Merge the last green changeset of mozilla-inbound to mozilla-central

browser/base/content/nsContextMenu.js

@@ -1036,7 +1036,7 @@ nsContextMenu.prototype = {
     MailIntegration.sendMessage( this.linkURL, "" );
   },
 
-  // Backwards-compatability wrapper
+  // Backwards-compatibility wrapper
   saveImage : function() {
     if (this.onCanvas || this.onImage)
         this.saveMedia();
@@ -1062,7 +1062,7 @@ nsContextMenu.prototype = {
     }
   },
 
-  // Backwards-compatability wrapper
+  // Backwards-compatibility wrapper
   sendImage : function() {
     if (this.onCanvas || this.onImage)
         this.sendMedia();

browser/base/content/test/browser_sanitize-download-history.js

@@ -73,7 +73,7 @@ function test()
     // Add download to DB
     let file = Cc["@mozilla.org/file/directory_service;1"].
                getService(Ci.nsIProperties).get("TmpD", Ci.nsIFile);
-    file.append("satitize-dm-test.file");
+    file.append("sanitize-dm-test.file");
     file.createUnique(Ci.nsIFile.NORMAL_FILE_TYPE, 0666);
     let testPath = Services.io.newFileURI(file).spec;
     let data = {

content/html/content/src/nsHTMLFrameSetElement.cpp

@@ -322,7 +322,7 @@ nsHTMLFrameSetElement::ParseRowCol(const nsAString & aValue,
         }
       }
         
-      // Catch zero and negative frame sizes for Nav compatability
+      // Catch zero and negative frame sizes for Nav compatibility
       // Nav resized absolute and relative frames to "1" and
       // percent frames to an even percentage of the width
       //

content/media/ogg/nsOggCodecState.cpp

@@ -397,7 +397,7 @@ nsTheoraState::PageIn(ogg_page* aPage)
 }
 
 // Returns 1 if the Theora info struct is decoding a media of Theora
-// verion (maj,min,sub) or later, otherwise returns 0.
+// version (maj,min,sub) or later, otherwise returns 0.
 int
 TheoraVersion(th_info* info,
               unsigned char maj,

content/media/ogg/nsOggCodecState.h

@@ -273,7 +273,7 @@ public:
 };
 
 // Returns 1 if the Theora info struct is decoding a media of Theora
-// verion (maj,min,sub) or later, otherwise returns 0.
+// version (maj,min,sub) or later, otherwise returns 0.
 int TheoraVersion(th_info* info,
                   unsigned char maj,
                   unsigned char min,

dom/base/nsDOMClassInfo.cpp

@@ -526,6 +526,7 @@ static const char kDOMStringBundleURL[] =
 
 #define NODE_SCRIPTABLE_FLAGS                                                 \
  ((DOM_DEFAULT_SCRIPTABLE_FLAGS |                                             \
+   nsIXPCScriptable::USE_STUB_EQUALITY_HOOK |                                 \
    nsIXPCScriptable::WANT_GETPROPERTY |                                       \
    nsIXPCScriptable::WANT_ADDPROPERTY |                                       \
    nsIXPCScriptable::WANT_SETPROPERTY) &                                      \
@@ -6385,19 +6386,30 @@ LocationSetterGuts(JSContext *cx, JSObject *obj, jsval *vp)
   nsresult rv = xpcomObj->GetLocation(getter_AddRefs(location));
   NS_ENSURE_SUCCESS(rv, rv);
 
+  // Grab the value we're being set to before we stomp on |vp|
   JSString *val = ::JS_ValueToString(cx, *vp);
   NS_ENSURE_TRUE(val, NS_ERROR_UNEXPECTED);
 
+  // Make sure |val| stays alive below
+  JS::Anchor<JSString *> anchor(val);
+
+  // We have to wrap location into vp before null-checking location, to
+  // avoid assigning the wrong thing into the slot.
+  nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
+  rv = WrapNative(cx, JS_GetGlobalForScopeChain(cx), location,
+                  &NS_GET_IID(nsIDOMLocation), PR_TRUE, vp,
+                  getter_AddRefs(holder));
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (!location) {
+    // Make this a no-op
+    return NS_OK;
+  }
+
   nsDependentJSString depStr;
   NS_ENSURE_TRUE(depStr.init(cx, val), NS_ERROR_UNEXPECTED);
   
-  rv = location->SetHref(depStr);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
-  return WrapNative(cx, JS_GetGlobalForScopeChain(cx), location,
-                    &NS_GET_IID(nsIDOMLocation), PR_TRUE, vp,
-                    getter_AddRefs(holder));
+  return location->SetHref(depStr);
 }
 
 template<class Interface>

dom/tests/mochitest/bugs/Makefile.in

@@ -141,6 +141,7 @@ _TEST_FILES	= \
 		test_bug642026.html \
 		test_bug648465.html \
 		test_bug654137.html \
+		test_bug684544.html \
 		test_window_bar.html \
 		file_window_bar.html \
 		test_resize_move_windows.html \

dom/tests/mochitest/bugs/test_bug684544.html

@@ -0,0 +1,48 @@
+<!DOCTYPE HTML>
+<html>
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=
+-->
+<head>
+  <title>Test for Bug </title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=">Mozilla Bug </a>
+<p id="display"></p>
+<div id="content" style="display: none">
+  
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for Bug  **/
+
+var f = document.createElement("iframe");
+document.body.appendChild(f);
+var win = f.contentWindow;
+
+// Set location once to make sure it's resolved
+win.location = "data:text/html,1";
+
+// Now try to make the location object go away.
+f.parentNode.removeChild(f);
+
+// Check that location is now null.  If it's not, the test needs changing
+// (e.g. to use window.close() so that it's null).
+is("location" in win, true, "Should still have a location property");
+todo_is(win.location, null, "There should be no location object now");
+
+// Just set the location.  This should not crash.
+win.location = "data:text/html,2";
+
+// And check that we didn't override the slot in the process.
+is(typeof(win.location), "object", "Location should not have become a string");
+is(win.location, null,
+   "There should be no location object for real after the set");
+
+</script>
+</pre>
+</body>
+</html>

editor/libeditor/html/nsHTMLAnonymousUtils.cpp

@@ -368,9 +368,11 @@ nsHTMLEditor::CheckSelectionStateForAnonymousButtons(nsISelection * aSelection)
   }
 
   // now, let's display all contextual UI for good
+  nsIContent* hostContent = GetActiveEditingHost();
+  nsCOMPtr<nsIDOMNode> hostNode = do_QueryInterface(hostContent);
 
   if (mIsObjectResizingEnabled && focusElement &&
-      IsModifiableNode(focusElement)) {
+      IsModifiableNode(focusElement) && focusElement != hostNode) {
     if (nsEditProperty::img == focusTagAtom)
       mResizedObjectIsAnImage = PR_TRUE;
     if (mResizedObject)
@@ -381,7 +383,7 @@ nsHTMLEditor::CheckSelectionStateForAnonymousButtons(nsISelection * aSelection)
   }
 
   if (mIsAbsolutelyPositioningEnabled && absPosElement &&
-      IsModifiableNode(absPosElement)) {
+      IsModifiableNode(absPosElement) && absPosElement != hostNode) {
     if (mAbsolutelyPositionedObject)
       res = RefreshGrabber();
     else
@@ -390,7 +392,7 @@ nsHTMLEditor::CheckSelectionStateForAnonymousButtons(nsISelection * aSelection)
   }
 
   if (mIsInlineTableEditingEnabled && cellElement &&
-      IsModifiableNode(cellElement)) {
+      IsModifiableNode(cellElement) && cellElement != hostNode) {
     if (mInlineEditedCell)
       res = RefreshInlineTableEditingUI();
     else

editor/libeditor/text/nsInternetCiter.cpp

@@ -83,7 +83,7 @@ nsInternetCiter::GetCiteString(const nsAString& aInString, nsAString& aOutString
     {
       aOutString.Append(gt);
       // No space between >: this is ">>> " style quoting, for
-      // compatability with RFC 2646 and format=flowed.
+      // compatibility with RFC 2646 and format=flowed.
       if (*beginIter != gt)
         aOutString.Append(space);
     }

gfx/thebes/GLContext.cpp

@@ -436,7 +436,6 @@ static const char *sExtensionNames[] = {
     "GL_ARB_ES2_compatibility",
     "GL_OES_texture_float",
     "GL_ARB_texture_float",
-    "GL_EXT_unpack_subimage",
     NULL
 };
 
@@ -1840,17 +1839,9 @@ GLContext::TexImage2D(GLenum target, GLint level, GLint internalformat,
                         GetAddressAlignment((ptrdiff_t)stride)));
 
 #ifndef USE_GLES2
-    bool useUnpackRowLength = true;
+    fPixelStorei(LOCAL_GL_UNPACK_ROW_LENGTH, stride/pixelsize);
 #else
-    // A Khronos extension, GL_EXT_unpack_subimage, that restores support
-    // for GL_UNPACK_ROW_LENGTH, GL_UNPACK_SKIP_ROWS and GL_UNPACK_SKIP_PIXELS
-    // exists on Tegra 2 (and possibly other chipsets)
-    bool useUnpackRowLength = IsExtensionSupported(EXT_unpack_subimage);
-#endif
-
-    if (useUnpackRowLength)
-        fPixelStorei(LOCAL_GL_UNPACK_ROW_LENGTH, stride/pixelsize);
-    else if (stride != width * pixelsize) {
+    if (stride != width * pixelsize) {
         // Not using the whole row of texture data and GLES doesn't 
         // support GL_UNPACK_ROW_LENGTH. We need to upload each row
         // separately.
@@ -1882,6 +1873,7 @@ GLContext::TexImage2D(GLenum target, GLint level, GLint internalformat,
         fPixelStorei(LOCAL_GL_UNPACK_ALIGNMENT, 4);
         return;
     }
+#endif
 
     fTexImage2D(target,
                 level,
@@ -1893,8 +1885,9 @@ GLContext::TexImage2D(GLenum target, GLint level, GLint internalformat,
                 type,
                 pixels);
 
-    if (useUnpackRowLength)
-        fPixelStorei(LOCAL_GL_UNPACK_ROW_LENGTH, 0);
+#ifndef USE_GLES2
+    fPixelStorei(LOCAL_GL_UNPACK_ROW_LENGTH, 0);
+#endif
     fPixelStorei(LOCAL_GL_UNPACK_ALIGNMENT, 4);
 }
 

gfx/thebes/GLContext.h

@@ -980,7 +980,6 @@ public:
         ARB_ES2_compatibility,
         OES_texture_float,
         ARB_texture_float,
-        EXT_unpack_subimage,
         Extensions_Max
     };
 

intl/lwbrk/src/nsJISx4501LineBreaker.cpp

@@ -460,7 +460,7 @@ GetClass(PRUnichar u)
    } else if (((0x3200 <= u) && (u <= 0xA4CF)) || // CJK and Yi
               ((0xAC00 <= h) && (h <= 0xD7FF)) || // Hangul
               ((0xf900 <= h) && (h <= 0xfaff))) {
-     c = CLASS_BREAKABLE; // CJK character, Han, and Han Compatability
+     c = CLASS_BREAKABLE; // CJK character, Han, and Han Compatibility
    } else if (0xff00 == h) {
      if (l < 0x0060) { // Fullwidth ASCII variant
        c = GETCLASSFROMTABLE(gLBClass00, (l+0x20));

intl/uconv/src/nsUnicodeToUTF8.cpp

@@ -53,7 +53,7 @@ NS_IMETHODIMP nsUnicodeToUTF8::GetMaxLength(const PRUnichar * aSrc,
   // aSrc is interpreted as UTF16, 3 is normally enough.
   // But when previous buffer only contains part of the surrogate pair, we 
   // need to complete it here. If the first word in following buffer is not
-  // in valid surrogate rang, we need to convert the remaining of last buffer 
+  // in valid surrogate range, we need to convert the remaining of last buffer
   // to 3 bytes.
   *aDestLength = 3*aSrcLength + 3;
   return NS_OK;

js/src/jit-test/tests/closures/bug684178.js

@@ -0,0 +1,9 @@
+var obj = {};
+(function() {
+    if (obj) {
+        function f() { obj.x = 1; }
+        obj.m = function() { f(); };
+    }
+})();
+obj.m();
+assertEq(obj.x, 1);

js/src/jit-test/tests/sunspider/check-3d-raytrace.js

@@ -312,7 +312,6 @@ Camera.prototype.render = function(scene, pixels, width, height) {
 
 function raytraceScene()
 {
-    var startDate = new Date().getTime();
     var numTriangles = 2 * 6;
     var triangles = new Array();//numTriangles);
     var tfl = createVector(-10,  10, -10);

js/src/jit-test/tests/sunspider/check-crypto-aes.js

@@ -176,7 +176,8 @@ function AESEncryptCtr(plaintext, password, nBits) {
   // block counter in 2nd 8 bytes
   var blockSize = 16;  // block size fixed at 16 bytes / 128 bits (Nb=4) for AES
   var counterBlock = new Array(blockSize);  // block size fixed at 16 bytes / 128 bits (Nb=4) for AES
-  var nonce = (new Date()).getTime();  // milliseconds since 1-Jan-1970
+  var nonce = (new Date("2000-01-01")).getTime();  // milliseconds since 1-Jan-1970;
+                                                   // fixed for repeatability
 
   // encode nonce in two stages to cater for JavaScript 32-bit limit on bitwise ops
   for (var i=0; i<4; i++) counterBlock[i] = (nonce >>> i*8) & 0xff;

js/src/jit-test/tests/sunspider/check-math-cordic.js

@@ -84,17 +84,11 @@ function cordicsincos() {
 function cordic( runs ) {
   var actual;
 
-  var start = new Date();
-
   for ( var i = 0 ; i < runs ; i++ ) {
     actual = cordicsincos();
   }
 
-  var end = new Date();
-
   assertEq(actual, 1834995.3515519998)
-
-  return end.getTime() - start.getTime();
 }
 
 cordic(25000);

js/src/jsapi.h

@@ -1995,7 +1995,7 @@ struct JSClass {
     JSTraceOp           trace;
 
     JSClassInternal     reserved1;
-    void                *reserved[19];
+    void                *reserved[26];
 };
 
 #define JSCLASS_HAS_PRIVATE             (1<<0)  /* objects have private slot */

js/src/jsarray.cpp

@@ -723,6 +723,16 @@ array_lookupProperty(JSContext *cx, JSObject *obj, jsid id, JSObject **objp,
     return proto->lookupProperty(cx, id, objp, propp);
 }
 
+static JSBool
+array_lookupElement(JSContext *cx, JSObject *obj, uint32 index, JSObject **objp,
+                    JSProperty **propp)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return array_lookupProperty(cx, obj, id, objp, propp);
+}
+
 JSBool
 js_GetDenseArrayElementValue(JSContext *cx, JSObject *obj, jsid id, Value *vp)
 {
@@ -789,6 +799,15 @@ array_getProperty(JSContext *cx, JSObject *obj, JSObject *receiver, jsid id, Val
     return JS_TRUE;
 }
 
+static JSBool
+array_getElement(JSContext *cx, JSObject *obj, JSObject *receiver, uint32 index, Value *vp)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return array_getProperty(cx, obj, receiver, id, vp);
+}
+
 static JSBool
 slowarray_addProperty(JSContext *cx, JSObject *obj, jsid id, Value *vp)
 {
@@ -844,6 +863,15 @@ array_setProperty(JSContext *cx, JSObject *obj, jsid id, Value *vp, JSBool stric
     return js_SetPropertyHelper(cx, obj, id, 0, vp, strict);
 }
 
+static JSBool
+array_setElement(JSContext *cx, JSObject *obj, uint32 index, Value *vp, JSBool strict)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return array_setProperty(cx, obj, id, vp, strict);
+}
+
 JSBool
 js_PrototypeHasIndexedProperties(JSContext *cx, JSObject *obj)
 {
@@ -868,6 +896,7 @@ js_PrototypeHasIndexedProperties(JSContext *cx, JSObject *obj)
 
 namespace js {
 
+/* non-static for direct definition of array elements within the engine */
 JSBool
 array_defineProperty(JSContext *cx, JSObject *obj, jsid id, const Value *value,
                      PropertyOp getter, StrictPropertyOp setter, uintN attrs)
@@ -903,6 +932,17 @@ array_defineProperty(JSContext *cx, JSObject *obj, jsid id, const Value *value,
     return js_DefineProperty(cx, obj, id, value, getter, setter, attrs);
 }
 
+/* non-static for direct definition of array elements within the engine */
+JSBool
+array_defineElement(JSContext *cx, JSObject *obj, uint32 index, const Value *value,
+                    PropertyOp getter, StrictPropertyOp setter, uintN attrs)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return array_defineProperty(cx, obj, id, value, getter, setter, attrs);
+}
+
 } // namespace js
 
 static JSBool
@@ -913,6 +953,15 @@ array_getAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp)
     return JS_TRUE;
 }
 
+static JSBool
+array_getElementAttributes(JSContext *cx, JSObject *obj, uint32 index, uintN *attrsp)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return array_getAttributes(cx, obj, id, attrsp);
+}
+
 static JSBool
 array_setAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp)
 {
@@ -921,8 +970,18 @@ array_setAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp)
     return JS_FALSE;
 }
 
+static JSBool
+array_setElementAttributes(JSContext *cx, JSObject *obj, uint32 index, uintN *attrsp)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return array_setAttributes(cx, obj, id, attrsp);
+}
+
 namespace js {
 
+/* non-static for direct deletion of array elements within the engine */
 JSBool
 array_deleteProperty(JSContext *cx, JSObject *obj, jsid id, Value *rval, JSBool strict)
 {
@@ -948,6 +1007,16 @@ array_deleteProperty(JSContext *cx, JSObject *obj, jsid id, Value *rval, JSBool
     return JS_TRUE;
 }
 
+/* non-static for direct deletion of array elements within the engine */
+JSBool
+array_deleteElement(JSContext *cx, JSObject *obj, uint32 index, Value *rval, JSBool strict)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return array_deleteProperty(cx, obj, id, rval, strict);
+}
+
 } // namespace js
 
 static void
@@ -997,12 +1066,19 @@ Class js::ArrayClass = {
     JS_NULL_CLASS_EXT,
     {
         array_lookupProperty,
+        array_lookupElement,
         array_defineProperty,
+        array_defineElement,
         array_getProperty,
+        array_getElement,
         array_setProperty,
+        array_setElement,
         array_getAttributes,
+        array_getElementAttributes,
         array_setAttributes,
+        array_setElementAttributes,
         array_deleteProperty,
+        array_deleteElement,
         NULL,       /* enumerate      */
         array_typeOf,
         array_fix,

js/src/jscntxt.cpp

@@ -649,7 +649,7 @@ ReportError(JSContext *cx, const char *message, JSErrorReport *reportp,
      *
      * If an exception was raised, then we call the debugErrorHook
      * (if present) to give it a chance to see the error before it
-     * propagates out of scope.  This is needed for compatability
+     * propagates out of scope.  This is needed for compatibility
      * with the old scheme.
      */
     if (!JS_IsRunning(cx) ||

js/src/jscntxt.h

@@ -1092,7 +1092,7 @@ struct JSContext
      * Return:
      * - The override version, if there is an override version.
      * - The newest scripted frame's version, if there is such a frame.
-     * - The default verion.
+     * - The default version.
      *
      * Note: if this ever shows up in a profile, just add caching!
      */

js/src/jscompartment.cpp

@@ -596,12 +596,14 @@ JSCompartment::sweep(JSContext *cx, uint32 releaseInterval)
          * jitcode still needs to be released, if this is a shape-regenerating
          * GC then shape numbers baked into the code may change.
          */
+#ifdef JS_METHODJIT
         if (types.inferenceEnabled) {
             for (CellIterUnderGC i(this, FINALIZE_SCRIPT); !i.done(); i.next()) {
                 JSScript *script = i.get<JSScript>();
                 mjit::ReleaseScriptCode(cx, script);
             }
         }
+#endif
     } else {
         /*
          * Clear the analysis pool, but don't release its data yet. While

js/src/jscompartment.h

@@ -285,9 +285,9 @@ struct TraceMonitor {
     bool outOfMemory() const;
 
