Merge inbound to m-c.

2013-11-04 16:16:22 -05:00 · 2013-11-04 16:16:22 -05:00 · 3a4f8792df
--- a/browser/components/migration/src/SafariProfileMigrator.js
+++ b/browser/components/migration/src/SafariProfileMigrator.js
@ -342,29 +342,6 @@ Preferences.prototype = {
        this._set("WebKitDisplayImagesKey", "permissions.default.image",
                  function(webkitVal) webkitVal ? 1 : 2);

-        // Default charset migration
-        this._set("WebKitDefaultTextEncodingName", "intl.charset.default",
-          function(webkitCharset) {
-            // We don't support x-mac-korean (see bug 713516), but it mostly matches
-            // EUC-KR.
-            if (webkitCharset == "x-mac-korean")
-              return "EUC-KR";
-
-            // getCharsetAlias throws if an invalid value is passed in.
-            try {
-              return Cc["@mozilla.org/charset-converter-manager;1"].
-                     getService(Ci.nsICharsetConverterManager).
-                     getCharsetAlias(webkitCharset);
-            }
-            catch(ex) {
-              Cu.reportError("Could not convert webkit charset '" + webkitCharset +
-                             "' to a supported charset");
-            }
-            // Don't set the preference if we could not get the corresponding
-            // charset.
-            return undefined;
-          });
-
 #ifdef XP_WIN
        // Cookie-accept policy.
        // For the OS X version, see WebFoundationCookieBehavior.
--- a/browser/components/preferences/fonts.js
+++ b/browser/components/preferences/fonts.js
@ -98,18 +98,6 @@ var gFontsDialog = {
    return defaultValue;
  },
  
-  _charsetMenuInitialized: false,
-  readDefaultCharset: function ()
-  {
-    if (!this._charsetMenuInitialized) {
-      var os = Components.classes["@mozilla.org/observer-service;1"]
-                         .getService(Components.interfaces.nsIObserverService);
-      os.notifyObservers(null, "charsetmenu-selected", "other");
-      this._charsetMenuInitialized = true;
-    }
-    return undefined;
-  },
-  
  readUseDocumentFonts: function ()
  {
    var preference = document.getElementById("browser.display.use_document_fonts");
--- a/browser/components/preferences/fonts.xul
+++ b/browser/components/preferences/fonts.xul
@ -37,7 +37,7 @@
      <preference id="browser.display.use_document_fonts"
                  name="browser.display.use_document_fonts"
                  type="int"/>
-      <preference id="intl.charset.default" name="intl.charset.default" type="wstring"/>
+      <preference id="intl.charset.fallback.override" name="intl.charset.fallback.override" type="string"/>
    </preferences>
    
    <stringbundle id="bundlePreferences" src="chrome://browser/locale/preferences/preferences.properties"/>
@ -262,14 +262,25 @@
        <label value="&languages.customize.Fallback.label;"
               accesskey="&languages.customize.Fallback.accesskey;"
               control="DefaultCharsetList"/>
-        <menulist id="DefaultCharsetList" ref="NC:DecodersRoot" datasources="rdf:charset-menu"
-                  preference="intl.charset.default" 
-                  onsyncfrompreference="return gFontsDialog.readDefaultCharset();">
-          <template>
-            <menupopup>
-              <menuitem label="rdf:http://home.netscape.com/NC-rdf#Name" value="..." uri="..."/>
-            </menupopup>
-          </template>
+        <menulist id="DefaultCharsetList" preference="intl.charset.fallback.override">
+          <menupopup>
+            <menuitem label="&languages.customize.Fallback.auto;"        value=""/>
+            <menuitem label="&languages.customize.Fallback.arabic;"      value="windows-1256"/>
+            <menuitem label="&languages.customize.Fallback.baltic;"      value="windows-1257"/>
+            <menuitem label="&languages.customize.Fallback.ceiso;"       value="ISO-8859-2"/>
+            <menuitem label="&languages.customize.Fallback.cewindows;"   value="windows-1250"/>
+            <menuitem label="&languages.customize.Fallback.simplified;"  value="gbk"/>
+            <menuitem label="&languages.customize.Fallback.traditional;" value="Big5"/>
+            <menuitem label="&languages.customize.Fallback.cyrillic;"    value="windows-1251"/>
+            <menuitem label="&languages.customize.Fallback.greek;"       value="ISO-8859-7"/>
+            <menuitem label="&languages.customize.Fallback.hebrew;"      value="windows-1255"/>
+            <menuitem label="&languages.customize.Fallback.japanese;"    value="Shift_JIS"/>
+            <menuitem label="&languages.customize.Fallback.korean;"      value="EUC-KR"/>
+            <menuitem label="&languages.customize.Fallback.thai;"        value="windows-874"/>
+            <menuitem label="&languages.customize.Fallback.turkish;"     value="windows-1254"/>
+            <menuitem label="&languages.customize.Fallback.vietnamese;"  value="windows-1258"/>
+            <menuitem label="&languages.customize.Fallback.other;"       value="windows-1252"/>
+          </menupopup>
        </menulist>
      </hbox>
    </groupbox>
--- a/browser/locales/en-US/chrome/browser/preferences/fonts.dtd
+++ b/browser/locales/en-US/chrome/browser/preferences/fonts.dtd
@ -72,3 +72,40 @@
 <!ENTITY languages.customize.Fallback.label       "Fallback Character Encoding:">
 <!ENTITY languages.customize.Fallback.accesskey   "C">
 <!ENTITY languages.customize.Fallback.desc        "This character encoding is used for legacy content that fails to declare its encoding.">
+
+<!ENTITY languages.customize.Fallback.auto        "Default for Current Locale">
+<!-- LOCALIZATION NOTE (languages.customize.Fallback.arabic):
+     Translate "Arabic" as an adjective for an encoding, not as the name of the language. -->
+<!ENTITY languages.customize.Fallback.arabic      "Arabic">
+<!ENTITY languages.customize.Fallback.baltic      "Baltic">
+<!ENTITY languages.customize.Fallback.ceiso       "Central European, ISO">
+<!ENTITY languages.customize.Fallback.cewindows   "Central European, Microsoft">
+<!-- LOCALIZATION NOTE (languages.customize.Fallback.simplified):
+     Translate "Chinese" as an adjective for an encoding, not as the name of the language. -->
+<!ENTITY languages.customize.Fallback.simplified  "Chinese, Simplified">
+<!-- LOCALIZATION NOTE (languages.customize.Fallback.traditional):
+     Translate "Chinese" as an adjective for an encoding, not as the name of the language. -->
+<!ENTITY languages.customize.Fallback.traditional "Chinese, Traditional">
+<!ENTITY languages.customize.Fallback.cyrillic    "Cyrillic">
+<!-- LOCALIZATION NOTE (languages.customize.Fallback.greek):
+     Translate "Greek" as an adjective for an encoding, not as the name of the language. -->
+<!ENTITY languages.customize.Fallback.greek       "Greek">
+<!-- LOCALIZATION NOTE (languages.customize.Fallback.hebrew):
+     Translate "Hebrew" as an adjective for an encoding, not as the name of the language. -->
+<!ENTITY languages.customize.Fallback.hebrew      "Hebrew">
+<!-- LOCALIZATION NOTE (languages.customize.Fallback.japanese):
+     Translate "Japanese" as an adjective for an encoding, not as the name of the language. -->
+<!ENTITY languages.customize.Fallback.japanese    "Japanese">
+<!-- LOCALIZATION NOTE (languages.customize.Fallback.korean):
+     Translate "Korean" as an adjective for an encoding, not as the name of the language. -->
+<!ENTITY languages.customize.Fallback.korean      "Korean">
+<!-- LOCALIZATION NOTE (languages.customize.Fallback.thai):
+     Translate "Thai" as an adjective for an encoding, not as the name of the language. -->
+<!ENTITY languages.customize.Fallback.thai        "Thai">
+<!-- LOCALIZATION NOTE (languages.customize.Fallback.turkish):
+     Translate "Turkish" as an adjective for an encoding, not as the name of the language. -->
+<!ENTITY languages.customize.Fallback.turkish     "Turkish">
+<!-- LOCALIZATION NOTE (languages.customize.Fallback.vietnamese):
+     Translate "Vietnamese" as an adjective for an encoding, not as the name of the language. -->
+<!ENTITY languages.customize.Fallback.vietnamese  "Vietnamese">
+<!ENTITY languages.customize.Fallback.other       "Other (incl. Western European)">
--- a/content/html/document/src/nsHTMLDocument.cpp
+++ b/content/html/document/src/nsHTMLDocument.cpp
@ -83,6 +83,7 @@
 #include "nsBidiUtils.h"

