Merge last PGO-green changeset of mozilla-inbound to mozilla-central

aclocal.m4

@@ -17,6 +17,7 @@ builtin(include, build/autoconf/acwinpaths.m4)dnl
 builtin(include, build/autoconf/lto.m4)dnl
 builtin(include, build/autoconf/gcc-pr49911.m4)dnl
 builtin(include, build/autoconf/frameptr.m4)dnl
+builtin(include, build/autoconf/compiler-opts.m4)dnl
 
 MOZ_PROG_CHECKMSYS()
 

b2g/app/b2g.js

@@ -430,3 +430,5 @@ pref("layout.frame_rate.precise", true);
 pref("power.screen.timeout", 60);
 
 pref("full-screen-api.enabled", true);
+
+pref("media.volume.steps", 10);

b2g/chrome/content/shell.js

@@ -186,6 +186,24 @@ var shell = {
       Services.prefs.setBoolPref("nglayout.debug.paint_flashing", false);
     }
   },
+ 
+  changeVolume: function shell_changeVolume(aDelta) {
+    let audioManager = Cc["@mozilla.org/telephony/audiomanager;1"].getService(Ci.nsIAudioManager);
+
+    let steps = 10;
+    try {
+      steps = Services.prefs.getIntPref("media.volume.steps");
+      if (steps <= 0)
+        steps = 1;
+    } catch(e) {}
+
+    let volume = audioManager.masterVolume + aDelta / steps;
+    if (volume > 1)
+      volume = 1;
+    if (volume < 0)
+      volume = 0;
+    audioManager.masterVolume = volume;
+  },
 
   handleEvent: function shell_handleEvent(evt) {
     switch (evt.type) {
@@ -217,6 +235,12 @@ var shell = {
           case 'Search':
             this.toggleDebug();
             break;
+          case 'VolumeUp':
+            this.changeVolume(1);
+            break;
+          case 'VolumeDown':
+            this.changeVolume(-1);
+            break;
         }
         break;
       case 'load':

browser/base/content/browser.xul

@@ -90,6 +90,7 @@
         lightweightthemes="true"
         lightweightthemesfooter="browser-bottombox"
         windowtype="navigator:browser"
+        macanimationtype="document"
         screenX="4" screenY="4"
         browsingmode="normal"
         persist="screenX screenY width height sizemode">

browser/base/content/tabbrowser.xml

@@ -1266,6 +1266,12 @@
                 else {
                   t._animStartTime = Date.now();
                   t.setAttribute("fadein", "true");
+
+                  // This call to adjustTabstrip is redundant but needed so that
+                  // when opening a second tab, the first tab's close buttons
+                  // appears immediately rather than when the transition ends.
+                  if (tabContainer.childNodes.length == 2)
+                    tabContainer.adjustTabstrip();
                 }
               }, 0, this.tabContainer);
             }
@@ -4055,7 +4061,7 @@
           let alignRight = false;
 
           if (getComputedStyle(document.documentElement).direction == "rtl")
-            alighRight = !alignRight;
+            alignRight = !alignRight;
 
           let rect = this.getBoundingClientRect();
           this._mouseTargetRect = {

browser/components/sessionstore/src/nsSessionStartup.js

@@ -72,6 +72,7 @@ const Cr = Components.results;
 const Cu = Components.utils;
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/Services.jsm");
+Cu.import("resource:///modules/TelemetryStopwatch.jsm");
 
 const STATE_RUNNING_STR = "running";
 const MAX_FILE_SIZE = 100 * 1024 * 1024; // 100 megabytes
@@ -127,23 +128,30 @@ SessionStartup.prototype = {
       return;
 
     // parse the session state into a JS object
+    // remove unneeded braces (added for compatibility with Firefox 2.0 and 3.0)
+    if (iniString.charAt(0) == '(')
+      iniString = iniString.slice(1, -1);
+    let corruptFile = false;
     try {
-      // remove unneeded braces (added for compatibility with Firefox 2.0 and 3.0)
+      this._initialState = JSON.parse(iniString);
-      if (iniString.charAt(0) == '(')
+    }
-        iniString = iniString.slice(1, -1);
+    catch (ex) {
+      debug("The session file contained un-parse-able JSON: " + ex);
+      // Try to eval.
+      // evalInSandbox will throw if iniString is not parse-able.
       try {
-        this._initialState = JSON.parse(iniString);
-      }
-      catch (exJSON) {
         var s = new Cu.Sandbox("about:blank", {sandboxName: 'nsSessionStartup'});
         this._initialState = Cu.evalInSandbox("(" + iniString + ")", s);
+      } catch(ex) {
+        debug("The session file contained un-eval-able JSON: " + ex);
+        corruptFile = true;
       }
-
-      // If this is a normal restore then throw away any previous session
-      if (!doResumeSessionOnce)
-        delete this._initialState.lastSessionState;
     }
-    catch (ex) { debug("The session file is invalid: " + ex); }
+    Services.telemetry.getHistogramById("FX_SESSION_RESTORE_CORRUPT_FILE").add(corruptFile);
+
+    // If this is a normal restore then throw away any previous session
+    if (!doResumeSessionOnce)
+      delete this._initialState.lastSessionState;
 
     let resumeFromCrash = prefBranch.getBoolPref("sessionstore.resume_from_crash");
     let lastSessionCrashed =
@@ -154,8 +162,7 @@ SessionStartup.prototype = {
     // Report shutdown success via telemetry. Shortcoming here are
     // being-killed-by-OS-shutdown-logic, shutdown freezing after
     // session restore was written, etc.
-    let Telemetry = Cc["@mozilla.org/base/telemetry;1"].getService(Ci.nsITelemetry);
+    Services.telemetry.getHistogramById("SHUTDOWN_OK").add(!lastSessionCrashed);
-    Telemetry.getHistogramById("SHUTDOWN_OK").add(!lastSessionCrashed);
 
     // set the startup type
     if (lastSessionCrashed && resumeFromCrash)
@@ -296,9 +303,11 @@ SessionStartup.prototype = {
    * @returns a session state string
    */
   _readStateFile: function sss_readStateFile(aFile) {
+    TelemetryStopwatch.start("FX_SESSION_RESTORE_READ_FILE_MS");
     var stateString = Cc["@mozilla.org/supports-string;1"].
                         createInstance(Ci.nsISupportsString);
     stateString.data = this._readFile(aFile) || "";
+    TelemetryStopwatch.finish("FX_SESSION_RESTORE_READ_FILE_MS");
 
     Services.obs.notifyObservers(stateString, "sessionstore-state-read", "");
 

browser/components/sessionstore/src/nsSessionStore.js

@@ -131,6 +131,7 @@ Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://gre/modules/debug.js");
 
 Cu.import("resource:///modules/TelemetryTimestamps.jsm");
+Cu.import("resource:///modules/TelemetryStopwatch.jsm");
 
 XPCOMUtils.defineLazyGetter(this, "NetUtil", function() {
   Cu.import("resource://gre/modules/NetUtil.jsm");
@@ -3653,6 +3654,8 @@ SessionStoreService.prototype = {
     // if we crash.
     let pinnedOnly = this._loadState == STATE_RUNNING && !this._resume_from_crash;
 
+    TelemetryStopwatch.start("FX_SESSION_RESTORE_COLLECT_DATA_MS");
+
     var oState = this._getCurrentState(aUpdateAll, pinnedOnly);
     if (!oState)
       return;
@@ -3691,6 +3694,8 @@ SessionStoreService.prototype = {
     if (this._lastSessionState)
       oState.lastSessionState = this._lastSessionState;
 
+    TelemetryStopwatch.finish("FX_SESSION_RESTORE_COLLECT_DATA_MS");
+
     this._saveStateObject(oState);
   },
 
@@ -3698,9 +3703,11 @@ SessionStoreService.prototype = {
    * write a state object to disk
    */
   _saveStateObject: function sss_saveStateObject(aStateObj) {
+    TelemetryStopwatch.start("FX_SESSION_RESTORE_SERIALIZE_DATA_MS");
     var stateString = Cc["@mozilla.org/supports-string;1"].
                         createInstance(Ci.nsISupportsString);
     stateString.data = this._toJSONString(aStateObj);
+    TelemetryStopwatch.finish("FX_SESSION_RESTORE_SERIALIZE_DATA_MS");
 
     Services.obs.notifyObservers(stateString, "sessionstore-state-write", "");
 
@@ -3809,7 +3816,7 @@ SessionStoreService.prototype = {
     argString.data = "";
 
     // Build feature string
-    let features = "chrome,dialog=no,all";
+    let features = "chrome,dialog=no,macsuppressanimation,all";
     let winState = aState.windows[0];
     WINDOW_ATTRIBUTES.forEach(function(aFeature) {
       // Use !isNaN as an easy way to ignore sizemode and check for numbers
@@ -4427,6 +4434,7 @@ SessionStoreService.prototype = {
    *        String data
    */
   _writeFile: function sss_writeFile(aFile, aData) {
+    TelemetryStopwatch.start("FX_SESSION_RESTORE_WRITE_FILE_MS");
     // Initialize the file output stream.
     var ostream = Cc["@mozilla.org/network/safe-file-output-stream;1"].
                   createInstance(Ci.nsIFileOutputStream);
@@ -4442,6 +4450,7 @@ SessionStoreService.prototype = {
     var self = this;
     NetUtil.asyncCopy(istream, ostream, function(rc) {
       if (Components.isSuccessCode(rc)) {
+        TelemetryStopwatch.finish("FX_SESSION_RESTORE_WRITE_FILE_MS");
         Services.obs.notifyObservers(null,
                                      "sessionstore-state-write-complete",
                                      "");

browser/devtools/scratchpad/scratchpad.xul

@@ -51,6 +51,7 @@
         xmlns="http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul"
         title="&window.title;"
         windowtype="devtools:scratchpad"
+        macanimationtype="document"
         screenX="4" screenY="4"
         width="640" height="480"
         persist="screenX screenY width height sizemode">

browser/makefiles.sh

@@ -88,6 +88,12 @@ browser/themes/Makefile
 $MOZ_BRANDING_DIRECTORY/Makefile
 $MOZ_BRANDING_DIRECTORY/content/Makefile
 $MOZ_BRANDING_DIRECTORY/locales/Makefile
+toolkit/locales/Makefile
+extensions/spellcheck/locales/Makefile
+intl/locales/Makefile
+netwerk/locales/Makefile
+dom/locales/Makefile
+security/manager/locales/Makefile
 "
 
 if [ "$MOZ_SAFE_BROWSING" ]; then

build/autoconf/compiler-opts.m4

@@ -0,0 +1,13 @@
+dnl Add compiler specific options
+
+AC_DEFUN([MOZ_COMPILER_OPTS],
+[
+if test "$CLANG_CXX"; then
+    ## We disable return-type-c-linkage because jsval is defined as a C++ type but is
+    ## returned by C functions. This is possible because we use knowledge about the ABI
+    ## to typedef it to a C type with the same layout when the headers are included
+    ## from C.
+    _WARNINGS_CXXFLAGS="${_WARNINGS_CXXFLAGS} -Wno-return-type-c-linkage"
+fi
+])
+

build/unix/build-toolchain/build-gcc.py

@@ -1,5 +1,18 @@
 #!/usr/bin/python
 
+# The directories end up in the debug info, so the easy way of getting
+# a reproducible build is to run it in a know absolute directory.
+# We use a directory in /builds/slave because the mozilla infrastructure
+# cleans it up automatically.
+base_dir = "/builds/slave/moz-toolschain"
+
+source_dir = base_dir + "/src"
+build_dir  = base_dir + "/build"
+aux_inst_dir = build_dir + '/aux_inst'
+old_make = aux_inst_dir + '/bin/make'
+
+##############################################
+
 import urllib
 import os
 import os.path
@@ -33,17 +46,21 @@ def patch(patch, plevel, srcdir):
     check_run(['patch', '-d', srcdir, '-p%s' % plevel, '-i', patch, '--fuzz=0',
                '-s'])
 
-def build_package(package_source_dir, package_build_dir, configure_args):
+def build_package(package_source_dir, package_build_dir, configure_args,
+                   make = old_make):
     os.mkdir(package_build_dir)
     run_in(package_build_dir,
            ["%s/configure" % package_source_dir] + configure_args)
-    run_in(package_build_dir, ["make", "-j8"])
+    run_in(package_build_dir, [make, "-j8"])
-    run_in(package_build_dir, ["make", "install"])
+    run_in(package_build_dir, [make, "install"])
 
-def build_tar(base_dir, tar_inst_dir):
+def build_aux_tools(base_dir):
+    make_build_dir = base_dir + '/make_build'
+    build_package(make_source_dir, make_build_dir,
+                  ["--prefix=%s" % aux_inst_dir], "make")
     tar_build_dir = base_dir + '/tar_build'
     build_package(tar_source_dir, tar_build_dir,
-                  ["--prefix=%s" % tar_inst_dir])
+                  ["--prefix=%s" % aux_inst_dir])
 
 def with_env(env, f):
     old_env = os.environ.copy()
@@ -133,21 +150,13 @@ def build_tar_package(tar, name, base, directory):
 
 ##############################################
 
-# The directories end up in the debug info, so the easy way of getting
-# a reproducible build is to run it in a know absolute directory.
-# We use a directory in /builds/slave because the mozilla infrastructure
-# cleans it up automatically.
-base_dir = "/builds/slave/moz-toolschain"
-
-source_dir = base_dir + "/src"
-build_dir  = base_dir + "/build"
-
 def build_source_dir(prefix, version):
     return source_dir + '/' + prefix + version
 
 binutils_version = "2.21.1"
-glibc_version = "2.12.2" #FIXME: should probably use 2.5.1
+glibc_version = "2.7" #FIXME: should probably use 2.5.1
 tar_version = "1.26"
+make_version = "3.81"
 gcc_version = "4.5.2"
 mpfr_version = "2.4.2"
 gmp_version = "5.0.1"
@@ -159,6 +168,8 @@ glibc_source_uri = "http://ftp.gnu.org/gnu/glibc/glibc-%s.tar.bz2" % \
     glibc_version
 tar_source_uri = "http://ftp.gnu.org/gnu/tar/tar-%s.tar.bz2" % \
     tar_version
+make_source_uri = "http://ftp.gnu.org/gnu/make/make-%s.tar.bz2" % \
+    make_version
 gcc_source_uri = "http://ftp.gnu.org/gnu/gcc/gcc-%s/gcc-%s.tar.bz2" % \
     (gcc_version, gcc_version)
 mpfr_source_uri = "http://www.mpfr.org/mpfr-%s/mpfr-%s.tar.bz2" % \
@@ -170,6 +181,7 @@ mpc_source_uri = "http://www.multiprecision.org/mpc/download/mpc-%s.tar.gz" % \
 binutils_source_tar = download_uri(binutils_source_uri)
 glibc_source_tar = download_uri(glibc_source_uri)
 tar_source_tar = download_uri(tar_source_uri)
+make_source_tar = download_uri(make_source_uri)
 mpc_source_tar = download_uri(mpc_source_uri)
 mpfr_source_tar = download_uri(mpfr_source_uri)
 gmp_source_tar = download_uri(gmp_source_uri)
@@ -178,6 +190,7 @@ gcc_source_tar = download_uri(gcc_source_uri)
 binutils_source_dir  = build_source_dir('binutils-', binutils_version)
 glibc_source_dir  = build_source_dir('glibc-', glibc_version)
 tar_source_dir  = build_source_dir('tar-', tar_version)
+make_source_dir  = build_source_dir('make-', make_version)
 mpc_source_dir  = build_source_dir('mpc-', mpc_version)
 mpfr_source_dir = build_source_dir('mpfr-', mpfr_version)
 gmp_source_dir  = build_source_dir('gmp-', gmp_version)
@@ -191,6 +204,7 @@ if not os.path.exists(source_dir):
     patch('glibc-deterministic.patch', 1, glibc_source_dir)
     run_in(glibc_source_dir, ["autoconf"])
     extract(tar_source_tar, source_dir)
+    extract(make_source_tar, source_dir)
     extract(mpc_source_tar, source_dir)
     extract(mpfr_source_tar, source_dir)
     extract(gmp_source_tar, source_dir)
@@ -203,8 +217,7 @@ if os.path.exists(build_dir):
     shutil.rmtree(build_dir)
 os.makedirs(build_dir)
 
-tar_inst_dir = build_dir + '/tar_inst'
+build_aux_tools(build_dir)
-build_tar(build_dir, tar_inst_dir)
 
 stage1_dir = build_dir + '/stage1'
 build_one_stage({"CC": "gcc", "CXX" : "g++"}, stage1_dir, True)
@@ -217,5 +230,5 @@ build_one_stage({"CC"     : stage1_tool_inst_dir + "/bin/gcc",
                  "RANLIB" : "true" },
                 stage2_dir, False)
 
-build_tar_package(tar_inst_dir + "/bin/tar",
+build_tar_package(aux_inst_dir + "/bin/tar",
                   "toolchain.tar", stage2_dir, "inst")

build/unix/build-toolchain/glibc-deterministic.patch

@@ -1,7 +1,22 @@
 diff -ru a/configure.in b/configure.in
 --- a/configure.in	2011-01-17 23:34:07.000000000 -0500
 +++ b/configure.in	2012-01-25 20:40:27.919485606 -0500
-@@ -2230,6 +2230,7 @@
+@@ -841,14 +841,6 @@
+ LIBC_PROG_BINUTILS
+ AC_SUBST(MIG)dnl Needed by sysdeps/mach/configure.in
+ 
+-# Accept binutils 2.13 or newer.
+-AC_CHECK_PROG_VER(AS, $AS, --version,
+-		  [GNU assembler.* \([0-9]*\.[0-9.]*\)],
+-		  [2.1[3-9]*], AS=: critic_missing="$critic_missing as")
+-AC_CHECK_PROG_VER(LD, $LD, --version,
+-		  [GNU ld.* \([0-9][0-9]*\.[0-9.]*\)],
+-		  [2.1[3-9]*], LD=: critic_missing="$critic_missing ld")
+-
+ # We need the physical current working directory.  We cannot use the
+ # "pwd -P" shell builtin since that's not portable.  Instead we try to
+ # find a pwd binary.  Note that assigning to the PWD environment
+@@ -2175,6 +2167,7 @@
  fi
  AC_SUBST(old_glibc_headers)
  