     JS_FRIEND_API(void) getCodeAllocStats(size_t &total, size_t &frag_size, size_t &free_size) const;
-    JS_FRIEND_API(size_t) getVMAllocatorsMainSize() const;
-    JS_FRIEND_API(size_t) getVMAllocatorsReserveSize() const;
-    JS_FRIEND_API(size_t) getTraceMonitorSize() const;
+    JS_FRIEND_API(size_t) getVMAllocatorsMainSize(JSUsableSizeFun usf) const;
+    JS_FRIEND_API(size_t) getVMAllocatorsReserveSize(JSUsableSizeFun usf) const;
+    JS_FRIEND_API(size_t) getTraceMonitorSize(JSUsableSizeFun usf) const;
 };
 
 namespace mjit {

js/src/jsemit.h

@@ -262,7 +262,7 @@ struct JSStmtInfo {
  */
 #define TCF_IN_WITH             0x10000000
 
-/* 
+/*
  * This function does something that can extend the set of bindings in its
  * call objects --- it does a direct eval in non-strict code, or includes a
  * function statement (as opposed to a function definition).
@@ -426,7 +426,7 @@ struct JSTreeContext {              /* tree context for semantic checks */
 
     inline bool needStrictChecks();
 
-    /* 
+    /*
      * sharpSlotBase is -1 or first slot of pair for [sharpArray, sharpDepth].
      * The parser calls ensureSharpSlots to allocate these two stack locals.
      */
@@ -678,7 +678,7 @@ struct JSCodeGenerator : public JSTreeContext
 
     /*
      * Adds a use of a variable that is statically known to exist on the
-     * global object. 
+     * global object.
      *
      * The actual slot of the variable on the global object is not known
      * until after compilation. Properties must be resolved before being

js/src/jsgc.cpp

@@ -238,9 +238,7 @@ Arena::finalize(JSContext *cx, AllocKind thingKind, size_t thingSize)
     FreeSpan *newListTail = &newListHead;
     uintptr_t newFreeSpanStart = 0;
     bool allClear = true;
-#ifdef DEBUG
-    size_t nmarked = 0;
-#endif
+    DebugOnly<size_t> nmarked = 0;
     for (;; thing += thingSize) {
         JS_ASSERT(thing <= lastByte + 1);
         if (thing == nextFree.first) {
@@ -257,9 +255,7 @@ Arena::finalize(JSContext *cx, AllocKind thingKind, size_t thingSize)
             T *t = reinterpret_cast<T *>(thing);
             if (t->isMarked()) {
                 allClear = false;
-#ifdef DEBUG
                 nmarked++;
-#endif
                 if (newFreeSpanStart) {
                     JS_ASSERT(thing >= thingsStart(thingKind) + thingSize);
                     newListTail->first = newFreeSpanStart;
@@ -1557,9 +1553,7 @@ GCMarker::GCMarker(JSContext *cx)
     largeStack(cx->runtime->gcMarkStackLarges, sizeof(cx->runtime->gcMarkStackLarges))
 {
     JS_TRACER_INIT(this, cx, NULL);
-#ifdef DEBUG
     markLaterArenas = 0;
-#endif
 #ifdef JS_DUMP_CONSERVATIVE_GC_ROOTS
     conservativeDumpFileName = getenv("JS_DUMP_CONSERVATIVE_GC_ROOTS");
     memset(&conservativeStats, 0, sizeof(conservativeStats));
@@ -1584,9 +1578,7 @@ GCMarker::delayMarkingChildren(const void *thing)
     }
     aheader->getMarkingDelay()->link = unmarkedArenaStackTop;
     unmarkedArenaStackTop = aheader;
-#ifdef DEBUG
     markLaterArenas++;
-#endif
 }
 
 static void
@@ -1617,10 +1609,8 @@ GCMarker::markDelayedChildren()
         unmarkedArenaStackTop = aheader->getMarkingDelay()->link;
         JS_ASSERT(unmarkedArenaStackTop);
         aheader->getMarkingDelay()->link = NULL;
-#ifdef DEBUG
         JS_ASSERT(markLaterArenas);
         markLaterArenas--;
-#endif
         MarkDelayedChildren(this, aheader);
     }
     JS_ASSERT(!markLaterArenas);

js/src/jsgc.h

@@ -1480,11 +1480,10 @@ struct GCMarker : public JSTracer {
     uint32 color;
 
   public:
-    /* See comments before delayMarkingChildren is jsgc.cpp. */
+    /* Pointer to the top of the stack of arenas we are delaying marking on. */
     js::gc::ArenaHeader *unmarkedArenaStackTop;
-#ifdef DEBUG
-    size_t              markLaterArenas;
-#endif
+    /* Count of arenas that are currently in the stack. */
+    DebugOnly<size_t> markLaterArenas;
 
 #ifdef JS_DUMP_CONSERVATIVE_GC_ROOTS
     js::gc::ConservativeGCStats conservativeStats;

js/src/jshashtable.h

@@ -650,8 +650,14 @@ class HashTable : private AllocPolicy
         return gen;
     }
 
-    size_t tableSize() const {
-        return tableCapacity * sizeof(Entry);
+    /*
+     * This counts the HashTable's |table| array.  If |countMe| is true is also
+     * counts the HashTable object itself.
+     */
+    size_t sizeOf(JSUsableSizeFun usf, bool countMe) const {
+        size_t usable = usf(table) + (countMe ? usf((void*)this) : 0);
+        return usable ? usable
+                      : (tableCapacity * sizeof(Entry)) + (countMe ? sizeof(HashTable) : 0);
     }
 
     Ptr lookup(const Lookup &l) const {
@@ -1082,7 +1088,7 @@ class HashMap
     typedef typename Impl::Range Range;
     Range all() const                                 { return impl.all(); }
     size_t count() const                              { return impl.count(); }
-    size_t tableSize() const                          { return impl.tableSize(); }
+    size_t sizeOf(JSUsableSizeFun usf, bool cm) const { return impl.sizeOf(usf, cm); }
 
     /*
      * Typedef for the enumeration class. An Enum may be used to examine and
@@ -1284,7 +1290,7 @@ class HashSet
     typedef typename Impl::Range Range;
     Range all() const                                 { return impl.all(); }
     size_t count() const                              { return impl.count(); }
-    size_t tableSize() const                          { return impl.tableSize(); }
+    size_t sizeOf(JSUsableSizeFun usf, bool cm) const { return impl.sizeOf(usf, cm); }
 
     /*
      * Typedef for the enumeration class. An Enum may be used to examine and

js/src/jsobj.cpp

@@ -2718,11 +2718,11 @@ obj_preventExtensions(JSContext *cx, uintN argc, Value *vp)
 }
 
 size_t
-JSObject::sizeOfSlotsArray(size_t(*mus)(void *))
+JSObject::sizeOfSlotsArray(JSUsableSizeFun usf)
 {
     if (!hasSlotsArray())
         return 0;
-    size_t usable = mus((void *)slots);
+    size_t usable = usf((void *)slots);
     return usable ? usable : numSlots() * sizeof(js::Value);
 }
 
@@ -3268,36 +3268,91 @@ with_LookupProperty(JSContext *cx, JSObject *obj, jsid id, JSObject **objp,
     return obj->getProto()->lookupProperty(cx, id, objp, propp);
 }
 
+static JSBool
+with_LookupElement(JSContext *cx, JSObject *obj, uint32 index, JSObject **objp,
+                   JSProperty **propp)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return with_LookupProperty(cx, obj, id, objp, propp);
+}
+
 static JSBool
 with_GetProperty(JSContext *cx, JSObject *obj, JSObject *receiver, jsid id, Value *vp)
 {
     return obj->getProto()->getProperty(cx, id, vp);
 }
 
+static JSBool
+with_GetElement(JSContext *cx, JSObject *obj, JSObject *receiver, uint32 index, Value *vp)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return with_GetProperty(cx, obj, receiver, id, vp);
+}
+
 static JSBool
 with_SetProperty(JSContext *cx, JSObject *obj, jsid id, Value *vp, JSBool strict)
 {
     return obj->getProto()->setProperty(cx, id, vp, strict);
 }
 
+static JSBool
+with_SetElement(JSContext *cx, JSObject *obj, uint32 index, Value *vp, JSBool strict)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return with_SetProperty(cx, obj, id, vp, strict);
+}
+
 static JSBool
 with_GetAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp)
 {
     return obj->getProto()->getAttributes(cx, id, attrsp);
 }
 
+static JSBool
+with_GetElementAttributes(JSContext *cx, JSObject *obj, uint32 index, uintN *attrsp)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return with_GetAttributes(cx, obj, id, attrsp);
+}
+
 static JSBool
 with_SetAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp)
 {
     return obj->getProto()->setAttributes(cx, id, attrsp);
 }
 
+static JSBool
+with_SetElementAttributes(JSContext *cx, JSObject *obj, uint32 index, uintN *attrsp)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return with_SetAttributes(cx, obj, id, attrsp);
+}
+
 static JSBool
 with_DeleteProperty(JSContext *cx, JSObject *obj, jsid id, Value *rval, JSBool strict)
 {
     return obj->getProto()->deleteProperty(cx, id, rval, strict);
 }
 
+static JSBool
+with_DeleteElement(JSContext *cx, JSObject *obj, uint32 index, Value *rval, JSBool strict)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return with_DeleteProperty(cx, obj, id, rval, strict);
+}
+
 static JSBool
 with_Enumerate(JSContext *cx, JSObject *obj, JSIterateOp enum_op,
                Value *statep, jsid *idp)
@@ -3338,12 +3393,19 @@ Class js::WithClass = {
     JS_NULL_CLASS_EXT,
     {
         with_LookupProperty,
+        with_LookupElement,
         NULL,             /* defineProperty */
+        NULL,             /* defineElement */
         with_GetProperty,
+        with_GetElement,
         with_SetProperty,
+        with_SetElement,
         with_GetAttributes,
+        with_GetElementAttributes,
         with_SetAttributes,
+        with_SetElementAttributes,
         with_DeleteProperty,
+        with_DeleteElement,
         with_Enumerate,
         with_TypeOf,
         NULL,             /* fix   */

js/src/jsobj.h

@@ -478,7 +478,7 @@ struct JSObject : js::gc::Cell {
         jsuword initializedLength;
     };
 
-    JS_FRIEND_API(size_t) sizeOfSlotsArray(size_t(*mus)(void *));
+    JS_FRIEND_API(size_t) sizeOfSlotsArray(JSUsableSizeFun usf);
 
     JSObject    *parent;                    /* object's parent */
     void        *privateData;               /* private data */

js/src/jsparse.cpp

@@ -320,7 +320,7 @@ bool
 JSFunctionBox::inAnyDynamicScope() const
 {
     for (const JSFunctionBox *funbox = this; funbox; funbox = funbox->parent) {
-        if (funbox->tcflags & (TCF_IN_WITH | TCF_FUN_CALLS_EVAL))
+        if (funbox->tcflags & (TCF_IN_WITH | TCF_FUN_EXTENSIBLE_SCOPE))
             return true;
     }
     return false;
@@ -6734,7 +6734,7 @@ class GenexpGuard {
 
     void endBody();
     bool checkValidBody(JSParseNode *pn);
-    bool maybeNoteGenerator();
+    bool maybeNoteGenerator(JSParseNode *pn);
 };
 
 void
@@ -6780,7 +6780,7 @@ GenexpGuard::checkValidBody(JSParseNode *pn)
  * generator expression.
  */
 bool
-GenexpGuard::maybeNoteGenerator()
+GenexpGuard::maybeNoteGenerator(JSParseNode *pn)
 {
     if (tc->yieldCount > 0) {
         tc->flags |= TCF_FUN_IS_GENERATOR;
@@ -6789,6 +6789,13 @@ GenexpGuard::maybeNoteGenerator()
                                           js_yield_str);
             return false;
         }
+        if (tc->flags & TCF_RETURN_EXPR) {
+            /* At the time we saw the yield, we might not have set TCF_FUN_IS_GENERATOR yet. */
+            ReportBadReturn(tc->parser->context, tc, pn, JSREPORT_ERROR,
+                            JSMSG_BAD_GENERATOR_RETURN,
+                            JSMSG_BAD_ANON_GENERATOR_RETURN);
+            return false;
+        }
     }
     return true;
 }
@@ -7129,7 +7136,7 @@ Parser::comprehensionTail(JSParseNode *kid, uintN blockid, bool isGenexp,
             if (!guard.checkValidBody(pn2))
                 return NULL;
         } else {
-            if (!guard.maybeNoteGenerator())
+            if (!guard.maybeNoteGenerator(pn2))
                 return NULL;
         }
 
@@ -7359,7 +7366,7 @@ Parser::argumentList(JSParseNode *listNode)
             }
         } else
 #endif
-        if (arg0 && !guard.maybeNoteGenerator())
+        if (arg0 && !guard.maybeNoteGenerator(argNode))
             return JS_FALSE;
 
         arg0 = false;
@@ -8454,7 +8461,6 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
 
       case TOK_LC:
       {
-        JSBool afterComma;
         JSParseNode *pnval;
 
         /*
@@ -8476,7 +8482,6 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
         pn->pn_op = JSOP_NEWINIT;
         pn->makeEmpty();
 
-        afterComma = JS_FALSE;
         for (;;) {
             JSAtom *atom;
             tt = tokenStream.getToken(TSF_KEYWORD_IS_NAME);
@@ -8635,7 +8640,6 @@ Parser::primaryExpr(TokenKind tt, JSBool afterDot)
                 reportErrorNumber(NULL, JSREPORT_ERROR, JSMSG_CURLY_AFTER_LIST);
                 return NULL;
             }
-            afterComma = JS_TRUE;
         }
 
       end_obj_init:
@@ -8980,7 +8984,7 @@ Parser::parenExpr(JSBool *genexp)
     } else
 #endif /* JS_HAS_GENERATOR_EXPRS */
 
-    if (!guard.maybeNoteGenerator())
+    if (!guard.maybeNoteGenerator(pn))
         return NULL;
 
     return pn;

js/src/jsproxy.cpp

@@ -901,6 +901,16 @@ proxy_LookupProperty(JSContext *cx, JSObject *obj, jsid id, JSObject **objp,
     return true;
 }
 
+static JSBool
+proxy_LookupElement(JSContext *cx, JSObject *obj, uint32 index, JSObject **objp,
+                    JSProperty **propp)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return proxy_LookupProperty(cx, obj, id, objp, propp);
+}
+
 static JSBool
 proxy_DefineProperty(JSContext *cx, JSObject *obj, jsid id, const Value *value,
                      PropertyOp getter, StrictPropertyOp setter, uintN attrs)
@@ -915,18 +925,46 @@ proxy_DefineProperty(JSContext *cx, JSObject *obj, jsid id, const Value *value,
     return JSProxy::defineProperty(cx, obj, id, &desc);
 }
 
+static JSBool
+proxy_DefineElement(JSContext *cx, JSObject *obj, uint32 index, const Value *value,
+                    PropertyOp getter, StrictPropertyOp setter, uintN attrs)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return proxy_DefineProperty(cx, obj, id, value, getter, setter, attrs);
+}
+
 static JSBool
 proxy_GetProperty(JSContext *cx, JSObject *obj, JSObject *receiver, jsid id, Value *vp)
 {
     return JSProxy::get(cx, obj, receiver, id, vp);
 }
 
+static JSBool
+proxy_GetElement(JSContext *cx, JSObject *obj, JSObject *receiver, uint32 index, Value *vp)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return proxy_GetProperty(cx, obj, receiver, id, vp);
+}
+
 static JSBool
 proxy_SetProperty(JSContext *cx, JSObject *obj, jsid id, Value *vp, JSBool strict)
 {
     return JSProxy::set(cx, obj, obj, id, strict, vp);
 }
 
+static JSBool
+proxy_SetElement(JSContext *cx, JSObject *obj, uint32 index, Value *vp, JSBool strict)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return proxy_SetProperty(cx, obj, id, vp, strict);
+}
+
 static JSBool
 proxy_GetAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp)
 {
@@ -937,6 +975,15 @@ proxy_GetAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp)
     return true;
 }
 
+static JSBool
+proxy_GetElementAttributes(JSContext *cx, JSObject *obj, uint32 index, uintN *attrsp)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return proxy_GetAttributes(cx, obj, id, attrsp);
+}
+
 static JSBool
 proxy_SetAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp)
 {
@@ -948,6 +995,15 @@ proxy_SetAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp)
     return JSProxy::defineProperty(cx, obj, id, &desc);
 }
 
+static JSBool
+proxy_SetElementAttributes(JSContext *cx, JSObject *obj, uint32 index, uintN *attrsp)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return proxy_SetAttributes(cx, obj, id, attrsp);
+}
+
 static JSBool
 proxy_DeleteProperty(JSContext *cx, JSObject *obj, jsid id, Value *rval, JSBool strict)
 {
@@ -959,6 +1015,15 @@ proxy_DeleteProperty(JSContext *cx, JSObject *obj, jsid id, Value *rval, JSBool
     return true;
 }
 
+static JSBool
+proxy_DeleteElement(JSContext *cx, JSObject *obj, uint32 index, Value *rval, JSBool strict)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return proxy_DeleteProperty(cx, obj, id, rval, strict);
+}
+
 static void
 proxy_TraceObject(JSTracer *trc, JSObject *obj)
 {
@@ -1046,12 +1111,19 @@ JS_FRIEND_DATA(Class) js::ObjectProxyClass = {
     JS_NULL_CLASS_EXT,
     {
         proxy_LookupProperty,
+        proxy_LookupElement,
         proxy_DefineProperty,
+        proxy_DefineElement,
         proxy_GetProperty,
+        proxy_GetElement,
         proxy_SetProperty,
+        proxy_SetElement,
         proxy_GetAttributes,
+        proxy_GetElementAttributes,
         proxy_SetAttributes,
+        proxy_SetElementAttributes,
         proxy_DeleteProperty,
+        proxy_DeleteElement,
         NULL,             /* enumerate       */
         proxy_TypeOf,
         proxy_Fix,        /* fix             */
@@ -1086,12 +1158,19 @@ JS_FRIEND_DATA(Class) js::OuterWindowProxyClass = {
     },
     {
         proxy_LookupProperty,
+        proxy_LookupElement,
         proxy_DefineProperty,
+        proxy_DefineElement,
         proxy_GetProperty,
+        proxy_GetElement,
         proxy_SetProperty,
+        proxy_SetElement,
         proxy_GetAttributes,
+        proxy_GetElementAttributes,
         proxy_SetAttributes,
+        proxy_SetElementAttributes,
         proxy_DeleteProperty,
+        proxy_DeleteElement,
         NULL,             /* enumerate       */
         NULL,             /* typeof          */
         NULL,             /* fix             */
@@ -1138,12 +1217,19 @@ JS_FRIEND_DATA(Class) js::FunctionProxyClass = {
     JS_NULL_CLASS_EXT,
     {
         proxy_LookupProperty,
+        proxy_LookupElement,
         proxy_DefineProperty,
+        proxy_DefineElement,
         proxy_GetProperty,
+        proxy_GetElement,
         proxy_SetProperty,
+        proxy_SetElement,
         proxy_GetAttributes,
+        proxy_GetElementAttributes,
         proxy_SetAttributes,
+        proxy_SetElementAttributes,
         proxy_DeleteProperty,
+        proxy_DeleteElement,
         NULL,             /* enumerate       */
         proxy_TypeOf,
         NULL,             /* fix             */

js/src/jsprvtd.h

@@ -328,11 +328,6 @@ typedef struct JSDebugHooks {
  * If JSLookupPropOp succeeds and returns with *propp non-null, that pointer
  * may be passed as the prop parameter to a JSAttributesOp, as a short-cut
  * that bypasses id re-lookup.
- *
- * NB: successful return with non-null *propp means the implementation may
- * have locked *objp and added a reference count associated with *propp, so
- * callers should not risk deadlock by nesting or interleaving other lookups
- * or any obj-bearing ops before dropping *propp.
  */
 typedef JSBool
 (* JSLookupPropOp)(JSContext *cx, JSObject *obj, jsid id, JSObject **objp,

js/src/jsscope.h

@@ -251,13 +251,13 @@ struct PropertyTable {
     /* Computes the size of the entries array for a given capacity. */
     static size_t sizeOfEntries(size_t cap) { return cap * sizeof(Shape *); }
 