 #include "mozilla/dom/EncodingUtils.h"
+#include "mozilla/dom/FallbackEncoding.h"
 #include "nsIEditingSession.h"
 #include "nsIEditor.h"
 #include "nsNodeInfoManager.h"
@ -445,26 +446,13 @@ nsHTMLDocument::TryParentCharset(nsIDocShell*  aDocShell,
 }

 void
-nsHTMLDocument::TryWeakDocTypeDefault(int32_t& aCharsetSource,
-                                      nsACString& aCharset)
+nsHTMLDocument::TryFallback(int32_t& aCharsetSource, nsACString& aCharset)
 {
-  if (kCharsetFromWeakDocTypeDefault <= aCharsetSource)
+  if (kCharsetFromFallback <= aCharsetSource)
    return;

-  const nsAdoptingCString& defCharset =
-    Preferences::GetLocalizedCString("intl.charset.default");
-
-  // Don't let the user break things by setting intl.charset.default to
-  // not a rough ASCII superset
-  nsAutoCString canonical;
-  if (EncodingUtils::FindEncodingForLabel(defCharset, canonical) &&
-      EncodingUtils::IsAsciiCompatible(canonical)) {
-    aCharset = canonical;
-  } else {
-    aCharset.AssignLiteral("windows-1252");
-  }
-  aCharsetSource = kCharsetFromWeakDocTypeDefault;
-  return;
+  aCharsetSource = kCharsetFromFallback;
+  FallbackEncoding::FromLocale(aCharset);
 }

 void
@ -642,7 +630,7 @@ nsHTMLDocument::StartDocumentLoad(const char* aCommand,
  }

  if (!IsHTML() || !docShell) { // no docshell for text/html XHR
-    charsetSource = IsHTML() ? kCharsetFromWeakDocTypeDefault
+    charsetSource = IsHTML() ? kCharsetFromFallback
                             : kCharsetFromDocTypeDefault;
    charset.AssignLiteral("UTF-8");
    TryChannelCharset(aChannel, charsetSource, charset, executor);
@ -683,7 +671,7 @@ nsHTMLDocument::StartDocumentLoad(const char* aCommand,
      TryCacheCharset(cachingChan, charsetSource, charset);
    }

-    TryWeakDocTypeDefault(charsetSource, charset);
+    TryFallback(charsetSource, charset);

    if (wyciwygChannel) {
      // We know for sure that the parser needs to be using UTF16.
--- a/content/html/document/src/nsHTMLDocument.h
+++ b/content/html/document/src/nsHTMLDocument.h
@ -313,8 +313,7 @@ protected:
                                nsACString& aCharset);
  void TryParentCharset(nsIDocShell*  aDocShell,
                        int32_t& charsetSource, nsACString& aCharset);
-  static void TryWeakDocTypeDefault(int32_t& aCharsetSource,
-                                    nsACString& aCharset);
+  static void TryFallback(int32_t& aCharsetSource, nsACString& aCharset);

  // Override so we can munge the charset on our wyciwyg channel as needed.
  virtual void SetDocumentCharacterSet(const nsACString& aCharSetID) MOZ_OVERRIDE;
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@ -1896,7 +1896,7 @@ nsDocShell::GatherCharsetMenuTelemetry()

  int32_t charsetSource = doc->GetDocumentCharacterSetSource();
  switch (charsetSource) {
-    case kCharsetFromWeakDocTypeDefault:
+    case kCharsetFromFallback:
    case kCharsetFromDocTypeDefault:
    case kCharsetFromCache:
    case kCharsetFromParentFrame:
--- a/dom/encoding/FallbackEncoding.cpp
+++ b/dom/encoding/FallbackEncoding.cpp
@ -0,0 +1,137 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/dom/FallbackEncoding.h"
+
+#include "mozilla/dom/EncodingUtils.h"
+#include "nsUConvPropertySearch.h"
+#include "nsIChromeRegistry.h"
+#include "mozilla/Preferences.h"
+#include "mozilla/Services.h"
+
+namespace mozilla {
+namespace dom {
+
+static const char* localesFallbacks[][3] = {
+#include "localesfallbacks.properties.h"
+};
+
+FallbackEncoding* FallbackEncoding::sInstance = nullptr;
+
+FallbackEncoding::FallbackEncoding()
+{
+  MOZ_COUNT_CTOR(FallbackEncoding);
+  MOZ_ASSERT(!FallbackEncoding::sInstance,
+             "Singleton already exists.");
+}
+
+FallbackEncoding::~FallbackEncoding()
+{
+  MOZ_COUNT_DTOR(FallbackEncoding);
+}
+
+void
+FallbackEncoding::Get(nsACString& aFallback)
+{
+  if (!mFallback.IsEmpty()) {
+    aFallback = mFallback;
+    return;
+  }
+
+  const nsAdoptingCString& override =
+    Preferences::GetCString("intl.charset.fallback.override");
+  // Don't let the user break things by setting the override to unreasonable
+  // values via about:config
+  if (!EncodingUtils::FindEncodingForLabel(override, mFallback) ||
+      !EncodingUtils::IsAsciiCompatible(mFallback) ||
+      mFallback.EqualsLiteral("UTF-8")) {
+    mFallback.Truncate();
+  }
+
+  if (!mFallback.IsEmpty()) {
+    aFallback = mFallback;
+    return;
+  }
+
+  nsAutoCString locale;
+  nsCOMPtr<nsIXULChromeRegistry> registry =
+    mozilla::services::GetXULChromeRegistryService();
+  if (registry) {
+    registry->GetSelectedLocale(NS_LITERAL_CSTRING("global"), locale);
+  }
+
+  // Let's lower case the string just in case unofficial language packs
+  // don't stick to conventions.
+  ToLowerCase(locale); // ASCII lowercasing with CString input!
+
+  // Special case Traditional Chinese before throwing away stuff after the
+  // language itself. Today we only ship zh-TW, but be defensive about
+  // possible future values.
+  if (locale.EqualsLiteral("zh-tw") ||
+      locale.EqualsLiteral("zh-hk") ||
+      locale.EqualsLiteral("zh-mo") ||
+      locale.EqualsLiteral("zh-hant")) {
+    mFallback.AssignLiteral("Big5");
+    aFallback = mFallback;
+    return;
+  }
+
+  // Throw away regions and other variants to accommodate weird stuff seen
+  // in telemetry--apparently unofficial language packs.
+  int32_t index = locale.FindChar('-');
+  if (index >= 0) {
+    locale.Truncate(index);
+  }
+
+  if (NS_FAILED(nsUConvPropertySearch::SearchPropertyValue(
+      localesFallbacks, ArrayLength(localesFallbacks), locale, mFallback))) {
+    mFallback.AssignLiteral("windows-1252");
+  }
+
+  aFallback = mFallback;
+}
+
+void
+FallbackEncoding::FromLocale(nsACString& aFallback)
+{
+  MOZ_ASSERT(FallbackEncoding::sInstance,
+             "Using uninitialized fallback cache.");
+  FallbackEncoding::sInstance->Get(aFallback);
+}
+
+// PrefChangedFunc
+int
+FallbackEncoding::PrefChanged(const char*, void*)
+{
+  MOZ_ASSERT(FallbackEncoding::sInstance,
+             "Pref callback called with null fallback cache.");
+  FallbackEncoding::sInstance->Invalidate();
+  return 0;
+}
+
+void
+FallbackEncoding::Initialize()
+{
+  MOZ_ASSERT(!FallbackEncoding::sInstance,
+             "Initializing pre-existing fallback cache.");
+  FallbackEncoding::sInstance = new FallbackEncoding;
+  Preferences::RegisterCallback(FallbackEncoding::PrefChanged,
+                                "intl.charset.fallback.override",
+                                nullptr);
+  Preferences::RegisterCallback(FallbackEncoding::PrefChanged,
+                                "general.useragent.locale",
+                                nullptr);
+}
+
+void
+FallbackEncoding::Shutdown()
+{
+  MOZ_ASSERT(FallbackEncoding::sInstance,
+             "Releasing non-existent fallback cache.");
+  delete FallbackEncoding::sInstance;
+  FallbackEncoding::sInstance = nullptr;
+}
+
+} // namespace dom
+} // namespace mozilla
--- a/dom/encoding/FallbackEncoding.h
+++ b/dom/encoding/FallbackEncoding.h
@ -0,0 +1,72 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_FallbackEncoding_h_
+#define mozilla_dom_FallbackEncoding_h_
+
+#include "nsString.h"
+
+namespace mozilla {
+namespace dom {
+
+class FallbackEncoding
+{
+public:
+
+  /**
+   * Gets the locale-dependent fallback encoding for legacy HTML and plain
+   * text content.
+   *
+   * @param aFallback the outparam for the fallback encoding
+   */
+  static void FromLocale(nsACString& aFallback);
+
+  // public API ends here!
+
+  /**
+   * Allocate sInstance used by FromLocale().
+   * To be called from nsLayoutStatics only.
+   */
+  static void Initialize();
+
+  /**
+   * Delete sInstance used by FromLocale().
+   * To be called from nsLayoutStatics only.
+   */
+  static void Shutdown();
+
+private:
+
+  /**
+   * The fallback cache.
+   */
+  static FallbackEncoding* sInstance;
+
+  FallbackEncoding();
+  ~FallbackEncoding();
+
+  /**
+   * Invalidates the cache.
+   */
+  void Invalidate()
+  {
+    mFallback.Truncate();
+  }
+
+  static int PrefChanged(const char*, void*);
+
+  /**
+   * Gets the fallback encoding label.
+   * @param aFallback the fallback encoding
+   */
+  void Get(nsACString& aFallback);
+
+  nsCString mFallback;
+};
+
+} // dom
+} // mozilla
+
+#endif // mozilla_dom_FallbackEncoding_h_
+
--- a/dom/encoding/Makefile.in
+++ b/dom/encoding/Makefile.in
@ -9,11 +9,15 @@ LOCAL_INCLUDES = \
 include $(topsrcdir)/config/rules.mk