@@ -12,7 +27,7 @@ diff -ru a/configure.in b/configure.in
 diff -ru a/csu/Makefile b/csu/Makefile
 --- a/csu/Makefile	2011-01-17 23:34:07.000000000 -0500
 +++ b/csu/Makefile	2012-01-23 13:58:28.957792633 -0500
-@@ -234,8 +234,7 @@
+@@ -223,8 +223,7 @@
  		   if [ -z "$$os" ]; then \
  		     os=Linux; \
  		   fi; \
@@ -22,10 +37,37 @@ diff -ru a/csu/Makefile b/csu/Makefile
  	   *) ;; \
  	 esac; \
  	 files="$(all-Banner-files)";				\
+diff -ru a/elf/Makefile b/elf/Makefile
+--- a/elf/Makefile	2008-10-31 16:35:11.000000000 -0400
++++ b/elf/Makefile	2012-02-16 12:20:00.038593752 -0500
+@@ -295,20 +295,13 @@
+ z-now-yes = -Wl,-z,now
+ 
+ $(objpfx)ld.so: $(objpfx)librtld.os $(ld-map)
+-	@rm -f $@.lds
+-	$(LINK.o) -nostdlib -nostartfiles -shared $(z-now-$(bind-now))	\
+-		  $(LDFLAGS-rtld) -Wl,-z,defs -Wl,--verbose 2>&1 |	\
+-		  LC_ALL=C \
+-		  sed -e '/^=========/,/^=========/!d;/^=========/d'	\
+-		      -e 's/\. = 0 + SIZEOF_HEADERS;/& _begin = . - SIZEOF_HEADERS;/' \
+-		  > $@.lds
+ 	$(LINK.o) -nostdlib -nostartfiles -shared -o $@			\
+ 		  $(LDFLAGS-rtld) -Wl,-z,defs $(z-now-$(bind-now))	\
+ 		  $(filter-out $(map-file),$^) $(load-map-file)		\
+-		  -Wl,-soname=$(rtld-installed-name) -T $@.lds
+-	rm -f $@.lds
++		  -Wl,-soname=$(rtld-installed-name)			\
++		  -Wl,-defsym=_begin=0
+ 	readelf -s $@ \
+-	  | awk '($$7 ~ /^UND(|EF)$$/ && $$1 != "0:" && $$4 != "REGISTER") { print; p=1 } END { exit p != 0 }'
++	  | $(AWK) '($$7 ~ /^UND(|EF)$$/ && $$1 != "0:" && $$4 != "REGISTER") { print; p=1 } END { exit p != 0 }'
+ 
+ # interp.c exists just to get this string into the libraries.
+ CFLAGS-interp.c = -D'RUNTIME_LINKER="$(slibdir)/$(rtld-installed-name)"' \
 diff -ru a/Makerules b/Makerules
 --- a/Makerules	2011-01-17 23:34:07.000000000 -0500
 +++ b/Makerules	2012-01-30 08:47:56.565068903 -0500
-@@ -992,9 +992,9 @@
+@@ -977,9 +977,9 @@
  	 echo '   Use the shared library, but some functions are only in';\
  	 echo '   the static library, so try that secondarily.  */';\
  	 cat $<; \

config/autoconf.mk.in

@@ -181,6 +181,7 @@ LIBJPEG_TURBO_AS = @LIBJPEG_TURBO_AS@
 LIBJPEG_TURBO_ASFLAGS = @LIBJPEG_TURBO_ASFLAGS@
 LIBJPEG_TURBO_X86_ASM = @LIBJPEG_TURBO_X86_ASM@
 LIBJPEG_TURBO_X64_ASM = @LIBJPEG_TURBO_X64_ASM@
+LIBJPEG_TURBO_ARM_ASM = @LIBJPEG_TURBO_ARM_ASM@
 NS_PRINTING = @NS_PRINTING@
 MOZ_PDF_PRINTING = @MOZ_PDF_PRINTING@
 MOZ_CRASHREPORTER = @MOZ_CRASHREPORTER@

configure.in

@@ -3343,6 +3343,7 @@ AC_SUBST(WRAP_SYSTEM_INCLUDES)
 AC_SUBST(VISIBILITY_FLAGS)
 
 MOZ_GCC_PR49911
+MOZ_COMPILER_OPTS
 
 dnl Check for __force_align_arg_pointer__ for SSE2 on gcc
 dnl ========================================================
@@ -4612,6 +4613,7 @@ LIBJPEG_TURBO_AS=
 LIBJPEG_TURBO_ASFLAGS=
 LIBJPEG_TURBO_X86_ASM=
 LIBJPEG_TURBO_X64_ASM=
+LIBJPEG_TURBO_ARM_ASM=
 MOZ_PANGO=1
 MOZ_PERMISSIONS=1
 MOZ_PLACES=1
@@ -6171,38 +6173,51 @@ if test -n "$MOZ_LIBJPEG_TURBO"; then
     LIBJPEG_TURBO_ASFLAGS="-f win64 -rnasm -pnasm -D__x86_64__ -DPIC -DWIN64 -DMSVC"
     LIBJPEG_TURBO_X64_ASM=1
   ;;
+  *:arm*)
+    LIBJPEG_TURBO_ASFLAGS="-march=armv7-a -mfpu=neon"
+    LIBJPEG_TURBO_ARM_ASM=1
+  ;;
   esac
 
 fi
 
-dnl If we're on a system which supports libjpeg-turbo's asm routines and
+dnl If we're on an x86 or x64 system which supports libjpeg-turbo's asm routines
-dnl --disable-libjpeg-turbo wasn't passed, check for yasm, and error out if it
+dnl and --disable-libjpeg-turbo wasn't passed, check for Yasm, and error out if
-dnl doesn't exist or we have too old of a version.
+dnl it doesn't exist or we have too old of a version.
 if test -n "$LIBJPEG_TURBO_X86_ASM" -o -n "$LIBJPEG_TURBO_X64_ASM" ; then
-    AC_MSG_CHECKING([for YASM assembler])
+    AC_MSG_CHECKING([for Yasm assembler])
     AC_CHECK_PROGS(LIBJPEG_TURBO_AS, yasm, "")
 
     if test -z "$LIBJPEG_TURBO_AS" ; then
-        AC_MSG_ERROR([yasm is required to build with libjpeg-turbo's optimized JPEG decoding routines, but you do not appear to have yasm installed.  Either install it or configure with --disable-libjpeg-turbo to use the pure C JPEG decoder.  See https://developer.mozilla.org/en/YASM for more details.])
+        AC_MSG_ERROR([Yasm is required to build with libjpeg-turbo's optimized JPEG decoding routines, but you do not appear to have Yasm installed.  Either install it or configure with --disable-libjpeg-turbo to use the pure C JPEG decoder.  See https://developer.mozilla.org/en/YASM for more details.])
     fi
 
     dnl Check that we have the right yasm version.  We require 1.0.1 or newer
     dnl on Linux and 1.1 or newer everywhere else.
     if test "$OS_ARCH" = "Linux" ; then
         if test "$_YASM_MAJOR_VERSION" -lt "1" -o \( "$_YASM_MAJOR_VERSION" -eq "1" -a "$_YASM_MINOR_VERSION" -eq "0" -a "$_YASM_RELEASE" -lt "1" \) ; then
-            AC_MSG_ERROR([yasm 1.0.1 or greater is required to build with libjpeg-turbo's optimized JPEG decoding routines, but you appear to have version $_YASM_MAJOR_VERSION.$_YASM_MINOR_VERSION.$_YASM_RELEASE.  Upgrade to the newest version or configure with --disable-libjpeg-turbo to use the pure C JPEG decoder.  See https://developer.mozilla.org/en/YASM for more details.])
+            AC_MSG_ERROR([Yasm 1.0.1 or greater is required to build with libjpeg-turbo's optimized JPEG decoding routines, but you appear to have version $_YASM_MAJOR_VERSION.$_YASM_MINOR_VERSION.$_YASM_RELEASE.  Upgrade to the newest version or configure with --disable-libjpeg-turbo to use the pure C JPEG decoder.  See https://developer.mozilla.org/en/YASM for more details.])
         fi
     else
         if test "$_YASM_MAJOR_VERSION" -lt "1" -o \( "$_YASM_MAJOR_VERSION" -eq "1" -a "$_YASM_MINOR_VERSION" -lt "1" \) ; then
-            AC_MSG_ERROR([yasm 1.1 or greater is required to build with libjpeg-turbo's optimized JPEG decoding routines, but you appear to have version $_YASM_MAJOR_VERSION.$_YASM_MINOR_VERSION.  Upgrade to the newest version or configure with --disable-libjpeg-turbo to use the pure C JPEG decoder.  See https://developer.mozilla.org/en/YASM for more details.])
+            AC_MSG_ERROR([Yasm 1.1 or greater is required to build with libjpeg-turbo's optimized JPEG decoding routines, but you appear to have version $_YASM_MAJOR_VERSION.$_YASM_MINOR_VERSION.  Upgrade to the newest version or configure with --disable-libjpeg-turbo to use the pure C JPEG decoder.  See https://developer.mozilla.org/en/YASM for more details.])
         fi
     fi
 fi
 
+dnl If we're on an ARM system which supports libjpeg-turbo's asm routines and
+dnl --disable-libjpeg-turbo wasn't passed, use the C compiler as the assembler.
+if test -n "$LIBJPEG_TURBO_ARM_ASM" ; then
+    echo "Using $AS as the assembler for ARM code."
+    LIBJPEG_TURBO_AS=$AS
+fi
+
 if test -n "$LIBJPEG_TURBO_X86_ASM"; then
     AC_DEFINE(LIBJPEG_TURBO_X86_ASM)
 elif test -n "$LIBJPEG_TURBO_X64_ASM"; then
     AC_DEFINE(LIBJPEG_TURBO_X64_ASM)
+elif test -n "$LIBJPEG_TURBO_ARM_ASM"; then
+    AC_DEFINE(LIBJPEG_TURBO_ARM_ASM)
 elif test -n "$MOZ_LIBJPEG_TURBO"; then
     dnl Warn if we're not building the optimized routines, even though the user
     dnl didn't specify --disable-libjpeg-turbo.
@@ -8756,6 +8771,7 @@ AC_SUBST(LIBJPEG_TURBO_AS)
 AC_SUBST(LIBJPEG_TURBO_ASFLAGS)
 AC_SUBST(LIBJPEG_TURBO_X86_ASM)
 AC_SUBST(LIBJPEG_TURBO_X64_ASM)
+AC_SUBST(LIBJPEG_TURBO_ARM_ASM)
 
 AC_MSG_CHECKING([for posix_fallocate])
 AC_TRY_LINK([#define _XOPEN_SOURCE 600

content/base/crashtests/700512-worker.js

@@ -1,7 +1,7 @@
 onmessage = function(event) {
   var blob = event.data;
 
-  blob.mozSlice(1, 5);
+  blob.slice(1, 5);
 
   postMessage("done");
 }

content/base/public/nsIDOMFile.idl

@@ -71,9 +71,9 @@ interface nsIDOMBlob : nsISupports
   // blob: protocol handler
   [noscript] DOMString getInternalUrl(in nsIPrincipal principal);
 
-  [optional_argc] nsIDOMBlob mozSlice([optional] in long long start,
+  [optional_argc] nsIDOMBlob slice([optional] in long long start,
-                                      [optional] in long long end,
+                                   [optional] in long long end,
-                                      [optional] in DOMString contentType);
+                                   [optional] in DOMString contentType);
 
   // Get internal id of stored file. Returns -1 if it is not a stored file.
   // Intended only for testing. It can be called on any thread.

content/base/src/nsDOMBlobBuilder.cpp

@@ -122,9 +122,9 @@ nsDOMMultipartFile::CreateSlice(PRUint64 aStart, PRUint64 aLength,
       PRUint64 upperBound = NS_MIN<PRUint64>(l - skipStart, length);
 
       nsCOMPtr<nsIDOMBlob> firstBlob;
-      rv = blob->MozSlice(skipStart, skipStart + upperBound,
+      rv = blob->Slice(skipStart, skipStart + upperBound,
-                          aContentType, 3,
+                       aContentType, 3,
-                          getter_AddRefs(firstBlob));
+                       getter_AddRefs(firstBlob));
       NS_ENSURE_SUCCESS(rv, nsnull);
 
       // Avoid wrapping a single blob inside an nsDOMMultipartFile
@@ -150,8 +150,8 @@ nsDOMMultipartFile::CreateSlice(PRUint64 aStart, PRUint64 aLength,
 
     if (length < l) {
       nsCOMPtr<nsIDOMBlob> lastBlob;
-      rv = blob->MozSlice(0, length, aContentType, 3,
+      rv = blob->Slice(0, length, aContentType, 3,
-                          getter_AddRefs(lastBlob));
+                       getter_AddRefs(lastBlob));
       NS_ENSURE_SUCCESS(rv, nsnull);
 
       blobs.AppendElement(lastBlob);

content/base/src/nsDOMFile.cpp

@@ -238,9 +238,9 @@ ParseSize(PRInt64 aSize, PRInt64& aStart, PRInt64& aEnd)
 }
 
 NS_IMETHODIMP
-nsDOMFileBase::MozSlice(PRInt64 aStart, PRInt64 aEnd,
+nsDOMFileBase::Slice(PRInt64 aStart, PRInt64 aEnd,
-                        const nsAString& aContentType, PRUint8 optional_argc,
+                     const nsAString& aContentType, PRUint8 optional_argc,
-                        nsIDOMBlob **aBlob)
+                     nsIDOMBlob **aBlob)
 {
   *aBlob = nsnull;
 

content/base/src/nsGenericElement.cpp

@@ -1700,9 +1700,29 @@ nsINode::SetExplicitBaseURI(nsIURI* aURI)
 
 //----------------------------------------------------------------------
 
+static JSObject*
+GetJSObjectChild(nsWrapperCache* aCache)
+{
+  if (aCache->PreservingWrapper()) {
+    return aCache->GetWrapperPreserveColor();
+  }
+  return aCache->GetExpandoObjectPreserveColor();
+}
+
+static bool
+NeedsScriptTraverse(nsWrapperCache* aCache)
+{
+  JSObject* o = GetJSObjectChild(aCache);
+  return o && xpc_IsGrayGCThing(o);
+}
+
+//----------------------------------------------------------------------
+
 NS_IMPL_CYCLE_COLLECTING_ADDREF(nsChildContentList)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(nsChildContentList)
 
+// If nsChildContentList is changed so that any additional fields are
+// traversed by the cycle collector, then CAN_SKIP must be updated.
 NS_IMPL_CYCLE_COLLECTION_CLASS(nsChildContentList)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsChildContentList)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_PRESERVED_WRAPPER
@@ -1714,6 +1734,20 @@ NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN(nsChildContentList)
   NS_IMPL_CYCLE_COLLECTION_TRACE_PRESERVED_WRAPPER
 NS_IMPL_CYCLE_COLLECTION_TRACE_END
 
+// nsChildContentList only ever has a single child, its wrapper, so if
+// the wrapper is black, the list can't be part of a garbage cycle.
+NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_BEGIN(nsChildContentList)
+  return !NeedsScriptTraverse(tmp);
+NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_END
+
+NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_IN_CC_BEGIN(nsChildContentList)
+  return !NeedsScriptTraverse(tmp);
+NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_IN_CC_END
+
+// CanSkipThis returns false to avoid problems with incomplete unlinking.
+NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_THIS_BEGIN(nsChildContentList)
+NS_IMPL_CYCLE_COLLECTION_CAN_SKIP_THIS_END
+
 NS_INTERFACE_TABLE_HEAD(nsChildContentList)
   NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
   NS_NODELIST_OFFSET_AND_INTERFACE_TABLE_BEGIN(nsChildContentList)
@@ -4405,22 +4439,6 @@ NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN(nsGenericElement)
   nsINode::Trace(tmp, aCallback, aClosure);
 NS_IMPL_CYCLE_COLLECTION_TRACE_END
 
-static JSObject*
-GetJSObjectChild(nsINode* aNode)
-{
-  if (aNode->PreservingWrapper()) {
-    return aNode->GetWrapperPreserveColor();
-  }
-  return aNode->GetExpandoObjectPreserveColor();
-}
-                                  
-static bool
-NeedsScriptTraverse(nsINode* aNode)
-{
-  JSObject* o = GetJSObjectChild(aNode);
-  return o && xpc_IsGrayGCThing(o);
-}
-
 void
 nsGenericElement::MarkUserData(void* aObject, nsIAtom* aKey, void* aChild,
                                void* aData)

content/base/src/nsGenericElement.h

@@ -102,7 +102,7 @@ public:
   }
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
-  NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS(nsChildContentList)
+  NS_DECL_CYCLE_COLLECTION_SKIPPABLE_SCRIPT_HOLDER_CLASS(nsChildContentList)
 
   // nsWrapperCache
   virtual JSObject* WrapObject(JSContext *cx, XPCWrappedNativeScope *scope,

content/base/test/fileutils.js

@@ -201,24 +201,24 @@ function testSlice(file, size, type, contents, fileType) {
   ok(file instanceof File, fileType + " file is a File");
   ok(file instanceof Blob, fileType + " file is also a Blob");
   
-  var slice = file.mozSlice(0, size);
+  var slice = file.slice(0, size);
   ok(slice instanceof Blob, fileType + " fullsize slice is a Blob");
   ok(!(slice instanceof File), fileType + " fullsize slice is not a File");
   
-  slice = file.mozSlice(0, 1234);
+  slice = file.slice(0, 1234);
   ok(slice instanceof Blob, fileType + " sized slice is a Blob");
   ok(!(slice instanceof File), fileType + " sized slice is not a File");
   
-  slice = file.mozSlice(0, size, "foo/bar");
+  slice = file.slice(0, size, "foo/bar");
   is(slice.type, "foo/bar", fileType + " fullsize slice foo/bar type");
 
-  slice = file.mozSlice(0, 5432, "foo/bar");
+  slice = file.slice(0, 5432, "foo/bar");
   is(slice.type, "foo/bar", fileType + " sized slice foo/bar type");
   
-  is(slice.mozSlice(0, 10).type, "", fileType + " slice-slice type");
+  is(slice.slice(0, 10).type, "", fileType + " slice-slice type");
-  is(slice.mozSlice(0, 10).size, 10, fileType + " slice-slice size");
+  is(slice.slice(0, 10).size, 10, fileType + " slice-slice size");
-  is(slice.mozSlice(0, 10, "hello/world").type, "hello/world", fileType + " slice-slice hello/world type");
+  is(slice.slice(0, 10, "hello/world").type, "hello/world", fileType + " slice-slice hello/world type");
-  is(slice.mozSlice(0, 10, "hello/world").size, 10, fileType + " slice-slice hello/world size");
+  is(slice.slice(0, 10, "hello/world").size, 10, fileType + " slice-slice hello/world size");
 
   // Start, end, expected size
   var indexes = [[0, size, size],
@@ -247,17 +247,17 @@ function testSlice(file, size, type, contents, fileType) {
     var sliceContents;
     var testName;
     if (indexes[i][0] == undefined) {
-      slice = file.mozSlice();
+      slice = file.slice();
       sliceContents = contents.slice();
       testName = fileType + " slice()";
     }
     else if (indexes[i][1] == undefined) {
-      slice = file.mozSlice(indexes[i][0]);
+      slice = file.slice(indexes[i][0]);
       sliceContents = contents.slice(indexes[i][0]);
       testName = fileType + " slice(" + indexes[i][0] + ")";
     }
     else {
-      slice = file.mozSlice(indexes[i][0], indexes[i][1]);
+      slice = file.slice(indexes[i][0], indexes[i][1]);
       sliceContents = contents.slice(indexes[i][0], indexes[i][1]);
       testName = fileType + " slice(" + indexes[i][0] + ", " + indexes[i][1] + ")";
     }
@@ -268,11 +268,11 @@ function testSlice(file, size, type, contents, fileType) {
   }
 
   // Slice of slice
-  var slice = file.mozSlice(0, 40000);
+  var slice = file.slice(0, 40000);
-  testFile(slice.mozSlice(5000, 42000), contents.slice(5000, 40000), "file slice slice");
+  testFile(slice.slice(5000, 42000), contents.slice(5000, 40000), "file slice slice");
   
   // ...of slice of slice
-  slice = slice.mozSlice(5000, 42000).mozSlice(400, 700);
+  slice = slice.slice(5000, 42000).slice(400, 700);
   SpecialPowers.gc();
   testFile(slice, contents.slice(5400, 5700), "file slice slice slice");
 }

content/base/test/test_blobbuilder.html

@@ -151,7 +151,7 @@ function doTest(data) {
     ok(blob instanceof Blob, "Test " + testCounter + " blob is a Blob");
     ok(!(blob instanceof File), "Test " + testCounter + " blob is not a File");
 
-    let slice = blob.mozSlice(test.start, test.start + test.length);
+    let slice = blob.slice(test.start, test.start + test.length);
     ok(slice, "Test " + testCounter + " got slice");
     ok(slice instanceof Blob, "Test " + testCounter + " slice is a Blob");
     ok(!(slice instanceof File), "Test " + testCounter + " slice is not a File");

content/base/test/test_fileapi_slice.html

@@ -104,7 +104,7 @@ function imageLoadHandler(event) {
 var imgfile = createFileWithData(testBinaryData + fileData + testBinaryData);
 is(imgfile.size, size + testBinaryData.length * 2, "correct file size (middle)");
 var img = new Image;
-img.src = URL.createObjectURL(imgfile.mozSlice(testBinaryData.length, testBinaryData.length + size));
+img.src = URL.createObjectURL(imgfile.slice(testBinaryData.length, testBinaryData.length + size));
 img.onload = imageLoadHandler;
 expectedTestCount++;
 
