakMap entry");
        return true;
    }
 };
@ -281,7 +281,7 @@ class DefaultMarkPolicy<HeapPtrObject> {
    bool isMarked(const HeapPtrObject &x) {
        return !IsAboutToBeFinalized(x);
    }
-    bool mark(const HeapPtrObject &x) {
+    bool mark(HeapPtrObject &x) {
        if (isMarked(x))
            return false;
        js::gc::MarkObject(tracer, x, "WeakMap entry");
@ -298,7 +298,7 @@ class DefaultMarkPolicy<HeapPtrScript> {
    bool isMarked(const HeapPtrScript &x) {
        return !IsAboutToBeFinalized(x);
    }
-    bool mark(const HeapPtrScript &x) {
+    bool mark(HeapPtrScript &x) {
        if (isMarked(x))
            return false;
        js::gc::MarkScript(tracer, x, "WeakMap entry");
--- a/js/src/jswrapper.cpp
+++ b/js/src/jswrapper.cpp
@ -367,7 +367,7 @@ Wrapper::iteratorNext(JSContext *cx, JSObject *wrapper, Value *vp)
 void
 Wrapper::trace(JSTracer *trc, JSObject *wrapper)
 {
-    MarkValue(trc, wrapper->getReservedSlotRef(JSSLOT_PROXY_PRIVATE), "wrappedObject");
+    MarkValue(trc, &wrapper->getReservedSlotRef(JSSLOT_PROXY_PRIVATE), "wrappedObject");
 }

 JSObject *
@ -875,7 +875,7 @@ CrossCompartmentWrapper::iteratorNext(JSContext *cx, JSObject *wrapper, Value *v
 void
 CrossCompartmentWrapper::trace(JSTracer *trc, JSObject *wrapper)
 {
-    MarkCrossCompartmentValue(trc, wrapper->getReservedSlotRef(JSSLOT_PROXY_PRIVATE),
+    MarkCrossCompartmentValue(trc, &wrapper->getReservedSlotRef(JSSLOT_PROXY_PRIVATE),
                              "wrappedObject");
 }

--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@ -177,6 +177,11 @@ mjit::Compiler::checkAnalysis(JSScript *script)
        return Compile_Abort;
    }

+    if (JSOp(*script->code) == JSOP_GENERATOR) {
+        JaegerSpew(JSpew_Abort, "script is a generator\n");
+        return Compile_Abort;
+    }
+
    if (!script->ensureRanAnalysis(cx, NULL))
        return Compile_Error;
    if (cx->typeInferenceEnabled() && !script->ensureRanInference(cx))
--- a/js/src/methodjit/PolyIC.cpp
+++ b/js/src/methodjit/PolyIC.cpp
@ -53,6 +53,7 @@
 #include "jsautooplen.h"

 #include "vm/ScopeObject-inl.h"
+#include "vm/StringObject-inl.h"

 #if defined JS_POLYIC

@ -944,7 +945,7 @@ class GetPropCompiler : public PICStubCompiler

        Jump notStringObj = masm.guardShape(pic.objReg, obj);

-        masm.loadPayload(Address(pic.objReg, JSObject::getPrimitiveThisOffset()), pic.objReg);
+        masm.loadPayload(Address(pic.objReg, StringObject::getPrimitiveValueOffset()), pic.objReg);
        masm.loadPtr(Address(pic.objReg, JSString::offsetOfLengthAndFlags()), pic.objReg);
        masm.urshift32(Imm32(JSString::LENGTH_SHIFT), pic.objReg);
        masm.move(ImmType(JSVAL_TYPE_INT32), pic.shapeReg);
@ -1885,7 +1886,7 @@ GetPropMaybeCached(VMFrame &f, ic::PICInfo *pic, bool cached)
                    LookupStatus status = cc.generateStringObjLengthStub();
                    if (status == Lookup_Error)
                        THROW();
-                    JSString *str = obj->getPrimitiveThis().toString();
+                    JSString *str = obj->asString().unbox();
                    f.regs.sp[-1].setInt32(str->length());
                }
                return;
--- a/js/src/methodjit/StubCalls.cpp
+++ b/js/src/methodjit/StubCalls.cpp
@ -1963,7 +1963,7 @@ stubs::ConvertToTypedFloat(JSContext *cx, Value *vp)
 void JS_FASTCALL
 stubs::WriteBarrier(VMFrame &f, Value *addr)
 {
-    js::gc::MarkValueUnbarriered(f.cx->compartment->barrierTracer(), *addr, "write barrier");
+    gc::MarkValueUnbarriered(f.cx->compartment->barrierTracer(), addr, "write barrier");
 }

 void JS_FASTCALL
@ -1971,5 +1971,5 @@ stubs::GCThingWriteBarrier(VMFrame &f, Value *addr)
 {
    gc::Cell *cell = (gc::Cell *)addr->toGCThing();
    if (cell && !cell->isMarked())
-        gc::MarkValueUnbarriered(f.cx->compartment->barrierTracer(), *addr, "write barrier");
+        gc::MarkValueUnbarriered(f.cx->compartment->barrierTracer(), addr, "write barrier");
 }
--- a/js/src/vm/BooleanObject.h
+++ b/js/src/vm/BooleanObject.h
@ -67,14 +67,13 @@ class BooleanObject : public JSObject
     */
    static inline BooleanObject *createWithProto(JSContext *cx, bool b, JSObject &proto);

-    Value unbox() const {
-        JS_ASSERT(getSlot(PRIMITIVE_VALUE_SLOT).isBoolean());
-        return getSlot(PRIMITIVE_VALUE_SLOT);
+    bool unbox() const {
+        return getFixedSlot(PRIMITIVE_VALUE_SLOT).toBoolean();
    }

  private:
    inline void setPrimitiveValue(bool b) {
-        setSlot(PRIMITIVE_VALUE_SLOT, BooleanValue(b));
+        setFixedSlot(PRIMITIVE_VALUE_SLOT, BooleanValue(b));
    }