 EncodingUtils.$(OBJ_SUFFIX): labelsencodings.properties.h
+FallbackEncoding.$(OBJ_SUFFIX): localesfallbacks.properties.h

 PROPS2ARRAYS = $(topsrcdir)/intl/locale/src/props2arrays.py
 labelsencodings.properties.h: $(PROPS2ARRAYS) labelsencodings.properties
 	$(PYTHON) $^ $@
+localesfallbacks.properties.h: $(PROPS2ARRAYS) localesfallbacks.properties
+	$(PYTHON) $^ $@

 GARBAGE += \
-	charsetalias.properties.h \
+	labelsencodings.properties.h \
+	localesfallbacks.properties.h \
 	$(NULL)
--- a/dom/encoding/localesfallbacks.properties
+++ b/dom/encoding/localesfallbacks.properties
@ -0,0 +1,72 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# This file contains mappings from languages to legacy encodings for languages
+# that are associated with legacy encoding other than windows-1252 (except
+# Traditional Chinese, which is handled as a special case elsewhere).
+#
+# The keys are language codes without regions. The values are Gecko-canonical
+# encoding labels (not necessarily lower case!).
+#
+# Rules:
+#
+# * Avoid editing this file!
+#
+# * If you do edit this file, be sure to file a spec bug against WHATWG HTML
+#   to keep this file in sync with
+#   http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html#determining-the-character-encoding
+#
+# * As an exception to the previous rule, gbk is used instead of GB18030 
+#   until/unless work on http://encoding.spec.whatwg.org/ shows that the former
+#   can be treated as an alias of the latter and our decoder implementation 
+#   has been audited to match the spec.
+#
+# * Use only the language code without a hyphen or anything that would come
+#   after the hyphen.
+#
+# * Don't put windows-1252-affiliated languages here.
+#
+# * Don't put Traditional Chinese here.
+
+ar=windows-1256
+# https://www.w3.org/Bugs/Public/show_bug.cgi?id=23089
+ba=windows-1251
+# https://www.w3.org/Bugs/Public/show_bug.cgi?id=23089
+be=windows-1251
+bg=windows-1251
+cs=windows-1250
+# https://www.w3.org/Bugs/Public/show_bug.cgi?id=23090
+el=ISO-8859-7
+et=windows-1257
+fa=windows-1256
+he=windows-1255
+hr=windows-1250
+hu=ISO-8859-2
+ja=Shift_JIS
+# https://www.w3.org/Bugs/Public/show_bug.cgi?id=23089
+kk=windows-1251
+ko=EUC-KR
+ku=windows-1254
+# https://www.w3.org/Bugs/Public/show_bug.cgi?id=23089
+ky=windows-1251
+lt=windows-1257
+lv=windows-1257
+# https://www.w3.org/Bugs/Public/show_bug.cgi?id=23089
+mk=windows-1251
+pl=ISO-8859-2
+ru=windows-1251
+# https://www.w3.org/Bugs/Public/show_bug.cgi?id=23089
+sah=windows-1251
+sk=windows-1250
+sl=ISO-8859-2
+sr=windows-1251
+# https://www.w3.org/Bugs/Public/show_bug.cgi?id=23089
+tg=windows-1251
+th=windows-874
+tr=windows-1254
+# https://www.w3.org/Bugs/Public/show_bug.cgi?id=23089
+tt=windows-1251
+uk=windows-1251
+vi=windows-1258
+zh=gbk
--- a/dom/encoding/moz.build
+++ b/dom/encoding/moz.build
@ -10,12 +10,14 @@ MODULE = 'dom'

 EXPORTS.mozilla.dom += [
    'EncodingUtils.h',
+    'FallbackEncoding.h',
    'TextDecoder.h',
    'TextEncoder.h',
 ]

 SOURCES += [
    'EncodingUtils.cpp',
+    'FallbackEncoding.cpp',
    'TextDecoder.cpp',
    'TextEncoder.cpp',
 ]
--- a/dom/indexedDB/IDBDatabase.h
+++ b/dom/indexedDB/IDBDatabase.h
@ -162,6 +162,12 @@ public:
                            const ObjectStoreInfoGuts& aInfo,
                            ErrorResult& aRv);

+  IDBFactory*
+  Factory() const
+  {
+    return mFactory;
+  }
+
  // nsWrapperCache
  virtual JSObject*
  WrapObject(JSContext* aCx, JS::Handle<JSObject*> aScope) MOZ_OVERRIDE;
@ -222,6 +228,7 @@ public:
                      ErrorResult& aRv);

  virtual void LastRelease() MOZ_OVERRIDE;
+
 private:
  IDBDatabase();
  ~IDBDatabase();
--- a/dom/indexedDB/IDBFactory.h
+++ b/dom/indexedDB/IDBFactory.h
@ -147,6 +147,12 @@ public:
    return mASCIIOrigin;
  }

+  bool
+  FromIPC()
+  {
+    return !!mContentParent;
+  }
+
  // nsWrapperCache
  virtual JSObject*
  WrapObject(JSContext* aCx, JS::Handle<JSObject*> aScope) MOZ_OVERRIDE;
--- a/dom/indexedDB/IDBRequest.cpp
+++ b/dom/indexedDB/IDBRequest.cpp
@ -66,16 +66,20 @@ IDBRequest::~IDBRequest()