@@ -112,7 +112,7 @@ expectedTestCount++;
 var imgfile = createFileWithData(fileData + testBinaryData);
 is(imgfile.size, size + testBinaryData.length, "correct file size (start)");
 var img = new Image;
-img.src = URL.createObjectURL(imgfile.mozSlice(0, size));
+img.src = URL.createObjectURL(imgfile.slice(0, size));
 img.onload = imageLoadHandler;
 expectedTestCount++;
 
@@ -120,7 +120,7 @@ expectedTestCount++;
 var imgfile = createFileWithData(testBinaryData + fileData);
 is(imgfile.size, size + testBinaryData.length, "correct file size (end)");
 var img = new Image;
-img.src = URL.createObjectURL(imgfile.mozSlice(testBinaryData.length, testBinaryData.length + size));
+img.src = URL.createObjectURL(imgfile.slice(testBinaryData.length, testBinaryData.length + size));
 img.onload = imageLoadHandler;
 expectedTestCount++;
 
@@ -128,7 +128,7 @@ expectedTestCount++;
 var imgfile = createFileWithData(testBinaryData + fileData);
 is(imgfile.size, size + testBinaryData.length, "correct file size (past end)");
 var img = new Image;
-img.src = URL.createObjectURL(imgfile.mozSlice(testBinaryData.length, testBinaryData.length + size + 1000));
+img.src = URL.createObjectURL(imgfile.slice(testBinaryData.length, testBinaryData.length + size + 1000));
 img.onload = imageLoadHandler;
 expectedTestCount++;
 

content/canvas/src/WebGLContext.h

@@ -1024,7 +1024,7 @@ struct WebGLVertexAttribData {
     }
 };
 
-class WebGLBuffer
+class WebGLBuffer MOZ_FINAL
     : public nsIWebGLBuffer
     , public WebGLRefCountedObject<WebGLBuffer>
     , public WebGLContextBoundObject
@@ -1158,7 +1158,7 @@ protected:
     void* mData; // in the case of an Element Array Buffer, we keep a copy.
 };
 
-class WebGLTexture
+class WebGLTexture MOZ_FINAL
     : public nsIWebGLTexture
     , public WebGLRefCountedObject<WebGLTexture>
     , public WebGLContextBoundObject
@@ -1608,7 +1608,7 @@ public:
     }
 };
 
-class WebGLShader
+class WebGLShader MOZ_FINAL
     : public nsIWebGLShader
     , public WebGLRefCountedObject<WebGLShader>
     , public WebGLContextBoundObject
@@ -1673,7 +1673,7 @@ protected:
     WebGLMonotonicHandle mMonotonicHandle;
 };
 
-class WebGLProgram
+class WebGLProgram MOZ_FINAL
     : public nsIWebGLProgram
     , public WebGLRefCountedObject<WebGLProgram>
     , public WebGLContextBoundObject
@@ -1795,7 +1795,7 @@ protected:
     WebGLMonotonicHandle mMonotonicHandle;
 };
 
-class WebGLRenderbuffer
+class WebGLRenderbuffer MOZ_FINAL
     : public nsIWebGLRenderbuffer
     , public WebGLRefCountedObject<WebGLRenderbuffer>
     , public WebGLRectangleObject
@@ -2001,7 +2001,7 @@ public:
     }
 };
 
-class WebGLFramebuffer
+class WebGLFramebuffer MOZ_FINAL
     : public nsIWebGLFramebuffer
     , public WebGLRefCountedObject<WebGLFramebuffer>
     , public WebGLContextBoundObject
@@ -2296,7 +2296,7 @@ public:
     WebGLMonotonicHandle mMonotonicHandle;
 };
 
-class WebGLUniformLocation
+class WebGLUniformLocation MOZ_FINAL
     : public nsIWebGLUniformLocation
     , public WebGLContextBoundObject
     , public WebGLRefCountedObject<WebGLUniformLocation>
@@ -2337,7 +2337,7 @@ protected:
     friend class WebGLProgram;
 };
 
-class WebGLActiveInfo
+class WebGLActiveInfo MOZ_FINAL
     : public nsIWebGLActiveInfo
 {
 public:
@@ -2356,7 +2356,7 @@ protected:
     nsString mName;
 };
 
-class WebGLShaderPrecisionFormat
+class WebGLShaderPrecisionFormat MOZ_FINAL
     : public nsIWebGLShaderPrecisionFormat
 {
 public:

content/canvas/src/WebGLContextGL.cpp

@@ -4377,7 +4377,7 @@ WebGLContext::CompileShader(nsIWebGLShader *sobj)
         // ESSL backend
         compiler = ShConstructCompiler((ShShaderType) shader->ShaderType(),
                                        SH_WEBGL_SPEC,
-#ifdef MOZ_WIDGET_ANDROID
+#ifdef ANDROID
                                        SH_GLSL_OUTPUT,
 #else
                                        gl->IsGLES2() ? SH_ESSL_OUTPUT : SH_GLSL_OUTPUT,

content/canvas/src/nsCanvasRenderingContext2D.cpp

@@ -180,7 +180,7 @@ CopyContext(gfxContext* dest, gfxContext* src)
  **/
 #define NS_CANVASGRADIENT_PRIVATE_IID \
     { 0x491d39d8, 0x4058, 0x42bd, { 0xac, 0x76, 0x70, 0xd5, 0x62, 0x7f, 0x02, 0x10 } }
-class nsCanvasGradient : public nsIDOMCanvasGradient
+class nsCanvasGradient MOZ_FINAL : public nsIDOMCanvasGradient
 {
 public:
     NS_DECLARE_STATIC_IID_ACCESSOR(NS_CANVASGRADIENT_PRIVATE_IID)
@@ -238,7 +238,7 @@ NS_INTERFACE_MAP_END
  **/
 #define NS_CANVASPATTERN_PRIVATE_IID \
     { 0xb85c6c8a, 0x0624, 0x4530, { 0xb8, 0xee, 0xff, 0xdf, 0x42, 0xe8, 0x21, 0x6d } }
-class nsCanvasPattern : public nsIDOMCanvasPattern
+class nsCanvasPattern MOZ_FINAL : public nsIDOMCanvasPattern
 {
 public:
     NS_DECLARE_STATIC_IID_ACCESSOR(NS_CANVASPATTERN_PRIVATE_IID)

content/canvas/test/webgl/failing_tests_mac.txt

@@ -7,3 +7,5 @@ conformance/more/conformance/quickCheckAPI-S_V.html
 conformance/glsl/misc/attrib-location-length-limits.html
 conformance/glsl/misc/uniform-location-length-limits.html
 conformance/programs/program-test.html
+conformance/textures/texture-mips.html
+conformance/textures/texture-npot.html

dom/interfaces/css/nsIDOMCSSStyleDeclaration.idl

@@ -60,7 +60,7 @@ interface nsIDOMCSSStyleDeclaration : nsISupports
   DOMString          getPropertyPriority(in DOMString propertyName);
   void               setProperty(in DOMString propertyName, 
                                  in DOMString value, 
-                                 in DOMString priority)
+                                 [optional] in DOMString priority)
                                         raises(DOMException);
   readonly attribute unsigned long    length;
   DOMString          item(in unsigned long index);

dom/plugins/base/nsPluginHost.cpp

@@ -3115,8 +3115,13 @@ nsresult nsPluginHost::NewPluginURLStream(const nsString& aURL,
   // deal with headers and post data
   nsCOMPtr<nsIHttpChannel> httpChannel(do_QueryInterface(channel));
   if (httpChannel) {
-    rv = httpChannel->SetReferrer(doc->GetDocumentURI());  
+    if (!aPostStream) {
-    NS_ENSURE_SUCCESS(rv,rv);
+      // Only set the Referer header for GET requests because IIS throws
+      // errors about malformed requests if we include it in POSTs. See
+      // bug 724465.
+      rv = httpChannel->SetReferrer(doc->GetDocumentURI());  
+      NS_ENSURE_SUCCESS(rv,rv);
+    }
       
     if (aPostStream) {
       // XXX it's a bit of a hack to rewind the postdata stream

dom/plugins/base/nsPluginInstanceOwner.cpp

@@ -1390,7 +1390,19 @@ void nsPluginInstanceOwner::CARefresh(nsITimer *aTimer, void *aClosure) {
   }
 }
 
-void nsPluginInstanceOwner::AddToCARefreshTimer(nsPluginInstanceOwner *aPluginInstance) {
+void nsPluginInstanceOwner::AddToCARefreshTimer() {
+  if (!mInstance) {
+    return;
+  }
+
+  // Flash invokes InvalidateRect for us.
+  const char* mime = nsnull;
+  if (NS_SUCCEEDED(mInstance->GetMIMEType(&mime)) && mime) {
+    if (strcmp(mime, "application/x-shockwave-flash") == 0) {
+      return;
+    }
+  }
+
   if (!sCARefreshListeners) {
     sCARefreshListeners = new nsTArray<nsPluginInstanceOwner*>();
     if (!sCARefreshListeners) {
@@ -1398,9 +1410,11 @@ void nsPluginInstanceOwner::AddToCARefreshTimer(nsPluginInstanceOwner *aPluginIn
     }
   }
 
-  NS_ASSERTION(!sCARefreshListeners->Contains(aPluginInstance), 
+  if (sCARefreshListeners->Contains(this)) {
-      "pluginInstanceOwner already registered as a listener");
+    return;
-  sCARefreshListeners->AppendElement(aPluginInstance);
+  }
+
+  sCARefreshListeners->AppendElement(this);
 
   if (!sCATimer) {
     sCATimer = new nsCOMPtr<nsITimer>();
@@ -1416,12 +1430,12 @@ void nsPluginInstanceOwner::AddToCARefreshTimer(nsPluginInstanceOwner *aPluginIn
   }
 }
 
-void nsPluginInstanceOwner::RemoveFromCARefreshTimer(nsPluginInstanceOwner *aPluginInstance) {
+void nsPluginInstanceOwner::RemoveFromCARefreshTimer() {
-  if (!sCARefreshListeners || sCARefreshListeners->Contains(aPluginInstance) == false) {
+  if (!sCARefreshListeners || sCARefreshListeners->Contains(this) == false) {
     return;
   }
 
-  sCARefreshListeners->RemoveElement(aPluginInstance);
+  sCARefreshListeners->RemoveElement(this);
 
   if (sCARefreshListeners->Length() == 0) {
     if (sCATimer) {
@@ -1434,21 +1448,6 @@ void nsPluginInstanceOwner::RemoveFromCARefreshTimer(nsPluginInstanceOwner *aPlu
   }
 }
 
-void nsPluginInstanceOwner::SetupCARefresh()
-{
-  if (!mInstance) {
-    return;
-  }
-
-  const char* mime = nsnull;
-  if (NS_SUCCEEDED(mInstance->GetMIMEType(&mime)) && mime) {
-    // Flash invokes InvalidateRect for us.
-    if (strcmp(mime, "application/x-shockwave-flash") != 0) {
-    AddToCARefreshTimer(this);
-  }
-}
-}
-
 void nsPluginInstanceOwner::RenderCoreAnimation(CGContextRef aCGContext,
                                                 int aWidth, int aHeight)
 {
@@ -2699,7 +2698,7 @@ nsPluginInstanceOwner::Destroy()
   CancelTimer();
 #endif
 #ifdef XP_MACOSX
-  RemoveFromCARefreshTimer(this);
+  RemoveFromCARefreshTimer();
   if (mColorProfile)
     ::CGColorSpaceRelease(mColorProfile);  
 #endif
@@ -3277,7 +3276,7 @@ NS_IMETHODIMP nsPluginInstanceOwner::CreateWidget(void)
 {
   NS_ENSURE_TRUE(mPluginWindow, NS_ERROR_NULL_POINTER);
 
-    nsresult rv = NS_ERROR_FAILURE;
+  nsresult rv = NS_ERROR_FAILURE;
   
   // Can't call this twice!
   if (mWidget) {
@@ -3318,6 +3317,21 @@ NS_IMETHODIMP nsPluginInstanceOwner::CreateWidget(void)
     mWidget->EnableDragDrop(true);
     mWidget->Show(false);
     mWidget->Enable(false);
+
+#ifdef XP_MACOSX
+    // Now that we have a widget we want to set the event model before
+    // any events are processed.
+    nsCOMPtr<nsIPluginWidget> pluginWidget = do_QueryInterface(mWidget);
+    if (!pluginWidget) {
+      return NS_ERROR_FAILURE;
+    }
+    pluginWidget->SetPluginEventModel(GetEventModel());
+    pluginWidget->SetPluginDrawingModel(GetDrawingModel());
+
+    if (GetDrawingModel() == NPDrawingModelCoreAnimation) {
+      AddToCARefreshTimer();
+    }
+#endif
   }
 
   if (mObjectFrame) {

dom/plugins/base/nsPluginInstanceOwner.h

@@ -182,9 +182,8 @@ public:
   bool IsRemoteDrawingCoreAnimation();
   NPEventModel GetEventModel();
   static void CARefresh(nsITimer *aTimer, void *aClosure);
-  static void AddToCARefreshTimer(nsPluginInstanceOwner *aPluginInstance);
+  void AddToCARefreshTimer();
-  static void RemoveFromCARefreshTimer(nsPluginInstanceOwner *aPluginInstance);
+  void RemoveFromCARefreshTimer();
-  void SetupCARefresh();
   // This calls into the plugin (NPP_SetWindow) and can run script.
   void* FixUpPluginWindow(PRInt32 inPaintState);
   void HidePluginWindow();

dom/plugins/test/mochitest/Makefile.in

@@ -109,6 +109,8 @@ _MOCHITEST_FILES = \
   test_instance_unparent1.html \
   test_instance_unparent2.html \
   test_instance_unparent3.html \
+  test_pluginstream_referer.html \
+  plugin-stream-referer.sjs \
   $(NULL)
 
 #  test_plugin_scroll_painting.html \ bug 596491

dom/plugins/test/mochitest/plugin-stream-referer.sjs

@@ -0,0 +1,10 @@
+function handleRequest(request, response)
+{
+  response.setHeader('Content-Type', 'text/plain', false);
+  if (request.hasHeader('Referer')) {
+    response.write('Referer found: ' + request.getHeader('Referer'));
+  }
+  else {
+    response.write('No Referer found');
+  }
+}

dom/plugins/test/mochitest/test_pluginstream_referer.html

@@ -0,0 +1,42 @@
+<head>
+  <title>Do plugin stream requests send the Referer header correctly?</title>
+  <script type="application/javascript"
+	  src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" 
+        href="/tests/SimpleTest/test.css" />
+
+<body onload="runTests()">
+  <p id="display"></p>
+
+  <embed id="plugin1" type="application/x-test" width="200" height="200"></embed>
+
+  <script class="testbody" type="application/javascript">
+  SimpleTest.waitForExplicitFinish();
+
+  var pending = 2;
+  function testDone() {
+    --pending;
+    if (0 == pending)
+      SimpleTest.finish()
+  }
+
+  function runTests() {
+    var p = document.getElementById('plugin1');
+
+    ok(p.streamTest('plugin-stream-referer.sjs', false, null, null,
+                    function(r, t) {
+                      is(r, 0, "GET plugin-stream-referer.sjs");
+                      is(t, "Referer found: " + window.location,
+                         "GET Referer correct");
+                      testDone();
+                    }, null, true), "referer GET");
+
+    ok(p.streamTest('plugin-stream-referer.sjs', true, "Dummy Data", null,
+                    function(r, t) {
+                      is(r, 0, "POST plugin-stream-referer.sjs");
+                      is(t, "No Referer found", "POST Referer absent");
+                      testDone();
+                    }, null, true), "referer POST");
+  }
+  </script>
+

dom/workers/File.cpp

@@ -171,14 +171,14 @@ private:
   }
 
   static JSBool
-  MozSlice(JSContext* aCx, uintN aArgc, jsval* aVp)
+  Slice(JSContext* aCx, uintN aArgc, jsval* aVp)
   {
     JSObject* obj = JS_THIS_OBJECT(aCx, aVp);
     if (!obj) {
       return false;
     }
 
-    nsIDOMBlob* blob = GetInstancePrivate(aCx, obj, "mozSlice");
+    nsIDOMBlob* blob = GetInstancePrivate(aCx, obj, "slice");
     if (!blob) {
       return false;
     }
@@ -197,10 +197,10 @@ private:
 
     PRUint8 optionalArgc = aArgc;
     nsCOMPtr<nsIDOMBlob> rtnBlob;
-    if (NS_FAILED(blob->MozSlice(static_cast<PRUint64>(start),
+    if (NS_FAILED(blob->Slice(static_cast<PRUint64>(start),
-                                 static_cast<PRUint64>(end),
+                              static_cast<PRUint64>(end),
-                                 contentType, optionalArgc,
+                              contentType, optionalArgc,
-                                 getter_AddRefs(rtnBlob)))) {
+                              getter_AddRefs(rtnBlob)))) {
       ThrowFileExceptionForCode(aCx, FILE_NOT_READABLE_ERR);
       return false;
     }
@@ -230,7 +230,7 @@ JSPropertySpec Blob::sProperties[] = {
 };
 
 JSFunctionSpec Blob::sFunctions[] = {
-  JS_FN("mozSlice", MozSlice, 1, JSPROP_ENUMERATE),
+  JS_FN("slice", Slice, 1, JSPROP_ENUMERATE),
   JS_FS_END
 };
 

dom/workers/test/Makefile.in

@@ -136,21 +136,21 @@ _CHROME_TEST_FILES = \
   test_extension.xul \
   test_extensionBootstrap.xul \
   test_file.xul \
-  test_fileMozSlice.xul \
+  test_fileSlice.xul \
   test_fileBlobPosting.xul \
   test_filePosting.xul \
   test_fileReaderSync.xul \
   test_fileReaderSyncErrors.xul \
-  test_fileReadMozSlice.xul \
+  test_fileReadSlice.xul \
   test_fileSubWorker.xul \
   test_fileBlobSubWorker.xul \
   file_worker.js \
   fileBlob_worker.js \
-  fileMozSlice_worker.js \
+  fileSlice_worker.js \
   filePosting_worker.js \
   fileReaderSync_worker.js \
   fileReaderSyncErrors_worker.js \
-  fileReadMozSlice_worker.js \
+  fileReadSlice_worker.js \
   fileSubWorker_worker.js \
   fileBlobSubWorker_worker.js \
   WorkerTest.jsm \

dom/workers/test/fileReadSlice_worker.js

@@ -7,7 +7,7 @@ onmessage = function(event) {
   var start = event.data.start;
   var end = event.data.end;
 
-  var slicedBlob = blob.mozSlice(start, end);
+  var slicedBlob = blob.slice(start, end);
 
   var fileReader = new FileReaderSync();
   var text = fileReader.readAsText(slicedBlob);

dom/workers/test/fileSlice_worker.js

@@ -11,11 +11,11 @@ onmessage = function(event) {
 
   var slicedBlob;
   if (contentType == undefined && end == undefined) {
-    slicedBlob = blob.mozSlice(start);
+    slicedBlob = blob.slice(start);
   } else if (contentType == undefined) {
-    slicedBlob = blob.mozSlice(start, end);
+    slicedBlob = blob.slice(start, end);
   } else {
-    slicedBlob = blob.mozSlice(start, end, contentType);
+    slicedBlob = blob.slice(start, end, contentType);
   }
 
   var rtnObj = new Object();

dom/workers/test/test_fileBlobPosting.xul

@@ -70,7 +70,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=664783
       finish();
     };
 
-    var blob = file.mozSlice();
+    var blob = file.slice();
     worker.postMessage(blob);
     waitForWorkerFinish();
   }

dom/workers/test/test_fileBlobSubWorker.xul

@@ -72,7 +72,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=664783
       finish();
     };
 