-    size_t sizeOf(size_t(*mus)(void *)) const {
-        if (mus) {
-            size_t usable = mus((void*)this) + mus(entries);
-            if (usable)
-                return usable;
-        }
-        return sizeOfEntries(capacity()) + sizeof(PropertyTable);
+    /*
+     * This counts the PropertyTable object itself (which must be
+     * heap-allocated) and its |entries| array.
+     */
+    size_t sizeOf(JSUsableSizeFun usf) const {
+        size_t usable = usf((void*)this) + usf(entries);
+        return usable ? usable : sizeOfEntries(capacity()) + sizeof(PropertyTable);
     }
 
     /* Whether we need to grow.  We want to do this if the load factor is >= 0.75 */
@@ -357,6 +357,7 @@ struct Shape : public js::gc::Cell
 
   protected:
     mutable js::Shape   *parent;        /* parent node, reverse for..in order */
+    /* kids is valid when !inDictionary(), listp is valid when inDictionary(). */
     union {
         mutable js::KidsPointer kids;   /* null, single child, or a tagged ptr
                                            to many-kids data structure */
@@ -445,6 +446,17 @@ struct Shape : public js::gc::Cell
         return table;
     }
 
+    size_t sizeOfPropertyTable(JSUsableSizeFun usf) const {
+        return hasTable() ? getTable()->sizeOf(usf) : 0;
+    }
+
+    size_t sizeOfKids(JSUsableSizeFun usf) const {
+        /* Nb: |countMe| is true because the kids HashTable is on the heap. */
+        return (!inDictionary() && kids.isHash())
+             ? kids.toHash()->sizeOf(usf, /* countMe */true)
+             : 0;
+    }
+
     bool isNative() const { return this != &sharedNonNative; }
 
     const js::Shape *previous() const {

js/src/jsscript.cpp

@@ -1289,6 +1289,18 @@ JSScript::dataSize()
     return dataEnd - data;
 }
 
+size_t
+JSScript::dataSize(JSUsableSizeFun usf)
+{
+#if JS_SCRIPT_INLINE_DATA_LIMIT
+    if (data == inlineData)
+        return 0;
+#endif
+
+    size_t usable = usf(data);
+    return usable ? usable : dataSize();
+}
+
 void
 JSScript::setOwnerObject(JSObject *owner)
 {

js/src/jsscript.h

@@ -683,7 +683,7 @@ struct JSScript : public js::gc::Cell {
     }
 
     /* Size of the JITScript and all sections.  (This method is implemented in MethodJIT.h.) */
-    JS_FRIEND_API(size_t) jitDataSize(size_t(*mus)(void *));
+    JS_FRIEND_API(size_t) jitDataSize(JSUsableSizeFun usf);
     
 #endif
 
@@ -691,7 +691,13 @@ struct JSScript : public js::gc::Cell {
         return code + mainOffset;
     }
 
-    JS_FRIEND_API(size_t) dataSize();   /* Size of all data sections */
+    /*
+     * The first dataSize() is the in-use size of all the data sections, the
+     * second is the size of the block allocated to hold all the data sections
+     * (which can be larger than the in-use size).
+     */
+    JS_FRIEND_API(size_t) dataSize();                       /* Size of all data sections */
+    JS_FRIEND_API(size_t) dataSize(JSUsableSizeFun usf);    /* Size of all data sections */
     uint32 numNotes();                  /* Number of srcnote slots in the srcnotes section */
 
     /* Script notes are allocated right after the code. */

js/src/jstracer.cpp

@@ -2498,33 +2498,43 @@ TraceMonitor::getCodeAllocStats(size_t &total, size_t &frag_size, size_t &free_s
 }
 
 size_t
-TraceMonitor::getVMAllocatorsMainSize() const
+TraceMonitor::getVMAllocatorsMainSize(JSUsableSizeFun usf) const
 {
     size_t n = 0;
     if (dataAlloc)
-        n += dataAlloc->getBytesAllocated();
+        n += dataAlloc->getBytesAllocated(usf);
     if (traceAlloc)
-        n += traceAlloc->getBytesAllocated();
+        n += traceAlloc->getBytesAllocated(usf);
     if (tempAlloc)
-        n += tempAlloc->getBytesAllocated();
+        n += tempAlloc->getBytesAllocated(usf);
     return n;
 }
 
 size_t
-TraceMonitor::getVMAllocatorsReserveSize() const
+TraceMonitor::getVMAllocatorsReserveSize(JSUsableSizeFun usf) const
 {
-    return dataAlloc->mReserveSize +
-           traceAlloc->mReserveSize +
-           tempAlloc->mReserveSize;
+    size_t usable = usf(dataAlloc->mReserve) +
+                    usf(traceAlloc->mReserve) +
+                    usf(tempAlloc->mReserve);
+    return usable ? usable : dataAlloc->mReserveSize +
+                             traceAlloc->mReserveSize +
+                             tempAlloc->mReserveSize;
 }
 
 size_t
-TraceMonitor::getTraceMonitorSize() const
+TraceMonitor::getTraceMonitorSize(JSUsableSizeFun usf) const
 {
-    return sizeof(TraceMonitor) +           // TraceMonitor
-           sizeof(*storage) +               // TraceNativeStorage
-           recordAttempts->tableSize() +    // RecordAttemptMap
-           loopProfiles->tableSize();       // LoopProfileMap
+    /*
+     * Measures: TraceMonitor, TraceNativeStorage, RecordAttemptMap,
+     * LoopProfileMap.  |countMe| is true for both sizeOf() calls because the
+     * two HashMaps are not inline in TraceMonitor.
+     */
+    size_t usableTM  = usf((void *)this);
+    size_t usableTNS = usf(storage);
+    return (usableTM  ? usableTM  : sizeof(*this)) +
+           (usableTNS ? usableTNS : sizeof(*storage)) +
+           recordAttempts->sizeOf(usf, /* countMe */true) +
+           loopProfiles->sizeOf(usf, /* countMe */true);
 }
 
 /*

js/src/jstypedarray.cpp

@@ -65,6 +65,7 @@
 
 #include "vm/GlobalObject.h"
 
+#include "jsatominlines.h"
 #include "jsinferinlines.h"
 #include "jsobjinlines.h"
 #include "jstypedarrayinlines.h"
@@ -276,6 +277,16 @@ ArrayBuffer::obj_lookupProperty(JSContext *cx, JSObject *obj, jsid id,
     return proto->lookupProperty(cx, id, objp, propp);
 }
 
+JSBool
+ArrayBuffer::obj_lookupElement(JSContext *cx, JSObject *obj, uint32 index,
+                               JSObject **objp, JSProperty **propp)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return obj_lookupProperty(cx, obj, id, objp, propp);
+}
+
 JSBool
 ArrayBuffer::obj_defineProperty(JSContext *cx, JSObject *obj, jsid id, const Value *v,
                    PropertyOp getter, StrictPropertyOp setter, uintN attrs)
@@ -289,6 +300,16 @@ ArrayBuffer::obj_defineProperty(JSContext *cx, JSObject *obj, jsid id, const Val
     return js_DefineProperty(cx, delegate, id, v, getter, setter, attrs);
 }
 
+JSBool
+ArrayBuffer::obj_defineElement(JSContext *cx, JSObject *obj, uint32 index, const Value *v,
+                   PropertyOp getter, StrictPropertyOp setter, uintN attrs)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return obj_defineProperty(cx, obj, id, v, getter, setter, attrs);
+}
+
 JSBool
 ArrayBuffer::obj_getProperty(JSContext *cx, JSObject *obj, JSObject *receiver, jsid id, Value *vp)
 {
@@ -304,6 +325,15 @@ ArrayBuffer::obj_getProperty(JSContext *cx, JSObject *obj, JSObject *receiver, j
     return js_GetProperty(cx, delegate, receiver, id, vp);
 }
 
+JSBool
+ArrayBuffer::obj_getElement(JSContext *cx, JSObject *obj, JSObject *receiver, uint32 index, Value *vp)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return obj_getProperty(cx, obj, receiver, id, vp);
+}
+
 JSBool
 ArrayBuffer::obj_setProperty(JSContext *cx, JSObject *obj, jsid id, Value *vp, JSBool strict)
 {
@@ -358,6 +388,15 @@ ArrayBuffer::obj_setProperty(JSContext *cx, JSObject *obj, jsid id, Value *vp, J
     return js_SetPropertyHelper(cx, delegate, id, 0, vp, strict);
 }
 
+JSBool
+ArrayBuffer::obj_setElement(JSContext *cx, JSObject *obj, uint32 index, Value *vp, JSBool strict)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return obj_setProperty(cx, obj, id, vp, strict);
+}
+
 JSBool
 ArrayBuffer::obj_getAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp)
 {
@@ -372,6 +411,15 @@ ArrayBuffer::obj_getAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *att
     return js_GetAttributes(cx, delegate, id, attrsp);
 }
 
+JSBool
+ArrayBuffer::obj_getElementAttributes(JSContext *cx, JSObject *obj, uint32 index, uintN *attrsp)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return obj_getAttributes(cx, obj, id, attrsp);
+}
+
 JSBool
 ArrayBuffer::obj_setAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp)
 {
@@ -387,6 +435,15 @@ ArrayBuffer::obj_setAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *att
     return js_SetAttributes(cx, delegate, id, attrsp);
 }
 
+JSBool
+ArrayBuffer::obj_setElementAttributes(JSContext *cx, JSObject *obj, uint32 index, uintN *attrsp)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return obj_setAttributes(cx, obj, id, attrsp);
+}
+
 JSBool
 ArrayBuffer::obj_deleteProperty(JSContext *cx, JSObject *obj, jsid id, Value *rval, JSBool strict)
 {
@@ -401,6 +458,15 @@ ArrayBuffer::obj_deleteProperty(JSContext *cx, JSObject *obj, jsid id, Value *rv
     return js_DeleteProperty(cx, delegate, id, rval, strict);
 }
 
+JSBool
+ArrayBuffer::obj_deleteElement(JSContext *cx, JSObject *obj, uint32 index, Value *rval, JSBool strict)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return obj_deleteElement(cx, obj, index, rval, strict);
+}
+
 JSBool
 ArrayBuffer::obj_enumerate(JSContext *cx, JSObject *obj, JSIterateOp enum_op,
               Value *statep, jsid *idp)
@@ -538,6 +604,16 @@ TypedArray::obj_lookupProperty(JSContext *cx, JSObject *obj, jsid id,
     return proto->lookupProperty(cx, id, objp, propp);
 }
 
+JSBool
+TypedArray::obj_lookupElement(JSContext *cx, JSObject *obj, uint32 index,
+                              JSObject **objp, JSProperty **propp)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return obj_lookupProperty(cx, obj, id, objp, propp);
+}
+
 JSBool
 TypedArray::obj_getAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp)
 {
@@ -547,6 +623,15 @@ TypedArray::obj_getAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attr
     return true;
 }
 
+JSBool
+TypedArray::obj_getElementAttributes(JSContext *cx, JSObject *obj, uint32 index, uintN *attrsp)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return obj_getAttributes(cx, obj, id, attrsp);
+}
+
 JSBool
 TypedArray::obj_setAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp)
 {
@@ -555,6 +640,15 @@ TypedArray::obj_setAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attr
     return false;
 }
 
+JSBool
+TypedArray::obj_setElementAttributes(JSContext *cx, JSObject *obj, uint32 index, uintN *attrsp)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return obj_setAttributes(cx, obj, id, attrsp);
+}
+
 /* static */ int
 TypedArray::lengthOffset()
 {
@@ -777,6 +871,15 @@ class TypedArrayTemplate
         return true;
     }
 
+    static JSBool
+    obj_getElement(JSContext *cx, JSObject *obj, JSObject *receiver, uint32 index, Value *vp)
+    {
+        jsid id;
+        if (!IndexToId(cx, index, &id))
+            return false;
+        return obj_getProperty(cx, obj, receiver, id, vp);
+    }
+
     static JSBool
     obj_setProperty(JSContext *cx, JSObject *obj, jsid id, Value *vp, JSBool strict)
     {
@@ -854,6 +957,15 @@ class TypedArrayTemplate
         return true;
     }
 
+    static JSBool
+    obj_setElement(JSContext *cx, JSObject *obj, uint32 index, Value *vp, JSBool strict)
+    {
+        jsid id;
+        if (!IndexToId(cx, index, &id))
+            return false;
+        return obj_setProperty(cx, obj, id, vp, strict);
+    }
+
     static JSBool
     obj_defineProperty(JSContext *cx, JSObject *obj, jsid id, const Value *v,
                        PropertyOp getter, StrictPropertyOp setter, uintN attrs)
@@ -865,6 +977,16 @@ class TypedArrayTemplate
         return obj_setProperty(cx, obj, id, &tmp, false);
     }
 
+    static JSBool
+    obj_defineElement(JSContext *cx, JSObject *obj, uint32 index, const Value *v,
+                       PropertyOp getter, StrictPropertyOp setter, uintN attrs)
+    {
+        jsid id;
+        if (!IndexToId(cx, index, &id))
+            return false;
+        return obj_defineProperty(cx, obj, id, v, getter, setter, attrs);
+    }
+
     static JSBool
     obj_deleteProperty(JSContext *cx, JSObject *obj, jsid id, Value *rval, JSBool strict)
     {
@@ -885,6 +1007,15 @@ class TypedArrayTemplate
         return true;
     }
 
+    static JSBool
+    obj_deleteElement(JSContext *cx, JSObject *obj, uint32 index, Value *rval, JSBool strict)
+    {
+        jsid id;
+        if (!IndexToId(cx, index, &id))
+            return false;
+        return obj_deleteProperty(cx, obj, id, rval, strict);
+    }
+
     static JSBool
     obj_enumerate(JSContext *cx, JSObject *obj, JSIterateOp enum_op,
                   Value *statep, jsid *idp)
@@ -1718,12 +1849,19 @@ Class js::ArrayBufferClass = {
     JS_NULL_CLASS_EXT,
     {
         ArrayBuffer::obj_lookupProperty,
+        ArrayBuffer::obj_lookupElement,
         ArrayBuffer::obj_defineProperty,
+        ArrayBuffer::obj_defineElement,
         ArrayBuffer::obj_getProperty,
+        ArrayBuffer::obj_getElement,
         ArrayBuffer::obj_setProperty,
+        ArrayBuffer::obj_setElement,
         ArrayBuffer::obj_getAttributes,
+        ArrayBuffer::obj_getElementAttributes,
         ArrayBuffer::obj_setAttributes,
+        ArrayBuffer::obj_setElementAttributes,
         ArrayBuffer::obj_deleteProperty,
+        ArrayBuffer::obj_deleteElement,
         ArrayBuffer::obj_enumerate,
         ArrayBuffer::obj_typeOf,
         NULL,       /* thisObject      */
@@ -1809,12 +1947,19 @@ JSFunctionSpec _typedArray::jsfuncs[] = {                                      \
     JS_NULL_CLASS_EXT,                                                         \
     {                                                                          \
         _typedArray::obj_lookupProperty,                                       \
+        _typedArray::obj_lookupElement,                                        \
         _typedArray::obj_defineProperty,                                       \
+        _typedArray::obj_defineElement,                                        \
         _typedArray::obj_getProperty,                                          \
+        _typedArray::obj_getElement,                                           \
         _typedArray::obj_setProperty,                                          \
+        _typedArray::obj_setElement,                                           \
         _typedArray::obj_getAttributes,                                        \
+        _typedArray::obj_getElementAttributes,                                 \
         _typedArray::obj_setAttributes,                                        \
+        _typedArray::obj_setElementAttributes,                                 \
         _typedArray::obj_deleteProperty,                                       \
+        _typedArray::obj_deleteElement,                                        \
         _typedArray::obj_enumerate,                                            \
         _typedArray::obj_typeOf,                                               \
         NULL,       /* thisObject      */                                      \

js/src/jstypedarray.h

@@ -78,25 +78,48 @@ struct JS_FRIEND_API(ArrayBuffer) {
     obj_lookupProperty(JSContext *cx, JSObject *obj, jsid id,
                        JSObject **objp, JSProperty **propp);
 
+    static JSBool
+    obj_lookupElement(JSContext *cx, JSObject *obj, uint32 index,
+                      JSObject **objp, JSProperty **propp);
+
     static JSBool
     obj_defineProperty(JSContext *cx, JSObject *obj, jsid id, const Value *v,
                        PropertyOp getter, StrictPropertyOp setter, uintN attrs);
 
+    static JSBool
+    obj_defineElement(JSContext *cx, JSObject *obj, uint32 index, const Value *v,
+                      PropertyOp getter, StrictPropertyOp setter, uintN attrs);
+
     static JSBool
     obj_getProperty(JSContext *cx, JSObject *obj, JSObject *receiver, jsid id, Value *vp);
 
+    static JSBool
+    obj_getElement(JSContext *cx, JSObject *obj, JSObject *receiver, uint32 index, Value *vp);
+
     static JSBool
     obj_setProperty(JSContext *cx, JSObject *obj, jsid id, Value *vp, JSBool strict);
 
+    static JSBool
+    obj_setElement(JSContext *cx, JSObject *obj, uint32 index, Value *vp, JSBool strict);
+
     static JSBool
     obj_getAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp);
 
+    static JSBool
+    obj_getElementAttributes(JSContext *cx, JSObject *obj, uint32 index, uintN *attrsp);
+
     static JSBool
     obj_setAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp);
 
+    static JSBool
+    obj_setElementAttributes(JSContext *cx, JSObject *obj, uint32 index, uintN *attrsp);
+
     static JSBool
     obj_deleteProperty(JSContext *cx, JSObject *obj, jsid id, Value *rval, JSBool strict);
 
+    static JSBool
+    obj_deleteElement(JSContext *cx, JSObject *obj, uint32 index, Value *rval, JSBool strict);
+
     static JSBool
     obj_enumerate(JSContext *cx, JSObject *obj, JSIterateOp enum_op,
                   Value *statep, jsid *idp);
@@ -164,10 +187,14 @@ struct JS_FRIEND_API(TypedArray) {
 
     static JSBool obj_lookupProperty(JSContext *cx, JSObject *obj, jsid id,
                                      JSObject **objp, JSProperty **propp);
+    static JSBool obj_lookupElement(JSContext *cx, JSObject *obj, uint32 index,
+                                    JSObject **objp, JSProperty **propp);
 
     static JSBool obj_getAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp);
+    static JSBool obj_getElementAttributes(JSContext *cx, JSObject *obj, uint32 index, uintN *attrsp);
 
     static JSBool obj_setAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp);
+    static JSBool obj_setElementAttributes(JSContext *cx, JSObject *obj, uint32 index, uintN *attrsp);
 
     static JSUint32 getLength(JSObject *obj);
     static JSUint32 getByteOffset(JSObject *obj);

js/src/jsutil.h

@@ -267,6 +267,13 @@ static JS_INLINE void js_free(void* p) {
 }
 #endif/* JS_USE_CUSTOM_ALLOCATOR */
 
+/* 
+ * This signature is for malloc_usable_size-like functions used to measure
+ * memory usage.  A return value of zero indicates that the size is unknown,
+ * and so a fall-back computation should be done for the size.
+ */
+typedef size_t(*JSUsableSizeFun)(void *p);
+
 JS_END_EXTERN_C
 