 // static
 already_AddRefed<IDBRequest>
-IDBRequest::Create(IDBWrapperCache* aOwnerCache,
+IDBRequest::Create(IDBDatabase* aDatabase,
                   IDBTransaction* aTransaction)
 {
  NS_ASSERTION(NS_IsMainThread(), "Wrong thread!");
  nsRefPtr<IDBRequest> request(new IDBRequest());

  request->mTransaction = aTransaction;
-  request->BindToOwner(aOwnerCache);
-  request->SetScriptOwner(aOwnerCache->GetScriptOwner());
-  request->CaptureCaller();
+  request->BindToOwner(aDatabase);
+  request->SetScriptOwner(aDatabase->GetScriptOwner());
+
+  if (!aDatabase->Factory()->FromIPC()) {
+    request->CaptureCaller();
+  }
+

  return request.forget();
 }
@ -83,10 +87,10 @@ IDBRequest::Create(IDBWrapperCache* aOwnerCache,
 // static
 already_AddRefed<IDBRequest>
 IDBRequest::Create(IDBObjectStore* aSourceAsObjectStore,
-                   IDBWrapperCache* aOwnerCache,
+                   IDBDatabase* aDatabase,
                   IDBTransaction* aTransaction)
 {
-  nsRefPtr<IDBRequest> request = Create(aOwnerCache, aTransaction);
+  nsRefPtr<IDBRequest> request = Create(aDatabase, aTransaction);

  request->mSourceAsObjectStore = aSourceAsObjectStore;

@ -96,29 +100,16 @@ IDBRequest::Create(IDBObjectStore* aSourceAsObjectStore,
 // static
 already_AddRefed<IDBRequest>
 IDBRequest::Create(IDBIndex* aSourceAsIndex,
-                   IDBWrapperCache* aOwnerCache,
+                   IDBDatabase* aDatabase,
                   IDBTransaction* aTransaction)
 {
-  nsRefPtr<IDBRequest> request = Create(aOwnerCache, aTransaction);
+  nsRefPtr<IDBRequest> request = Create(aDatabase, aTransaction);

  request->mSourceAsIndex = aSourceAsIndex;

  return request.forget();
 }

-// static
-already_AddRefed<IDBRequest>
-IDBRequest::Create(IDBCursor* aSourceAsCursor,
-                   IDBWrapperCache* aOwnerCache,
-                   IDBTransaction* aTransaction)
-{
-  nsRefPtr<IDBRequest> request = Create(aOwnerCache, aTransaction);
-
-  request->mSourceAsCursor = aSourceAsCursor;
-
-  return request.forget();
-}
-
 #ifdef DEBUG
 void
 IDBRequest::AssertSourceIsCorrect() const
@ -287,11 +278,7 @@ IDBRequest::CaptureCaller()
  const char* filename = nullptr;
  uint32_t lineNo = 0;
  if (!nsJSUtils::GetCallingLocation(cx, &filename, &lineNo)) {
-    // If our caller is in another process, we won't have a JSContext on the
-    // stack, and AutoJSContext will push the SafeJSContext. But that won't have
-    // any script on it (certainly not after the push), so GetCallingLocation
-    // will fail when it calls JS_DescribeScriptedCaller. That's fine.
-    NS_WARNING("Failed to get caller.");
+    MOZ_CRASH("Failed to get caller.");
    return;
  }

@ -418,9 +405,12 @@ IDBOpenDBRequest::Create(IDBFactory* aFactory,

  request->BindToOwner(aOwner);
  request->SetScriptOwner(aScriptOwner);
-  request->CaptureCaller();
  request->mFactory = aFactory;

+  if (!aFactory->FromIPC()) {
+    request->CaptureCaller();
+  }
+
  return request.forget();
 }

--- a/dom/indexedDB/IDBRequest.h
+++ b/dom/indexedDB/IDBRequest.h
@ -46,21 +46,17 @@ public:
                                                         IDBWrapperCache)

  static
-  already_AddRefed<IDBRequest> Create(IDBWrapperCache* aOwnerCache,
+  already_AddRefed<IDBRequest> Create(IDBDatabase* aDatabase,
                                      IDBTransaction* aTransaction);

  static
  already_AddRefed<IDBRequest> Create(IDBObjectStore* aSource,
-                                      IDBWrapperCache* aOwnerCache,
+                                      IDBDatabase* aDatabase,
                                      IDBTransaction* aTransaction);

  static
  already_AddRefed<IDBRequest> Create(IDBIndex* aSource,
-                                      IDBWrapperCache* aOwnerCache,
-                                      IDBTransaction* aTransaction);
-  static
-  already_AddRefed<IDBRequest> Create(IDBCursor* aSource,
-                                      IDBWrapperCache* aOwnerCache,
+                                      IDBDatabase* aDatabase,
                                      IDBTransaction* aTransaction);

  // nsIDOMEventTarget
--- a/dom/plugins/base/nsJSNPRuntime.cpp
+++ b/dom/plugins/base/nsJSNPRuntime.cpp
@ -524,7 +524,7 @@ nsJSObjWrapper::NP_Invalidate(NPObject *npobj)

  if (jsnpobj && jsnpobj->mJSObj) {
    // Unroot the object's JSObject
-    js_RemoveRoot(sJSRuntime, &jsnpobj->mJSObj);
+    JS_RemoveObjectRootRT(sJSRuntime, &jsnpobj->mJSObj);

    if (sJSObjWrappers.ops) {
      // Remove the wrapper from the hash
--- a/extensions/universalchardet/tests/CharsetDetectionTests.js
+++ b/extensions/universalchardet/tests/CharsetDetectionTests.js
@ -45,17 +45,9 @@ function InitDetectorTests()
    $("testframe").onload = DoDetectionTest;

    if (gExpectedCharset == "default") {
-        try {
-            gExpectedCharset = prefService
-                .getComplexValue("intl.charset.default",
-                                 Ci.nsIPrefLocalizedString)
-                .data;
-            if (gExpectedCharset == "ISO-8859-1") {
-                gExpectedCharset = "windows-1252";
-            }
-        } catch (e) {
-            gExpectedCharset = "windows-1252";
-        }
+        // No point trying to be generic here, because we have plenty of other
+        // unit tests that fail if run using a non-windows-1252 locale.
+        gExpectedCharset = "windows-1252";
    }

    // Get the local directory. This needs to be a file: URI because chrome:
--- a/js/src/frontend/BytecodeCompiler.cpp
+++ b/js/src/frontend/BytecodeCompiler.cpp
@ -385,10 +385,10 @@ frontend::CompileScript(ExclusiveContext *cx, LifoAlloc *alloc, HandleObject sco
    }

    /*
-     * Nowadays the threaded interpreter needs a stop instruction, so we
+     * Nowadays the threaded interpreter needs a last return instruction, so we
     * do have to emit that here.
     */
-    if (Emit1(cx, &bce, JSOP_STOP) < 0)
+    if (Emit1(cx, &bce, JSOP_RETRVAL) < 0)
        return nullptr;

    if (!JSScript::fullyInitFromEmitter(cx, script, &bce))
--- a/js/src/frontend/BytecodeEmitter.cpp
+++ b/js/src/frontend/BytecodeEmitter.cpp
@ -1140,17 +1140,6 @@ TryConvertFreeName(BytecodeEmitter *bce, ParseNode *pn)
     * resolving upvar accesses within the inner function.
     */
    if (bce->emitterMode == BytecodeEmitter::LazyFunction) {
-        // The only statements within a lazy function which can push lexical
-        // scopes are try/catch blocks. Use generic ops in this case.
-        for (StmtInfoBCE *stmt = bce->topStmt; stmt; stmt = stmt->down) {
-            switch (stmt->type) {
-              case STMT_TRY:
-              case STMT_FINALLY:
-                return true;
-              default:;
-            }
-        }
-
        size_t hops = 0;
        FunctionBox *funbox = bce->sc->asFunctionBox();
        if (funbox->hasExtensibleScope())
@ -2700,10 +2689,10 @@ frontend::EmitFunctionScript(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNo
    }

    /*
-     * Always end the script with a JSOP_STOP. Some other parts of the codebase
+     * Always end the script with a JSOP_RETRVAL. Some other parts of the codebase
     * depend on this opcode, e.g. js_InternalInterpret.
     */
-    if (Emit1(cx, bce, JSOP_STOP) < 0)
+    if (Emit1(cx, bce, JSOP_RETRVAL) < 0)
        return false;

    if (!JSScript::fullyInitFromEmitter(cx, bce->script, bce))
@ -3162,7 +3151,7 @@ MaybeEmitGroupAssignment(ExclusiveContext *cx, BytecodeEmitter *bce, JSOp prolog
 {
    JS_ASSERT(pn->isKind(PNK_ASSIGN));
    JS_ASSERT(pn->isOp(JSOP_NOP));
-    JS_ASSERT(*pop == JSOP_POP || *pop == JSOP_POPV);
+    JS_ASSERT(*pop == JSOP_POP || *pop == JSOP_SETRVAL);