-    var blob = file.mozSlice();
+    var blob = file.slice();
     worker.postMessage(blob);
     waitForWorkerFinish();
   }

dom/workers/test/test_fileReadSlice.xul

@@ -36,7 +36,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=664783
     var testFile = Components.classes["@mozilla.org/file/directory_service;1"]
                        .getService(Components.interfaces.nsIProperties)
                        .get("ProfD", Components.interfaces.nsIFile);
-    testFile.append("workerReadMozSlice" + fileNum++);
+    testFile.append("workerReadSlice" + fileNum++);
 
     var outStream = Components.classes["@mozilla.org/network/file-output-stream;1"]
                         .createInstance(Components.interfaces.nsIFileOutputStream);
@@ -55,8 +55,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=664783
    * Creates a worker which slices a blob to the given start and end offset and
    * reads the content as text.
    */
-  function readMozSlice(blob, start, end, expectedText) {
+  function readSlice(blob, start, end, expectedText) {
-    var worker = new Worker("fileReadMozSlice_worker.js");
+    var worker = new Worker("fileReadSlice_worker.js");
 
     worker.onerror = function(event) {
       ok(false, "Worker had an error: " + event.data);
@@ -74,16 +74,16 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=664783
   }
 
   // Empty file.
-  readMozSlice(createFileWithData(""), 0, 0, "");
+  readSlice(createFileWithData(""), 0, 0, "");
 
   // Typical use case.
-  readMozSlice(createFileWithData("HelloBye"), 5, 8, "Bye");
+  readSlice(createFileWithData("HelloBye"), 5, 8, "Bye");
 
   // End offset too large.
-  readMozSlice(createFileWithData("HelloBye"), 5, 9, "Bye");
+  readSlice(createFileWithData("HelloBye"), 5, 9, "Bye");
 
   // Start of file.
-  readMozSlice(createFileWithData("HelloBye"), 0, 5, "Hello");
+  readSlice(createFileWithData("HelloBye"), 0, 5, "Hello");
 
   ]]>
   </script>

dom/workers/test/test_fileSlice.xul

@@ -37,7 +37,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=664783
                        .getService(Components.interfaces.nsIProperties)
                        .get("ProfD", Components.interfaces.nsIFile);
     var fileExtension = (extension == undefined) ? "" : "." + extension;
-    testFile.append("workerMozSlice" + fileNum++ + fileExtension);
+    testFile.append("workerSlice" + fileNum++ + fileExtension);
 
     var outStream = Components.classes["@mozilla.org/network/file-output-stream;1"]
                         .createInstance(Components.interfaces.nsIFileOutputStream);
@@ -56,8 +56,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=664783
    * Starts a worker which slices the blob to the given start offset and optional end offset and
    * content type. It then verifies that the size and type of the sliced blob is correct.
    */
-  function createMozSlice(blob, start, expectedLength, /** optional */ end, /** optional */ contentType) {
+  function createSlice(blob, start, expectedLength, /** optional */ end, /** optional */ contentType) {
-    var worker = new Worker("fileMozSlice_worker.js");
+    var worker = new Worker("fileSlice_worker.js");
 
     worker.onerror = function(event) {
       ok(false, "Worker had an error: " + event.data);
@@ -76,30 +76,30 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=664783
   }
 
   // Empty file.
-  createMozSlice(createFileWithData(""), 0, 0, 0);
+  createSlice(createFileWithData(""), 0, 0, 0);
 
   // Typical use case.
-  createMozSlice(createFileWithData("Hello"), 1, 1, 2);
+  createSlice(createFileWithData("Hello"), 1, 1, 2);
 
   // Longish file.
   var text = "";
   for (var i = 0; i < 10000; ++i) {
     text += "long";
   }
-  createMozSlice(createFileWithData(text), 2000, 2000, 4000);
+  createSlice(createFileWithData(text), 2000, 2000, 4000);
 
   // Slice to different type.
-  createMozSlice(createFileWithData("text", "txt"), 0, 2, 2, "image/png");
+  createSlice(createFileWithData("text", "txt"), 0, 2, 2, "image/png");
 
   // Length longer than blob.
-  createMozSlice(createFileWithData("text"), 0, 4, 20);
+  createSlice(createFileWithData("text"), 0, 4, 20);
 
   // Start longer than blob.
-  createMozSlice(createFileWithData("text"), 20, 0, 4);
+  createSlice(createFileWithData("text"), 20, 0, 4);
 
   // No optional arguments
-  createMozSlice(createFileWithData("text"), 0, 4);
+  createSlice(createFileWithData("text"), 0, 4);
-  createMozSlice(createFileWithData("text"), 2, 2);
+  createSlice(createFileWithData("text"), 2, 2);
 
   ]]>
   </script>

editor/composer/src/nsEditorSpellCheck.cpp

@@ -83,7 +83,7 @@ class UpdateDictionnaryHolder {
 
 #define CPS_PREF_NAME NS_LITERAL_STRING("spellcheck.lang")
 
-class LastDictionary {
+class LastDictionary MOZ_FINAL {
 public:
   /**
    * Store current dictionary for editor document url. Use content pref

editor/libeditor/html/nsHTMLAnonymousUtils.cpp

@@ -102,7 +102,7 @@ static PRInt32 GetCSSFloatValue(nsIDOMCSSStyleDeclaration * aDecl,
   return (PRInt32) f;
 }
 
-class nsElementDeletionObserver : public nsIMutationObserver
+class nsElementDeletionObserver MOZ_FINAL : public nsIMutationObserver
 {
 public:
   nsElementDeletionObserver(nsINode* aNativeAnonNode, nsINode* aObservedNode)

embedding/browser/webBrowser/nsIWebBrowserChrome.idl

@@ -47,7 +47,7 @@ interface nsIDocShellTreeItem;
  * containing an embedded Gecko web browser.
  */
 
-[scriptable, uuid(BA434C60-9D52-11d3-AFB0-00A024FFC08C)]
+[scriptable, uuid(E8C414C4-DC38-4BA3-AB4E-EC4CBBE22907)]
 interface nsIWebBrowserChrome : nsISupports
 {
     const unsigned long STATUS_SCRIPT         = 0x00000001;
@@ -75,43 +75,47 @@ interface nsIWebBrowserChrome : nsISupports
     /**
      * Definitions for the chrome flags
      */
-    const unsigned long CHROME_DEFAULT          = 0x00000001;
+    const unsigned long CHROME_DEFAULT                = 0x00000001;
-    const unsigned long CHROME_WINDOW_BORDERS   = 0x00000002;
+    const unsigned long CHROME_WINDOW_BORDERS         = 0x00000002;
-    const unsigned long CHROME_WINDOW_CLOSE     = 0x00000004;
+    const unsigned long CHROME_WINDOW_CLOSE           = 0x00000004;
-    const unsigned long CHROME_WINDOW_RESIZE    = 0x00000008;
+    const unsigned long CHROME_WINDOW_RESIZE          = 0x00000008;
-    const unsigned long CHROME_MENUBAR          = 0x00000010;
+    const unsigned long CHROME_MENUBAR                = 0x00000010;
-    const unsigned long CHROME_TOOLBAR          = 0x00000020;
+    const unsigned long CHROME_TOOLBAR                = 0x00000020;
-    const unsigned long CHROME_LOCATIONBAR      = 0x00000040;
+    const unsigned long CHROME_LOCATIONBAR            = 0x00000040;
-    const unsigned long CHROME_STATUSBAR        = 0x00000080;
+    const unsigned long CHROME_STATUSBAR              = 0x00000080;
-    const unsigned long CHROME_PERSONAL_TOOLBAR = 0x00000100;
+    const unsigned long CHROME_PERSONAL_TOOLBAR       = 0x00000100;
-    const unsigned long CHROME_SCROLLBARS       = 0x00000200;
+    const unsigned long CHROME_SCROLLBARS             = 0x00000200;
-    const unsigned long CHROME_TITLEBAR         = 0x00000400;
+    const unsigned long CHROME_TITLEBAR               = 0x00000400;
-    const unsigned long CHROME_EXTRA            = 0x00000800;
+    const unsigned long CHROME_EXTRA                  = 0x00000800;
     
     // createBrowserWindow specific flags
-    const unsigned long CHROME_WITH_SIZE        = 0x00001000;
+    const unsigned long CHROME_WITH_SIZE              = 0x00001000;
-    const unsigned long CHROME_WITH_POSITION    = 0x00002000;
+    const unsigned long CHROME_WITH_POSITION          = 0x00002000;
 
     // special cases
-    const unsigned long CHROME_WINDOW_MIN       = 0x00004000;
+    const unsigned long CHROME_WINDOW_MIN             = 0x00004000;
-    const unsigned long CHROME_WINDOW_POPUP     = 0x00008000;
+    const unsigned long CHROME_WINDOW_POPUP           = 0x00008000;
 
-    const unsigned long CHROME_WINDOW_RAISED    = 0x02000000;
+    // Prevents new window animations on Mac OS X Lion.  Ignored on other
-    const unsigned long CHROME_WINDOW_LOWERED   = 0x04000000;
+    // platforms.
-    const unsigned long CHROME_CENTER_SCREEN    = 0x08000000;
+    const unsigned long CHROME_MAC_SUPPRESS_ANIMATION = 0x01000000;
+
+    const unsigned long CHROME_WINDOW_RAISED          = 0x02000000;
+    const unsigned long CHROME_WINDOW_LOWERED         = 0x04000000;
+    const unsigned long CHROME_CENTER_SCREEN          = 0x08000000;
 
     // Make the new window dependent on the parent.  This flag is only
     // meaningful if CHROME_OPENAS_CHROME is set; content windows should not be
     // dependent.
-    const unsigned long CHROME_DEPENDENT        = 0x10000000;
+    const unsigned long CHROME_DEPENDENT              = 0x10000000;
 
     // Note: The modal style bit just affects the way the window looks and does
     //       mean it's actually modal.
-    const unsigned long CHROME_MODAL            = 0x20000000; 
+    const unsigned long CHROME_MODAL                  = 0x20000000; 
-    const unsigned long CHROME_OPENAS_DIALOG    = 0x40000000;
+    const unsigned long CHROME_OPENAS_DIALOG          = 0x40000000;
-    const unsigned long CHROME_OPENAS_CHROME    = 0x80000000;
+    const unsigned long CHROME_OPENAS_CHROME          = 0x80000000;
     
-    const unsigned long CHROME_ALL              = 0x00000ffe;
+    const unsigned long CHROME_ALL                    = 0x00000ffe;
     
     /**
      * The chrome flags for this browser chrome. The implementation should

embedding/components/windowwatcher/src/nsWindowWatcher.cpp

@@ -1527,6 +1527,9 @@ PRUint32 nsWindowWatcher::CalculateChromeFlags(const char *aFeatures,
   else if (WinHasOption(aFeatures, "alwaysRaised", 0, nsnull))
     chromeFlags |= nsIWebBrowserChrome::CHROME_WINDOW_RAISED;
 
+  chromeFlags |= WinHasOption(aFeatures, "macsuppressanimation", 0, nsnull) ?
+    nsIWebBrowserChrome::CHROME_MAC_SUPPRESS_ANIMATION : 0;
+
   chromeFlags |= WinHasOption(aFeatures, "chrome", 0, nsnull) ?
     nsIWebBrowserChrome::CHROME_OPENAS_CHROME : 0;
   chromeFlags |= WinHasOption(aFeatures, "extrachrome", 0, nsnull) ?

gfx/2d/DrawTargetD2D.cpp

@@ -633,7 +633,7 @@ DrawTargetD2D::DrawSurfaceWithShadow(SourceSurface *aSurface,
   if (mPushedClips.size()) {
     mPrivateData->mEffect->GetVariableByName("mask")->AsShaderResource()->SetResource(maskSRView);
     mPrivateData->mEffect->GetVariableByName("MaskTexCoords")->AsVector()->
-      SetFloatVector(ShaderConstantRectD3D10(shadowDest.x / mSize.width, shadowDest.y / mSize.width,
+      SetFloatVector(ShaderConstantRectD3D10(shadowDest.x / mSize.width, shadowDest.y / mSize.height,
                                              Float(aSurface->GetSize().width) / mSize.width,
                                              Float(aSurface->GetSize().height) / mSize.height));
     mPrivateData->mEffect->GetTechniqueByName("SampleTextureWithShadow")->
@@ -658,7 +658,7 @@ DrawTargetD2D::DrawSurfaceWithShadow(SourceSurface *aSurface,
 
   if (mPushedClips.size()) {
     mPrivateData->mEffect->GetVariableByName("MaskTexCoords")->AsVector()->
-      SetFloatVector(ShaderConstantRectD3D10(aDest.x / mSize.width, aDest.y / mSize.width,
+      SetFloatVector(ShaderConstantRectD3D10(aDest.x / mSize.width, aDest.y / mSize.height,
                                              Float(aSurface->GetSize().width) / mSize.width,
                                              Float(aSurface->GetSize().height) / mSize.height));
     mPrivateData->mEffect->GetTechniqueByName("SampleMaskedTexture")->

gfx/gl/GLContext.cpp

@@ -1452,6 +1452,8 @@ GLContext::ResizeOffscreenFBO(const gfxIntSize& aSize, const bool aUseReadFBO, c
 
     // We're good, and the framebuffer is already attached.
     // Now restore the GL state back to what it was before the resize took place.
+    // If the user was using fb 0, this will bind the offscreen framebuffer we
+    // just created.
     BindDrawFBO(curBoundFramebufferDraw);
     BindReadFBO(curBoundFramebufferRead);
     fBindTexture(LOCAL_GL_TEXTURE_2D, curBoundTexture);

gfx/gl/GLContext.h

@@ -541,8 +541,10 @@ public:
               bool aIsOffscreen = false,
               GLContext *aSharedContext = nsnull)
       : mFlushGuaranteesResolve(false),
-        mBoundDrawFBO(0),
+        mUserBoundDrawFBO(0),
-        mBoundReadFBO(0),
+        mUserBoundReadFBO(0),
+        mInternalBoundDrawFBO(0),
+        mInternalBoundReadFBO(0),
         mOffscreenFBOsDirty(false),
         mInitialized(false),
         mIsOffscreen(aIsOffscreen),
@@ -862,23 +864,67 @@ public:
 
 
 private:
-    GLuint mBoundDrawFBO;
+    GLuint mUserBoundDrawFBO;
-    GLuint mBoundReadFBO;
+    GLuint mUserBoundReadFBO;
+    GLuint mInternalBoundDrawFBO;
+    GLuint mInternalBoundReadFBO;
 
 public:
     void fBindFramebuffer(GLenum target, GLuint framebuffer) {
         switch (target) {
-          case LOCAL_GL_FRAMEBUFFER:
-            mBoundDrawFBO = mBoundReadFBO = framebuffer;
-            break;
           case LOCAL_GL_DRAW_FRAMEBUFFER_EXT:
-            mBoundDrawFBO = framebuffer;
+            mUserBoundDrawFBO = framebuffer;
+
+            if (framebuffer == 0) {
+                mInternalBoundDrawFBO = mOffscreenDrawFBO;
+            } else {
+                mInternalBoundDrawFBO = mUserBoundDrawFBO;
+            }
+
+            raw_fBindFramebuffer(LOCAL_GL_DRAW_FRAMEBUFFER_EXT,
+                                 mInternalBoundDrawFBO);
             break;
+
           case LOCAL_GL_READ_FRAMEBUFFER_EXT:
-            mBoundReadFBO = framebuffer;
+            mUserBoundReadFBO = framebuffer;
+
+            if (framebuffer == 0) {
+                mInternalBoundReadFBO = mOffscreenReadFBO;
+            } else {
+                mInternalBoundReadFBO = mUserBoundReadFBO;
+            }
+
+            raw_fBindFramebuffer(LOCAL_GL_READ_FRAMEBUFFER_EXT,
+                                 mInternalBoundReadFBO);
+            break;
+
+          case LOCAL_GL_FRAMEBUFFER:
+            mUserBoundDrawFBO = mUserBoundReadFBO = framebuffer;
+
+            if (framebuffer == 0) {
+                mInternalBoundDrawFBO = mOffscreenDrawFBO;
+                mInternalBoundReadFBO = mOffscreenReadFBO;
+            } else {
+                mInternalBoundDrawFBO = mUserBoundDrawFBO;
+                mInternalBoundReadFBO = mUserBoundReadFBO;
+            }
+
+            if (SupportsOffscreenSplit()) {
+                raw_fBindFramebuffer(LOCAL_GL_DRAW_FRAMEBUFFER_EXT,
+                                     mInternalBoundDrawFBO);
+                raw_fBindFramebuffer(LOCAL_GL_READ_FRAMEBUFFER_EXT,
+                                     mInternalBoundReadFBO);
+            } else {
+                raw_fBindFramebuffer(LOCAL_GL_FRAMEBUFFER,
+                                     mInternalBoundDrawFBO);
+            }
+
+            break;
+
+          default:
+            raw_fBindFramebuffer(target, framebuffer);
             break;
         }
-        raw_fBindFramebuffer(target, framebuffer);
     }
 
     GLuint GetBoundDrawFBO() {
@@ -886,32 +932,38 @@ public:
         GLint ret = 0;
         // Don't need a branch here, because:
         // LOCAL_GL_DRAW_FRAMEBUFFER_BINDING_EXT == LOCAL_GL_FRAMEBUFFER_BINDING == 0x8CA6
-        fGetIntegerv(LOCAL_GL_DRAW_FRAMEBUFFER_BINDING_EXT, &ret);
+        // We use raw_ here because this is debug code and we need to see what
+        // the driver thinks.
+        raw_fGetIntegerv(LOCAL_GL_DRAW_FRAMEBUFFER_BINDING_EXT, &ret);
 
-        if (mBoundDrawFBO != (GLuint)ret) {
+        if (mInternalBoundDrawFBO != (GLuint)ret) {
-          printf_stderr("!!! Draw FBO mismatch: Was: %d, Expected: %d\n", ret, mBoundDrawFBO);
+          printf_stderr("!!! Draw FBO mismatch: Was: %d, Expected: %d\n", ret, mInternalBoundDrawFBO);
           NS_ABORT();
         }
 #endif
 
-        return mBoundDrawFBO;
+        // We only ever expose the user's bound FBOs
+        return mUserBoundDrawFBO;
     }
 
     GLuint GetBoundReadFBO() {
 #ifdef DEBUG
         GLint ret = 0;
+        // We use raw_ here because this is debug code and we need to see what
+        // the driver thinks.
         if (SupportsOffscreenSplit())
-            fGetIntegerv(LOCAL_GL_READ_FRAMEBUFFER_BINDING_EXT, &ret);
+            raw_fGetIntegerv(LOCAL_GL_READ_FRAMEBUFFER_BINDING_EXT, &ret);
         else
-            fGetIntegerv(LOCAL_GL_FRAMEBUFFER_BINDING, &ret);
+            raw_fGetIntegerv(LOCAL_GL_FRAMEBUFFER_BINDING, &ret);
 
-        if (mBoundReadFBO != (GLuint)ret) {
+        if (mInternalBoundReadFBO != (GLuint)ret) {
-          printf_stderr("!!! Read FBO mismatch: Was: %d, Expected: %d\n", ret, mBoundReadFBO);
+          printf_stderr("!!! Read FBO mismatch: Was: %d, Expected: %d\n", ret, mInternalBoundReadFBO);
           NS_ABORT();
         }
 #endif
 
-        return mBoundReadFBO;
+        // We only ever expose the user's bound FBOs
+        return mUserBoundReadFBO;
     }
 
     void BindDrawFBO(GLuint name) {
@@ -954,8 +1006,6 @@ public:
     }
 
 private:
-    GLuint mPrevDrawFBOBinding;
-    GLuint mPrevReadFBOBinding;
     bool mOffscreenFBOsDirty;
 
     void GetShaderPrecisionFormatNonES2(GLenum shadertype, GLenum precisiontype, GLint* range, GLint* precision) {
@@ -980,40 +1030,29 @@ private:
         }
     }
 
+    // Do whatever setup is necessary to draw to our offscreen FBO, if it's
+    // bound.
     void BeforeGLDrawCall() {
-        // Record and rebind if necessary
+        if (mInternalBoundDrawFBO != mOffscreenDrawFBO)
-        mPrevDrawFBOBinding = GetBoundDrawFBO();
-        if (mPrevDrawFBOBinding == 0) {
-            BindDrawFBO(mOffscreenDrawFBO);
-        } else if (mPrevDrawFBOBinding != mOffscreenDrawFBO)
             return;
 
-        // Must be after binding the proper FBO
         if (mOffscreenDrawFBO == mOffscreenReadFBO)
             return;
 