 

js/src/jsvalue.h

@@ -949,18 +949,32 @@ typedef JSBool
 (* DefinePropOp)(JSContext *cx, JSObject *obj, jsid id, const Value *value,
                  PropertyOp getter, StrictPropertyOp setter, uintN attrs);
 typedef JSBool
+(* DefineElementOp)(JSContext *cx, JSObject *obj, uint32 index, const Value *value,
+                    PropertyOp getter, StrictPropertyOp setter, uintN attrs);
+typedef JSBool
 (* PropertyIdOp)(JSContext *cx, JSObject *obj, JSObject *receiver, jsid id, Value *vp);
 typedef JSBool
+(* ElementIdOp)(JSContext *cx, JSObject *obj, JSObject *receiver, uint32 index, Value *vp);
+typedef JSBool
 (* StrictPropertyIdOp)(JSContext *cx, JSObject *obj, jsid id, Value *vp, JSBool strict);
 typedef JSBool
+(* StrictElementIdOp)(JSContext *cx, JSObject *obj, uint32 index, Value *vp, JSBool strict);
+typedef JSBool
 (* DeleteIdOp)(JSContext *cx, JSObject *obj, jsid id, Value *vp, JSBool strict);
 typedef JSBool
+(* DeleteElementOp)(JSContext *cx, JSObject *obj, uint32 index, Value *vp, JSBool strict);
+typedef JSBool
 (* CallOp)(JSContext *cx, uintN argc, Value *vp);
 typedef JSBool
 (* LookupPropOp)(JSContext *cx, JSObject *obj, jsid id, JSObject **objp,
                  JSProperty **propp);
 typedef JSBool
+(* LookupElementOp)(JSContext *cx, JSObject *obj, uint32 index, JSObject **objp,
+                    JSProperty **propp);
+typedef JSBool
 (* AttributesOp)(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp);
+typedef JSBool
+(* ElementAttributesOp)(JSContext *cx, JSObject *obj, uint32 index, uintN *attrsp);
 typedef JSType
 (* TypeOfOp)(JSContext *cx, JSObject *obj);
 typedef JSObject *
@@ -1058,12 +1072,20 @@ struct ClassExtension {
 
 struct ObjectOps {
     js::LookupPropOp        lookupProperty;
+    js::LookupElementOp     lookupElement;
     js::DefinePropOp        defineProperty;
+    js::DefineElementOp     defineElement;
     js::PropertyIdOp        getProperty;
+    js::ElementIdOp         getElement;
     js::StrictPropertyIdOp  setProperty;
+    js::StrictElementIdOp   setElement;
     js::AttributesOp        getAttributes;
+    js::ElementAttributesOp getElementAttributes;
     js::AttributesOp        setAttributes;
+    js::ElementAttributesOp setElementAttributes;
     js::DeleteIdOp          deleteProperty;
+    js::DeleteElementOp     deleteElement;
+
     js::NewEnumerateOp      enumerate;
     js::TypeOfOp            typeOf;
     js::FixOp               fix;
@@ -1071,7 +1093,9 @@ struct ObjectOps {
     js::FinalizeOp          clear;
 };
 
-#define JS_NULL_OBJECT_OPS  {NULL,NULL,NULL,NULL,NULL,NULL, NULL,NULL,NULL,NULL,NULL,NULL}
+#define JS_NULL_OBJECT_OPS                                                    \
+    {NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,   \
+     NULL,NULL,NULL,NULL,NULL}
 
 struct Class {
     JS_CLASS_MEMBERS;

js/src/jsweakmap.h

@@ -99,7 +99,7 @@ namespace js {
 //        removing entries whose keys this function leaves unmarked should never
 //        make future lookups fail.
 //
-//        A typical definition of markIteratively would be:
+//        A typical definition of markEntryIfLive would be:
 //
 //          if (keyMarked(k) && !valueMarked(v)) {
 //              markObject(*v, "WeakMap entry value");
@@ -117,11 +117,12 @@ namespace js {
 //        in such a table could be live even when its key is not marked. The
 //        markEntryIfLive function for such a table would generally mark both k and v.
 //
-//     void markEntry(Key &k, Value &v)
-//        Mark the table entry's key and value, k and v, as reachable by the
-//        collector. WeakMap uses this function for non-marking tracers: other
-//        code using the GC heap tracing functions to map the heap for some
-//        purpose or other.
+//     void markEntry(Value &v)
+//        Mark the table entry's value v as reachable by the collector. WeakMap
+//        uses this function for non-marking tracers: other code using the GC
+//        heap tracing functions to map the heap for some purpose or other.
+//        This provides a conservative approximation of the true reachability
+//        relation of the heap graph.
 //
 //   If omitted, the MarkPolicy parameter defaults to js::DefaultMarkPolicy<Key,
 //   Value>, a policy template with the obvious definitions for some typical
@@ -197,7 +198,7 @@ class WeakMap : public HashMap<Key, Value, HashPolicy, RuntimeAllocPolicy>, publ
     void nonMarkingTrace(JSTracer *tracer) {
         MarkPolicy t(tracer);
         for (Range r = Base::all(); !r.empty(); r.popFront())
-            t.markEntry(r.front().key, r.front().value);
+            t.markEntry(r.front().value);
     }
 
     bool markIteratively(JSTracer *tracer) {
@@ -281,8 +282,7 @@ class DefaultMarkPolicy<JSObject *, Value> {
         markUnmarkedValue(v);
         return true;
     }
-    void markEntry(JSObject *k, const Value &v) {
-        js::gc::MarkObject(tracer, *k, "WeakMap entry key");
+    void markEntry(const Value &v) {
         js::gc::MarkValue(tracer, v, "WeakMap entry value");
     }
 };
@@ -302,8 +302,7 @@ class DefaultMarkPolicy<JSObject *, JSObject *> {
         }
         return false;
     }
-    void markEntry(JSObject *k, JSObject *v) {
-        js::gc::MarkObject(tracer, *k, "WeakMap entry key");
+    void markEntry(JSObject *v) {
         js::gc::MarkObject(tracer, *v, "WeakMap entry value");
     }
 };

js/src/jsxml.cpp

@@ -4733,6 +4733,16 @@ xml_lookupProperty(JSContext *cx, JSObject *obj, jsid id, JSObject **objp,
     return JS_TRUE;
 }
 
+static JSBool
+xml_lookupElement(JSContext *cx, JSObject *obj, uint32 index, JSObject **objp,
+                  JSProperty **propp)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return xml_lookupProperty(cx, obj, id, objp, propp);
+}
+
 static JSBool
 xml_defineProperty(JSContext *cx, JSObject *obj, jsid id, const Value *v,
                    PropertyOp getter, StrictPropertyOp setter, uintN attrs)
@@ -4747,6 +4757,16 @@ xml_defineProperty(JSContext *cx, JSObject *obj, jsid id, const Value *v,
     return PutProperty(cx, obj, id, false, &tmp);
 }
 
+static JSBool
+xml_defineElement(JSContext *cx, JSObject *obj, uint32 index, const Value *v,
+                  PropertyOp getter, StrictPropertyOp setter, uintN attrs)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return xml_defineProperty(cx, obj, id, v, getter, setter, attrs);
+}
+
 static JSBool
 xml_getProperty(JSContext *cx, JSObject *obj, JSObject *receiver, jsid id, Value *vp)
 {
@@ -4758,12 +4778,30 @@ xml_getProperty(JSContext *cx, JSObject *obj, JSObject *receiver, jsid id, Value
     return GetProperty(cx, obj, id, Jsvalify(vp));
 }
 
+static JSBool
+xml_getElement(JSContext *cx, JSObject *obj, JSObject *receiver, uint32 index, Value *vp)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return xml_getProperty(cx, obj, receiver, id, vp);
+}
+
 static JSBool
 xml_setProperty(JSContext *cx, JSObject *obj, jsid id, Value *vp, JSBool strict)
 {
     return PutProperty(cx, obj, id, strict, Jsvalify(vp));
 }
 
+static JSBool
+xml_setElement(JSContext *cx, JSObject *obj, uint32 index, Value *vp, JSBool strict)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return xml_setProperty(cx, obj, id, vp, strict);
+}
+
 static JSBool
 xml_getAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp)
 {
@@ -4775,6 +4813,15 @@ xml_getAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp)
     return JS_TRUE;
 }
 
+static JSBool
+xml_getElementAttributes(JSContext *cx, JSObject *obj, uint32 index, uintN *attrsp)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return xml_getAttributes(cx, obj, id, attrsp);
+}
+
 static JSBool
 xml_setAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp)
 {
@@ -4790,6 +4837,15 @@ xml_setAttributes(JSContext *cx, JSObject *obj, jsid id, uintN *attrsp)
     return true;
 }
 
+static JSBool
+xml_setElementAttributes(JSContext *cx, JSObject *obj, uint32 index, uintN *attrsp)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return xml_setAttributes(cx, obj, id, attrsp);
+}
+
 static JSBool
 xml_deleteProperty(JSContext *cx, JSObject *obj, jsid id, Value *rval, JSBool strict)
 {
@@ -4835,6 +4891,15 @@ xml_deleteProperty(JSContext *cx, JSObject *obj, jsid id, Value *rval, JSBool st
     return true;
 }
 
+static JSBool
+xml_deleteElement(JSContext *cx, JSObject *obj, uint32 index, Value *rval, JSBool strict)
+{
+    jsid id;
+    if (!IndexToId(cx, index, &id))
+        return false;
+    return xml_deleteProperty(cx, obj, id, rval, strict);
+}
+
 static JSString *
 xml_toString_helper(JSContext *cx, JSXML *xml);
 
@@ -5134,12 +5199,19 @@ JS_FRIEND_DATA(Class) js::XMLClass = {
     JS_NULL_CLASS_EXT,
     {
         xml_lookupProperty,
+        xml_lookupElement,
         xml_defineProperty,
+        xml_defineElement,
         xml_getProperty,
+        xml_getElement,
         xml_setProperty,
+        xml_setElement,
         xml_getAttributes,
+        xml_getElementAttributes,
         xml_setAttributes,
+        xml_setElementAttributes,
         xml_deleteProperty,
+        xml_deleteElement,
         xml_enumerate,
         xml_typeOf,
         xml_fix,

js/src/methodjit/MethodJIT.cpp

@@ -1138,21 +1138,21 @@ mjit::JITScript::~JITScript()
 }
 
 size_t
-JSScript::jitDataSize(size_t(*mus)(void *))
+JSScript::jitDataSize(JSUsableSizeFun usf)
 {
     size_t n = 0;
     if (jitNormal)
-        n += jitNormal->scriptDataSize(mus); 
+        n += jitNormal->scriptDataSize(usf); 
     if (jitCtor)
-        n += jitCtor->scriptDataSize(mus); 
+        n += jitCtor->scriptDataSize(usf); 
     return n;
 }
 
 /* Please keep in sync with Compiler::finishThisUp! */
 size_t
-mjit::JITScript::scriptDataSize(size_t(*mus)(void *))
+mjit::JITScript::scriptDataSize(JSUsableSizeFun usf)
 {
-    size_t usable = mus ? mus(this) : 0;
+    size_t usable = usf ? usf(this) : 0;
     return usable ? usable :
         sizeof(JITScript) +
         sizeof(NativeMapEntry) * nNmapPairs +

js/src/methodjit/MethodJIT.h

@@ -643,7 +643,8 @@ struct JITScript {
 
     void trace(JSTracer *trc);
 
-    size_t scriptDataSize(size_t(*mus)(void *));
+    /* |usf| can be NULL here, in which case the fallback size computation will be used. */
+    size_t scriptDataSize(JSUsableSizeFun usf);
 
     jsbytecode *nativeToPC(void *returnAddress, CallSite **pinline) const;
 

js/src/nanojit-import-rev

@@ -1 +1 @@
-55c10227eece4a02b593997eda3dedef39af7beb
+d66d2e24ef1688e3b6d47e824354f5a78ac22487

js/src/nanojit/Allocator.cpp

@@ -100,12 +100,13 @@ namespace nanojit
         }
     }
 
-    size_t Allocator::getBytesAllocated()
+    size_t Allocator::getBytesAllocated(size_t(*my_malloc_usable_size)(void *))
     {
         size_t n = 0;
         Chunk *c = current_chunk;
         while (c) {
-            n += c->size;
+            size_t usable = my_malloc_usable_size(c);
+            n += usable ? usable : c->size;
             c = c->prev;
         }
         return n;

js/src/nanojit/Allocator.h

@@ -90,7 +90,7 @@ namespace nanojit
             return p;
         }
 
-        size_t getBytesAllocated();
+        size_t getBytesAllocated(size_t(*my_malloc_usable_size)(void *));
 
     protected:
         void* allocSlow(size_t nbytes, bool fallible = false);

js/src/shell/js.cpp

@@ -4069,6 +4069,12 @@ MJitCodeStats(JSContext *cx, uintN argc, jsval *vp)
 
 #ifdef JS_METHODJIT
 
+static size_t
+zero_usable_size(void *p)
+{
+    return 0;
+}
+
 static void
 SumJitDataSizeCallback(JSContext *cx, void *data, void *thing,
                        JSGCTraceKind traceKind, size_t thingSize)
@@ -4076,7 +4082,11 @@ SumJitDataSizeCallback(JSContext *cx, void *data, void *thing,
     size_t *sump = static_cast<size_t *>(data);
     JS_ASSERT(traceKind == JSTRACE_SCRIPT);
     JSScript *script = static_cast<JSScript *>(thing);
-    *sump += script->jitDataSize(NULL);
+    /*
+     * Passing in zero_usable_size causes jitDataSize to fall back to its
+     * secondary size computation.
+     */
+    *sump += script->jitDataSize(zero_usable_size);
 }
 
 #endif

js/src/tests/js1_8/genexps/jstests.list

@@ -12,3 +12,4 @@ script regress-634472.js
 script regress-665286.js
 script regress-666852.js
 script regress-667131.js
+script regress-683738.js

js/src/tests/js1_8/genexps/regress-683738.js

@@ -0,0 +1,103 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is JavaScript Engine testing utilities.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2007
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s): Dave Herman
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 683738;
+var summary = 'return with argument and lazy generator detection';
+var actual = '';
+var expect = '';
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+  expect = "generator function foo returns a value";
+  try
+  {
+    actual = 'No Error';
+    eval("function foo(x) { if (x) { return this; } else { yield 3; } }");
+  }
+  catch(ex)
+  {
+    actual = ex.message;
+  }
+  reportCompare(expect, actual, summary + ": 1");
+
+  expect = "generator function foo returns a value";
+  try
+  {
+    actual = 'No Error';
+    eval("function foo(x) { if (x) { yield 3; } else { return this; } }");
+  }
+  catch(ex)
+  {
+    actual = ex.message;
+  }
+  reportCompare(expect, actual, summary + ": 2");
+
+  expect = "generator function foo returns a value";
+  try
+  {
+    actual = 'No Error';
+    eval("function foo(x) { if (x) { return this; } else { (yield 3); } }");
+  }
+  catch(ex)
+  {
+    actual = ex.message;
+  }
+  reportCompare(expect, actual, summary + ": 3");
+
+  expect = "generator function foo returns a value";
+  try
+  {
+    actual = 'No Error';
+    eval("function foo(x) { if (x) { (yield 3); } else { return this; } }");
+  }
+  catch(ex)
+  {
+    actual = ex.message;
+  }
+  reportCompare(expect, actual, summary + ": 4");
+
+}

js/src/vm/String.cpp

@@ -83,7 +83,7 @@ JSLinearString::mark(JSTracer *)
 }
 
 size_t
-JSString::charsHeapSize()
+JSString::charsHeapSize(JSUsableSizeFun usf)
 {
     /* JSRope: do nothing, we'll count all children chars when we hit the leaf strings. */
     if (isRope())
@@ -98,8 +98,11 @@ JSString::charsHeapSize()
     JS_ASSERT(isFlat());
 
     /* JSExtensibleString: count the full capacity, not just the used space. */
-    if (isExtensible())
-        return asExtensible().capacity() * sizeof(jschar);
+    if (isExtensible()) {
+        JSExtensibleString &extensible = asExtensible();
+        size_t usable = usf((void *)extensible.chars());
+        return usable ? usable : asExtensible().capacity() * sizeof(jschar);
+    }
 
     JS_ASSERT(isFixed());
 
@@ -116,7 +119,9 @@ JSString::charsHeapSize()
         return 0;
 
     /* JSAtom, JSFixedString: count the chars. */
-    return length() * sizeof(jschar);
+    JSFixedString &fixed = asFixed();
+    size_t usable = usf((void *)fixed.chars());
+    return usable ? usable : length() * sizeof(jschar);
 }
 
 static JS_ALWAYS_INLINE bool

js/src/vm/String.h

@@ -411,7 +411,7 @@ class JSString : public js::gc::Cell
 
     /* Gets the number of bytes that the chars take on the heap. */
 
-    JS_FRIEND_API(size_t) charsHeapSize();
+    JS_FRIEND_API(size_t) charsHeapSize(JSUsableSizeFun usf);
 
     /* Offsets for direct field from jit code. */
 

js/src/xpconnect/idl/nsIXPCScriptable.idl

@@ -108,6 +108,7 @@ interface nsIXPCScriptable : nsISupports
     const PRUint32 DONT_REFLECT_INTERFACE_NAMES     = 1 << 27;
     const PRUint32 WANT_EQUALITY                    = 1 << 28;
     const PRUint32 WANT_OUTER_OBJECT                = 1 << 29;
+    const PRUint32 USE_STUB_EQUALITY_HOOK           = 1 << 30;
 
     // The high order bit is RESERVED for consumers of these flags. 
     // No implementor of this interface should ever return flags 

js/src/xpconnect/idl/nsIXPConnect.idl

@@ -392,7 +392,7 @@ interface nsIXPCFunctionThisTranslator : nsISupports
     { 0xbd, 0xd6, 0x0, 0x0, 0x64, 0x65, 0x73, 0x74 } }
 %}
 
-[uuid(f99ffb06-4e7b-4bab-83d4-7d573235a08a)]
+[uuid(a995b541-d514-43f1-ac0e-f49746c0b063)]
 interface nsIXPConnect : nsISupports
 {
 %{ C++
@@ -724,13 +724,6 @@ interface nsIXPConnect : nsISupports
     [noscript,notxpcom] void noteJSContext(in JSContextPtr aJSContext,
                                            in nsCCTraversalCallbackRef aCb);
 
-    /**
-     * Get the JSEqualityOp pointer to use for identifying JSObjects that hold
-     * a pointer to a nsIXPConnectWrappedNative or to the native in their
-     * private date. See IS_WRAPPER_CLASS in xpcprivate.h for details.
-     */
-    void GetXPCWrappedNativeJSClassInfo(out JSEqualityOp equality);
-
     /**
      * Whether or not XPConnect should report all JS exceptions when returning
      * from JS into C++. False by default, although any value set in the

js/src/xpconnect/src/nsXPConnect.cpp

@@ -2108,18 +2108,6 @@ nsXPConnect::EvalInSandboxObject(const nsAString& source, JSContext *cx,
                              JSVERSION_DEFAULT, returnStringOnly, rval);
 }
 
-/* void GetXPCWrappedNativeJSClassInfo(out JSEqualityOp equality); */
-NS_IMETHODIMP
-nsXPConnect::GetXPCWrappedNativeJSClassInfo(JSEqualityOp *equality)
-{
-    // Expose the equality pointer used by IS_WRAPPER_CLASS(). If that macro
-    // ever changes, this function needs to stay in sync.
-
-    *equality = &XPC_WN_Equality;
-
-    return NS_OK;
-}
-
 /* nsIXPConnectJSObjectHolder getWrappedNativePrototype (in JSContextPtr aJSContext, in JSObjectPtr aScope, in nsIClassInfo aClassInfo); */
 NS_IMETHODIMP 
 nsXPConnect::GetWrappedNativePrototype(JSContext * aJSContext, 

js/src/xpconnect/src/xpcjsruntime.cpp

@@ -1268,7 +1268,7 @@ PRInt64
 GetCompartmentTjitDataAllocatorsMainSize(JSCompartment *c)
 {
     return c->hasTraceMonitor()
-         ? c->traceMonitor()->getVMAllocatorsMainSize()
+         ? c->traceMonitor()->getVMAllocatorsMainSize(moz_malloc_usable_size)
          : 0;
 }
 