    ParseNode *lhs = pn->pn_left;
    ParseNode *rhs = pn->pn_right;
@ -3194,7 +3183,7 @@ MaybeEmitLetGroupDecl(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn,
 {
    JS_ASSERT(pn->isKind(PNK_ASSIGN));
    JS_ASSERT(pn->isOp(JSOP_NOP));
-    JS_ASSERT(*pop == JSOP_POP || *pop == JSOP_POPV);
+    JS_ASSERT(*pop == JSOP_POP || *pop == JSOP_SETRVAL);

    ParseNode *lhs = pn->pn_left;
    ParseNode *rhs = pn->pn_right;
@ -5309,7 +5298,7 @@ EmitStatement(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
     * that it appears useless to the compiler.
     *
     * API users may also set the JSOPTION_NO_SCRIPT_RVAL option when
-     * calling JS_Compile* to suppress JSOP_POPV.
+     * calling JS_Compile* to suppress JSOP_SETRVAL.
     */
    bool wantval = false;
    bool useful = false;
@ -5339,7 +5328,7 @@ EmitStatement(ExclusiveContext *cx, BytecodeEmitter *bce, ParseNode *pn)
    }

    if (useful) {
-        JSOp op = wantval ? JSOP_POPV : JSOP_POP;
+        JSOp op = wantval ? JSOP_SETRVAL : JSOP_POP;
        JS_ASSERT_IF(pn2->isKind(PNK_ASSIGN), pn2->isOp(JSOP_NOP));
 #if JS_HAS_DESTRUCTURING
        if (!wantval &&
--- a/js/src/gc/Barrier.h
+++ b/js/src/gc/Barrier.h
@ -270,8 +270,11 @@ HashTableWriteBarrierPost(JSRuntime *rt, Map *map, const Key &key)
 #endif
 }

+/*
+ * Base class for barriered pointer types.
+ */
 template<class T, typename Unioned = uintptr_t>
-class EncapsulatedPtr
+class BarrieredPtr
 {
  protected:
    union {
@ -279,38 +282,15 @@ class EncapsulatedPtr
        Unioned other;
    };

+    BarrieredPtr(T *v) : value(v) {}
+    ~BarrieredPtr() { pre(); }
+
  public:
-    EncapsulatedPtr() : value(nullptr) {}
-    EncapsulatedPtr(T *v) : value(v) {}
-    explicit EncapsulatedPtr(const EncapsulatedPtr<T> &v) : value(v.value) {}
-
-    ~EncapsulatedPtr() { pre(); }
-
    void init(T *v) {
        JS_ASSERT(!IsPoisonedPtr<T>(v));
        this->value = v;
    }

-    /* Use to set the pointer to nullptr. */
-    void clear() {
-        pre();
-        value = nullptr;
-    }
-
-    EncapsulatedPtr<T, Unioned> &operator=(T *v) {
-        pre();
-        JS_ASSERT(!IsPoisonedPtr<T>(v));
-        value = v;
-        return *this;
-    }
-
-    EncapsulatedPtr<T, Unioned> &operator=(const EncapsulatedPtr<T> &v) {
-        pre();
-        JS_ASSERT(!IsPoisonedPtr<T>(v.value));
-        value = v.value;
-        return *this;
-    }
-
    /* Use this if the automatic coercion to T* isn't working. */
    T *get() const { return value; }

@ -332,19 +312,48 @@ class EncapsulatedPtr
    void pre() { T::writeBarrierPre(value); }
 };

+template<class T, typename Unioned = uintptr_t>
+class EncapsulatedPtr : public BarrieredPtr<T, Unioned>
+{
+  public:
+    EncapsulatedPtr() : BarrieredPtr<T, Unioned>(nullptr) {}
+    EncapsulatedPtr(T *v) : BarrieredPtr<T, Unioned>(v) {}
+    explicit EncapsulatedPtr(const EncapsulatedPtr<T, Unioned> &v)
+      : BarrieredPtr<T, Unioned>(v.value) {}
+
+    /* Use to set the pointer to nullptr. */
+    void clear() {
+        this->pre();
+        this->value = nullptr;
+    }
+
+    EncapsulatedPtr<T, Unioned> &operator=(T *v) {
+        this->pre();
+        JS_ASSERT(!IsPoisonedPtr<T>(v));
+        this->value = v;
+        return *this;
+    }
+
+    EncapsulatedPtr<T, Unioned> &operator=(const EncapsulatedPtr<T> &v) {
+        this->pre();
+        JS_ASSERT(!IsPoisonedPtr<T>(v.value));
+        this->value = v.value;
+        return *this;
+    }
+};
+
 /*
 * A pre- and post-barriered heap pointer, for use inside the JS engine.
 *
 * Not to be confused with JS::Heap<T>.
 */
 template <class T, class Unioned = uintptr_t>
-class HeapPtr : public EncapsulatedPtr<T, Unioned>
+class HeapPtr : public BarrieredPtr<T, Unioned>
 {
  public:
-    HeapPtr() : EncapsulatedPtr<T>(nullptr) {}
-    explicit HeapPtr(T *v) : EncapsulatedPtr<T>(v) { post(); }
-    explicit HeapPtr(const HeapPtr<T> &v)
-      : EncapsulatedPtr<T>(v) { post(); }
+    HeapPtr() : BarrieredPtr<T, Unioned>(nullptr) {}
+    explicit HeapPtr(T *v) : BarrieredPtr<T, Unioned>(v) { post(); }
+    explicit HeapPtr(const HeapPtr<T> &v) : BarrieredPtr<T, Unioned>(v) { post(); }

    void init(T *v) {
        JS_ASSERT(!IsPoisonedPtr<T>(v));
@ -410,15 +419,15 @@ class FixedHeapPtr
 };

 template <class T>
-class RelocatablePtr : public EncapsulatedPtr<T>
+class RelocatablePtr : public BarrieredPtr<T>
 {
  public:
-    RelocatablePtr() : EncapsulatedPtr<T>(nullptr) {}
-    explicit RelocatablePtr(T *v) : EncapsulatedPtr<T>(v) {
+    RelocatablePtr() : BarrieredPtr<T>(nullptr) {}
+    explicit RelocatablePtr(T *v) : BarrieredPtr<T>(v) {
        if (v)
            post();
    }
-    RelocatablePtr(const RelocatablePtr<T> &v) : EncapsulatedPtr<T>(v) {
+    RelocatablePtr(const RelocatablePtr<T> &v) : BarrieredPtr<T>(v) {
        if (this->value)
            post();
    }
@ -495,6 +504,9 @@ class Shape;
 class BaseShape;
 namespace types { struct TypeObject; }

+typedef BarrieredPtr<JSObject> BarrieredPtrObject;
+typedef BarrieredPtr<JSScript> BarrieredPtrScript;
+
 typedef EncapsulatedPtr<JSObject> EncapsulatedPtrObject;
 typedef EncapsulatedPtr<JSScript> EncapsulatedPtrScript;

@ -540,7 +552,10 @@ struct EncapsulatedPtrHasher
 template <class T>
 struct DefaultHasher< EncapsulatedPtr<T> > : EncapsulatedPtrHasher<T> { };

-class EncapsulatedValue : public ValueOperations<EncapsulatedValue>
+/*
+ * Base class for barriered value types.
+ */
+class BarrieredValue : public ValueOperations<BarrieredValue>
 {
  protected:
    Value value;
@ -549,20 +564,17 @@ class EncapsulatedValue : public ValueOperations<EncapsulatedValue>
     * Ensure that EncapsulatedValue is not constructable, except by our
     * implementations.
     */
-    EncapsulatedValue() MOZ_DELETE;
+    BarrieredValue() MOZ_DELETE;