-        // If we're already dirty, no need to set it again
-        if (mOffscreenFBOsDirty)
-            return;
-
         mOffscreenFBOsDirty = true;
     }
 
+    // Do whatever tear-down is necessary after drawing to our offscreen FBO,
+    // if it's bound.
     void AfterGLDrawCall() {
-        if (mPrevDrawFBOBinding == 0) {
-            BindDrawFBO(0);
-        }
     }
 
+    // Do whatever setup is necessary to read from our offscreen FBO, if it's
+    // bound.
     void BeforeGLReadCall() {
-        // Record and rebind if necessary
+        if (mInternalBoundReadFBO != mOffscreenReadFBO)
-        mPrevReadFBOBinding = GetBoundReadFBO();
-        if (mPrevReadFBOBinding == 0) {
-            BindReadFBO(mOffscreenReadFBO);
-        } else if (mPrevReadFBOBinding != mOffscreenReadFBO)
             return;
 
-        // Must be after binding the proper FBO
         if (mOffscreenDrawFBO == mOffscreenReadFBO)
             return;
 
@@ -1027,7 +1066,7 @@ private:
 
         // flip read/draw for blitting
         GLuint prevDraw = SwapBoundDrawFBO(mOffscreenReadFBO);
-        BindReadFBO(mOffscreenDrawFBO); // We know that Read must already be mOffscreenRead, so no need to write that down
+        GLuint prevRead = SwapBoundReadFBO(mOffscreenDrawFBO);
 
         GLint width = mOffscreenActualSize.width;
         GLint height = mOffscreenActualSize.height;
@@ -1037,7 +1076,7 @@ private:
                              LOCAL_GL_NEAREST);
 
         BindDrawFBO(prevDraw);
-        BindReadFBO(mOffscreenReadFBO);
+        BindReadFBO(prevRead);
 
         if (scissor)
             fEnable(LOCAL_GL_SCISSOR_TEST);
@@ -1045,10 +1084,9 @@ private:
         mOffscreenFBOsDirty = false;
     }
 
+    // Do whatever tear-down is necessary after reading from our offscreen FBO,
+    // if it's bound.
     void AfterGLReadCall() {
-        if (mPrevReadFBOBinding == 0) {
-            BindReadFBO(0);
-        }
     }
 
 public:
@@ -1997,12 +2035,34 @@ public:
         return retval;
     }
 
-    void fGetIntegerv(GLenum pname, GLint *params) {
+private:
+    void raw_fGetIntegerv(GLenum pname, GLint *params) {
         BEFORE_GL_CALL;
         mSymbols.fGetIntegerv(pname, params);
         AFTER_GL_CALL;
     }
 
+public:
+    void fGetIntegerv(GLenum pname, GLint *params) {
+        switch (pname)
+        {
+            // LOCAL_GL_FRAMEBUFFER_BINDING is equal to
+            // LOCAL_GL_DRAW_FRAMEBUFFER_BINDING_EXT, so we don't need two
+            // cases.
+            case LOCAL_GL_FRAMEBUFFER_BINDING:
+                *params = GetBoundDrawFBO();
+                break;
+
+            case LOCAL_GL_READ_FRAMEBUFFER_BINDING_EXT:
+                *params = GetBoundReadFBO();
+                break;
+
+            default:
+                raw_fGetIntegerv(pname, params);
+                break;
+        }
+    }
+
     void fGetFloatv(GLenum pname, GLfloat *params) {
         BEFORE_GL_CALL;
         mSymbols.fGetFloatv(pname, params);

gfx/harfbuzz/src/hb-ot-layout.cc

@@ -32,6 +32,7 @@
 #include "hb-ot-layout-gsub-table.hh"
 #include "hb-ot-layout-gpos-table.hh"
 #include "hb-ot-maxp-table.hh"
+#include "hb-ot-shape-private.hh"
 
 
 #include <stdlib.h>
@@ -496,8 +497,46 @@ hb_ot_layout_position_lookup   (hb_font_t    *font,
 }
 
 void
-hb_ot_layout_position_finish (hb_buffer_t  *buffer)
+hb_ot_layout_position_finish (hb_face_t *face, hb_buffer_t *buffer)
 {
+  /* force diacritics to have zero width */
+  unsigned int count = buffer->len;
+  if (hb_ot_layout_has_glyph_classes (face)) {
+    const GDEF& gdef = _get_gdef (face);
+    if (buffer->props.direction == HB_DIRECTION_RTL) {
+      for (unsigned int i = 1; i < count; i++) {
+        if (gdef.get_glyph_class (buffer->info[i].codepoint) == GDEF::MarkGlyph) {
+          buffer->pos[i].x_advance = 0;
+        }
+      }
+    } else {
+      for (unsigned int i = 1; i < count; i++) {
+        if (gdef.get_glyph_class (buffer->info[i].codepoint) == GDEF::MarkGlyph) {
+          hb_glyph_position_t& pos = buffer->pos[i];
+          pos.x_offset -= pos.x_advance;
+          pos.x_advance = 0;
+        }
+      }
+    }
+  } else {
+    /* no GDEF classes available, so use General Category as a fallback */
+    if (buffer->props.direction == HB_DIRECTION_RTL) {
+      for (unsigned int i = 1; i < count; i++) {
+        if (buffer->info[i].general_category() == HB_UNICODE_GENERAL_CATEGORY_NON_SPACING_MARK) {
+          buffer->pos[i].x_advance = 0;
+        }
+      }
+    } else {
+      for (unsigned int i = 1; i < count; i++) {
+        if (buffer->info[i].general_category() == HB_UNICODE_GENERAL_CATEGORY_NON_SPACING_MARK) {
+          hb_glyph_position_t& pos = buffer->pos[i];
+          pos.x_offset -= pos.x_advance;
+          pos.x_advance = 0;
+        }
+      }
+    }
+  }
+
   GPOS::position_finish (buffer);
 }
 

gfx/harfbuzz/src/hb-ot-layout.h

@@ -199,7 +199,7 @@ hb_ot_layout_position_lookup (hb_font_t    *font,
 
 /* Should be called after all the position_lookup's are done */
 void
-hb_ot_layout_position_finish (hb_buffer_t  *buffer);
+hb_ot_layout_position_finish (hb_face_t *face, hb_buffer_t *buffer);
 
 
 HB_END_DECLS

gfx/harfbuzz/src/hb-ot-shape-private.hh

@@ -104,12 +104,40 @@ _hb_unicode_modified_combining_class (hb_unicode_funcs_t *ufuncs,
 {
   int c = hb_unicode_combining_class (ufuncs, unicode);
 
+  /* For Hebrew, we permute the "fixed-position" classes 10-25 into the order
+   * described in the SBL Hebrew manual http://www.sbl-site.org/Fonts/SBLHebrewUserManual1.5x.pdf
+   * (as recommended by http://forum.fontlab.com/archive-old-microsoft-volt-group/vista-and-diacritic-ordering-t6751.0.html)
+   */
+  static const int permuted_hebrew_classes[25 - 10 + 1] = {
+    /* 10 sheva */        15,
+    /* 11 hataf segol */  16,
+    /* 12 hataf patah */  17,
+    /* 13 hataf qamats */ 18,
+    /* 14 hiriq */        19,
+    /* 15 tsere */        20,
+    /* 16 segol */        21,
+    /* 17 patah */        22,
+    /* 18 qamats */       23,
+    /* 19 holam */        14,
+    /* 20 qubuts */       24,
+    /* 21 dagesh */       12,
+    /* 22 meteg */        25,
+    /* 23 rafe */         13,
+    /* 24 shin dot */     10,
+    /* 25 sin dot */      11,
+  };
+
   /* Modify the combining-class to suit Arabic better.  See:
    * http://unicode.org/faq/normalization.html#8
    * http://unicode.org/faq/normalization.html#9
    */
   if (unlikely (hb_in_range<int> (c, 27, 33)))
     c = c == 33 ? 27 : c + 1;
+  /* The equivalent fix for Hebrew is more complex,
+   * see the SBL Hebrew manual.
+   */
+  else if (unlikely (hb_in_range<int> (c, 10, 25)))
+    c = permuted_hebrew_classes[c - 10];
 
   return c;
 }

gfx/harfbuzz/src/hb-ot-shape.cc

@@ -299,15 +299,36 @@ hb_ot_position_complex (hb_ot_shape_context_t *c)
     c->applied_position_complex = TRUE;
   }
 
-  hb_ot_layout_position_finish (c->buffer);
+  hb_ot_layout_position_finish (c->face, c->buffer);
 
   return;
 }
 
 static void
-hb_position_complex_fallback (hb_ot_shape_context_t *c HB_UNUSED)
+hb_position_complex_fallback (hb_ot_shape_context_t *c)
 {
-  /* TODO Mark pos */
+  unsigned int count = c->buffer->len;
+  if (c->buffer->props.direction == HB_DIRECTION_RTL) {
+    for (unsigned int i = 1; i < count; i++) {
+      unsigned int gen_cat = c->buffer->info[i].general_category();
+      if ((1<<gen_cat) & ((1<<HB_UNICODE_GENERAL_CATEGORY_NON_SPACING_MARK)|
+                          (1<<HB_UNICODE_GENERAL_CATEGORY_ENCLOSING_MARK)|
+                          (1<<HB_UNICODE_GENERAL_CATEGORY_FORMAT))) {
+        c->buffer->pos[i].x_advance = 0;
+      }
+    }
+  } else {
+    for (unsigned int i = 1; i < count; i++) {
+      unsigned int gen_cat = c->buffer->info[i].general_category();
+      if ((1<<gen_cat) & ((1<<HB_UNICODE_GENERAL_CATEGORY_NON_SPACING_MARK)|
+                          (1<<HB_UNICODE_GENERAL_CATEGORY_ENCLOSING_MARK)|
+                          (1<<HB_UNICODE_GENERAL_CATEGORY_FORMAT))) {
+        hb_glyph_position_t& pos = c->buffer->pos[i];
+        pos.x_offset = -pos.x_advance;
+        pos.x_advance = 0;
+      }
+    }
+  }
 }
 
 static void

gfx/thebes/gfxPlatform.cpp

@@ -1358,11 +1358,19 @@ gfxPlatform::FontsPrefsChanged(const char *aPref)
 #ifdef MOZ_GRAPHITE
     } else if (!strcmp(GFX_PREF_GRAPHITE_SHAPING, aPref)) {
         mGraphiteShapingEnabled = UNINITIALIZED_VALUE;
-        gfxFontCache::GetCache()->AgeAllGenerations();
+        gfxFontCache *fontCache = gfxFontCache::GetCache();
+        if (fontCache) {
+            fontCache->AgeAllGenerations();
+            fontCache->FlushShapedWordCaches();
+        }
 #endif
     } else if (!strcmp(GFX_PREF_HARFBUZZ_SCRIPTS, aPref)) {
         mUseHarfBuzzScripts = UNINITIALIZED_VALUE;
-        gfxFontCache::GetCache()->AgeAllGenerations();
+        gfxFontCache *fontCache = gfxFontCache::GetCache();
+        if (fontCache) {
+            fontCache->AgeAllGenerations();
+            fontCache->FlushShapedWordCaches();
+        }
     } else if (!strcmp(BIDI_NUMERAL_PREF, aPref)) {
         mBidiNumeralOption = UNINITIALIZED_VALUE;
     }

gfx/thebes/nsIOSurface.h

@@ -44,7 +44,7 @@
 #import <OpenGL/OpenGL.h>
 
 class gfxASurface;
-class _CGLContextObject;
+struct _CGLContextObject;
 
 typedef _CGLContextObject* CGLContextObj;
 typedef uint32_t IOSurfaceID;

hal/gonk/GonkHal.cpp

@@ -268,10 +268,29 @@ GetCurrentBatteryInformation(hal::BatteryInformation *aBatteryInfo)
   }
 
   FILE *chargingFile = fopen("/sys/class/power_supply/battery/charging_source", "r");
-  int chargingSrc = 1;
+  int chargingSrc = BATTERY_CHARGING_USB;
+  bool done = false;
   if (chargingFile) {
     fscanf(chargingFile, "%d", &chargingSrc);
     fclose(chargingFile);
+    done = true;
+  }
+
+  if (!done) {
+    // toro devices support
+    chargingFile = fopen("/sys/class/power_supply/battery/status", "r");
+    if (chargingFile) {
+      char status[16];
+      fscanf(chargingFile, "%s", &status);
+      if (!strcmp(status, "Charging") || !strcmp(status, "Full")) {
+        // no way here to know if we're charging from USB or AC.
+        chargingSrc = BATTERY_CHARGING_USB;
+      } else {
+        chargingSrc = BATTERY_NOT_CHARGING;
+      }
+      fclose(chargingFile);
+      done = true;
+    }
   }
 
   #ifdef DEBUG

js/src/aclocal.m4

@@ -14,5 +14,6 @@ builtin(include, build/autoconf/acwinpaths.m4)dnl
 builtin(include, build/autoconf/lto.m4)dnl
 builtin(include, build/autoconf/gcc-pr49911.m4)dnl
 builtin(include, build/autoconf/frameptr.m4)dnl
+builtin(include, build/autoconf/compiler-opts.m4)dnl
 
 MOZ_PROG_CHECKMSYS()

js/src/assembler/wtf/Assertions.h

@@ -29,8 +29,16 @@
 #include "Platform.h"
 #include "mozilla/Assertions.h"
 
+#ifndef DEBUG
+   /*
+    * Prevent unused-variable warnings by defining the macro WTF uses to test
+    * for assertions taking effect.
+    */
+#  define ASSERT_DISABLED 1
+#endif
+
 #define ASSERT(assertion) MOZ_ASSERT(assertion)
-#define ASSERT_UNUSED(variable, assertion) ASSERT(assertion)
+#define ASSERT_UNUSED(variable, assertion) (((void)variable), ASSERT(assertion))
 #define ASSERT_NOT_REACHED() MOZ_NOT_REACHED("")
 #define CRASH() MOZ_Crash()
 #define COMPILE_ASSERT(exp, name) MOZ_STATIC_ASSERT(exp, #name)

js/src/build/autoconf/compiler-opts.m4

@@ -0,0 +1,13 @@
+dnl Add compiler specific options
+
+AC_DEFUN([MOZ_COMPILER_OPTS],
+[
+if test "$CLANG_CXX"; then
+    ## We disable return-type-c-linkage because jsval is defined as a C++ type but is
+    ## returned by C functions. This is possible because we use knowledge about the ABI
+    ## to typedef it to a C type with the same layout when the headers are included
+    ## from C.
+    _WARNINGS_CXXFLAGS="${_WARNINGS_CXXFLAGS} -Wno-return-type-c-linkage"
+fi
+])
+

js/src/builtin/MapObject.cpp

@@ -185,8 +185,11 @@ MapObject::mark(JSTracer *trc, JSObject *obj)
     MapObject *mapobj = static_cast<MapObject *>(obj);
     if (ValueMap *map = mapobj->getData()) {
         for (ValueMap::Range r = map->all(); !r.empty(); r.popFront()) {
-            gc::MarkValue(trc, r.front().key, "key");
+            const HeapValue &key = r.front().key;
-            gc::MarkValue(trc, r.front().value, "value");
+            HeapValue tmp(key);
+            gc::MarkValue(trc, &tmp, "key");
+            JS_ASSERT(tmp.get() == key.get());
+            gc::MarkValue(trc, &r.front().value, "value");
         }
     }
 }
@@ -331,8 +334,12 @@ SetObject::mark(JSTracer *trc, JSObject *obj)
 {
     SetObject *setobj = static_cast<SetObject *>(obj);
     if (ValueSet *set = setobj->getData()) {
-        for (ValueSet::Range r = set->all(); !r.empty(); r.popFront())
+        for (ValueSet::Range r = set->all(); !r.empty(); r.popFront()) {
-            gc::MarkValue(trc, r.front(), "key");
+            const HeapValue &key = r.front();
+            HeapValue tmp(key);
+            gc::MarkValue(trc, &tmp, "key");
+            JS_ASSERT(tmp.get() == key.get());
+        }
     }
 }
 

js/src/configure.in

@@ -3133,6 +3133,7 @@ AC_SUBST(WRAP_SYSTEM_INCLUDES)
 AC_SUBST(VISIBILITY_FLAGS)
 
 MOZ_GCC_PR49911
+MOZ_COMPILER_OPTS
 
 dnl Check for __force_align_arg_pointer__ for SSE2 on gcc
 dnl ========================================================

js/src/gc/Barrier-inl.h

@@ -134,8 +134,11 @@ inline void
 HeapValue::writeBarrierPre(JSCompartment *comp, const Value &value)
 {
 #ifdef JSGC_INCREMENTAL
-    if (comp->needsBarrier())
+    if (comp->needsBarrier()) {
-        js::gc::MarkValueUnbarriered(comp->barrierTracer(), value, "write barrier");
+        Value tmp(value);
+        js::gc::MarkValueUnbarriered(comp->barrierTracer(), &tmp, "write barrier");
+        JS_ASSERT(tmp == value);
+    }
 #endif
 }
 

js/src/gc/Barrier.h

@@ -319,6 +319,7 @@ class HeapValue
     inline void set(JSCompartment *comp, const Value &v);
 
     const Value &get() const { return value; }
+    Value *unsafeGet() { return &value; }
     operator const Value &() const { return value; }
 
     bool isUndefined() const { return value.isUndefined(); }

js/src/jit-test/lib/prolog.js

@@ -8,3 +8,6 @@ if (!("gczeal" in this)) {
   gczeal = function() { }
 }
 
+if (!("schedulegc" in this)) {
+  schedulegc = function() { }
+}

js/src/jit-test/tests/basic/bug727921.js

@@ -0,0 +1,10 @@
+(function() {
+    let(d) {
+        yield
+    }
+})()
+eval("\
+    (function(){\
+        schedulegc(5), 'a'.replace(/a/,function(){yield})\
+    })\
+")()

js/src/jsapi.cpp

@@ -4415,20 +4415,13 @@ JS_ElementIteratorStub(JSContext *cx, JSObject *obj, JSBool keysonly)
 JS_PUBLIC_API(jsval)
 JS_GetReservedSlot(JSObject *obj, uint32_t index)
 {
-    if (!obj->isNative())
+    return obj->getReservedSlot(index);
-        return UndefinedValue();
-
-    return GetReservedSlot(obj, index);
 }
 
 JS_PUBLIC_API(void)
 JS_SetReservedSlot(JSObject *obj, uint32_t index, jsval v)
 {
-    if (!obj->isNative())
+    obj->setReservedSlot(index, v);
-        return;
-
-    SetReservedSlot(obj, index, v);
-    GCPoke(obj->compartment()->rt, NullValue());
 }
 
 JS_PUBLIC_API(JSObject *)

js/src/jsapi.h

@@ -1860,7 +1860,11 @@ INTERNED_STRING_TO_JSID(JSContext *cx, JSString *str)
     jsid id;
     JS_ASSERT(str);
     JS_ASSERT(((size_t)str & JSID_TYPE_MASK) == 0);
+#ifdef DEBUG
     JS_ASSERT(JS_StringHasBeenInterned(cx, str));
+#else
+    (void)cx;
+#endif
     JSID_BITS(id) = (size_t)str;
     return id;
 }
@@ -5314,6 +5318,8 @@ JS_IsConstructing(JSContext *cx, const jsval *vp)
     } else {
         JS_ASSERT(JS_GetClass(callee)->construct != NULL);
     }
+#else
+    (void)cx;
 #endif
 
     return JSVAL_IS_MAGIC_IMPL(JSVAL_TO_IMPL(vp[1]));

js/src/jsarray.cpp

@@ -1434,23 +1434,22 @@ JSObject::makeDenseArraySlow(JSContext *cx)
 class ArraySharpDetector
 {
     JSContext *cx;
-    JSHashEntry *he;
+    bool success;
     bool alreadySeen;
     bool sharp;
 
   public:
     ArraySharpDetector(JSContext *cx)
       : cx(cx),
-        he(NULL),
+        success(false),
         alreadySeen(false),
         sharp(false)
     {}
 
     bool init(JSObject *obj) {
-        he = js_EnterSharpObject(cx, obj, NULL, &alreadySeen);
+        success = js_EnterSharpObject(cx, obj, NULL, &alreadySeen, &sharp);
-        if (!he)
+        if (!success)
             return false;
-        sharp = IS_SHARP(he);
         return true;
     }
 