@@ -1276,7 +1276,7 @@ PRInt64
 GetCompartmentTjitDataAllocatorsReserveSize(JSCompartment *c)
 {
     return c->hasTraceMonitor()
-         ? c->traceMonitor()->getVMAllocatorsReserveSize()
+         ? c->traceMonitor()->getVMAllocatorsReserveSize(moz_malloc_usable_size)
          : 0;
 }
 
@@ -1284,7 +1284,7 @@ PRInt64
 GetCompartmentTjitDataTraceMonitorSize(JSCompartment *c)
 {
     return c->hasTraceMonitor()
-         ? c->traceMonitor()->getTraceMonitorSize()
+         ? c->traceMonitor()->getTraceMonitorSize(moz_malloc_usable_size)
          : 0;
 }
 
@@ -1352,27 +1352,20 @@ CellCallback(JSContext *cx, void *vdata, void *thing, JSGCTraceKind traceKind,
         case JSTRACE_STRING:
         {
             JSString *str = static_cast<JSString *>(thing);
-            curr->stringChars += str->charsHeapSize();
+            curr->stringChars += str->charsHeapSize(moz_malloc_usable_size);
             break;
         }
         case JSTRACE_SHAPE:
         {
             js::Shape *shape = static_cast<js::Shape *>(thing);
-            if(shape->hasTable())
-                curr->propertyTables +=
-                    shape->getTable()->sizeOf(moz_malloc_usable_size);
+            curr->propertyTables += shape->sizeOfPropertyTable(moz_malloc_usable_size);
+            curr->shapeKids += shape->sizeOfKids(moz_malloc_usable_size);
             break;
         }
         case JSTRACE_SCRIPT:
         {
             JSScript *script = static_cast<JSScript *>(thing);
-#if JS_SCRIPT_INLINE_DATA_LIMIT
-            if (script->data != script->inlineData)
-#endif
-            {
-                size_t usable = moz_malloc_usable_size(script->data);
-                curr->scriptData += usable ? usable : script->dataSize();
-            }
+            curr->scriptData += script->dataSize(moz_malloc_usable_size);
 #ifdef JS_METHODJIT
             curr->mjitData += script->jitDataSize(moz_malloc_usable_size);
 #endif
@@ -1602,8 +1595,12 @@ CollectCompartmentStatsForRuntime(JSRuntime *rt, IterateData *data)
             data->stackSize += i.threadData()->stackSpace.committedSize();
 
         size_t usable = moz_malloc_usable_size(rt);
-        data->runtimeObjectSize += usable ? usable : sizeof(JSRuntime);
-        data->atomsTableSize += rt->atomState.atoms.tableSize();
+        data->runtimeObjectSize = usable ? usable : sizeof(JSRuntime);
+
+        // Nb: |countMe| is false because atomState.atoms is within JSRuntime,
+        // and so counted when JSRuntime is counted.
+        data->atomsTableSize =
+            rt->atomState.atoms.sizeOf(moz_malloc_usable_size, /* countMe */false);
     }
 
     JS_DestroyContextNoGC(cx);
@@ -1762,6 +1759,14 @@ ReportCompartmentStats(const CompartmentStats &stats,
     "Arrays attached to prototype JS objects managing shape information.",
                        callback, closure);
 
+    ReportMemoryBytes0(MakeMemoryReporterPath(pathPrefix, stats.name,
+                                              "shape-kids"),
+                       nsIMemoryReporter::KIND_HEAP, stats.shapeKids,
+    "Memory allocated for the compartment's shape kids.  A shape kid "
+    "is an internal data structure that makes JavaScript property accesses "
+    "fast.",
+                       callback, closure);
+
     ReportMemoryBytes0(MakeMemoryReporterPath(pathPrefix, stats.name,
                                               "script-data"),
                        nsIMemoryReporter::KIND_HEAP, stats.scriptData,

js/src/xpconnect/src/xpcprivate.h

@@ -1389,12 +1389,19 @@ XPC_WN_JSOp_ThisObject(JSContext *cx, JSObject *obj);
 #define XPC_WN_WithCall_ObjectOps                                             \
     {                                                                         \
         nsnull, /* lookupProperty */                                          \
+        nsnull, /* lookupElement */                                           \
         nsnull, /* defineProperty */                                          \
+        nsnull, /* defineElement */                                           \
         nsnull, /* getProperty    */                                          \
+        nsnull, /* getElement    */                                           \
         nsnull, /* setProperty    */                                          \
+        nsnull, /* setElement    */                                           \
         nsnull, /* getAttributes  */                                          \
+        nsnull, /* getElementAttributes  */                                   \
         nsnull, /* setAttributes  */                                          \
+        nsnull, /* setElementAttributes  */                                   \
         nsnull, /* deleteProperty */                                          \
+        nsnull, /* deleteElement */                                           \
         js::Valueify(XPC_WN_JSOp_Enumerate),                                  \
         XPC_WN_JSOp_TypeOf_Function,                                          \
         nsnull, /* fix            */                                          \
@@ -1405,12 +1412,19 @@ XPC_WN_JSOp_ThisObject(JSContext *cx, JSObject *obj);
 #define XPC_WN_NoCall_ObjectOps                                               \
     {                                                                         \
         nsnull, /* lookupProperty */                                          \
+        nsnull, /* lookupElement */                                           \
         nsnull, /* defineProperty */                                          \
+        nsnull, /* defineElement */                                           \
         nsnull, /* getProperty    */                                          \
+        nsnull, /* getElement    */                                           \
         nsnull, /* setProperty    */                                          \
+        nsnull, /* setElement    */                                           \
         nsnull, /* getAttributes  */                                          \
+        nsnull, /* getElementAttributes  */                                   \
         nsnull, /* setAttributes  */                                          \
+        nsnull, /* setElementAttributes  */                                   \
         nsnull, /* deleteProperty */                                          \
+        nsnull, /* deleteElement */                                           \
         js::Valueify(XPC_WN_JSOp_Enumerate),                                  \
         XPC_WN_JSOp_TypeOf_Object,                                            \
         nsnull, /* fix            */                                          \
@@ -1952,6 +1966,7 @@ public:
     JSBool AllowPropModsToPrototype()     GET_IT(ALLOW_PROP_MODS_TO_PROTOTYPE)
     JSBool DontSharePrototype()           GET_IT(DONT_SHARE_PROTOTYPE)
     JSBool DontReflectInterfaceNames()    GET_IT(DONT_REFLECT_INTERFACE_NAMES)
+    JSBool UseStubEqualityHook()          GET_IT(USE_STUB_EQUALITY_HOOK)
 
 #undef GET_IT
 };

js/src/xpconnect/src/xpcpublic.h

@@ -75,11 +75,8 @@ xpc_LocalizeContext(JSContext *cx);
 nsresult
 xpc_MorphSlimWrapper(JSContext *cx, nsISupports *tomorph);
 
-extern JSBool
-XPC_WN_Equality(JSContext *cx, JSObject *obj, const jsval *v, JSBool *bp);
-
 #define IS_WRAPPER_CLASS(clazz)                                               \
-    (clazz->ext.equality == js::Valueify(XPC_WN_Equality))
+    ((clazz)->ext.isWrappedNative)
 
 inline JSBool
 DebugCheckWrapperClass(JSObject* obj)
@@ -207,6 +204,7 @@ struct CompartmentStats
     PRInt64 objectSlots;
     PRInt64 stringChars;
     PRInt64 propertyTables;
+    PRInt64 shapeKids;
     PRInt64 scriptData;
 
 #ifdef JS_METHODJIT

js/src/xpconnect/src/xpcwrappednativejsops.cpp

@@ -907,12 +907,19 @@ js::Class XPC_WN_NoHelper_JSClass = {
     // ObjectOps
     {
         nsnull, // lookupProperty
+        nsnull, // lookupElement
         nsnull, // defineProperty
+        nsnull, // defineElement
         nsnull, // getProperty
+        nsnull, // getElement
         nsnull, // setProperty
+        nsnull, // setElement
         nsnull, // getAttributes
+        nsnull, // getElementAttributes
         nsnull, // setAttributes
+        nsnull, // setElementAttributes
         nsnull, // deleteProperty
+        nsnull, // deleteElement
         JS_VALUEIFY(js::NewEnumerateOp, XPC_WN_JSOp_Enumerate),
         XPC_WN_JSOp_TypeOf_Object,
         nsnull, // fix
@@ -1541,8 +1548,17 @@ XPCNativeScriptableShared::PopulateJSClass(JSBool isGlobal)
         ops->typeOf = XPC_WN_JSOp_TypeOf_Object;
     }
 
-    // Equality is a required hook.
-    mJSClass.base.ext.equality = js::Valueify(XPC_WN_Equality);
+    if(mFlags.UseStubEqualityHook())
+    {
+        NS_ASSERTION(!mFlags.WantEquality(),
+                     "If you want an Equality callback, you can't use a stub "
+                     "equality hook");
+        mJSClass.base.ext.equality = nsnull;
+    }
+    else
+    {
+        mJSClass.base.ext.equality = js::Valueify(XPC_WN_Equality);
+    }
 
     if(mFlags.WantHasInstance())
         mJSClass.base.hasInstance = js::Valueify(XPC_WN_Helper_HasInstance);

layout/base/crashtests/crashtests.list

@@ -258,11 +258,9 @@ load 471594-1.xhtml
 load 479114-1.html
 load 477333-1.xhtml
 asserts-if(Android,6) load 477731-1.html
-# 479360-1.xhtml will assert 6 times due to bug 439258 and then make the test
-# after the test after it also assert 6 times.
-asserts-if(!Android,6) load 479360-1.xhtml # Bug 439258
+load 479360-1.xhtml
 asserts-if(Android,6) load 480686-1.html
-asserts-if(!Android,6) load 481806-1.html  # Bug 439258
+load 481806-1.html
 load 483604-1.xhtml
 load 485501-1.html
 load 487544-1.html

layout/base/nsDisplayList.cpp

@@ -2582,7 +2582,7 @@ PRBool nsDisplayTransform::ComputeVisibility(nsDisplayListBuilder *aBuilder,
                                aBuilder->ToReferenceFrame(mFrame);
   }
   nsRegion untransformedVisible = untransformedVisibleRect;
-  // Call RecomputeVisiblity instead of ComputeVisibilty since
+  // Call RecomputeVisiblity instead of ComputeVisibility since
   // nsDisplayItem::ComputeVisibility should only be called from
   // nsDisplayList::ComputeVisibility (which sets mVisibleRect on the item)
   mStoredList.RecomputeVisibility(aBuilder, &untransformedVisible);

layout/base/nsPresShell.cpp

@@ -1434,6 +1434,9 @@ public:
 protected:
   void QueryIsActive();
   nsresult UpdateImageLockingState();
+
+private:
+  nscolor GetDefaultBackgroundColorToDraw();
 };
 
 NS_IMPL_ISUPPORTS1(PresShell::MemoryReporter, nsIMemoryMultiReporter)
@@ -4044,13 +4047,19 @@ PresShell::ScrollToAnchor()
  * we should include the top of the line in the added rectangle
  * @param aRect [inout] rect into which its bounds should be unioned
  * @param aHaveRect [inout] whether aRect contains data yet
+ * @param aPrevBlock [inout] the block aLines is a line iterator for
+ * @param aLines [inout] the line iterator we're using
+ * @param aCurLine [inout] the line to start looking from in this iterator
  */
 static void
 AccumulateFrameBounds(nsIFrame* aContainerFrame,
                       nsIFrame* aFrame,
                       PRBool aUseWholeLineHeightForInlines,
                       nsRect& aRect,
-                      PRBool& aHaveRect)
+                      PRBool& aHaveRect,
+                      nsIFrame*& aPrevBlock,
+                      nsAutoLineIterator& aLines,
+                      PRInt32& aCurLine)
 {
   nsRect frameBounds = aFrame->GetRect() +
     aFrame->GetParent()->GetOffsetTo(aContainerFrame);
@@ -4073,17 +4082,22 @@ AccumulateFrameBounds(nsIFrame* aContainerFrame,
         f &&
         frameType == nsGkAtoms::blockFrame) {
       // find the line containing aFrame and increase the top of |offset|.
-      nsAutoLineIterator lines = f->GetLineIterator();
-      if (lines) {
-        PRInt32 index = lines->FindLineContaining(prevFrame);
+      if (f != aPrevBlock) {
+        aLines = f->GetLineIterator();
+        aPrevBlock = f;
+        aCurLine = 0;
+      }
+      if (aLines) {
+        PRInt32 index = aLines->FindLineContaining(prevFrame, aCurLine);
         if (index >= 0) {
+          aCurLine = index;
           nsIFrame *trash1;
           PRInt32 trash2;
           nsRect lineBounds;
           PRUint32 trash3;
 
-          if (NS_SUCCEEDED(lines->GetLine(index, &trash1, &trash2,
-                                          lineBounds, &trash3))) {
+          if (NS_SUCCEEDED(aLines->GetLine(index, &trash1, &trash2,
+                                           lineBounds, &trash3))) {
             lineBounds += f->GetOffsetTo(aContainerFrame);
             if (lineBounds.y < frameBounds.y) {
               frameBounds.height = frameBounds.YMost() - lineBounds.y;
@@ -4286,9 +4300,16 @@ PresShell::DoScrollContentIntoView(nsIContent* aContent,
   nsRect frameBounds;
   PRBool haveRect = PR_FALSE;
   PRBool useWholeLineHeightForInlines = aVPercent != NS_PRESSHELL_SCROLL_ANYWHERE;
+  // Reuse the same line iterator across calls to AccumulateFrameBounds.  We set
+  // it every time we detect a new block (stored in prevBlock).
+  nsIFrame* prevBlock = nsnull;
+  nsAutoLineIterator lines;
+  // The last line we found a continuation on in |lines|.  We assume that later
+  // continuations cannot come on earlier lines.
+  PRInt32 curLine = 0;
   do {
     AccumulateFrameBounds(container, frame, useWholeLineHeightForInlines,
-                          frameBounds, haveRect);
+                          frameBounds, haveRect, prevBlock, lines, curLine);
   } while ((frame = frame->GetNextContinuation()));
 
   ScrollFrameRectIntoView(container, frameBounds, aVPercent, aHPercent,
@@ -5833,6 +5854,14 @@ static PRBool IsTransparentContainerElement(nsPresContext* aPresContext)
          containerElement->HasAttr(kNameSpaceID_None, nsGkAtoms::transparent);
 }
 
+nscolor PresShell::GetDefaultBackgroundColorToDraw()
+{
+  if (!mPresContext || !mPresContext->GetBackgroundColorDraw()) {
+    return NS_RGB(255,255,255);
+  }
+  return mPresContext->DefaultBackgroundColor();
+}
+
 void PresShell::UpdateCanvasBackground()
 {
   // If we have a frame tree and it has style information that
@@ -5852,7 +5881,7 @@ void PresShell::UpdateCanvasBackground()
     if (GetPresContext()->IsRootContentDocument() &&
         !IsTransparentContainerElement(mPresContext)) {
       mCanvasBackgroundColor =
-        NS_ComposeColors(mPresContext->DefaultBackgroundColor(), mCanvasBackgroundColor);
+        NS_ComposeColors(GetDefaultBackgroundColorToDraw(), mCanvasBackgroundColor);
     }
   }
 
@@ -5860,7 +5889,7 @@ void PresShell::UpdateCanvasBackground()
   // then the document's background color does not get drawn; cache the
   // color we actually draw.
   if (!FrameConstructor()->GetRootElementFrame()) {
-    mCanvasBackgroundColor = mPresContext->DefaultBackgroundColor();
+    mCanvasBackgroundColor = GetDefaultBackgroundColorToDraw();
   }
 }
 
@@ -5875,7 +5904,7 @@ nscolor PresShell::ComputeBackstopColor(nsIView* aDisplayRoot)
   // Within an opaque widget (or no widget at all), so the backstop
   // color must be totally opaque. The user's default background
   // as reported by the prescontext is guaranteed to be opaque.
-  return GetPresContext()->DefaultBackgroundColor();
+  return GetDefaultBackgroundColorToDraw();
 }
 
 struct PaintParams {

layout/base/tests/test_reftests_with_caret.html

@@ -97,16 +97,12 @@ function endTest() {
 var isWindows = /WINNT/.test(SpecialPowers.OS);
 
 var tests = [
-    [ 'bug106855-1.html' , 'bug106855-1-ref.html' ] ,
     [ 'bug389321-1.html' , 'bug389321-1-ref.html' ] ,
     [ 'bug389321-2.html' , 'bug389321-2-ref.html' ] ,
     [ 'bug389321-3.html' , 'bug389321-3-ref.html' ] ,
     [ 'bug482484.html'   , 'bug482484-ref.html'   ] ,
     [ 'bug585922.html'   , 'bug585922-ref.html'   ] ,
-    [ 'bug602141-2.html' , 'bug602141-2-ref.html' ] ,
     [ 'bug602141-3.html' , 'bug602141-3-ref.html' ] ,
-    [ 'bug613433-2.html' , 'bug613433-ref.html' ] ,
-    [ 'bug613433-3.html' , 'bug613433-ref.html' ] ,
     [ 'bug632215-1.html' , 'bug632215-ref.html'   ] ,
     [ 'bug632215-2.html' , 'bug632215-ref.html'   ] ,
     [ 'bug633044-1.html' , 'bug633044-1-ref.html' ] ,
@@ -114,6 +110,7 @@ var tests = [
 ];
 
 if (!isWindows) {
+  tests.push([ 'bug106855-1.html' , 'bug106855-1-ref.html' ]); // bug 682837
   tests.push([ 'bug106855-2.html' , 'bug106855-1-ref.html' ]); // bug 681138
   tests.push([ 'bug240933-1.html' , 'bug240933-1-ref.html' ]); // bug 681144
   tests.push([ 'bug240933-2.html' , 'bug240933-1-ref.html' ]); // bug 681162
@@ -121,11 +118,14 @@ if (!isWindows) {
   tests.push([ 'bug512295-2.html' , 'bug512295-2-ref.html' ]); // bug 681331
   tests.push([ 'bug597519-1.html' , 'bug597519-1-ref.html' ]); // bug 680579
   tests.push([ 'bug602141-1.html' , 'bug602141-1-ref.html' ]); // bug 681334
+  tests.push([ 'bug602141-2.html' , 'bug602141-2-ref.html' ]); // bug 682836
   tests.push([ 'bug602141-4.html' , 'bug602141-4-ref.html' ]); // bug 681167
   tests.push([ 'bug612271-1.html' , 'bug612271-ref.html' ]);   // bug 681032
   tests.push([ 'bug612271-2.html' , 'bug612271-ref.html' ]);   // bug 680581
   tests.push([ 'bug612271-3.html' , 'bug612271-ref.html' ]);   // bug 681035
   tests.push([ 'bug613433-1.html' , 'bug613433-ref.html' ]);   // bug 681332
+  tests.push([ 'bug613433-2.html' , 'bug613433-ref.html' ]);   // bug 681332
+  tests.push([ 'bug613433-3.html' , 'bug613433-ref.html' ]);   // bug 681332
   tests.push([ 'bug613807-1.html' , 'bug613807-1-ref.html' ]); // bug 680574
   tests.push([ 'bug634406-1.html' , 'bug634406-1-ref.html' ]); // bug 681146
 }

layout/doc/obsolete/nav4-html.html

@@ -76,7 +76,7 @@ equivalents.
 <H3>
 Special Hacks</H3>
 The following list describes hacks added to the magellan parsing engine
-to deal with navigator compatability. These are just the parser hacks,
+to deal with navigator compatibility. These are just the parser hacks,
 not the layout or presentation hacks. Most hacks are intriduced for HTML
 syntax error recovering. HTML doesn't specify much how to handle those
 error conditions. Netscape has made big effort to render pages with non-prefect

layout/generic/nsIFrame.h

@@ -6,7 +6,7 @@
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
- * http://www.mozilla.org/MPL/I
+ * http://www.mozilla.org/MPL/
  *
  * Software distributed under the License is distributed on an "AS IS" basis,
  * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
@@ -561,7 +561,7 @@ public:
   /**
    * Destroys this frame and each of its child frames (recursively calls
    * Destroy() for each child). If this frame is a first-continuation, this
-   * also removes the frame from the primary frame man and clears undisplayed
+   * also removes the frame from the primary frame map and clears undisplayed
    * content for its content node.
    * If the frame is a placeholder, it also ensures the out-of-flow frame's
    * removal and destruction.