-  public:
-    EncapsulatedValue(const Value &v) : value(v) {
-        JS_ASSERT(!IsPoisonedValue(v));
-    }
-    EncapsulatedValue(const EncapsulatedValue &v) : value(v) {
+    BarrieredValue(const Value &v) : value(v) {
        JS_ASSERT(!IsPoisonedValue(v));
    }

-    ~EncapsulatedValue() {
+    ~BarrieredValue() {
        pre();
    }

+  public:
    void init(const Value &v) {
        JS_ASSERT(!IsPoisonedValue(v));
        value = v;
@ -572,22 +584,8 @@ class EncapsulatedValue : public ValueOperations<EncapsulatedValue>
        value = v;
    }

-    EncapsulatedValue &operator=(const Value &v) {
-        pre();
-        JS_ASSERT(!IsPoisonedValue(v));
-        value = v;
-        return *this;
-    }
-
-    EncapsulatedValue &operator=(const EncapsulatedValue &v) {
-        pre();
-        JS_ASSERT(!IsPoisonedValue(v));
-        value = v.get();
-        return *this;
-    }
-
-    bool operator==(const EncapsulatedValue &v) const { return value == v.value; }
-    bool operator!=(const EncapsulatedValue &v) const { return value != v.value; }
+    bool operator==(const BarrieredValue &v) const { return value == v.value; }
+    bool operator!=(const BarrieredValue &v) const { return value != v.value; }

    const Value &get() const { return value; }
    Value *unsafeGet() { return &value; }
@ -636,33 +634,54 @@ class EncapsulatedValue : public ValueOperations<EncapsulatedValue>
    }

  private:
-    friend class ValueOperations<EncapsulatedValue>;
+    friend class ValueOperations<BarrieredValue>;
    const Value * extract() const { return &value; }
 };

+class EncapsulatedValue : public BarrieredValue
+{
+  public:
+    EncapsulatedValue(const Value &v) : BarrieredValue(v) {}
+    EncapsulatedValue(const EncapsulatedValue &v) : BarrieredValue(v) {}
+
+    EncapsulatedValue &operator=(const Value &v) {
+        pre();
+        JS_ASSERT(!IsPoisonedValue(v));
+        value = v;
+        return *this;
+    }
+
+    EncapsulatedValue &operator=(const EncapsulatedValue &v) {
+        pre();
+        JS_ASSERT(!IsPoisonedValue(v));
+        value = v.get();
+        return *this;
+    }
+};
+
 /*
 * A pre- and post-barriered heap JS::Value, for use inside the JS engine.
 *
 * Not to be confused with JS::Heap<JS::Value>.
 */
-class HeapValue : public EncapsulatedValue
+class HeapValue : public BarrieredValue
 {
  public:
    explicit HeapValue()
-      : EncapsulatedValue(UndefinedValue())
+      : BarrieredValue(UndefinedValue())
    {
        post();
    }

    explicit HeapValue(const Value &v)
-      : EncapsulatedValue(v)
+      : BarrieredValue(v)
    {
        JS_ASSERT(!IsPoisonedValue(v));
        post();
    }

    explicit HeapValue(const HeapValue &v)
-      : EncapsulatedValue(v.value)
+      : BarrieredValue(v.value)
    {
        JS_ASSERT(!IsPoisonedValue(v.value));
        post();
@ -745,23 +764,20 @@ class HeapValue : public EncapsulatedValue
    }
 };

-class RelocatableValue : public EncapsulatedValue
+class RelocatableValue : public BarrieredValue
 {
  public:
-    explicit RelocatableValue()
-      : EncapsulatedValue(UndefinedValue())
-    {}
+    explicit RelocatableValue() : BarrieredValue(UndefinedValue()) {}

    explicit RelocatableValue(const Value &v)
-      : EncapsulatedValue(v)
+      : BarrieredValue(v)
    {
-        JS_ASSERT(!IsPoisonedValue(v));
        if (v.isMarkable())
            post();
    }

    RelocatableValue(const RelocatableValue &v)
-      : EncapsulatedValue(v.value)
+      : BarrieredValue(v.value)
    {
        JS_ASSERT(!IsPoisonedValue(v.value));
        if (v.value.isMarkable())
@ -822,16 +838,8 @@ class RelocatableValue : public EncapsulatedValue
    }
 };

-class HeapSlot : public EncapsulatedValue
+class HeapSlot : public BarrieredValue
 {
-    /*
-     * Operator= is not valid for HeapSlot because is must take the object and
-     * slot offset to provide to the post/generational barrier.
-     */
-    inline HeapSlot &operator=(const Value &v) MOZ_DELETE;
-    inline HeapSlot &operator=(const HeapValue &v) MOZ_DELETE;
-    inline HeapSlot &operator=(const HeapSlot &v) MOZ_DELETE;
-
  public:
    enum Kind {
        Slot,
@ -841,14 +849,14 @@ class HeapSlot : public EncapsulatedValue
    explicit HeapSlot() MOZ_DELETE;

    explicit HeapSlot(JSObject *obj, Kind kind, uint32_t slot, const Value &v)
-      : EncapsulatedValue(v)
+      : BarrieredValue(v)
    {
        JS_ASSERT(!IsPoisonedValue(v));
        post(obj, kind, slot, v);
    }

    explicit HeapSlot(JSObject *obj, Kind kind, uint32_t slot, const HeapSlot &s)
-      : EncapsulatedValue(s.value)
+      : BarrieredValue(s.value)
    {
        JS_ASSERT(!IsPoisonedValue(s.value));
        post(obj, kind, slot, s);
@ -925,7 +933,7 @@ class HeapSlot : public EncapsulatedValue
 };

 static inline const Value *
-Valueify(const EncapsulatedValue *array)
+Valueify(const BarrieredValue *array)
 {
    JS_STATIC_ASSERT(sizeof(HeapValue) == sizeof(Value));
    JS_STATIC_ASSERT(sizeof(HeapSlot) == sizeof(Value));
@ -954,27 +962,22 @@ class HeapSlotArray
    HeapSlotArray operator +(uint32_t offset) const { return HeapSlotArray(array + offset); }
 };

-class EncapsulatedId
+/*
+ * Base class for barriered jsid types.
+ */
+class BarrieredId
 {
  protected:
    jsid value;

  private:
-    EncapsulatedId(const EncapsulatedId &v) MOZ_DELETE;
+    BarrieredId(const BarrieredId &v) MOZ_DELETE;
+
+  protected:
+    explicit BarrieredId(jsid id) : value(id) {}
+    ~BarrieredId() { pre(); }

  public:
-    explicit EncapsulatedId() : value(JSID_VOID) {}
-    explicit EncapsulatedId(jsid id) : value(id) {}
-    ~EncapsulatedId() { pre(); }
-
-    EncapsulatedId &operator=(const EncapsulatedId &v) {
-        if (v.value != value)
-            pre();
-        JS_ASSERT(!IsPoisonedId(v.value));
-        value = v.value;
-        return *this;
-    }
-
    bool operator==(jsid id) const { return value == id; }
    bool operator!=(jsid id) const { return value != id; }

@ -1005,13 +1008,36 @@ class EncapsulatedId
    }
 };

-class RelocatableId : public EncapsulatedId
+class EncapsulatedId : public BarrieredId
 {
  public:
-    explicit RelocatableId() : EncapsulatedId() {}
-    explicit inline RelocatableId(jsid id) : EncapsulatedId(id) {}
+    explicit EncapsulatedId(jsid id) : BarrieredId(id) {}
+    explicit EncapsulatedId() : BarrieredId(JSID_VOID) {}
+
+    EncapsulatedId &operator=(const EncapsulatedId &v) {
+        if (v.value != value)
+            pre();
+        JS_ASSERT(!IsPoisonedId(v.value));
+        value = v.value;
+        return *this;
+    }
+};
+
+class RelocatableId : public BarrieredId
+{
+  public:
+    explicit RelocatableId() : BarrieredId(JSID_VOID) {}
+    explicit inline RelocatableId(jsid id) : BarrieredId(id) {}
    ~RelocatableId() { pre(); }