@@ -1460,7 +1459,7 @@ class ArraySharpDetector
     }
 
     ~ArraySharpDetector() {
-        if (he && !sharp)
+        if (success && !sharp)
             js_LeaveSharpObject(cx, NULL);
     }
 };

js/src/jsbool.cpp

@@ -157,7 +157,7 @@ js_InitBooleanClass(JSContext *cx, JSObject *obj)
     JSObject *booleanProto = global->createBlankPrototype(cx, &BooleanClass);
     if (!booleanProto)
         return NULL;
-    booleanProto->setPrimitiveThis(BooleanValue(false));
+    booleanProto->setFixedSlot(BooleanObject::PRIMITIVE_VALUE_SLOT, BooleanValue(false));
 
     JSFunction *ctor = global->createConstructor(cx, Boolean, &BooleanClass,
                                                  CLASS_ATOM(cx, Boolean), 1);

js/src/jsboolinlines.h

@@ -42,13 +42,15 @@
 
 #include "jsobjinlines.h"
 
+#include "vm/BooleanObject-inl.h"
+
 namespace js {
 
 inline bool
 BooleanGetPrimitiveValue(JSContext *cx, JSObject &obj, Value *vp)
 {
     if (obj.isBoolean()) {
-        *vp = obj.getPrimitiveThis();
+        *vp = BooleanValue(obj.asBoolean().unbox());
         return true;
     }
 

js/src/jsclone.cpp

@@ -42,7 +42,10 @@
 
 #include "jstypedarrayinlines.h"
 
+#include "vm/BooleanObject-inl.h"
+#include "vm/NumberObject-inl.h"
 #include "vm/RegExpObject-inl.h"
+#include "vm/StringObject-inl.h"
 
 using namespace js;
 
@@ -536,12 +539,12 @@ JSStructuredCloneWriter::startWrite(const js::Value &v)
         } else if (js_IsArrayBuffer(obj)) {
             return writeArrayBuffer(obj);
         } else if (obj->isBoolean()) {
-            return out.writePair(SCTAG_BOOLEAN_OBJECT, obj->getPrimitiveThis().toBoolean());
+            return out.writePair(SCTAG_BOOLEAN_OBJECT, obj->asBoolean().unbox());
         } else if (obj->isNumber()) {
             return out.writePair(SCTAG_NUMBER_OBJECT, 0) &&
-                   out.writeDouble(obj->getPrimitiveThis().toNumber());
+                   out.writeDouble(obj->asNumber().unbox());
         } else if (obj->isString()) {
-            return writeString(SCTAG_STRING_OBJECT, obj->getPrimitiveThis().toString());
+            return writeString(SCTAG_STRING_OBJECT, obj->asString().unbox());
         }
 
         if (callbacks && callbacks->write)

js/src/jscntxt.cpp

@@ -970,6 +970,7 @@ JSContext::JSContext(JSRuntime *rt)
     stack(thisDuringConstruction()),  /* depends on cx->thread_ */
     parseMapPool_(NULL),
     globalObject(NULL),
+    sharpObjectMap(this),
     argumentFormatMap(NULL),
     lastMessage(NULL),
     errorReporter(NULL),
@@ -1270,6 +1271,26 @@ JSContext::sizeOfIncludingThis(JSMallocSizeOfFun mallocSizeOf) const
     return mallocSizeOf(this) + busyArrays.sizeOfExcludingThis(mallocSizeOf);
 }
 
+void
+JSContext::mark(JSTracer *trc)
+{
+    /* Stack frames and slots are traced by StackSpace::mark. */
+
+    /* Mark other roots-by-definition in the JSContext. */
+    if (globalObject && !hasRunOption(JSOPTION_UNROOTED_GLOBAL))
+        MarkObjectRoot(trc, globalObject, "global object");
+    if (isExceptionPending())
+        MarkValueRoot(trc, &exception, "exception");
+
+    if (autoGCRooters)
+        autoGCRooters->traceAll(trc);
+
+    if (sharpObjectMap.depth > 0)
+        js_TraceSharpMap(trc, &sharpObjectMap);
+
+    MarkValueRoot(trc, &iterValue, "iterValue");
+}
+
 namespace JS {
 
 #if defined JS_THREADSAFE && defined DEBUG

js/src/jscntxt.h

@@ -76,12 +76,23 @@ JS_BEGIN_EXTERN_C
 struct DtoaState;
 JS_END_EXTERN_C
 
-struct JSSharpObjectMap {
+struct JSSharpInfo {
-    jsrefcount  depth;
+    bool hasGen;
-    uint32_t    sharpgen;
+    bool isSharp;
-    JSHashTable *table;
 
-    JSSharpObjectMap() : depth(0), sharpgen(0), table(NULL) {}
+    JSSharpInfo() : hasGen(false), isSharp(false) {}
+};
+
+typedef js::HashMap<JSObject *, JSSharpInfo> JSSharpTable;
+
+struct JSSharpObjectMap {
+    jsrefcount   depth;
+    uint32_t     sharpgen;
+    JSSharpTable table;
+
+    JSSharpObjectMap(JSContext *cx) : depth(0), sharpgen(0), table(js::TempAllocPolicy(cx)) {
+        table.init();
+    }
 };
 
 namespace js {
@@ -1121,6 +1132,8 @@ struct JSContext : js::ContextFriendFields
         return reinterpret_cast<JSContext *>(uintptr_t(link) - offsetof(JSContext, link));
     }
 
+    void mark(JSTracer *trc);
+
   private:
     /*
      * The allocation code calls the function to indicate either OOM failure
@@ -1558,18 +1571,18 @@ class AutoShapeVector : public AutoVectorRooter<const Shape *>
 
 class AutoValueArray : public AutoGCRooter
 {
-    const js::Value *start_;
+    js::Value *start_;
     unsigned length_;
 
   public:
-    AutoValueArray(JSContext *cx, const js::Value *start, unsigned length
+    AutoValueArray(JSContext *cx, js::Value *start, unsigned length
                    JS_GUARD_OBJECT_NOTIFIER_PARAM)
         : AutoGCRooter(cx, VALARRAY), start_(start), length_(length)
     {
         JS_GUARD_OBJECT_NOTIFIER_INIT;
     }
 
-    const Value *start() const { return start_; }
+    Value *start() { return start_; }
     unsigned length() const { return length_; }
 
     JS_DECL_USE_GUARD_OBJECT_NOTIFIER

js/src/jscompartment.cpp

@@ -416,8 +416,11 @@ JSCompartment::markCrossCompartmentWrappers(JSTracer *trc)
 {
     JS_ASSERT(trc->runtime->gcCurrentCompartment);
 
-    for (WrapperMap::Enum e(crossCompartmentWrappers); !e.empty(); e.popFront())
+    for (WrapperMap::Enum e(crossCompartmentWrappers); !e.empty(); e.popFront()) {
-        MarkValueRoot(trc, e.front().key, "cross-compartment wrapper");
+        Value tmp = e.front().key;
+        MarkValueRoot(trc, &tmp, "cross-compartment wrapper");
+        JS_ASSERT(tmp == e.front().key);
+    }
 }
 
 void

js/src/jsexn.cpp

@@ -432,9 +432,8 @@ exn_trace(JSTracer *trc, JSObject *obj)
             vcount += elem->argc;
         }
         vp = GetStackTraceValueBuffer(priv);
-        for (i = 0; i != vcount; ++i, ++vp) {
+        for (i = 0; i != vcount; ++i, ++vp)
-            MarkValue(trc, *vp, "stack trace argument");
+            MarkValue(trc, vp, "stack trace argument");
-        }
     }
 }
 

js/src/jsfun.cpp

@@ -100,12 +100,6 @@ using namespace js;
 using namespace js::gc;
 using namespace js::types;
 
-inline JSObject *
-JSObject::getThrowTypeError() const
-{
-    return global().getThrowTypeError();
-}
-
 JSBool
 js_GetArgsValue(JSContext *cx, StackFrame *fp, Value *vp)
 {
@@ -475,8 +469,8 @@ strictargs_resolve(JSContext *cx, JSObject *obj, jsid id, uintN flags, JSObject
         }
 
         attrs = JSPROP_PERMANENT | JSPROP_GETTER | JSPROP_SETTER | JSPROP_SHARED;
-        getter = CastAsPropertyOp(argsobj.getThrowTypeError());
+        getter = CastAsPropertyOp(argsobj.global().getThrowTypeError());
-        setter = CastAsStrictPropertyOp(argsobj.getThrowTypeError());
+        setter = CastAsStrictPropertyOp(argsobj.global().getThrowTypeError());
     }
 
     Value undef = UndefinedValue();
@@ -530,7 +524,7 @@ args_trace(JSTracer *trc, JSObject *obj)
 {
     ArgumentsObject &argsobj = obj->asArguments();
     ArgumentsData *data = argsobj.data();
-    MarkValue(trc, data->callee, js_callee_str);
+    MarkValue(trc, &data->callee, js_callee_str);
     MarkValueRange(trc, argsobj.initialLength(), data->slots, js_arguments_str);
 
     /*
@@ -1329,7 +1323,7 @@ fun_resolve(JSContext *cx, JSObject *obj, jsid id, uintN flags,
             StrictPropertyOp setter;
             uintN attrs = JSPROP_PERMANENT;
             if (fun->isInterpreted() ? fun->inStrictMode() : fun->isBoundFunction()) {
-                JSObject *throwTypeError = fun->getThrowTypeError();
+                JSObject *throwTypeError = fun->global().getThrowTypeError();
 
                 getter = CastAsPropertyOp(throwTypeError);
                 setter = CastAsStrictPropertyOp(throwTypeError);

js/src/jsgc.cpp

@@ -1855,7 +1855,7 @@ gc_root_traversal(JSTracer *trc, const RootEntry &entry)
     if (entry.value.type == JS_GC_ROOT_GCTHING_PTR)
         MarkGCThingRoot(trc, *reinterpret_cast<void **>(entry.key), name);
     else
-        MarkValueRoot(trc, *reinterpret_cast<Value *>(entry.key), name);
+        MarkValueRoot(trc, reinterpret_cast<Value *>(entry.key), name);
 }
 
 static void
@@ -1883,7 +1883,7 @@ AutoGCRooter::trace(JSTracer *trc)
 {
     switch (tag) {
       case JSVAL:
-        MarkValueRoot(trc, static_cast<AutoValueRooter *>(this)->val, "JS::AutoValueRooter.val");
+        MarkValueRoot(trc, &static_cast<AutoValueRooter *>(this)->val, "JS::AutoValueRooter.val");
         return;
 
       case PARSER:
@@ -1905,10 +1905,10 @@ AutoGCRooter::trace(JSTracer *trc)
             static_cast<AutoPropDescArrayRooter *>(this)->descriptors;
         for (size_t i = 0, len = descriptors.length(); i < len; i++) {
             PropDesc &desc = descriptors[i];
-            MarkValueRoot(trc, desc.pd, "PropDesc::pd");
+            MarkValueRoot(trc, &desc.pd, "PropDesc::pd");
-            MarkValueRoot(trc, desc.value, "PropDesc::value");
+            MarkValueRoot(trc, &desc.value, "PropDesc::value");
-            MarkValueRoot(trc, desc.get, "PropDesc::get");
+            MarkValueRoot(trc, &desc.get, "PropDesc::get");
-            MarkValueRoot(trc, desc.set, "PropDesc::set");
+            MarkValueRoot(trc, &desc.set, "PropDesc::set");
         }
         return;
       }
@@ -1917,7 +1917,7 @@ AutoGCRooter::trace(JSTracer *trc)
         PropertyDescriptor &desc = *static_cast<AutoPropertyDescriptorRooter *>(this);
         if (desc.obj)
             MarkObjectRoot(trc, desc.obj, "Descriptor::obj");
-        MarkValueRoot(trc, desc.value, "Descriptor::value");
+        MarkValueRoot(trc, &desc.value, "Descriptor::value");
         if ((desc.attrs & JSPROP_GETTER) && desc.getter)
             MarkObjectRoot(trc, CastAsObject(desc.getter), "Descriptor::get");
         if (desc.attrs & JSPROP_SETTER && desc.setter)
@@ -1996,26 +1996,6 @@ AutoGCRooter::traceAll(JSTracer *trc)
 
 namespace js {
 
-JS_FRIEND_API(void)
-MarkContext(JSTracer *trc, JSContext *acx)
-{
-    /* Stack frames and slots are traced by StackSpace::mark. */
-
-    /* Mark other roots-by-definition in acx. */
-    if (acx->globalObject && !acx->hasRunOption(JSOPTION_UNROOTED_GLOBAL))
-        MarkObjectRoot(trc, acx->globalObject, "global object");
-    if (acx->isExceptionPending())
-        MarkValueRoot(trc, acx->getPendingException(), "exception");
-
-    if (acx->autoGCRooters)
-        acx->autoGCRooters->traceAll(trc);
-
-    if (acx->sharpObjectMap.depth > 0)
-        js_TraceSharpMap(trc, &acx->sharpObjectMap);
-
-    MarkValueRoot(trc, acx->iterValue, "iterValue");
-}
-
 void
 MarkWeakReferences(GCMarker *gcmarker)
 {
@@ -2053,7 +2033,7 @@ MarkRuntime(JSTracer *trc)
 
     JSContext *iter = NULL;
     while (JSContext *acx = js_ContextIterator(rt, JS_TRUE, &iter))
-        MarkContext(trc, acx);
+        acx->mark(trc);
 
     for (GCCompartmentsIter c(rt); !c.done(); c.next()) {
         if (c->activeAnalysis)

js/src/jsgcmark.cpp

@@ -45,9 +45,6 @@
  * scanning functions, but they don't push onto an explicit stack.
  */
 
-using namespace js;
-using namespace js::gc;
-
 namespace js {
 namespace gc {
 
@@ -147,7 +144,8 @@ MarkRoot(JSTracer *trc, T *thing, const char *name)
 
 template <typename T>
 static void
-MarkRange(JSTracer *trc, size_t len, HeapPtr<T> *vec, const char *name) {
+MarkRange(JSTracer *trc, size_t len, HeapPtr<T> *vec, const char *name)
+{
     for (size_t i = 0; i < len; ++i) {
         if (T *obj = vec[i]) {
             JS_SET_TRACING_INDEX(trc, name, i);
@@ -158,7 +156,8 @@ MarkRange(JSTracer *trc, size_t len, HeapPtr<T> *vec, const char *name) {
 
 template <typename T>
 static void
-MarkRootRange(JSTracer *trc, size_t len, T **vec, const char *name) {
+MarkRootRange(JSTracer *trc, size_t len, T **vec, const char *name)
+{
     for (size_t i = 0; i < len; ++i) {
         JS_SET_TRACING_INDEX(trc, name, i);
         MarkInternal(trc, vec[i]);
@@ -299,43 +298,43 @@ MarkIdRootRange(JSTracer *trc, size_t len, jsid *vec, const char *name)
 /*** Value Marking ***/
 
 static inline void
-MarkValueInternal(JSTracer *trc, const Value &v)
+MarkValueInternal(JSTracer *trc, Value *v)
 {
-    if (v.isMarkable()) {
+    if (v->isMarkable()) {
-        JS_ASSERT(v.toGCThing());
+        JS_ASSERT(v->toGCThing());
-        return MarkKind(trc, v.toGCThing(), v.gcKind());
+        return MarkKind(trc, v->toGCThing(), v->gcKind());
     }
 }
 
 void
-MarkValue(JSTracer *trc, const js::HeapValue &v, const char *name)
+MarkValue(JSTracer *trc, HeapValue *v, const char *name)
+{
+    JS_SET_TRACING_NAME(trc, name);
+    MarkValueInternal(trc, v->unsafeGet());
+}
+
+void
+MarkValueRoot(JSTracer *trc, Value *v, const char *name)
 {
     JS_SET_TRACING_NAME(trc, name);
     MarkValueInternal(trc, v);
 }
 
 void
-MarkValueRoot(JSTracer *trc, const Value &v, const char *name)
+MarkValueRange(JSTracer *trc, size_t len, HeapValue *vec, const char *name)
-{
-    JS_SET_TRACING_NAME(trc, name);
-    MarkValueInternal(trc, v);
-}
-
-void
-MarkValueRange(JSTracer *trc, size_t len, const HeapValue *vec, const char *name)
 {
     for (size_t i = 0; i < len; ++i) {
         JS_SET_TRACING_INDEX(trc, name, i);
-        MarkValueInternal(trc, vec[i]);
+        MarkValueInternal(trc, vec[i].unsafeGet());
     }
 }
 
 void
-MarkValueRootRange(JSTracer *trc, size_t len, const Value *vec, const char *name)
+MarkValueRootRange(JSTracer *trc, size_t len, Value *vec, const char *name)
 {
     for (size_t i = 0; i < len; ++i) {
         JS_SET_TRACING_INDEX(trc, name, i);
-        MarkValueInternal(trc, vec[i]);
+        MarkValueInternal(trc, &vec[i]);
     }
 }
 
@@ -360,17 +359,17 @@ MarkShape(JSTracer *trc, const HeapPtr<const Shape> &thing, const char *name)
 }
 
 void
-MarkValueUnbarriered(JSTracer *trc, const js::Value &v, const char *name)
+MarkValueUnbarriered(JSTracer *trc, Value *v, const char *name)
 {
     JS_SET_TRACING_NAME(trc, name);
     MarkValueInternal(trc, v);
 }
 
 void
-MarkCrossCompartmentValue(JSTracer *trc, const js::HeapValue &v, const char *name)
+MarkCrossCompartmentValue(JSTracer *trc, HeapValue *v, const char *name)
 {
-    if (v.isMarkable()) {
+    if (v->isMarkable()) {
-        js::gc::Cell *cell = (js::gc::Cell *)v.toGCThing();
+        Cell *cell = (Cell *)v->toGCThing();
         JSRuntime *rt = trc->runtime;
         if (rt->gcCurrentCompartment && cell->compartment() != rt->gcCurrentCompartment)
             return;
@@ -643,7 +642,7 @@ MarkChildren(JSTracer *trc, JSObject *obj)
         uint32_t nslots = obj->slotSpan();
         for (uint32_t i = 0; i < nslots; i++) {
             JS_SET_TRACING_DETAILS(trc, js_PrintObjectSlotName, obj, i);
-            MarkValueInternal(trc, obj->nativeGetSlot(i));
+            MarkValueInternal(trc, obj->nativeGetSlotRef(i).unsafeGet());
         }
     }
 }
@@ -672,7 +671,10 @@ MarkChildren(JSTracer *trc, JSScript *script)
     JS_ASSERT_IF(trc->runtime->gcCheckCompartment,
                  script->compartment() == trc->runtime->gcCheckCompartment);
 
-    MarkStringRootRange(trc, script->natoms, script->atoms, "atoms");
+    for (uint32_t i = 0; i < script->natoms; ++i) {
+        if (JSAtom *p = script->atoms[i])
+            MarkStringUnbarriered(trc, p, "atom");
+    }
 
     if (JSScript::isValidOffset(script->objectsOffset)) {
         JSObjectArray *objarray = script->objects();
@@ -851,6 +853,8 @@ MarkChildren(JSTracer *trc, JSXML *xml)
 
 } /* namespace gc */
 
+using namespace js::gc;
+
 inline void
 GCMarker::processMarkStackTop()
 {
@@ -916,7 +920,7 @@ GCMarker::processMarkStackTop()
         types::TypeObject *type = obj->typeFromGC();
         PushMarkStack(this, type);
 
-        js::Shape *shape = obj->lastProperty();
+        Shape *shape = obj->lastProperty();
         PushMarkStack(this, shape);
 