layout/generic/nsILineIterator.h

@@ -104,9 +104,12 @@ public:
 
   /**
    * Given a frame that's a child of the block, find which line its on
-   * and return that line index. Returns -1 if the frame cannot be found.
+   * and return that line index, as long as it's at least as big as
+   * aStartLine.  Returns -1 if the frame cannot be found on lines
+   * starting with aStartLine.
    */
-  virtual PRInt32 FindLineContaining(nsIFrame* aFrame) = 0;
+  virtual PRInt32 FindLineContaining(nsIFrame* aFrame,
+                                     PRInt32 aStartLine = 0) = 0;
 
   // Given a line number and an X coordinate, find the frame on the
   // line that is nearest to the X coordinate. The

layout/generic/nsImageMap.cpp

@@ -403,7 +403,7 @@ void RectArea::ParseCoords(const nsAString& aSpec)
 
 PRBool RectArea::IsInside(nscoord x, nscoord y) const
 {
-  if (mNumCoords >= 4) {       // Note: > is for nav compatability
+  if (mNumCoords >= 4) {       // Note: > is for nav compatibility
     nscoord x1 = mCoords[0];
     nscoord y1 = mCoords[1];
     nscoord x2 = mCoords[2];
@@ -638,7 +638,7 @@ void CircleArea::ParseCoords(const nsAString& aSpec)
 
 PRBool CircleArea::IsInside(nscoord x, nscoord y) const
 {
-  // Note: > is for nav compatability
+  // Note: > is for nav compatibility
   if (mNumCoords >= 3) {
     nscoord x1 = mCoords[0];
     nscoord y1 = mCoords[1];

layout/generic/nsLineBox.cpp

@@ -626,15 +626,16 @@ nsLineIterator::GetLine(PRInt32 aLineNumber,
 }
 
 PRInt32
-nsLineIterator::FindLineContaining(nsIFrame* aFrame)
+nsLineIterator::FindLineContaining(nsIFrame* aFrame, PRInt32 aStartLine)
 {
-  nsLineBox* line = mLines[0];
-  PRInt32 lineNumber = 0;
+  NS_PRECONDITION(aStartLine <= mNumLines, "Bogus line numbers");
+  PRInt32 lineNumber = aStartLine;
   while (lineNumber != mNumLines) {
+    nsLineBox* line = mLines[lineNumber];
     if (line->Contains(aFrame)) {
       return lineNumber;
     }
-    line = mLines[++lineNumber];
+    ++lineNumber;
   }
   return -1;
 }

layout/generic/nsLineBox.h

@@ -1581,7 +1581,7 @@ public:
                      PRInt32* aNumFramesOnLine,
                      nsRect& aLineBounds,
                      PRUint32* aLineFlags);
-  virtual PRInt32 FindLineContaining(nsIFrame* aFrame);
+  virtual PRInt32 FindLineContaining(nsIFrame* aFrame, PRInt32 aStartLine = 0);
   NS_IMETHOD FindFrameAt(PRInt32 aLineNumber,
                          nscoord aX,
                          nsIFrame** aFrameFound,

layout/reftests/editor/462758-grabbers-resizers-ref.html

@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+  <script type="text/javascript">
+    function init() {
+      var editor = document.querySelector("div[contenteditable]");
+      editor.addEventListener("focus", function() {
+        setTimeout(function() {
+          document.documentElement.className = "";
+        }, 0);
+      }, false);
+      editor.focus();
+    }
+  </script>
+  <style type="text/css">
+    html, body, div {
+      margin: 0;
+      padding: 0;
+    }
+    div {
+      border: 1px solid black;
+      margin: 50px;
+      height: 200px;
+      width: 200px;
+    }
+  </style>
+</head>
+<body onload="init()">
+  <div contenteditable>
+    this editable container should be neither draggable nor resizable.
+  </div>
+</body>
+</html>
+

layout/reftests/editor/462758-grabbers-resizers.html

@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+  <script type="text/javascript">
+    function init() {
+      var editor = document.querySelector("div[contenteditable]");
+      editor.addEventListener("focus", function() {
+        setTimeout(function() {
+          document.documentElement.className = "";
+        }, 0);
+      }, false);
+      editor.focus();
+    }
+  </script>
+  <style type="text/css">
+    html, body, div {
+      margin: 0;
+      padding: 0;
+    }
+    div {
+      border: 1px solid black;
+      margin: 50px;
+      height: 200px;
+      width: 200px;
+    }
+  </style>
+</head>
+<body onload="init()">
+  <div contenteditable style="position: absolute">
+    this editable container should be neither draggable nor resizable.
+  </div>
+</body>
+</html>

layout/reftests/editor/reftest.list

@@ -68,3 +68,4 @@ fails-if(Android) != spellcheck-hyphen-multiple-invalid.html spellcheck-hyphen-m
 skip-if(Android) == 674212-spellcheck.html 674212-spellcheck-ref.html
 skip-if(Android) == 338427-2.html 338427-2-ref.html
 skip-if(Android) == 338427-3.html 338427-3-ref.html
+skip-if(Android) == 462758-grabbers-resizers.html 462758-grabbers-resizers-ref.html

layout/style/nsRuleProcessorData.h

@@ -44,7 +44,7 @@
 #ifndef nsRuleProcessorData_h_
 #define nsRuleProcessorData_h_
 
-#include "nsPresContext.h" // for nsCompatability
+#include "nsPresContext.h" // for nsCompatibility
 #include "nsString.h"
 #include "nsChangeHint.h"
 #include "nsIContent.h"

layout/tables/nsTableFrame.h

@@ -553,8 +553,8 @@ protected:
   nscoord GetCollapsedWidth(nsMargin aBorderPadding);
 
   
-  /** Adjust the table for visibilty.collapse set on rowgroups, rows, colgroups
-    * and cols
+  /** Adjust the table for visibility.collapse set on rowgroups, rows,
+    * colgroups and cols
     * @param aDesiredSize    the metrics of the table
     * @param aBorderPadding  the border and padding of the table
     */

layout/tables/nsTableRowGroupFrame.cpp

@@ -1706,14 +1706,16 @@ nsTableRowGroupFrame::GetLine(PRInt32    aLineNumber,
 }
   
 PRInt32
-nsTableRowGroupFrame::FindLineContaining(nsIFrame* aFrame)
+nsTableRowGroupFrame::FindLineContaining(nsIFrame* aFrame, PRInt32 aStartLine)
 {
   NS_ENSURE_ARG_POINTER(aFrame);
   
   nsTableRowFrame *rowFrame = do_QueryFrame(aFrame);
   NS_ASSERTION(rowFrame, "RowGroup contains a frame that is not a row");
 
-  return rowFrame->GetRowIndex() - GetStartRowIndex();
+  PRInt32 rowIndexInGroup = rowFrame->GetRowIndex() - GetStartRowIndex();
+
+  return rowIndexInGroup >= aStartLine ? rowIndexInGroup : -1;
 }
 
 #ifdef IBMBIDI

layout/tables/nsTableRowGroupFrame.h

@@ -258,10 +258,12 @@ public:
   
   /** Given a frame that's a child of the rowgroup, find which line its on.
     * @param aFrame       - frame, should be a row
+    * @param aStartLine   - minimal index to return
     * @return               row index relative to the row group if this a row
-    *                       frame. -1 if the frame cannot be found.
+    *                       frame and the index is at least aStartLine.
+    *                       -1 if the frame cannot be found.
     */
-  virtual PRInt32 FindLineContaining(nsIFrame* aFrame);
+  virtual PRInt32 FindLineContaining(nsIFrame* aFrame, PRInt32 aStartLine = 0);
 
   /** Find the orginating cell frame on a row that is the nearest to the
     * coordinate X.

mfbt/Util.h

@@ -165,6 +165,12 @@ struct DebugOnly
         value = rhs;
         return *this;
     }
+    void operator++(int) {
+        value++;
+    }
+    void operator--(int) {
+        value--;
+    }
 
     operator T&() { return value; }
     operator const T&() const { return value; }
@@ -175,6 +181,8 @@ struct DebugOnly
     DebugOnly() {}
     DebugOnly(const T&) {}
     DebugOnly& operator=(const T&) { return *this; }
+    void operator++(int) {}
+    void operator--(int) {}
 #endif
 
     /*

mobile/chrome/content/bindings/arrowbox.xml

@@ -45,7 +45,7 @@
     <content orient="vertical">
       <xul:box anonid="container" class="panel-arrowcontainer" flex="1">
         <xul:box anonid="arrowbox" class="panel-arrowbox" dir="ltr">
-          <xul:image anonid="arrow" class="panel-arrow"/>
+          <xul:image anonid="arrow" class="panel-arrow" xbl:inherits="type"/>
         </xul:box>
         <xul:scrollbox anonid="arrowcontent" class="panel-arrowcontent" flex="1">
           <xul:box class="panel-inner-arrowcontent" xbl:inherits="align,dir,orient,pack,flex">

mobile/chrome/content/browser.xul

@@ -316,7 +316,7 @@
     </arrowbox>
 
     <!-- popup for site identity information -->
-    <arrowbox id="identity-container" hidden="true" mode="unknownIdentity" offset="18" flex="1">
+    <arrowbox id="identity-container" hidden="true" mode="unknownIdentity" offset="18" flex="1" type="dialog">
       <hbox id="identity-popup-container" flex="1" align="top">
         <image id="identity-popup-icon"/>
         <vbox id="identity-popup-content-box" flex="1">
@@ -359,7 +359,7 @@
       </hbox>
     </arrowbox>
 
-    <arrowbox id="bookmark-popup" hidden="true" align="stretch" offset="12">
+    <arrowbox id="bookmark-popup" hidden="true" align="stretch" offset="12" type="dialog">
       <hbox id="bookmark-popup-title">
         <label value="&bookmarkPopup.label;"/>
       </hbox>
@@ -391,7 +391,7 @@
       </dialog>
     </box>
 
-    <arrowbox id="appmenu-popup" hidden="true">
+    <arrowbox id="appmenu-popup" hidden="true" type="dialog">
       <box id="appmenu-popup-sitecommands"/>
       <richlistbox id="appmenu-popup-appcommands"/>
     </arrowbox>

mobile/chrome/content/common-ui.js

@@ -1349,21 +1349,6 @@ var SelectionHelper = {
 
   handleEvent: function handleEvent(aEvent) {
     switch (aEvent.type) {
-      case "PanBegin":
-        window.removeEventListener("PanBegin", this, true);
-        window.removeEventListener("TapUp", this, true);
-        window.addEventListener("PanFinished", this, true);
-        this._start.hidden = true;
-        this._end.hidden = true;
-        break;
-      case "PanFinished":
-        window.removeEventListener("PanFinished", this, true);
-        try {
-          this.popupState.target.messageManager.sendAsyncMessage("Browser:SelectionMeasure", {});
-        } catch (e) {
-          Cu.reportError(e);
-        }
-        break
       case "TapDown":
         if (aEvent.target == this._start || aEvent.target == this._end) {
           this.target = aEvent.target;
@@ -1371,22 +1356,14 @@ var SelectionHelper = {
           this.deltaY = (aEvent.clientY - this.target.top);
           window.addEventListener("TapMove", this, true);
         } else {
-          window.addEventListener("PanBegin", this, true);
-          window.addEventListener("TapUp", this, true);
-          this.target = null;
+          this.hide(aEvent);
         }
         break;
       case "TapUp":
-        if (this.target) {
-          window.removeEventListener("TapMove", this, true);
-          this.target = null;
-          this.deltaX = -1;
-          this.deltaY = -1;
-        } else {
-          window.removeEventListener("PanBegin", this, true);
-          window.removeEventListener("TapUp", this, true);
-          this.hide(aEvent);
-        }
+        window.removeEventListener("TapMove", this, true);
+        this.target = null;
+        this.deltaX = -1;
+        this.deltaY = -1;
         break;
       case "TapMove":
         if (this.target) {
@@ -1406,14 +1383,6 @@ var SelectionHelper = {
       case "resize":
       case "SizeChanged":
       case "ZoomChanged":
-      {
-        try {
-          this.popupState.target.messageManager.sendAsyncMessage("Browser:SelectionMeasure", {});
-        } catch (e) {
-          Cu.reportError(e);
-        }
-        break        
-      }
       case "URLChanged":
       case "keypress":
         this.hide(aEvent);

mobile/chrome/content/content.js

@@ -1353,7 +1353,6 @@ var SelectionHandler = {
     addMessageListener("Browser:SelectionStart", this);
     addMessageListener("Browser:SelectionEnd", this);
     addMessageListener("Browser:SelectionMove", this);
-    addMessageListener("Browser:SelectionMeasure", this);
   },
 
   getCurrentWindowAndOffset: function(x, y, offset) {
@@ -1401,11 +1400,12 @@ var SelectionHandler = {
         let selection = contentWindow.getSelection();
         selection.removeAllRanges();
 
+          // Position the caret using a fake mouse click
+          utils.sendMouseEventToWindow("mousedown", x, y, 0, 1, 0, true);
+          utils.sendMouseEventToWindow("mouseup", x, y, 0, 1, 0, true);
+
         try {
-          let caretPos = contentWindow.document.caretPositionFromPoint(json.x - scrollOffset.x, json.y - scrollOffset.y);
           let selcon = currentDocShell.QueryInterface(Ci.nsIInterfaceRequestor).getInterface(Ci.nsISelectionDisplay).QueryInterface(Ci.nsISelectionController);
-          let sel = selcon.getSelection(1);
-          sel.collapse(caretPos.offsetNode, caretPos.offset);
 
           // Select the word nearest the caret
           selcon.wordMove(false, false);
@@ -1462,41 +1462,36 @@ var SelectionHandler = {
         break;
       }
 
-      case "Browser:SelectionMove":
+      case "Browser:SelectionMove": {
         if (!this.contentWindow)
           return;
 
-        let x = json.x - scrollOffset.x;
-        let y = json.y - scrollOffset.y;
+        // Hack to avoid setting focus in a textbox [Bugs 654352 & 667243]
+        let elemUnder = elementFromPoint(json.x - scrollOffset.x, json.y - scrollOffset.y);
+        if (elemUnder && elemUnder instanceof Ci.nsIDOMHTMLInputElement || elemUnder instanceof Ci.nsIDOMHTMLTextAreaElement)
 
-        try {
-          let caretPos = this.contentWindow.document.caretPositionFromPoint(x, y);
-          if (caretPos.offsetNode == null ||
-              caretPos.offsetNode instanceof Ci.nsIDOMHTMLInputElement || 
-              caretPos.offsetNode instanceof Ci.nsIDOMHTMLTextAreaElement ||
-              caretPos.offsetNode.ownerDocument.defaultView != this.contentWindow)
-            return;
-
-          // Keep the cache in "client" coordinates
-          if (json.type == "end")
-            this.cache.end = { x: json.x, y: json.y };
-          else
-            this.cache.start = { x: json.x, y: json.y };
-
-          let currentDocShell = this.contentWindow.QueryInterface(Ci.nsIInterfaceRequestor).getInterface(Ci.nsIWebNavigation).QueryInterface(Ci.nsIDocShell);
-          let selcon = currentDocShell.QueryInterface(Ci.nsIInterfaceRequestor).getInterface(Ci.nsISelectionDisplay).QueryInterface(Ci.nsISelectionController);
-          let sel = selcon.getSelection(1);
-          if (json.type != "end") {
-            let focusOffset = sel.focusOffset;
-            let focusNode = sel.focusNode;
-            sel.collapse(caretPos.offsetNode, caretPos.offset);
-            sel.extend(focusNode, focusOffset);
-          } else {
-            sel.extend(caretPos.offsetNode, caretPos.offset);
-          }
-        } catch(e) {
-          Cu.reportError(e);
+        // Limit the selection to the initial content window (don't leave or enter iframes)
+        if (elemUnder && elemUnder.ownerDocument.defaultView != this.contentWindow)
           return;
+        
+        // Use fake mouse events to update the selection
+        if (json.type == "end") {
+          // Keep the cache in "client" coordinates, but translate for the mouse event
+          this.cache.end = { x: json.x, y: json.y };
+          let end = { x: this.cache.end.x - scrollOffset.x, y: this.cache.end.y - scrollOffset.y };
+          utils.sendMouseEventToWindow("mousedown", end.x, end.y, 0, 1, Ci.nsIDOMNSEvent.SHIFT_MASK, true);
+          utils.sendMouseEventToWindow("mouseup", end.x, end.y, 0, 1, Ci.nsIDOMNSEvent.SHIFT_MASK, true);
+        } else {
+          // Keep the cache in "client" coordinates, but translate for the mouse event
+          this.cache.start = { x: json.x, y: json.y };
+          let start = { x: this.cache.start.x - scrollOffset.x, y: this.cache.start.y - scrollOffset.y };
+          let end = { x: this.cache.end.x - scrollOffset.x, y: this.cache.end.y - scrollOffset.y };
+        
+          utils.sendMouseEventToWindow("mousedown", start.x, start.y, 0, 0, 0, true);
+          utils.sendMouseEventToWindow("mouseup", start.x, start.y, 0, 0, 0, true);
+        
+          utils.sendMouseEventToWindow("mousedown", end.x, end.y, 0, 1, Ci.nsIDOMNSEvent.SHIFT_MASK, true);
+          utils.sendMouseEventToWindow("mouseup", end.x, end.y, 0, 1, Ci.nsIDOMNSEvent.SHIFT_MASK, true);
         }
 
         // Cache the selected text since the selection might be gone by the time we get the "end" message
@@ -1507,28 +1502,6 @@ var SelectionHandler = {
         let range = selection.getRangeAt(0).QueryInterface(Ci.nsIDOMNSRange);
         this.cache.rect = this._extractFromRange(range, this.cache.offset).rect;
         break;
-      case "Browser:SelectionMeasure": {
-        if (!this.contentWindow)
-          return;
-
-        let selection = this.contentWindow.getSelection();
-        let range = selection.getRangeAt(0).QueryInterface(Ci.nsIDOMNSRange);
-        if (!range)
-          return;
-
-        // Cache the selected text since the selection might be gone by the time we get the "end" message
-        this.selectedText = selection.toString().trim();
-
-        // If the range didn't have any text, let's bail
-        if (!this.selectedText.length) {
-          selection.removeAllRanges();
-          return;
-        }
-
-        this.cache = this._extractFromRange(range, this.cache.offset);
-
-        sendAsyncMessage("Browser:SelectionRange", this.cache);
-        break;
       }
     }
   },

mobile/chrome/content/downloads.js

@@ -350,7 +350,7 @@ var DownloadsView = {
     }
     else if (today - end < (24 * 60 * 60 * 1000)) {
       // Download finished after yesterday started, show yesterday
-      dateTime = strings.GetStringFromName("donwloadsYesterday");
+      dateTime = strings.GetStringFromName("downloadsYesterday");
     }
     else if (today - end < (6 * 24 * 60 * 60 * 1000)) {
       // Download finished after last week started, show day of week

mobile/chrome/content/extensions.js

@@ -221,17 +221,6 @@ var ExtensionsView = {
     let os = Services.obs;
     os.addObserver(this, "addon-update-started", false);
     os.addObserver(this, "addon-update-ended", false);
-
-    if (!Services.prefs.getBoolPref("extensions.hideUpdateButton"))
-      document.getElementById("addons-update-all").hidden = false;
-
-#ifdef ANDROID
-    // Hide the notification
-    let alertsService = Cc["@mozilla.org/alerts-service;1"].getService(Ci.nsIAlertsService);
-    let progressListener = alertsService.QueryInterface(Ci.nsIAlertsProgressListener);
-    if (progressListener)
-      progressListener.onCancel(ADDONS_NOTIFICATION_NAME);
-#endif
   },
 
   delayedInit: function ev__delayedInit() {
@@ -259,6 +248,9 @@ var ExtensionsView = {
     this._strings["addonType.locale"] = strings.GetStringFromName("addonType.8");
     this._strings["addonType.search"] = strings.GetStringFromName("addonType.1024");
 