+    bool operator==(jsid id) const { return value == id; }
+    bool operator!=(jsid id) const { return value != id; }
+
+    jsid get() const { return value; }
+    operator jsid() const { return value; }
+
+    jsid *unsafeGet() { return &value; }
+
    RelocatableId &operator=(jsid id) {
        if (id != value)
            pre();
@ -1034,13 +1060,13 @@ class RelocatableId : public EncapsulatedId
 *
 * Not to be confused with JS::Heap<jsid>.
 */
-class HeapId : public EncapsulatedId
+class HeapId : public BarrieredId
 {
  public:
-    explicit HeapId() : EncapsulatedId() {}
+    explicit HeapId() : BarrieredId(JSID_VOID) {}

    explicit HeapId(jsid id)
-      : EncapsulatedId(id)
+      : BarrieredId(id)
    {
        JS_ASSERT(!IsPoisonedId(id));
        post();
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@ -219,7 +219,7 @@ MarkUnbarriered(JSTracer *trc, T **thingp, const char *name)

 template <typename T>
 static void
-Mark(JSTracer *trc, EncapsulatedPtr<T> *thing, const char *name)
+Mark(JSTracer *trc, BarrieredPtr<T> *thing, const char *name)
 {
    JS_SET_TRACING_NAME(trc, name);
    MarkInternal(trc, thing->unsafeGet());
@ -311,7 +311,7 @@ IsAboutToBeFinalized(T **thingp)

 #define DeclMarkerImpl(base, type)                                                                \
 void                                                                                              \
-Mark##base(JSTracer *trc, EncapsulatedPtr<type> *thing, const char *name)                         \
+Mark##base(JSTracer *trc, BarrieredPtr<type> *thing, const char *name)                         \
 {                                                                                                 \
    Mark<type>(trc, thing, name);                                                                 \
 }                                                                                                 \
@ -352,7 +352,7 @@ Is##base##Marked(type **thingp)
 }                                                                                                 \
                                                                                                  \
 bool                                                                                              \
-Is##base##Marked(EncapsulatedPtr<type> *thingp)                                                   \
+Is##base##Marked(BarrieredPtr<type> *thingp)                                                   \
 {                                                                                                 \
    return IsMarked<type>(thingp->unsafeGet());                                                   \
 }                                                                                                 \
@ -364,7 +364,7 @@ Is##base##AboutToBeFinalized(type **thingp)
 }                                                                                                 \
                                                                                                  \
 bool                                                                                              \
-Is##base##AboutToBeFinalized(EncapsulatedPtr<type> *thingp)                                       \
+Is##base##AboutToBeFinalized(BarrieredPtr<type> *thingp)                                       \
 {                                                                                                 \
    return IsAboutToBeFinalized<type>(thingp->unsafeGet());                                       \
 }
@ -476,7 +476,7 @@ MarkIdInternal(JSTracer *trc, jsid *id)
 }

 void
-gc::MarkId(JSTracer *trc, EncapsulatedId *id, const char *name)
+gc::MarkId(JSTracer *trc, BarrieredId *id, const char *name)
 {
    JS_SET_TRACING_NAME(trc, name);
    MarkIdInternal(trc, id->unsafeGet());
@ -537,7 +537,7 @@ MarkValueInternal(JSTracer *trc, Value *v)
 }

 void
-gc::MarkValue(JSTracer *trc, EncapsulatedValue *v, const char *name)
+gc::MarkValue(JSTracer *trc, BarrieredValue *v, const char *name)
 {
    JS_SET_TRACING_NAME(trc, name);
    MarkValueInternal(trc, v->unsafeGet());
@ -568,7 +568,7 @@ gc::MarkTypeRoot(JSTracer *trc, types::Type *v, const char *name)
 }

 void
-gc::MarkValueRange(JSTracer *trc, size_t len, EncapsulatedValue *vec, const char *name)
+gc::MarkValueRange(JSTracer *trc, size_t len, BarrieredValue *vec, const char *name)
 {
    for (size_t i = 0; i < len; ++i) {
        JS_SET_TRACING_INDEX(trc, name, i);
@ -877,7 +877,7 @@ ScanShape(GCMarker *gcmarker, Shape *shape)
  restart:
    PushMarkStack(gcmarker, shape->base());

-    const EncapsulatedId &id = shape->propidRef();
+    const BarrieredId &id = shape->propidRef();
    if (JSID_IS_STRING(id))
        PushMarkStack(gcmarker, JSID_TO_STRING(id));
    else if (JS_UNLIKELY(JSID_IS_OBJECT(id)))
--- a/js/src/gc/Marking.h
+++ b/js/src/gc/Marking.h
@ -81,15 +81,15 @@ namespace gc {
 *     GC things.  It indicates whether the object is currently marked.
 */
 #define DeclMarker(base, type)                                                                    \
-void Mark##base(JSTracer *trc, EncapsulatedPtr<type> *thing, const char *name);                   \
+void Mark##base(JSTracer *trc, BarrieredPtr<type> *thing, const char *name);                   \
 void Mark##base##Root(JSTracer *trc, type **thingp, const char *name);                            \
 void Mark##base##Unbarriered(JSTracer *trc, type **thingp, const char *name);                     \
 void Mark##base##Range(JSTracer *trc, size_t len, HeapPtr<type> *thing, const char *name);        \
 void Mark##base##RootRange(JSTracer *trc, size_t len, type **thing, const char *name);            \
 bool Is##base##Marked(type **thingp);                                                             \
-bool Is##base##Marked(EncapsulatedPtr<type> *thingp);                                             \
+bool Is##base##Marked(BarrieredPtr<type> *thingp);                                             \
 bool Is##base##AboutToBeFinalized(type **thingp);                                                 \
-bool Is##base##AboutToBeFinalized(EncapsulatedPtr<type> *thingp);
+bool Is##base##AboutToBeFinalized(BarrieredPtr<type> *thingp);                                 \

 DeclMarker(BaseShape, BaseShape)
 DeclMarker(BaseShape, UnownedBaseShape)
@ -142,7 +142,7 @@ MarkGCThingUnbarriered(JSTracer *trc, void **thingp, const char *name);
 /*** ID Marking ***/

 void
-MarkId(JSTracer *trc, EncapsulatedId *id, const char *name);
+MarkId(JSTracer *trc, BarrieredId *id, const char *name);

 void
 MarkIdRoot(JSTracer *trc, jsid *id, const char *name);
@ -159,10 +159,10 @@ MarkIdRootRange(JSTracer *trc, size_t len, jsid *vec, const char *name);
 /*** Value Marking ***/

 void
-MarkValue(JSTracer *trc, EncapsulatedValue *v, const char *name);
+MarkValue(JSTracer *trc, BarrieredValue *v, const char *name);

 void
-MarkValueRange(JSTracer *trc, size_t len, EncapsulatedValue *vec, const char *name);
+MarkValueRange(JSTracer *trc, size_t len, BarrieredValue *vec, const char *name);

 inline void
 MarkValueRange(JSTracer *trc, HeapValue *begin, HeapValue *end, const char *name)
@ -259,19 +259,19 @@ PushArena(GCMarker *gcmarker, ArenaHeader *aheader);
 */

 inline void
-Mark(JSTracer *trc, EncapsulatedValue *v, const char *name)
+Mark(JSTracer *trc, BarrieredValue *v, const char *name)
 {
    MarkValue(trc, v, name);
 }

 inline void
-Mark(JSTracer *trc, EncapsulatedPtrObject *o, const char *name)
+Mark(JSTracer *trc, BarrieredPtrObject *o, const char *name)
 {
    MarkObject(trc, o, name);
 }

 inline void
-Mark(JSTracer *trc, EncapsulatedPtrScript *o, const char *name)
+Mark(JSTracer *trc, BarrieredPtrScript *o, const char *name)
 {
    MarkScript(trc, o, name);
 }
@ -303,7 +303,7 @@ bool
 IsCellAboutToBeFinalized(Cell **thing);

 inline bool
-IsMarked(EncapsulatedValue *v)
+IsMarked(BarrieredValue *v)
 {
    if (!v->isMarkable())
        return true;
@ -311,19 +311,19 @@ IsMarked(EncapsulatedValue *v)
 }