         /* Call the trace hook if necessary. */

js/src/jsgcmark.h

@@ -97,19 +97,19 @@ MarkIdRootRange(JSTracer *trc, size_t len, jsid *vec, const char *name);
 /*** Value Marking ***/
 
 void
-MarkValue(JSTracer *trc, const js::HeapValue &v, const char *name);
+MarkValue(JSTracer *trc, HeapValue *v, const char *name);
 
 void
-MarkValueRange(JSTracer *trc, size_t len, const HeapValue *vec, const char *name);
+MarkValueRange(JSTracer *trc, size_t len, HeapValue *vec, const char *name);
 
 void
-MarkValueRoot(JSTracer *trc, const Value &v, const char *name);
+MarkValueRoot(JSTracer *trc, Value *v, const char *name);
 
 void
-MarkValueRootRange(JSTracer *trc, size_t len, const Value *vec, const char *name);
+MarkValueRootRange(JSTracer *trc, size_t len, Value *vec, const char *name);
 
 inline void
-MarkValueRootRange(JSTracer *trc, const Value *begin, const Value *end, const char *name)
+MarkValueRootRange(JSTracer *trc, Value *begin, Value *end, const char *name)
 {
     MarkValueRootRange(trc, end - begin, begin, name);
 }
@@ -122,14 +122,14 @@ MarkShape(JSTracer *trc, const HeapPtr<const Shape> &thing, const char *name);
 
 /* Direct value access used by the write barriers and the methodjit */
 void
-MarkValueUnbarriered(JSTracer *trc, const js::Value &v, const char *name);
+MarkValueUnbarriered(JSTracer *trc, Value *v, const char *name);
 
 /*
  * Mark a value that may be in a different compartment from the compartment
  * being GC'd. (Although it won't be marked if it's in the wrong compartment.)
  */
 void
-MarkCrossCompartmentValue(JSTracer *trc, const js::HeapValue &v, const char *name);
+MarkCrossCompartmentValue(JSTracer *trc, HeapValue *v, const char *name);
 
 /*
  * MarkChildren<JSObject> is exposed solely for preWriteBarrier on
@@ -153,7 +153,7 @@ MarkCycleCollectorChildren(JSTracer *trc, const Shape *shape);
  */
 
 inline void
-Mark(JSTracer *trc, const js::HeapValue &v, const char *name)
+Mark(JSTracer *trc, HeapValue *v, const char *name)
 {
     MarkValue(trc, v, name);
 }
@@ -171,7 +171,7 @@ Mark(JSTracer *trc, const HeapPtr<JSXML> &xml, const char *name)
 }
 
 inline bool
-IsMarked(const js::Value &v)
+IsMarked(const Value &v)
 {
     if (v.isMarkable())
         return !IsAboutToBeFinalized(v);

js/src/jsnum.cpp

@@ -490,10 +490,9 @@ Number(JSContext *cx, uintN argc, Value *vp)
     if (!isConstructing)
         return true;
 
-    JSObject *obj = NewBuiltinClassInstance(cx, &NumberClass);
+    JSObject *obj = NumberObject::create(cx, vp[0].toNumber());
     if (!obj)
         return false;
-    obj->setPrimitiveThis(vp[0]);
     vp->setObject(*obj);
     return true;
 }

js/src/jsobj.cpp

@@ -203,14 +203,8 @@ obj_setProto(JSContext *cx, JSObject *obj, jsid id, JSBool strict, Value *vp)
 
 #endif /* !JS_HAS_OBJ_PROTO_PROP */
 
-static JSHashNumber
+static bool
-js_hash_object(const void *key)
+MarkSharpObjects(JSContext *cx, JSObject *obj, JSIdArray **idap, JSSharpInfo *value)
-{
-    return JSHashNumber(uintptr_t(key) >> JS_GCTHING_ALIGN);
-}
-
-static JSHashEntry *
-MarkSharpObjects(JSContext *cx, JSObject *obj, JSIdArray **idap)
 {
     JS_CHECK_RECURSION(cx, return NULL);
 
@@ -218,21 +212,15 @@ MarkSharpObjects(JSContext *cx, JSObject *obj, JSIdArray **idap)
 
     JSSharpObjectMap *map = &cx->sharpObjectMap;
     JS_ASSERT(map->depth >= 1);
-    JSHashTable *table = map->table;
+    JSSharpInfo sharpid;
-    JSHashNumber hash = js_hash_object(obj);
+    JSSharpTable::Ptr p = map->table.lookup(obj);
-    JSHashEntry **hep = JS_HashTableRawLookup(table, hash, obj);
+    if (!p) {
-    JSHashEntry *he = *hep;
+        if (!map->table.put(obj, sharpid))
-    if (!he) {
+            return false;
-        jsatomid sharpid = 0;
-        he = JS_HashTableRawAdd(table, hep, hash, obj, (void *) sharpid);
-        if (!he) {
-            JS_ReportOutOfMemory(cx);
-            return NULL;
-        }
 
         ida = JS_Enumerate(cx, obj);
         if (!ida)
-            return NULL;
+            return false;
 
         bool ok = true;
         for (jsint i = 0, length = ida->length; i < length; i++) {
@@ -261,7 +249,7 @@ MarkSharpObjects(JSContext *cx, JSObject *obj, JSIdArray **idap)
             if (hasSetter) {
                 /* Mark the getter, then set val to setter. */
                 if (hasGetter && v.value().isObject()) {
-                    ok = !!MarkSharpObjects(cx, &v.value().toObject(), NULL);
+                    ok = MarkSharpObjects(cx, &v.value().toObject(), NULL, NULL);
                     if (!ok)
                         break;
                 }
@@ -271,7 +259,7 @@ MarkSharpObjects(JSContext *cx, JSObject *obj, JSIdArray **idap)
                 if (!ok)
                     break;
             }
-            if (v.value().isObject() && !MarkSharpObjects(cx, &v.value().toObject(), NULL)) {
+            if (v.value().isObject() && !MarkSharpObjects(cx, &v.value().toObject(), NULL, NULL)) {
                 ok = false;
                 break;
             }
@@ -279,47 +267,42 @@ MarkSharpObjects(JSContext *cx, JSObject *obj, JSIdArray **idap)
         if (!ok || !idap)
             JS_DestroyIdArray(cx, ida);
         if (!ok)
-            return NULL;
+            return false;
     } else {
-        jsatomid sharpid = uintptr_t(he->value);
+        if (!p->value.hasGen && !p->value.isSharp) {
-        if (sharpid == 0) {
+            p->value.hasGen = true;
-            sharpid = ++map->sharpgen << SHARP_ID_SHIFT;
-            he->value = (void *) sharpid;
         }
+        sharpid = p->value;
         ida = NULL;
     }
     if (idap)
         *idap = ida;
-    return he;
+    if (value)
+        *value = sharpid;
+    return true;
 }
 
-JSHashEntry *
+bool
-js_EnterSharpObject(JSContext *cx, JSObject *obj, JSIdArray **idap, bool *alreadySeen)
+js_EnterSharpObject(JSContext *cx, JSObject *obj, JSIdArray **idap, bool *alreadySeen, bool *isSharp)
 {
     if (!JS_CHECK_OPERATION_LIMIT(cx))
-        return NULL;
+        return false;
 
     *alreadySeen = false;
 
     JSSharpObjectMap *map = &cx->sharpObjectMap;
-    JSHashTable *table = map->table;
-    if (!table) {
-        table = JS_NewHashTable(8, js_hash_object, JS_CompareValues,
-                                JS_CompareValues, NULL, NULL);
-        if (!table) {
-            JS_ReportOutOfMemory(cx);
-            return NULL;
-        }
-        map->table = table;
-        JS_KEEP_ATOMS(cx->runtime);
-    }
 
-    JSHashEntry *he;
+    JS_ASSERT_IF(map->depth == 0, map->table.count() == 0);
-    jsatomid sharpid;
+    JS_ASSERT_IF(map->table.count() == 0, map->depth == 0);
+
+    JSSharpTable::Ptr p;
+    JSSharpInfo sharpid;
     JSIdArray *ida = NULL;
 
     /* From this point the control must flow either through out: or bad:. */
     if (map->depth == 0) {
+        JS_KEEP_ATOMS(cx->runtime);
+
         /*
          * Although MarkSharpObjects tries to avoid invoking getters,
          * it ends up doing so anyway under some circumstances; for
@@ -332,21 +315,18 @@ js_EnterSharpObject(JSContext *cx, JSObject *obj, JSIdArray **idap, bool *alread
          * ensure that such a call doesn't free the hash table we're
          * still using.
          */
-        ++map->depth;
+        map->depth = 1;
-        he = MarkSharpObjects(cx, obj, &ida);
+        bool success = MarkSharpObjects(cx, obj, &ida, &sharpid);
-        --map->depth;
+        JS_ASSERT(map->depth == 1);
-        if (!he)
+        map->depth = 0;
+        if (!success)
             goto bad;
-        JS_ASSERT((uintptr_t(he->value) & SHARP_BIT) == 0);
+        JS_ASSERT(!sharpid.isSharp);
         if (!idap) {
             JS_DestroyIdArray(cx, ida);
             ida = NULL;
         }
     } else {
-        JSHashNumber hash = js_hash_object(obj);
-        JSHashEntry **hep = JS_HashTableRawLookup(table, hash, obj);
-        he = *hep;
-
         /*
          * It's possible that the value of a property has changed from the
          * first time the object's properties are traversed (when the property
@@ -354,24 +334,20 @@ js_EnterSharpObject(JSContext *cx, JSObject *obj, JSIdArray **idap, bool *alread
          * converted to strings), i.e., the JSObject::getProperty() call is not
          * idempotent.
          */
-        if (!he) {
+        p = map->table.lookup(obj);
-            he = JS_HashTableRawAdd(table, hep, hash, obj, NULL);
+        if (!p) {
-            if (!he) {
+            if (!map->table.put(obj, sharpid))
-                JS_ReportOutOfMemory(cx);
                 goto bad;
-            }
-            sharpid = 0;
             goto out;
         }
+        sharpid = p->value;
     }
 
-    sharpid = uintptr_t(he->value);
+    if (sharpid.isSharp || sharpid.hasGen)
-    if (sharpid != 0)
         *alreadySeen = true;
 
 out:
-    JS_ASSERT(he);
+    if (!sharpid.isSharp) {
-    if ((sharpid & SHARP_BIT) == 0) {
         if (idap && !ida) {
             ida = JS_Enumerate(cx, obj);
             if (!ida)
@@ -382,17 +358,17 @@ out:
 
     if (idap)
         *idap = ida;
-    return he;
+    *isSharp = sharpid.isSharp;
+    return true;
 
 bad:
     /* Clean up the sharpObjectMap table on outermost error. */
     if (map->depth == 0) {
         JS_UNKEEP_ATOMS(cx->runtime);
         map->sharpgen = 0;
-        JS_HashTableDestroy(map->table);
+        map->table.clear();
-        map->table = NULL;
     }
-    return NULL;
+    return false;
 }
 
 void
@@ -403,8 +379,7 @@ js_LeaveSharpObject(JSContext *cx, JSIdArray **idap)
     if (--map->depth == 0) {
         JS_UNKEEP_ATOMS(cx->runtime);
         map->sharpgen = 0;
-        JS_HashTableDestroy(map->table);
+        map->table.clear();
-        map->table = NULL;
     }
     if (idap) {
         if (JSIdArray *ida = *idap) {
@@ -414,18 +389,10 @@ js_LeaveSharpObject(JSContext *cx, JSIdArray **idap)
     }
 }
 
-static intN
-gc_sharp_table_entry_marker(JSHashEntry *he, intN i, void *arg)
-{
-    MarkObjectRoot((JSTracer *)arg, (JSObject *)he->key, "sharp table entry");
-    return JS_DHASH_NEXT;
-}
-
 void
 js_TraceSharpMap(JSTracer *trc, JSSharpObjectMap *map)
 {
     JS_ASSERT(map->depth > 0);
-    JS_ASSERT(map->table);
 
     /*
      * During recursive calls to MarkSharpObjects a non-native object or
@@ -447,7 +414,8 @@ js_TraceSharpMap(JSTracer *trc, JSSharpObjectMap *map)
      * with otherwise unreachable objects. But this is way too complex
      * to justify spending efforts.
      */
-    JS_HashTableEnumerateEntries(map->table, gc_sharp_table_entry_marker, trc);
+    for (JSSharpTable::Range r = map->table.all(); !r.empty(); r.popFront())
+        MarkObjectRoot(trc, r.front().key, "sharp table entry");
 }
 
 #if JS_HAS_TOSOURCE
@@ -475,8 +443,8 @@ obj_toSource(JSContext *cx, uintN argc, Value *vp)
 
     JSIdArray *ida;
     bool alreadySeen = false;
-    JSHashEntry *he = js_EnterSharpObject(cx, obj, &ida, &alreadySeen);
+    bool isSharp = false;
-    if (!he)
+    if (!js_EnterSharpObject(cx, obj, &ida, &alreadySeen, &isSharp))
         return false;
 
     if (!ida) {
@@ -491,10 +459,14 @@ obj_toSource(JSContext *cx, uintN argc, Value *vp)
         vp->setString(str);
         return true;
     }
-    JS_ASSERT(!IS_SHARP(he));
 
-    if (alreadySeen)
+    JS_ASSERT(!isSharp);
-        MAKE_SHARP(he);
+    if (alreadySeen) {
+        JSSharpTable::Ptr p = cx->sharpObjectMap.table.lookup(obj);
+        JS_ASSERT(p);
+        JS_ASSERT(!p->value.isSharp);
+        p->value.isSharp = true;
+    }
 
     /* Automatically call js_LeaveSharpObject when we leave this frame. */
     class AutoLeaveSharpObject {
@@ -537,7 +509,6 @@ obj_toSource(JSContext *cx, uintN argc, Value *vp)
         JSString *s = ToString(cx, IdToValue(id));
         if (!s || !(idstr = s->ensureLinear(cx)))
             return false;
-        vp->setString(idstr);                           /* local root */
 
         int valcnt = 0;
         if (prop) {
@@ -576,7 +547,6 @@ obj_toSource(JSContext *cx, uintN argc, Value *vp)
             s = js_QuoteString(cx, idstr, jschar('\''));
             if (!s || !(idstr = s->ensureLinear(cx)))
                 return false;
-            vp->setString(idstr);                       /* local root */
         }
 
         for (int j = 0; j < valcnt; j++) {
@@ -3525,6 +3495,11 @@ JSObject::TradeGuts(JSContext *cx, JSObject *a, JSObject *b, TradeGutsReserved &
     types::TypeObject::writeBarrierPost(a->type_, &a->type_);
     types::TypeObject::writeBarrierPost(b->type_, &b->type_);
 #endif
+
+    if (a->inDictionaryMode())
+        a->lastProperty()->listp = &a->shape_;
+    if (b->inDictionaryMode())
+        b->lastProperty()->listp = &b->shape_;
 }
 
 /*
@@ -3595,7 +3570,7 @@ DefineStandardSlot(JSContext *cx, JSObject *obj, JSProtoKey key, JSAtom *atom,
         const Shape *shape = obj->nativeLookup(cx, id);
         if (!shape) {
             uint32_t slot = 2 * JSProto_LIMIT + key;
-            SetReservedSlot(obj, slot, v);
+            obj->setReservedSlot(slot, v);
             if (!obj->addProperty(cx, id, JS_PropertyStub, JS_StrictPropertyStub, slot, attrs, 0, 0))
                 return false;
             AddTypePropertyId(cx, obj, id, v);
@@ -3618,8 +3593,8 @@ SetClassObject(JSObject *obj, JSProtoKey key, JSObject *cobj, JSObject *proto)
     if (!obj->isGlobal())
         return;
 
-    SetReservedSlot(obj, key, ObjectOrNullValue(cobj));
+    obj->setReservedSlot(key, ObjectOrNullValue(cobj));
-    SetReservedSlot(obj, JSProto_LIMIT + key, ObjectOrNullValue(proto));
+    obj->setReservedSlot(JSProto_LIMIT + key, ObjectOrNullValue(proto));
 }
 
 static void
@@ -5887,7 +5862,7 @@ DefaultValue(JSContext *cx, JSObject *obj, JSType hint, Value *vp)
                                  &StringClass,
                                  ATOM_TO_JSID(cx->runtime->atomState.toStringAtom),
                                  js_str_toString)) {
-            *vp = obj->getPrimitiveThis();
+            *vp = StringValue(obj->asString().unbox());
             return true;
         }
 
@@ -5910,7 +5885,9 @@ DefaultValue(JSContext *cx, JSObject *obj, JSType hint, Value *vp)
              ClassMethodIsNative(cx, obj, &NumberClass,
                                  ATOM_TO_JSID(cx->runtime->atomState.valueOfAtom),
                                  js_num_valueOf))) {
-            *vp = obj->getPrimitiveThis();
+            *vp = obj->isString()
+                  ? StringValue(obj->asString().unbox())
+                  : NumberValue(obj->asNumber().unbox());
             return true;
         }
 

js/src/jsobj.h

@@ -998,22 +998,6 @@ struct JSObject : js::gc::Cell
     bool isSealed(JSContext *cx, bool *resultp) { return isSealedOrFrozen(cx, SEAL, resultp); }
     bool isFrozen(JSContext *cx, bool *resultp) { return isSealedOrFrozen(cx, FREEZE, resultp); }
 
-    /*
-     * Primitive-specific getters and setters.
-     */
-
-  private:
-    static const uint32_t JSSLOT_PRIMITIVE_THIS = 0;
-
-  public:
-    inline const js::Value &getPrimitiveThis() const;
-    inline void setPrimitiveThis(const js::Value &pthis);
-
-    static size_t getPrimitiveThisOffset() {
-        /* All primitive objects have their value in a fixed slot. */
-        return getFixedSlotOffset(JSSLOT_PRIMITIVE_THIS);
-    }
-
     /* Accessors for elements. */
 
     js::ObjectElements *getElementsHeader() const {
@@ -1365,8 +1349,6 @@ struct JSObject : js::gc::Cell
 
     static bool thisObject(JSContext *cx, const js::Value &v, js::Value *vp);
 
-    inline JSObject *getThrowTypeError() const;
-
     bool swap(JSContext *cx, JSObject *other);
 
     inline void initArrayClass();
@@ -1554,13 +1536,8 @@ class ValueArray {
 };
 
 /* For manipulating JSContext::sharpObjectMap. */
-#define SHARP_BIT       ((jsatomid) 1)
+extern bool
-#define SHARP_ID_SHIFT  2
+js_EnterSharpObject(JSContext *cx, JSObject *obj, JSIdArray **idap, bool *alreadySeen, bool *isSharp);
-#define IS_SHARP(he)    (uintptr_t((he)->value) & SHARP_BIT)
-#define MAKE_SHARP(he)  ((he)->value = (void *) (uintptr_t((he)->value)|SHARP_BIT))
-
-extern JSHashEntry *
-js_EnterSharpObject(JSContext *cx, JSObject *obj, JSIdArray **idap, bool *alreadySeen);
 
 extern void
 js_LeaveSharpObject(JSContext *cx, JSIdArray **idap);

js/src/jsobjinlines.h

@@ -65,8 +65,12 @@
 
 #include "gc/Barrier.h"
 #include "js/TemplateLib.h"
+
+#include "vm/BooleanObject.h"
 #include "vm/GlobalObject.h"
+#include "vm/NumberObject.h"
 #include "vm/RegExpStatics.h"
+#include "vm/StringObject.h"
 
 #include "jsatominlines.h"
 #include "jsfuninlines.h"
@@ -436,20 +440,6 @@ JSObject::setReservedSlot(uintN index, const js::Value &v)
     setSlot(index, v);
 }
 
-inline const js::Value &
-JSObject::getPrimitiveThis() const
-{
-    JS_ASSERT(isPrimitive());
-    return getFixedSlot(JSSLOT_PRIMITIVE_THIS);
-}
-
-inline void
-JSObject::setPrimitiveThis(const js::Value &pthis)
-{
-    JS_ASSERT(isPrimitive());
-    setFixedSlot(JSSLOT_PRIMITIVE_THIS, pthis);
-}
-
 inline bool
 JSObject::hasContiguousSlots(size_t start, size_t count) const
 {
@@ -1916,6 +1906,7 @@ class PrimitiveBehavior<JSString *> {
   public:
     static inline bool isType(const Value &v) { return v.isString(); }
     static inline JSString *extract(const Value &v) { return v.toString(); }
+    static inline JSString *extract(JSObject &obj) { return obj.asString().unbox(); }
     static inline Class *getClass() { return &StringClass; }
 };
 