+    if (!Services.prefs.getBoolPref("extensions.hideUpdateButton"))
+      document.getElementById("addons-update-all").hidden = false;
+
     let self = this;
     setTimeout(function() {
       self.getAddonsFromLocal();
@@ -272,6 +264,8 @@ var ExtensionsView = {
     os.removeObserver(this, "addon-update-ended");
 
     AddonManager.removeInstallListener(this._dloadmgr);
+
+    this.hideAlerts();
   },
 
   hideOnSelect: function ev_handleEvent(aEvent) {
@@ -840,6 +834,10 @@ var ExtensionsView = {
         let alerts = Cc["@mozilla.org/alerts-service;1"].getService(Ci.nsIAlertsService);
         alerts.showAlertNotification(URI_GENERIC_ICON_XPINSTALL, strings.GetStringFromName("alertAddons"),
                                      aMessage, true, "", observer, ADDONS_NOTIFICATION_NAME);
+
+        // Use a preference to help us cleanup this notification in case we don't shutdown correctly
+        Services.prefs.setBoolPref("browser.notifications.pending.addons", true);
+        Services.prefs.savePrefFile(null);
       }
     }
   },
@@ -848,8 +846,12 @@ var ExtensionsView = {
 #ifdef ANDROID
     let alertsService = Cc["@mozilla.org/alerts-service;1"].getService(Ci.nsIAlertsService);
     let progressListener = alertsService.QueryInterface(Ci.nsIAlertsProgressListener);
-    progressListener.onCancel(ADDONS_NOTIFICATION_NAME);
+    if (progressListener)
+      progressListener.onCancel(ADDONS_NOTIFICATION_NAME);
 #endif
+
+    // Keep our preference in sync
+    Services.prefs.clearUserPref("browser.notifications.pending.addons");
   },
 };
 
@@ -999,8 +1001,10 @@ AddonInstallListener.prototype = {
 #ifdef ANDROID
     let alertsService = Cc["@mozilla.org/alerts-service;1"].getService(Ci.nsIAlertsService);
     let progressListener = alertsService.QueryInterface(Ci.nsIAlertsProgressListener);
-    progressListener.onProgress(ADDONS_NOTIFICATION_NAME, aInstall.progress, aInstall.maxProgress);
+    if (progressListener)
+      progressListener.onProgress(ADDONS_NOTIFICATION_NAME, aInstall.progress, aInstall.maxProgress);
 #endif
+
     if (!element)
       return;
 

mobile/components/BrowserCLH.js

@@ -126,7 +126,7 @@ function haveSystemLocale() {
 
 function checkCurrentLocale() {
   if (Services.prefs.prefHasUserValue("general.useragent.locale")) {
-    // if the user has a compatable locale from a different buildid, we need to update
+    // if the user has a compatible locale from a different buildid, we need to update
     var buildID = Cc["@mozilla.org/xre/app-info;1"].getService(Ci.nsIXULAppInfo).appBuildID;
     let localeBuildID = Services.prefs.getCharPref("extensions.compatability.locales.buildid");
     if (buildID != localeBuildID)

mobile/components/BrowserStartup.js

@@ -38,6 +38,9 @@ const Ci = Components.interfaces;
 const Cu = Components.utils;
 
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+Cu.import("resource://gre/modules/Services.jsm");
+
+const ADDONS_NOTIFICATION_NAME = "addons";
 
 // Custom factory object to ensure that we're a singleton
 const BrowserStartupServiceFactory = {
@@ -55,19 +58,18 @@ function BrowserStartup() {
 
 BrowserStartup.prototype = {
   // for XPCOM
-  classID:          Components.ID("{1d542abc-c88b-4636-a4ef-075b49806317}"),
+  classID: Components.ID("{1d542abc-c88b-4636-a4ef-075b49806317}"),
 
   QueryInterface: XPCOMUtils.generateQI([Ci.nsIObserver, Ci.nsISupportsWeakReference]),
 
   _xpcom_factory: BrowserStartupServiceFactory,
 
-  _init: function () {
-    this._observerService = Cc["@mozilla.org/observer-service;1"].
-                            getService(Ci.nsIObserverService);
-    this._observerService.addObserver(this, "places-init-complete", false);
+  _init: function() {
+    Services.obs.addObserver(this, "places-init-complete", false);
+    Services.obs.addObserver(this, "final-ui-startup", false);
   },
 
-  _initDefaultBookmarks: function () {
+  _initDefaultBookmarks: function() {
     // We must instantiate the history service since it will tell us if we
     // need to import or restore bookmarks due to first-run, corruption or
     // forced migration (due to a major schema change).
@@ -128,12 +130,31 @@ BrowserStartup.prototype = {
     }
   },
 
+  _startupActions: function() {
+#ifdef ANDROID
+    // Hide the notification if we had any pending operations
+    try {
+      if (Services.prefs.getBoolPref("browser.notifications.pending.addons")) {
+        Services.prefs.clearUserPref("browser.notifications.pending.addons")
+        let alertsService = Cc["@mozilla.org/alerts-service;1"].getService(Ci.nsIAlertsService);
+        let progressListener = alertsService.QueryInterface(Ci.nsIAlertsProgressListener);
+        if (progressListener)
+          progressListener.onCancel(ADDONS_NOTIFICATION_NAME);
+      }
+    } catch (e) {}
+#endif
+  },
+
   // nsIObserver
   observe: function(aSubject, aTopic, aData) {
     switch (aTopic) {
       case "places-init-complete":
+        Services.obs.removeObserver(this, "places-init-complete");
         this._initDefaultBookmarks();
-        this._observerService.removeObserver(this, "places-init-complete");
+        break;
+      case "final-ui-startup":
+        Services.obs.removeObserver(this, "final-ui-startup");
+        this._startupActions();
         break;
     }
   }

mobile/components/Makefile.in

@@ -56,6 +56,7 @@ EXTRA_PP_COMPONENTS = \
         MobileComponents.manifest \
         AboutRedirector.js \
         BrowserCLH.js \
+        BrowserStartup.js \
         DirectoryProvider.js\
         HelperAppDialog.js \
         Sidebar.js \
@@ -64,7 +65,6 @@ EXTRA_PP_COMPONENTS = \
 
 EXTRA_COMPONENTS = \
         AlertsService.js \
-        BrowserStartup.js \
         ContentPermissionPrompt.js \
         XPIDialogService.js \
         DownloadManagerUI.js \

mobile/locales/en-US/chrome/browser.properties

@@ -78,7 +78,7 @@ downloadsTime= — #1
 downloadsUnknownSize=Unknown size
 # LOCALIZATION NOTE (KnownSize): #1 size number; #2 size unit
 downloadsKnownSize=#1 #2
-donwloadsYesterday=Yesterday
+downloadsYesterday=Yesterday
 # LOCALIZATION NOTE (MonthDate): #1 month name; #2 date number; e.g., January 22
 downloadsMonthDate=#1 #2
 downloadsEmpty=No downloads

mobile/themes/core/honeycomb/platform.css

@@ -632,6 +632,27 @@ dialog {
   text-align: start;
 }
 
+.panel-arrow[side="top"]:not([type="dialog"]) {
+  list-style-image: url("chrome://browser/skin/images/arrowbox-up.png");
+  margin-bottom: -@margin_normal@;
+}
+
+.panel-arrow[side="bottom"]:not([type="dialog"]) {
+  list-style-image: url("chrome://browser/skin/images/arrowbox-down.png");
+  margin-top: -@margin_normal@;
+}
+
+.panel-arrow[side="left"]:not([type="dialog"]) {
+  list-style-image: url("chrome://browser/skin/images/arrowbox-horiz.png");
+  margin-right: -@margin_normal@;
+  -moz-transform: scaleX(-1);
+}
+
+.panel-arrow[side="right"]:not([type="dialog"]) {
+  list-style-image: url("chrome://browser/skin/images/arrowbox-horiz.png");
+  margin-left: -@margin_normal@;
+}
+
 /*.panel-row-header ------------------------------------------------------------ */
 .panel-row-header {
   background-color: @color_background_panelrow@ !important;

modules/libpr0n/src/imgLoader.cpp

@@ -591,7 +591,7 @@ void imgCacheEntry::UpdateCache(PRInt32 diff /* = 0 */)
   // about our size or usage.
   if (!Evicted() && HasNoProxies()) {
     nsCOMPtr<nsIURI> uri;
-    mRequest->GetKeyURI(getter_AddRefs(uri));
+    mRequest->GetURI(getter_AddRefs(uri));
     imgLoader::CacheEntriesChanged(uri, diff);
   }
 }
@@ -600,7 +600,7 @@ void imgCacheEntry::SetHasNoProxies(PRBool hasNoProxies)
 {
 #if defined(PR_LOGGING)
   nsCOMPtr<nsIURI> uri;
-  mRequest->GetKeyURI(getter_AddRefs(uri));
+  mRequest->GetURI(getter_AddRefs(uri));
   nsCAutoString spec;
   if (uri)
     uri->GetSpec(spec);
@@ -796,7 +796,7 @@ void imgCacheExpirationTracker::NotifyExpired(imgCacheEntry *entry)
   nsRefPtr<imgRequest> req(entry->GetRequest());
   if (req) {
     nsCOMPtr<nsIURI> uri;
-    req->GetKeyURI(getter_AddRefs(uri));
+    req->GetURI(getter_AddRefs(uri));
     nsCAutoString spec;
     uri->GetSpec(spec);
     LOG_FUNC_WITH_PARAM(gImgLog, "imgCacheExpirationTracker::NotifyExpired", "entry", spec.get());
@@ -1185,7 +1185,7 @@ void imgLoader::CheckCacheLimits(imgCacheTable &cache, imgCacheQueue &queue)
     nsRefPtr<imgRequest> req(entry->GetRequest());
     if (req) {
       nsCOMPtr<nsIURI> uri;
-      req->GetKeyURI(getter_AddRefs(uri));
+      req->GetURI(getter_AddRefs(uri));
       nsCAutoString spec;
       uri->GetSpec(spec);
       LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::CheckCacheLimits", "entry", spec.get());
@@ -1492,7 +1492,7 @@ PRBool imgLoader::RemoveFromCache(imgCacheEntry *entry)
   nsRefPtr<imgRequest> request(getter_AddRefs(entry->GetRequest()));
   if (request) {
     nsCOMPtr<nsIURI> key;
-    if (NS_SUCCEEDED(request->GetKeyURI(getter_AddRefs(key))) && key) {
+    if (NS_SUCCEEDED(request->GetURI(getter_AddRefs(key))) && key) {
       imgCacheTable &cache = GetCache(key);
       imgCacheQueue &queue = GetCacheQueue(key);
       nsCAutoString spec;

modules/libpr0n/src/imgRequest.cpp

@@ -411,19 +411,6 @@ nsresult imgRequest::GetURI(nsIURI **aURI)
   return NS_ERROR_FAILURE;
 }
 
-nsresult imgRequest::GetKeyURI(nsIURI **aKeyURI)
-{
-  LOG_FUNC(gImgLog, "imgRequest::GetKeyURI");
-
-  if (mURI) {
-    *aKeyURI = mURI;
-    NS_ADDREF(*aKeyURI);
-    return NS_OK;
-  }
-
-  return NS_ERROR_FAILURE;
-}
-
 nsresult imgRequest::GetSecurityInfo(nsISupports **aSecurityInfo)
 {
   LOG_FUNC(gImgLog, "imgRequest::GetSecurityInfo");

modules/libpr0n/src/imgRequest.h

@@ -164,7 +164,6 @@ private:
   void RemoveFromCache();
 
   nsresult GetURI(nsIURI **aURI);
-  nsresult GetKeyURI(nsIURI **aURI);
   nsresult GetSecurityInfo(nsISupports **aSecurityInfo);
 
   inline const char *GetMimeType() const {

netwerk/base/src/nsProtocolProxyService.cpp

@@ -394,7 +394,7 @@ nsProtocolProxyService::PrefsChanged(nsIPrefBranch *prefBranch,
         PRInt32 type = -1;
         rv = prefBranch->GetIntPref(PROXY_PREF("type"), &type);
         if (NS_SUCCEEDED(rv)) {
-            // bug 115720 - for ns4.x backwards compatability
+            // bug 115720 - for ns4.x backwards compatibility
             if (type == PROXYCONFIG_DIRECT4X) {
                 type = PROXYCONFIG_DIRECT;
                 // Reset the type so that the dialog looks correct, and we

parser/htmlparser/tests/html/span001.html

@@ -11,7 +11,7 @@
 In HTML standard, SPANs are not allowed to cross Paragraphs.
 <br> In Vav4.0, SPAN tags go thour paragraphs and other block-level elements,
 except tbles.
-<br>It be compatable with Nav4.0 and HTML standard, HTMLParser
+<br>It be compatible with Nav4.0 and HTML standard, HTMLParser
 close all SPANs before open a new paragraph, and reopen SPANs
 inside the new paragraph
 <br>

testing/mochitest/specialpowers/content/specialpowers.js

@@ -442,13 +442,6 @@ function SpecialPowersManager() {
 SpecialPowersManager.prototype = {
   handleEvent: function handleEvent(aEvent) {
     var window = aEvent.target.defaultView;
-
-    // only add SpecialPowers to data pages, not about:*
-    var uri = window.document.documentURIObject;
-    if (uri.spec.split(":")[0] == "about") {
-      return;
-    }
-
     attachSpecialPowersToWindow(window);
   }
 };

toolkit/components/aboutmemory/content/aboutMemory.css

@@ -69,3 +69,22 @@
   -moz-user-select: none;  /* no need to include this when cutting+pasting */
 }
 
+body.verbose {
+  /* override setting in about.css */
+  max-width: 100% !important;
+}
+
+h2.tree {
+  cursor: pointer;
+  background: #ddd;
+  padding-left: .1em;
+}
+
+body.non-verbose pre.tree {
+  overflow-x: hidden;
+  text-overflow: ellipsis;
+}
+
+pre.collapsed {
+  display: none;
+}

toolkit/components/aboutmemory/content/aboutMemory.js

@@ -58,6 +58,55 @@ const UNITS_PERCENTAGE = Ci.nsIMemoryReporter.UNITS_PERCENTAGE;
 
 const kUnknown = -1;    // used for _amount if a memory reporter failed
 
+const kTreeDescriptions = {
+  'explicit' :
+    "This tree covers explicit memory allocations by the application, " +
+    "both at the operating system level (via calls to functions such as " +
+    "VirtualAlloc, vm_allocate, and mmap), and at the heap allocation level " +
+    "(via functions such as malloc, calloc, realloc, memalign, operator " +
+    "new, and operator new[]).  It excludes memory that is mapped implicitly " +
+    "such as code and data segments, and thread stacks.  It also excludes " +
+    "heap memory that has been freed by the application but is still being " +
+    "held onto by the heap allocator.  It is not guaranteed to cover every " +
+    "explicit allocation, but it does cover most (including the entire " +
+    "heap), and therefore it is the single best number to focus on when " +
+    "trying to reduce memory usage.",
+
+  'resident':
+    "This tree shows how much space in physical memory each of the " +
+    "process's mappings is currently using (the mapping's 'resident set size', " +
+    "or 'RSS'). This is a good measure of the 'cost' of the mapping, although " +
+    "it does not take into account the fact that shared libraries may be mapped " +
+    "by multiple processes but appear only once in physical memory. " +
+    "Note that the 'resident' value here might not equal the value for " +
+    "'resident' under 'Other Measurements' because the two measurements are not " +
+    "taken at exactly the same time.",
+
+  'vsize':
+    "This tree shows how much virtual addres space each of the process's " +
+    "mappings takes up (the mapping's 'vsize').  A mapping may have a large " +
+    "vsize but use only a small amount of physical memory; the resident set size " +
+    "of a mapping is a better measure of the mapping's 'cost'. Note that the " +
+    "'vsize' value here might not equal the value for 'vsize' under 'Other " +
+    "Measurements' because the two measurements are not taken at exactly the " +
+    "same time.",
+
+  'swap':
+    "This tree shows how much space in the swap file each of the process's " +
+    "mappings is currently using. Mappings which are not in the swap file " +
+    "(i.e., nodes which would have a value of 0 in this tree) are omitted."
+};
+
+const kTreeNames = {
+  'explicit': 'Explicit Allocations',
+  'resident': 'Resident Set Size (RSS) Breakdown',
+  'vsize':    'Virtual Size Breakdown',
+  'swap':     'Swap Usage Breakdown',
+  'other':    'Other Measurements'
+};
+
+const kMapTreePaths = ['map/resident', 'map/vsize', 'map/swap'];
+
 function onLoad()
 {
   var os = Cc["@mozilla.org/observer-service;1"].
@@ -135,6 +184,17 @@ function sendHeapMinNotifications()
   sendHeapMinNotificationsInner();
 }
 
+function toggleTreeVisibility(aEvent)
+{
+  var headerElem = aEvent.target;
+
+  // Replace "header-" with "pre-" in the header element's id to get the id of
+  // the corresponding pre element.
+  var treeElem = $(headerElem.id.replace(/^header-/, 'pre-'));
+
+  treeElem.classList.toggle('collapsed');
+}
+
 function Reporter(aPath, aKind, aUnits, aAmount, aDescription)
 {
   this._path        = aPath;
@@ -227,6 +287,11 @@ function update()
   content.parentNode.replaceChild(content.cloneNode(false), content);
   content = $("content");
 
+  if (gVerbose)
+    content.parentNode.classList.add('verbose');
+  else
+    content.parentNode.classList.add('non-verbose');
+
   // Generate output for one process at a time.  Always start with the
   // Main process.
   var reportersByProcess = getReportersByProcess();
@@ -259,9 +324,14 @@ function update()
         : "<span class='option'><a href='about:memory?verbose'>More verbose</a></span>";
   text += "</div>";
 