    /* For access to init, as Boolean.prototype is special. */
--- a/js/src/vm/NumberObject.h
+++ b/js/src/vm/NumberObject.h
@ -67,14 +67,13 @@ class NumberObject : public JSObject
     */
    static inline NumberObject *createWithProto(JSContext *cx, jsdouble d, JSObject &proto);

-    Value unbox() const {
-        JS_ASSERT(getSlot(PRIMITIVE_VALUE_SLOT).isNumber());
-        return getSlot(PRIMITIVE_VALUE_SLOT);
+    double unbox() const {
+        return getFixedSlot(PRIMITIVE_VALUE_SLOT).toNumber();
    }

  private:
    inline void setPrimitiveValue(jsdouble d) {
-        setSlot(PRIMITIVE_VALUE_SLOT, NumberValue(d));
+        setFixedSlot(PRIMITIVE_VALUE_SLOT, NumberValue(d));
    }

    /* For access to init, as Number.prototype is special. */
--- a/js/src/vm/Stack.cpp
+++ b/js/src/vm/Stack.cpp
@ -275,7 +275,7 @@ StackFrame::mark(JSTracer *trc)
    }
    if (IS_GC_MARKING_TRACER(trc))
        script()->compartment()->active = true;
-    gc::MarkValueUnbarriered(trc, returnValue(), "rval");
+    gc::MarkValueUnbarriered(trc, &returnValue(), "rval");
 }

 /*****************************************************************************/
@ -485,7 +485,7 @@ StackSpace::markFrameSlots(JSTracer *trc, StackFrame *fp, Value *slotsEnd, jsbyt

        /* Will this slot be synced by the JIT? */
        if (!analysis->trackSlot(slot) || analysis->liveness(slot).live(offset))
-            gc::MarkValueRoot(trc, *vp, "vm_stack");
+            gc::MarkValueRoot(trc, vp, "vm_stack");
        else
            *vp = UndefinedValue();
    }
--- a/js/src/vm/Stack.h
+++ b/js/src/vm/Stack.h
@ -999,7 +999,7 @@ class StackFrame
        return !!(flags_ & HAS_RVAL);
    }

-    const Value &returnValue() {
+    Value &returnValue() {
        if (!(flags_ & HAS_RVAL))
            rval_.setUndefined();
        return rval_;
--- a/js/src/vm/StringObject.h
+++ b/js/src/vm/StringObject.h
@ -50,7 +50,7 @@ namespace js {

 class StringObject : public JSObject
 {
-    static const uintN PRIMITIVE_THIS_SLOT = 0;
+    static const uintN PRIMITIVE_VALUE_SLOT = 0;
    static const uintN LENGTH_SLOT = 1;

  public:
@ -69,20 +69,24 @@ class StringObject : public JSObject
    static inline StringObject *createWithProto(JSContext *cx, JSString *str, JSObject &proto);

    JSString *unbox() const {
-        return getSlot(PRIMITIVE_THIS_SLOT).toString();
+        return getFixedSlot(PRIMITIVE_VALUE_SLOT).toString();
    }

    inline size_t length() const {
-        return size_t(getSlot(LENGTH_SLOT).toInt32());
+        return size_t(getFixedSlot(LENGTH_SLOT).toInt32());
+    }
+
+    static size_t getPrimitiveValueOffset() {
+        return getFixedSlotOffset(PRIMITIVE_VALUE_SLOT);
    }

  private:
    inline bool init(JSContext *cx, JSString *str);

    void setStringThis(JSString *str) {
-        JS_ASSERT(getSlot(PRIMITIVE_THIS_SLOT).isUndefined());
-        setSlot(PRIMITIVE_THIS_SLOT, StringValue(str));
-        setSlot(LENGTH_SLOT, Int32Value(int32_t(str->length())));
+        JS_ASSERT(getReservedSlot(PRIMITIVE_VALUE_SLOT).isUndefined());
+        setFixedSlot(PRIMITIVE_VALUE_SLOT, StringValue(str));
+        setFixedSlot(LENGTH_SLOT, Int32Value(int32_t(str->length())));
    }

    /* For access to init, as String.prototype is special. */
--- a/js/xpconnect/src/XPCQuickStubs.h
+++ b/js/xpconnect/src/XPCQuickStubs.h
@ -539,8 +539,8 @@ castNativeFromWrapper(JSContext *cx,

    NS_ASSERTION(IS_WRAPPER_CLASS(js::GetObjectClass(cur)), "Not a wrapper?");

-    XPCNativeScriptableSharedJSClass *clasp =
-      (XPCNativeScriptableSharedJSClass*)js::GetObjectClass(cur);
+    XPCWrappedNativeJSClass *clasp =
+      (XPCWrappedNativeJSClass*)js::GetObjectClass(cur);
    if (!(clasp->interfacesBitmap & (1 << interfaceBit)))
        return nsnull;

--- a/js/xpconnect/src/XPCWrappedNative.cpp
+++ b/js/xpconnect/src/XPCWrappedNative.cpp
@ -1091,7 +1091,7 @@ XPCWrappedNative::Init(XPCCallContext& ccx,

    // create our flatJSObject

-    JSClass* jsclazz = si ? si->GetJSClass() : Jsvalify(&XPC_WN_NoHelper_JSClass);
+    JSClass* jsclazz = si ? si->GetJSClass() : Jsvalify(&XPC_WN_NoHelper_JSClass.base);

    if (isGlobal) {
        // Resolving a global object's class can cause us to create a global's
--- a/Показать больше
+++ b/Показать больше