@@ -1924,6 +1915,7 @@ class PrimitiveBehavior<bool> {
   public:
     static inline bool isType(const Value &v) { return v.isBoolean(); }
     static inline bool extract(const Value &v) { return v.toBoolean(); }
+    static inline bool extract(JSObject &obj) { return obj.asBoolean().unbox(); }
     static inline Class *getClass() { return &BooleanClass; }
 };
 
@@ -1932,6 +1924,7 @@ class PrimitiveBehavior<double> {
   public:
     static inline bool isType(const Value &v) { return v.isNumber(); }
     static inline double extract(const Value &v) { return v.toNumber(); }
+    static inline double extract(JSObject &obj) { return obj.asNumber().unbox(); }
     static inline Class *getClass() { return &NumberClass; }
 };
 
@@ -1968,7 +1961,7 @@ BoxedPrimitiveMethodGuard(JSContext *cx, CallArgs args, Native native, T *v, boo
     if (!NonGenericMethodGuard(cx, args, native, Behavior::getClass(), ok))
         return false;
 
-    *v = Behavior::extract(thisv.toObject().getPrimitiveThis());
+    *v = Behavior::extract(thisv.toObject());
     return true;
 }
 

js/src/jsproxy.cpp

@@ -57,7 +57,7 @@
 using namespace js;
 using namespace js::gc;
 
-static inline const HeapValue &
+static inline HeapValue &
 GetCall(JSObject *proxy)
 {
     JS_ASSERT(IsFunctionProxy(proxy));
@@ -72,7 +72,7 @@ GetConstruct(JSObject *proxy)
     return proxy->getSlot(JSSLOT_PROXY_CONSTRUCT);
 }
 
-static inline const HeapValue &
+static inline HeapValue &
 GetFunctionProxyConstruct(JSObject *proxy)
 {
     JS_ASSERT(IsFunctionProxy(proxy));
@@ -92,6 +92,9 @@ OperationInProgress(JSContext *cx, JSObject *proxy)
     return false;
 }
 
+static bool
+FixProxy(JSContext *cx, JSObject *proxy, JSBool *bp);
+
 ProxyHandler::ProxyHandler(void *family) : mFamily(family)
 {
 }
@@ -1243,12 +1246,12 @@ static void
 proxy_TraceObject(JSTracer *trc, JSObject *obj)
 {
     GetProxyHandler(obj)->trace(trc, obj);
-    MarkCrossCompartmentValue(trc, obj->getReservedSlotRef(JSSLOT_PROXY_PRIVATE), "private");
+    MarkCrossCompartmentValue(trc, &obj->getReservedSlotRef(JSSLOT_PROXY_PRIVATE), "private");
-    MarkCrossCompartmentValue(trc, obj->getReservedSlotRef(JSSLOT_PROXY_EXTRA + 0), "extra0");
+    MarkCrossCompartmentValue(trc, &obj->getReservedSlotRef(JSSLOT_PROXY_EXTRA + 0), "extra0");
-    MarkCrossCompartmentValue(trc, obj->getReservedSlotRef(JSSLOT_PROXY_EXTRA + 1), "extra1");
+    MarkCrossCompartmentValue(trc, &obj->getReservedSlotRef(JSSLOT_PROXY_EXTRA + 1), "extra1");
     if (IsFunctionProxy(obj)) {
-        MarkCrossCompartmentValue(trc, GetCall(obj), "call");
+        MarkCrossCompartmentValue(trc, &GetCall(obj), "call");
-        MarkCrossCompartmentValue(trc, GetFunctionProxyConstruct(obj), "construct");
+        MarkCrossCompartmentValue(trc, &GetFunctionProxyConstruct(obj), "construct");
     }
 }
 
@@ -1256,8 +1259,8 @@ static void
 proxy_TraceFunction(JSTracer *trc, JSObject *obj)
 {
     proxy_TraceObject(trc, obj);
-    MarkCrossCompartmentValue(trc, GetCall(obj), "call");
+    MarkCrossCompartmentValue(trc, &GetCall(obj), "call");
-    MarkCrossCompartmentValue(trc, GetFunctionProxyConstruct(obj), "construct");
+    MarkCrossCompartmentValue(trc, &GetFunctionProxyConstruct(obj), "construct");
 }
 
 static JSBool
@@ -1735,8 +1738,8 @@ Class js::CallableObjectClass = {
     callable_Construct,
 };
 
-JS_FRIEND_API(JSBool)
+static bool
-js::FixProxy(JSContext *cx, JSObject *proxy, JSBool *bp)
+FixProxy(JSContext *cx, JSObject *proxy, JSBool *bp)
 {
     if (OperationInProgress(cx, proxy)) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_BAD_PROXY_FIX);

js/src/jsproxy.h

@@ -183,13 +183,6 @@ GetProxyPrivate(const JSObject *obj)
     return GetReservedSlot(obj, JSSLOT_PROXY_PRIVATE);
 }
 
-inline void
-SetProxyPrivate(JSObject *obj, const Value &priv)
-{
-    JS_ASSERT(IsProxy(obj));
-    SetReservedSlot(obj, JSSLOT_PROXY_PRIVATE, priv);
-}
-
 inline const Value &
 GetProxyExtra(const JSObject *obj, size_t n)
 {
@@ -210,9 +203,6 @@ NewProxyObject(JSContext *cx, ProxyHandler *handler, const Value &priv,
                JSObject *proto, JSObject *parent,
                JSObject *call = NULL, JSObject *construct = NULL);
 
-JS_FRIEND_API(JSBool)
-FixProxy(JSContext *cx, JSObject *proxy, JSBool *bp);
-
 } /* namespace js */
 
 JS_BEGIN_EXTERN_C

js/src/jsscript.cpp

@@ -1903,6 +1903,6 @@ JSScript::markTrapClosures(JSTracer *trc)
     for (unsigned i = 0; i < length; i++) {
         BreakpointSite *site = debug->breakpoints[i];
         if (site && site->trapHandler)
-            MarkValue(trc, site->trapClosure, "trap closure");
+            MarkValue(trc, &site->trapClosure, "trap closure");
     }
 }

js/src/jsstr.cpp

@@ -399,7 +399,7 @@ static const uintN STRING_ELEMENT_ATTRS = JSPROP_ENUMERATE | JSPROP_READONLY | J
 static JSBool
 str_enumerate(JSContext *cx, JSObject *obj)
 {
-    JSString *str = obj->getPrimitiveThis().toString();
+    JSString *str = obj->asString().unbox();
     for (size_t i = 0, length = str->length(); i < length; i++) {
         JSString *str1 = js_NewDependentString(cx, str, i, 1);
         if (!str1)
@@ -421,7 +421,7 @@ str_resolve(JSContext *cx, JSObject *obj, jsid id, uintN flags,
     if (!JSID_IS_INT(id))
         return JS_TRUE;
 
-    JSString *str = obj->getPrimitiveThis().toString();
+    JSString *str = obj->asString().unbox();
 
     jsint slot = JSID_TO_INT(id);
     if ((size_t)slot < str->length()) {
@@ -472,8 +472,9 @@ ThisToStringForStringProto(JSContext *cx, CallReceiver call)
                                 ATOM_TO_JSID(cx->runtime->atomState.toStringAtom),
                                 js_str_toString))
         {
-            call.thisv() = obj->getPrimitiveThis();
+            JSString *str = obj->asString().unbox();
-            return call.thisv().toString();
+            call.thisv().setString(str);
+            return str;
         }
     } else if (call.thisv().isNullOrUndefined()) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_CANT_CONVERT_TO,

js/src/jstypedarray.cpp

@@ -1097,7 +1097,7 @@ class TypedArrayTemplate
     static void
     obj_trace(JSTracer *trc, JSObject *obj)
     {
-        MarkValue(trc, obj->getFixedSlotRef(FIELD_BUFFER), "typedarray.buffer");
+        MarkValue(trc, &obj->getFixedSlotRef(FIELD_BUFFER), "typedarray.buffer");
     }
 
     static JSBool

js/src/jsweakmap.h

@@ -91,7 +91,7 @@ namespace js {
 //     bool isMarked(const Type &x)
 //        Return true if x has been marked as live by the garbage collector.
 //
-//     bool mark(const Type &x)
+//     bool mark(Type &x)
 //        Return false if x is already marked. Otherwise, mark x and return true.
 //
 //   If omitted, the MarkPolicy parameter defaults to js::DefaultMarkPolicy<Type>,
@@ -213,7 +213,7 @@ class WeakMap : public HashMap<Key, Value, HashPolicy, RuntimeAllocPolicy>, publ
         bool markedAny = false;
         for (Range r = Base::all(); !r.empty(); r.popFront()) {
             const Key &k = r.front().key;
-            const Value &v = r.front().value;
+            Value &v = r.front().value;
             /* If the entry is live, ensure its key and value are marked. */
             if (kp.isMarked(k)) {
                 markedAny |= vp.mark(v);
@@ -264,10 +264,10 @@ class DefaultMarkPolicy<HeapValue> {
             return !IsAboutToBeFinalized(x);
         return true;
     }
-    bool mark(const HeapValue &x) {
+    bool mark(HeapValue &x) {
         if (isMarked(x))
             return false;
-        js::gc::MarkValue(tracer, x, "WeakMap entry");
+        js::gc::MarkValue(tracer, &x, "WeakMap entry");
         return true;
     }
 };
@@ -281,7 +281,7 @@ class DefaultMarkPolicy<HeapPtrObject> {
     bool isMarked(const HeapPtrObject &x) {
         return !IsAboutToBeFinalized(x);
     }
-    bool mark(const HeapPtrObject &x) {
+    bool mark(HeapPtrObject &x) {
         if (isMarked(x))
             return false;
         js::gc::MarkObject(tracer, x, "WeakMap entry");
@@ -298,7 +298,7 @@ class DefaultMarkPolicy<HeapPtrScript> {
     bool isMarked(const HeapPtrScript &x) {
         return !IsAboutToBeFinalized(x);
     }
-    bool mark(const HeapPtrScript &x) {
+    bool mark(HeapPtrScript &x) {
         if (isMarked(x))
             return false;
         js::gc::MarkScript(tracer, x, "WeakMap entry");

js/src/jswrapper.cpp

@@ -367,7 +367,7 @@ Wrapper::iteratorNext(JSContext *cx, JSObject *wrapper, Value *vp)
 void
 Wrapper::trace(JSTracer *trc, JSObject *wrapper)
 {
-    MarkValue(trc, wrapper->getReservedSlotRef(JSSLOT_PROXY_PRIVATE), "wrappedObject");
+    MarkValue(trc, &wrapper->getReservedSlotRef(JSSLOT_PROXY_PRIVATE), "wrappedObject");
 }
 
 JSObject *
@@ -875,7 +875,7 @@ CrossCompartmentWrapper::iteratorNext(JSContext *cx, JSObject *wrapper, Value *v
 void
 CrossCompartmentWrapper::trace(JSTracer *trc, JSObject *wrapper)
 {
-    MarkCrossCompartmentValue(trc, wrapper->getReservedSlotRef(JSSLOT_PROXY_PRIVATE),
+    MarkCrossCompartmentValue(trc, &wrapper->getReservedSlotRef(JSSLOT_PROXY_PRIVATE),
                               "wrappedObject");
 }
 

js/src/methodjit/Compiler.cpp

@@ -177,6 +177,11 @@ mjit::Compiler::checkAnalysis(JSScript *script)
         return Compile_Abort;
     }
 
+    if (JSOp(*script->code) == JSOP_GENERATOR) {
+        JaegerSpew(JSpew_Abort, "script is a generator\n");
+        return Compile_Abort;
+    }
+
     if (!script->ensureRanAnalysis(cx, NULL))
         return Compile_Error;
     if (cx->typeInferenceEnabled() && !script->ensureRanInference(cx))

js/src/methodjit/PolyIC.cpp

@@ -53,6 +53,7 @@
 #include "jsautooplen.h"
 
 #include "vm/ScopeObject-inl.h"
+#include "vm/StringObject-inl.h"
 
 #if defined JS_POLYIC
 
@@ -944,7 +945,7 @@ class GetPropCompiler : public PICStubCompiler
 
         Jump notStringObj = masm.guardShape(pic.objReg, obj);
 
-        masm.loadPayload(Address(pic.objReg, JSObject::getPrimitiveThisOffset()), pic.objReg);
+        masm.loadPayload(Address(pic.objReg, StringObject::getPrimitiveValueOffset()), pic.objReg);
         masm.loadPtr(Address(pic.objReg, JSString::offsetOfLengthAndFlags()), pic.objReg);
         masm.urshift32(Imm32(JSString::LENGTH_SHIFT), pic.objReg);
         masm.move(ImmType(JSVAL_TYPE_INT32), pic.shapeReg);
@@ -1885,7 +1886,7 @@ GetPropMaybeCached(VMFrame &f, ic::PICInfo *pic, bool cached)
                     LookupStatus status = cc.generateStringObjLengthStub();
                     if (status == Lookup_Error)
                         THROW();
-                    JSString *str = obj->getPrimitiveThis().toString();
+                    JSString *str = obj->asString().unbox();
                     f.regs.sp[-1].setInt32(str->length());
                 }
                 return;

js/src/methodjit/StubCalls.cpp

@@ -1963,7 +1963,7 @@ stubs::ConvertToTypedFloat(JSContext *cx, Value *vp)
 void JS_FASTCALL
 stubs::WriteBarrier(VMFrame &f, Value *addr)
 {
-    js::gc::MarkValueUnbarriered(f.cx->compartment->barrierTracer(), *addr, "write barrier");
+    gc::MarkValueUnbarriered(f.cx->compartment->barrierTracer(), addr, "write barrier");
 }
 
 void JS_FASTCALL
@@ -1971,5 +1971,5 @@ stubs::GCThingWriteBarrier(VMFrame &f, Value *addr)
 {
     gc::Cell *cell = (gc::Cell *)addr->toGCThing();
     if (cell && !cell->isMarked())
-        gc::MarkValueUnbarriered(f.cx->compartment->barrierTracer(), *addr, "write barrier");
+        gc::MarkValueUnbarriered(f.cx->compartment->barrierTracer(), addr, "write barrier");
 }

js/src/vm/BooleanObject.h

@@ -67,14 +67,13 @@ class BooleanObject : public JSObject
      */
     static inline BooleanObject *createWithProto(JSContext *cx, bool b, JSObject &proto);
 
-    Value unbox() const {
+    bool unbox() const {
-        JS_ASSERT(getSlot(PRIMITIVE_VALUE_SLOT).isBoolean());
+        return getFixedSlot(PRIMITIVE_VALUE_SLOT).toBoolean();
-        return getSlot(PRIMITIVE_VALUE_SLOT);
     }
 
   private:
     inline void setPrimitiveValue(bool b) {
-        setSlot(PRIMITIVE_VALUE_SLOT, BooleanValue(b));
+        setFixedSlot(PRIMITIVE_VALUE_SLOT, BooleanValue(b));
     }
 
     /* For access to init, as Boolean.prototype is special. */

js/src/vm/NumberObject.h

@@ -67,14 +67,13 @@ class NumberObject : public JSObject
      */
     static inline NumberObject *createWithProto(JSContext *cx, jsdouble d, JSObject &proto);
 
-    Value unbox() const {
+    double unbox() const {
-        JS_ASSERT(getSlot(PRIMITIVE_VALUE_SLOT).isNumber());
+        return getFixedSlot(PRIMITIVE_VALUE_SLOT).toNumber();
-        return getSlot(PRIMITIVE_VALUE_SLOT);
     }
 
   private:
     inline void setPrimitiveValue(jsdouble d) {
-        setSlot(PRIMITIVE_VALUE_SLOT, NumberValue(d));
+        setFixedSlot(PRIMITIVE_VALUE_SLOT, NumberValue(d));
     }
 
     /* For access to init, as Number.prototype is special. */

js/src/vm/Stack.cpp

@@ -275,7 +275,7 @@ StackFrame::mark(JSTracer *trc)
     }
     if (IS_GC_MARKING_TRACER(trc))
         script()->compartment()->active = true;
-    gc::MarkValueUnbarriered(trc, returnValue(), "rval");
+    gc::MarkValueUnbarriered(trc, &returnValue(), "rval");
 }
 
 /*****************************************************************************/
@@ -485,7 +485,7 @@ StackSpace::markFrameSlots(JSTracer *trc, StackFrame *fp, Value *slotsEnd, jsbyt
 
         /* Will this slot be synced by the JIT? */
         if (!analysis->trackSlot(slot) || analysis->liveness(slot).live(offset))
-            gc::MarkValueRoot(trc, *vp, "vm_stack");
+            gc::MarkValueRoot(trc, vp, "vm_stack");
         else
             *vp = UndefinedValue();
     }

js/src/vm/Stack.h

@@ -999,7 +999,7 @@ class StackFrame
         return !!(flags_ & HAS_RVAL);
     }
 
-    const Value &returnValue() {
+    Value &returnValue() {
         if (!(flags_ & HAS_RVAL))
             rval_.setUndefined();
         return rval_;

js/src/vm/StringObject.h

@@ -50,7 +50,7 @@ namespace js {
 
 class StringObject : public JSObject
 {
-    static const uintN PRIMITIVE_THIS_SLOT = 0;
+    static const uintN PRIMITIVE_VALUE_SLOT = 0;
     static const uintN LENGTH_SLOT = 1;
 
   public:
@@ -69,20 +69,24 @@ class StringObject : public JSObject
     static inline StringObject *createWithProto(JSContext *cx, JSString *str, JSObject &proto);
 
     JSString *unbox() const {
-        return getSlot(PRIMITIVE_THIS_SLOT).toString();
+        return getFixedSlot(PRIMITIVE_VALUE_SLOT).toString();
     }
 
     inline size_t length() const {
-        return size_t(getSlot(LENGTH_SLOT).toInt32());
+        return size_t(getFixedSlot(LENGTH_SLOT).toInt32());
+    }
+
+    static size_t getPrimitiveValueOffset() {
+        return getFixedSlotOffset(PRIMITIVE_VALUE_SLOT);
     }
 
   private:
     inline bool init(JSContext *cx, JSString *str);
 
     void setStringThis(JSString *str) {
-        JS_ASSERT(getSlot(PRIMITIVE_THIS_SLOT).isUndefined());
+        JS_ASSERT(getReservedSlot(PRIMITIVE_VALUE_SLOT).isUndefined());
-        setSlot(PRIMITIVE_THIS_SLOT, StringValue(str));
+        setFixedSlot(PRIMITIVE_VALUE_SLOT, StringValue(str));
-        setSlot(LENGTH_SLOT, Int32Value(int32_t(str->length())));
+        setFixedSlot(LENGTH_SLOT, Int32Value(int32_t(str->length())));
     }
 
     /* For access to init, as String.prototype is special. */

js/xpconnect/src/XPCQuickStubs.h

@@ -539,8 +539,8 @@ castNativeFromWrapper(JSContext *cx,
 
     NS_ASSERTION(IS_WRAPPER_CLASS(js::GetObjectClass(cur)), "Not a wrapper?");
 
-    XPCNativeScriptableSharedJSClass *clasp =
+    XPCWrappedNativeJSClass *clasp =
-      (XPCNativeScriptableSharedJSClass*)js::GetObjectClass(cur);
+      (XPCWrappedNativeJSClass*)js::GetObjectClass(cur);
     if (!(clasp->interfacesBitmap & (1 << interfaceBit)))
         return nsnull;
 

js/xpconnect/src/XPCWrappedNative.cpp

@@ -1091,7 +1091,7 @@ XPCWrappedNative::Init(XPCCallContext& ccx,
 
     // create our flatJSObject
 
-    JSClass* jsclazz = si ? si->GetJSClass() : Jsvalify(&XPC_WN_NoHelper_JSClass);
+    JSClass* jsclazz = si ? si->GetJSClass() : Jsvalify(&XPC_WN_NoHelper_JSClass.base);
 
     if (isGlobal) {
         // Resolving a global object's class can cause us to create a global's