+  text += "<div>" +
+          "<span class='option'><a href='about:support'>Troubleshooting information</a></span>" +
+          "</div>";
+
   text += "<div>" +
           "<span class='legend'>Hover the pointer over the name of a memory " +
-          "reporter to see a detailed description of what it measures.</span>"
+          "reporter to see a detailed description of what it measures. Click a " +
+          "heading to expand or collapse its tree.</span>" +
           "</div>";
 
   var div = document.createElement("div");
@@ -312,23 +382,41 @@ TreeNode.compare = function(a, b) {
  *
  * @param aReporters
  *        The table of Reporters, indexed by path.
+ * @param aTreeName
+ *        The name of the tree being built.
  * @return The built tree.
  */
-function buildTree(aReporters)
+function buildTree(aReporters, aTreeName)
 {
-  const treeName = "explicit";
-
-  // We want to process all reporters that begin with |treeName|.  First we
+  // We want to process all reporters that begin with |aTreeName|.  First we
   // build the tree but only fill the properties that we can with a top-down
   // traversal.
+
+  // Is there any reporter which matches aTreeName?  If not, we'll create a
+  // dummy one.
+  var foundReporter = false;
+  for (var path in aReporters) {
+    if (aReporters[path].treeNameMatches(aTreeName)) {
+      foundReporter = true;
+      break;
+    }
+  }
+
+  if (!foundReporter) {
+    // We didn't find any reporters for this tree, so create an empty one.  Its
+    // description will be set later.
+    aReporters[aTreeName] =
+      new Reporter(aTreeName, KIND_NONHEAP, UNITS_BYTES, 0, '');
+  }
+
   var t = new TreeNode("falseRoot");
   for (var path in aReporters) {
     // Add any missing nodes in the tree implied by the path.
     var r = aReporters[path];
-    if (r.treeNameMatches(treeName)) {
+    if (r.treeNameMatches(aTreeName)) {
       assert(r._kind === KIND_HEAP || r._kind === KIND_NONHEAP,
              "reporters in the tree must have KIND_HEAP or KIND_NONHEAP");
-      assert(r._units === UNITS_BYTES);
+      assert(r._units === UNITS_BYTES, "r._units === UNITS_BYTES");
       var names = r._path.split('/');
       var u = t;
       for (var i = 0; i < names.length; i++) {
@@ -349,8 +437,9 @@ function buildTree(aReporters)
       }
     }
   }
+
   // Using falseRoot makes the above code simpler.  Now discard it, leaving
-  // treeName at the root.
+  // aTreeName at the root.
   t = t._kids[0];
 
   // Next, fill in the remaining properties bottom-up.
@@ -360,7 +449,7 @@ function buildTree(aReporters)
     var path = aPrepath ? aPrepath + '/' + aT._name : aT._name;
     if (aT._kids.length === 0) {
       // Leaf node.  Must have a reporter.
-      assert(aT._kind !== undefined);
+      assert(aT._kind !== undefined, "aT._kind !== undefined");
       aT._description = getDescription(aReporters, path);
       var amount = getBytes(aReporters, path);
       if (amount !== kUnknown) {
@@ -400,11 +489,32 @@ function buildTree(aReporters)
         aT._description = "The sum of all entries below '" + aT._name + "'.";
       }
     }
-    assert(aT._amount !== kUnknown);
+    assert(aT._amount !== kUnknown, "aT._amount !== kUnknown");
     return aT._amount;
   }
+
   fillInTree(t, "");
 
+  // Reduce the depth of the tree by the number of occurrences of '/' in
+  // aTreeName.  (Thus the tree named 'foo/bar/baz' will be rooted at 'baz'.)
+  var slashCount = 0;
+  for (var i = 0; i < aTreeName.length; i++) {
+    if (aTreeName[i] == '/') {
+      assert(t._kids.length == 1, "Not expecting multiple kids here.");
+      t = t._kids[0];
+    }
+  }
+
+  // Set the description on the root node.
+  t._description = kTreeDescriptions[t._name];
+
+  return t;
+}
+
+/**
+ * Do some work which only makes sense for the 'explicit' tree.
+ */
+function fixUpExplicitTree(aT, aReporters) {
   // Determine how many bytes are reported by heap reporters.  Be careful
   // with non-leaf reporters;  if we count a non-leaf reporter we don't want
   // to count any of its child reporters.
@@ -429,7 +539,7 @@ function buildTree(aReporters)
   var unknownHeapUsedBytes = 0;
   var hasProblem = true;
   if (heapUsedBytes !== kUnknown) {
-    unknownHeapUsedBytes = heapUsedBytes - getKnownHeapUsedBytes(t);
+    unknownHeapUsedBytes = heapUsedBytes - getKnownHeapUsedBytes(aT);
     hasProblem = false;
   }
   var heapUnclassified = new TreeNode("heap-unclassified");
@@ -446,10 +556,8 @@ function buildTree(aReporters)
     heapUnclassified._hasProblem = true;
   }
 
-  t._kids.push(heapUnclassified);
-  t._amount += unknownHeapUsedBytes;
-
-  return t;
+  aT._kids.push(heapUnclassified);
+  aT._amount += unknownHeapUsedBytes;
 }
 
 /**
@@ -515,16 +623,26 @@ function filterTree(aTotalBytes, aT)
  */
 function genProcessText(aProcess, aReporters)
 {
-  var tree = buildTree(aReporters);
-  filterTree(tree._amount, tree);
+  var explicitTree = buildTree(aReporters, 'explicit');
+  fixUpExplicitTree(explicitTree, aReporters);
+  filterTree(explicitTree._amount, explicitTree);
+  var explicitText = genTreeText(explicitTree, aProcess);
 
-  // Nb: the newlines give nice spacing if we cut+paste into a text buffer.
-  var text = "";
-  text += "<h1>" + aProcess + " Process</h1>\n\n";
-  text += genTreeText(tree);
-  text += genOtherText(aReporters);
-  text += "<hr></hr>";
-  return text;
+  var mapTreeText = '';
+  kMapTreePaths.forEach(function(t) {
+    var tree = buildTree(aReporters, t);
+    filterTree(tree._amount, tree);
+    mapTreeText += genTreeText(tree, aProcess);
+  });
+
+  // We have to call genOtherText after we process all the trees, because it
+  // looks at all the reporters which aren't part of a tree.
+  var otherText = genOtherText(aReporters, aProcess);
+
+  // The newlines give nice spacing if we cut+paste into a text buffer.
+  return "<h1>" + aProcess + " Process</h1>\n\n" +
+         explicitText + mapTreeText + otherText +
+         "<hr></hr>";
 }
 
 /**
@@ -691,17 +809,9 @@ function flipBackslashes(aStr)
   return aStr.replace(/\\/g, '/');
 }
 
-// Truncate the URL in a compartment name if not in verbose mode.
-function truncateCompartmentName(aStr)
-{
-  return (gVerbose)
-       ? aStr
-       : aStr.replace(/compartment\((.{40}).*\)/, 'compartment($1...)');
-}
-
 function prepName(aStr)
 {
-  return escapeAll(flipBackslashes(truncateCompartmentName(aStr)));
+  return escapeAll(flipBackslashes(aStr));
 }
 
 function prepDesc(aStr)
@@ -735,12 +845,15 @@ function genMrNameText(aKind, aDesc, aName, aHasProblem, aNMerged)
  *
  * @param aT
  *        The tree.
+ * @param aProcess
+ *        The process the tree corresponds to.
  * @return The generated text.
  */
-function genTreeText(aT)
+function genTreeText(aT, aProcess)
 {
   var treeBytes = aT._amount;
   var rootStringLength = aT.toString().length;
+  var isExplicitTree = aT._name == 'explicit';
 
   /**
    * Generates the text for a particular tree, without a heading.
@@ -808,8 +921,11 @@ function genTreeText(aT)
     }
     perc = "<span class='mrPerc'>(" + perc + "%)</span> ";
 
+    // We don't want to show '(nonheap)' on a tree like 'map/vsize', since the
+    // whole tree is non-heap.
+    var kind = isExplicitTree ? aT._kind : undefined;
     var text = indent + genMrValueText(tString) + " " + perc +
-               genMrNameText(aT._kind, aT._description, aT._name,
+               genMrNameText(kind, aT._description, aT._name,
                              aT._hasProblem, aT._nMerged);
 
     for (var i = 0; i < aT._kids.length; i++) {
@@ -822,22 +938,10 @@ function genTreeText(aT)
   }
 
   var text = genTreeText2(aT, [], rootStringLength);
-  // Nb: the newlines give nice spacing if we cut+paste into a text buffer.
-  const desc =
-    "This tree covers explicit memory allocations by the application, " +
-    "both at the operating system level (via calls to functions such as " +
-    "VirtualAlloc, vm_allocate, and mmap), and at the heap allocation level " +
-    "(via functions such as malloc, calloc, realloc, memalign, operator " +
-    "new, and operator new[]).  It excludes memory that is mapped implicitly " +
-    "such as code and data segments, and thread stacks.  It also excludes " +
-    "heap memory that has been freed by the application but is still being " +
-    "held onto by the heap allocator.  It is not guaranteed to cover every " +
-    "explicit allocation, but it does cover most (including the entire " +
-    "heap), and therefore it is the single best number to focus on when " +
-    "trying to reduce memory usage.";
-               
-  return "<h2 class='hasDesc' title='" + escapeQuotes(desc) +
-         "'>Explicit Allocations</h2>\n" + "<pre>" + text + "</pre>\n";
+
+  // The explicit tree is not collapsed, but all other trees are, so pass
+  // !isExplicitTree for genSectionMarkup's aCollapsed parameter.
+  return genSectionMarkup(aProcess, aT._name, text, !isExplicitTree);
 }
 
 function OtherReporter(aPath, aUnits, aAmount, aDescription, 
@@ -880,9 +984,11 @@ OtherReporter.compare = function(a, b) {
  *
  * @param aReportersByProcess
  *        Table of Reporters for this process, indexed by _path.
+ * @param aProcess
+ *        The process these reporters correspond to.
  * @return The generated text.
  */
-function genOtherText(aReportersByProcess)
+function genOtherText(aReportersByProcess, aProcess)
 {
   // Generate an array of Reporter-like elements, stripping out all the
   // Reporters that have already been handled.  Also find the width of the
@@ -918,8 +1024,22 @@ function genOtherText(aReportersByProcess)
   // Nb: the newlines give nice spacing if we cut+paste into a text buffer.
   const desc = "This list contains other memory measurements that cross-cut " +
                "the requested memory measurements above."
-  return "<h2 class='hasDesc' title='" + desc + "'>Other Measurements</h2>\n" +
-         "<pre>" + text + "</pre>\n";
+
+  return genSectionMarkup(aProcess, 'other', text, false);
+}
+
+function genSectionMarkup(aProcess, aName, aText, aCollapsed)
+{
+  var headerId = 'header-' + aProcess + '-' + aName;
+  var preId = 'pre-' + aProcess + '-' + aName;
+  var elemClass = (aCollapsed ? 'collapsed' : '') + ' tree';
+
+  // Ugh.
+  return '<h2 id="' + headerId + '" class="' + elemClass + '" ' +
+         'onclick="toggleTreeVisibility(event)">' +
+           kTreeNames[aName] +
+         '</h2>\n' +
+         '<pre id="' + preId + '" class="' + elemClass + '">' + aText + '</pre>\n';
 }
 
 function assert(aCond, aMsg)

toolkit/components/aboutmemory/tests/chrome/test_aboutmemory.xul

@@ -105,6 +105,17 @@
           f("perc2",            OTHER,   PERCENTAGE, 10000);
           f("perc1",            OTHER,   PERCENTAGE, 4567);
        }
+     },
+     { collectReports: function(cbObj, closure) {
+          // The amounts are given in pages, so multiply here by 4kb.
+          function f(p, a) { cbObj.callback("", p, NONHEAP, BYTES, a * 4 * KB, "(desc)", closure); }
+          f("map/vsize/a",     24);
+          f("map/swap/a",       1);
+          f("map/swap/a",       2);
+          f("map/vsize/a",      19);
+          f("map/swap/b/c",     10);
+          f("map/resident/a",   42);
+       }
      }
   ];
   for (var i = 0; i < fakeReporters.length; i++) {
@@ -133,7 +144,7 @@
     f("2nd", "explicit/a/b/c",  HEAP,      1 * MB), // dup: merge
     f("2nd", "explicit/flip\\the\\backslashes",
                                 HEAP,    200 * MB),
-    f("2nd", "explicit/compartment(this-will-be-truncated-in-non-verbose-mode-abcdefghijklmnopqrstuvwxyz)",
+    f("2nd", "explicit/compartment(compartment-url)",
                                 HEAP,    200 * MB),
     // The escaping of compartment names must prevent this script from running.
     f("2nd", "danger<script>window.alert(1)</script>",
@@ -192,6 +203,20 @@ Explicit Allocations\n\
 ├───11.00 MB (01.76%) -- heap-unclassified\n\
 └────0.58 MB (00.09%) -- (2 omitted)\n\
 \n\
+Resident Set Size (RSS) Breakdown\n\
+0.16 MB (100.0%) -- resident\n\
+└──0.16 MB (100.0%) -- a\n\
+\n\
+Virtual Size Breakdown\n\
+0.17 MB (100.0%) -- vsize\n\
+└──0.17 MB (100.0%) -- a [2]\n\
+\n\
+Swap Usage Breakdown\n\
+0.05 MB (100.0%) -- swap\n\
+├──0.04 MB (76.92%) -- b\n\
+│  └──0.04 MB (76.92%) -- c\n\
+└──0.01 MB (23.08%) -- a [2]\n\
+\n\
 Other Measurements\n\
 500.00 MB -- heap-allocated\n\
 100.00 MB -- heap-unallocated\n\
@@ -210,9 +235,18 @@ Explicit Allocations\n\
 │    └──499.00 MB (49.90%) -- b\n\
 │       └──499.00 MB (49.90%) -- c [3]\n\
 ├────200.00 MB (20.00%) -- flip/the/backslashes\n\
-├────200.00 MB (20.00%) -- compartment(this-will-be-truncated-in-non-verbose-mo...)\n\
+├────200.00 MB (20.00%) -- compartment(compartment-url)\n\
 └────101.00 MB (10.10%) -- heap-unclassified\n\
 \n\
+Resident Set Size (RSS) Breakdown\n\
+0.00 MB (100.0%) -- resident\n\
+\n\
+Virtual Size Breakdown\n\
+0.00 MB (100.0%) -- vsize\n\
+\n\
+Swap Usage Breakdown\n\
+0.00 MB (100.0%) -- swap\n\
+\n\
 Other Measurements\n\
   666.00 MB -- danger<script>window.alert(1)</script>\n\
 1,000.00 MB -- heap-allocated\n\
@@ -229,6 +263,15 @@ Explicit Allocations\n\
 │  └────0.00 MB (00.00%) -- (1 omitted)\n\
 └────0.00 MB (00.00%) -- (2 omitted)\n\
 \n\
+Resident Set Size (RSS) Breakdown\n\
+0.00 MB (100.0%) -- resident\n\
+\n\
+Virtual Size Breakdown\n\
+0.00 MB (100.0%) -- vsize\n\
+\n\
+Swap Usage Breakdown\n\
+0.00 MB (100.0%) -- swap\n\
+\n\
 Other Measurements\n\
 0.00 MB -- heap-allocated [*]\n\
 0.00 MB -- other1 [*]\n\
@@ -264,6 +307,20 @@ Explicit Allocations\n\
 ├──────510,976 B (00.08%) -- d\n\
 └──────102,400 B (00.02%) -- e\n\
 \n\
+Resident Set Size (RSS) Breakdown\n\
+172,032 B (100.0%) -- resident\n\
+└──172,032 B (100.0%) -- a\n\
+\n\
+Virtual Size Breakdown\n\
+176,128 B (100.0%) -- vsize\n\
+└──176,128 B (100.0%) -- a [2]\n\
+\n\
+Swap Usage Breakdown\n\
+53,248 B (100.0%) -- swap\n\
+├──40,960 B (76.92%) -- b\n\
+│  └──40,960 B (76.92%) -- c\n\
+└──12,288 B (23.08%) -- a [2]\n\
+\n\
 Other Measurements\n\
 524,288,000 B -- heap-allocated\n\
 104,857,600 B -- heap-unallocated\n\
@@ -282,9 +339,18 @@ Explicit Allocations\n\
 │    └──523,239,424 B (49.90%) -- b\n\
 │       └──523,239,424 B (49.90%) -- c [3]\n\
 ├────209,715,200 B (20.00%) -- flip/the/backslashes\n\
-├────209,715,200 B (20.00%) -- compartment(this-will-be-truncated-in-non-verbose-mode-abcdefghijklmnopqrstuvwxyz)\n\
+├────209,715,200 B (20.00%) -- compartment(compartment-url)\n\
 └────105,906,176 B (10.10%) -- heap-unclassified\n\
 \n\
+Resident Set Size (RSS) Breakdown\n\
+0 B (100.0%) -- resident\n\
+\n\
+Virtual Size Breakdown\n\
+0 B (100.0%) -- vsize\n\
+\n\
+Swap Usage Breakdown\n\
+0 B (100.0%) -- swap\n\
+\n\
 Other Measurements\n\
   698,351,616 B -- danger<script>window.alert(1)</script>\n\
 1,048,576,000 B -- heap-allocated\n\
@@ -302,6 +368,15 @@ Explicit Allocations\n\
 ├────────────0 B (00.00%) -- b [*]\n\
 └────────────0 B (00.00%) -- heap-unclassified [*]\n\
 \n\
+Resident Set Size (RSS) Breakdown\n\
+0 B (100.0%) -- resident\n\
+\n\
+Virtual Size Breakdown\n\
+0 B (100.0%) -- vsize\n\
+\n\
+Swap Usage Breakdown\n\
+0 B (100.0%) -- swap\n\
+\n\
 Other Measurements\n\
 0 B -- heap-allocated [*]\n\
 0 B -- other1 [*]\n\
@@ -328,22 +403,44 @@ Other Measurements\n\
     SimpleTest.finish();
   }
 
+  function check(actual, expected) {
+    var a = actual.QueryInterface(Ci.nsISupportsString).data;
+    if (a != expected) {
+      dump("*******ACTUAL*******\n");
+      dump(a);
+      dump("******EXPECTED******\n");
+      dump(expected);
+      dump("********************\n");
+      return false;
+    }
+    return true;
+  }
+
   // Cut+paste the entire page and check that the cut text matches what we
   // expect.  This tests the output in general and also that the cutting and
   // pasting works as expected.
   function test(aFrame, aExpectedText, aNext) {
-    document.querySelector("#" + aFrame).focus();
-    SimpleTest.waitForClipboard(aExpectedText,
-      function() {
-        synthesizeKey("A", {accelKey: true});
-        synthesizeKey("C", {accelKey: true});
-      },
-      aNext,
-      function() {
-        ok(false, "pasted text doesn't match for " + aFrame);
-        finish();
-      }
-    );
+    // Click all h2.collapsed elements so they expand.
+    var win = document.querySelector("#" + aFrame).contentWindow;
+    var nodes = win.document.querySelectorAll("pre.collapsed");
+    for (var i = 0; i < nodes.length; i++) {
+      nodes[i].classList.toggle('collapsed');
+    }
+
+    SimpleTest.executeSoon(function() {
+      document.querySelector("#" + aFrame).focus();
+      SimpleTest.waitForClipboard(function(actual) { return check(actual, aExpectedText) },
+        function() {
+          synthesizeKey("A", {accelKey: true});
+          synthesizeKey("C", {accelKey: true});
+        },
+        aNext,
+        function() {
+          ok(false, "pasted text doesn't match for " + aFrame);
+          finish();
+        }
+      );
+    });
   }
 
   addLoadEvent(function() {

toolkit/components/passwordmgr/storage-Legacy.js

@@ -1062,7 +1062,7 @@ LoginManagerStorage_legacy.prototype = {
                 // Line is unused filler for future use
                 case STATE.FILLER:
                     // Save the line's value (so we can dump it back out when
-                    // we save the file next time) for forwards compatability.
+                    // we save the file next time) for forwards compatibility.
                     entry.wrappedJSObject.filler = line.value;
                     processEntry = true;
 

toolkit/components/places/nsPlacesImportExportService.cpp

@@ -49,7 +49,7 @@
  *   Old version used this to set attributes on the bookmarks RDF root, such
  *   as the last modified date. We only use H1 to check for the attribute
  *   PLACES_ROOT, which tells us that this hierarchy root is the places root.
- *   For backwards compatability, if we don't find this, we assume that the
+ *   For backwards compatibility, if we don't find this, we assume that the
  *   hierarchy is rooted at the bookmarks menu.
  * Heading := any heading other than h1
  *   Old version used this to set attributes on the current container. We only