 inline bool
-IsMarked(EncapsulatedPtrObject *objp)
+IsMarked(BarrieredPtrObject *objp)
 {
    return IsObjectMarked(objp);
 }

 inline bool
-IsMarked(EncapsulatedPtrScript *scriptp)
+IsMarked(BarrieredPtrScript *scriptp)
 {
    return IsScriptMarked(scriptp);
 }

 inline bool
-IsAboutToBeFinalized(EncapsulatedValue *v)
+IsAboutToBeFinalized(BarrieredValue *v)
 {
    if (!v->isMarkable())
        return false;
@ -331,13 +331,13 @@ IsAboutToBeFinalized(EncapsulatedValue *v)
 }

 inline bool
-IsAboutToBeFinalized(EncapsulatedPtrObject *objp)
+IsAboutToBeFinalized(BarrieredPtrObject *objp)
 {
    return IsObjectAboutToBeFinalized(objp);
 }

 inline bool
-IsAboutToBeFinalized(EncapsulatedPtrScript *scriptp)
+IsAboutToBeFinalized(BarrieredPtrScript *scriptp)
 {
    return IsScriptAboutToBeFinalized(scriptp);
 }
--- a/js/src/jit-test/jit_test.py
+++ b/js/src/jit-test/jit_test.py
@ -196,7 +196,6 @@ def main(argv):
        prolog = posixpath.join(options.remote_test_root, 'jit-tests', 'jit-tests', 'lib', 'prolog.js')

    prefix += ['-f', prolog]
-    prefix += ['--js-cache', jittests.JS_CACHE_DIR]

    # Avoid racing on the cache by having the js shell create a new cache
    # subdir for each process. The js shell takes care of deleting these
--- a/js/src/jit/BacktrackingAllocator.cpp
+++ b/js/src/jit/BacktrackingAllocator.cpp
@ -368,6 +368,8 @@ BacktrackingAllocator::groupAndQueueRegisters()
        if (!reg.numIntervals())
            continue;

+        // Disable this for now; see bugs 906858, 931487, and 932465.
+#if 0
        // Eagerly set the canonical spill slot for registers which are preset
        // for that slot, and reuse it for other registers in the group.
        LDefinition *def = reg.def();
@ -376,6 +378,7 @@ BacktrackingAllocator::groupAndQueueRegisters()
            if (reg.group() && reg.group()->spill.isUse())
                reg.group()->spill = *def->output();
        }
+#endif

        // Place all intervals for this register on the allocation queue.
        // During initial queueing use single queue items for groups of
--- a/js/src/jit/BaselineCompiler.cpp
+++ b/js/src/jit/BaselineCompiler.cpp
@ -728,6 +728,7 @@ BaselineCompiler::emitBody()

    bool lastOpUnreachable = false;
    uint32_t emittedOps = 0;
+    mozilla::DebugOnly<jsbytecode *> prevpc = pc;

    while (true) {
        JSOp op = JSOp(*pc);
@ -738,10 +739,13 @@ BaselineCompiler::emitBody()

        // Skip unreachable ops.
        if (!info) {
-            if (op == JSOP_STOP)
-                break;
+            // Test if last instructions and stop emitting in that case.
            pc += GetBytecodeLength(pc);
+            if (pc >= script->code + script->length)
+                break;
+
            lastOpUnreachable = true;
+            prevpc = pc;
            continue;
        }

@ -791,15 +795,19 @@ OPCODE_LIST(EMIT_OP)
 #undef EMIT_OP
        }

-        if (op == JSOP_STOP)
+        // Test if last instructions and stop emitting in that case.
+        pc += GetBytecodeLength(pc);
+        if (pc >= script->code + script->length)
            break;

-        pc += GetBytecodeLength(pc);
        emittedOps++;
        lastOpUnreachable = false;
+#ifdef DEBUG
+        prevpc = pc;
+#endif
    }

-    JS_ASSERT(JSOp(*pc) == JSOP_STOP);
+    JS_ASSERT(JSOp(*prevpc) == JSOP_RETRVAL);
    return Method_Compiled;
 }

@ -2692,11 +2700,11 @@ BaselineCompiler::emitReturn()
        masm.loadValue(frame.addressOfReturnValue(), JSReturnOperand);
    }

-    if (JSOp(*pc) != JSOP_STOP) {
-        // JSOP_STOP is immediately followed by the return label, so we don't
-        // need a jump.
+    // Only emit the jump if this JSOP_RETRVAL is not the last instruction.
+    // Not needed for last instruction, because last instruction flows
+    // into return label.
+    if (pc + GetBytecodeLength(pc) < script->code + script->length)
        masm.jump(&return_);
-    }

    return true;
 }
@ -2711,7 +2719,7 @@ BaselineCompiler::emit_JSOP_RETURN()
 }

 bool
-BaselineCompiler::emit_JSOP_STOP()
+BaselineCompiler::emit_JSOP_RETRVAL()
 {
    JS_ASSERT(frame.stackDepth() == 0);

@ -2729,12 +2737,6 @@ BaselineCompiler::emit_JSOP_STOP()
    return emitReturn();
 }

-bool
-BaselineCompiler::emit_JSOP_RETRVAL()
-{
-    return emit_JSOP_STOP();
-}
-
 typedef bool (*ToIdFn)(JSContext *, HandleScript, jsbytecode *, HandleValue, HandleValue,
                       MutableHandleValue);
 static const VMFunction ToIdInfo = FunctionInfo<ToIdFn>(js::ToIdOperation);
@ -2849,12 +2851,6 @@ BaselineCompiler::emit_JSOP_CALLEE()
    return true;
 }

-bool
-BaselineCompiler::emit_JSOP_POPV()
-{
-    return emit_JSOP_SETRVAL();
-}
-
 typedef bool (*NewArgumentsObjectFn)(JSContext *, BaselineFrame *, MutableHandleValue);
 static const VMFunction NewArgumentsObjectInfo =
    FunctionInfo<NewArgumentsObjectFn>(jit::NewArgumentsObject);
--- a/js/src/jit/BaselineCompiler.h
+++ b/js/src/jit/BaselineCompiler.h
@ -164,11 +164,9 @@ namespace jit {
    _(JSOP_ITERNEXT)           \
    _(JSOP_ENDITER)            \
    _(JSOP_CALLEE)             \
-    _(JSOP_POPV)               \
    _(JSOP_SETRVAL)            \
-    _(JSOP_RETURN)             \
-    _(JSOP_STOP)               \
-    _(JSOP_RETRVAL)
+    _(JSOP_RETRVAL)            \
+    _(JSOP_RETURN)

 class BaselineCompiler : public BaselineCompilerSpecific
 {
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@ -1222,7 +1222,6 @@ IonBuilder::traverseBytecode()
              case JSOP_SETARG:
              case JSOP_SETLOCAL:
              case JSOP_SETRVAL:
-              case JSOP_POPV:
              case JSOP_VOID:
                // Don't require SSA uses for values popped by these ops.
                break;
@ -1271,7 +1270,6 @@ IonBuilder::snoopControlFlow(JSOp op)
        return maybeLoop(op, info().getNote(gsn, pc));

      case JSOP_RETURN:
-      case JSOP_STOP:
      case JSOP_RETRVAL:
        return processReturn(op);

@ -1678,7 +1676,6 @@ IonBuilder::inspectOpcode(JSOp op)
        return jsop_in();

      case JSOP_SETRVAL:
-      case JSOP_POPV:
        JS_ASSERT(!script()->noScriptRval);
        current->setSlot(info().returnValueSlot(), current->pop());
        return true;
@ -3478,7 +3475,7 @@ IonBuilder::processReturn(JSOp op)
        def = current->pop();
        break;

-      case JSOP_STOP:
+      case JSOP_RETRVAL:
        // Return undefined eagerly if script doesn't use return value.
        if (script()->noScriptRval) {
            MInstruction *ins = MConstant::New(UndefinedValue());
@ -3487,9 +3484,6 @@ IonBuilder::processReturn(JSOp op)
            break;
        }

-        // Fall through
-      case JSOP_RETRVAL:
-        // Return the value in the return value slot.
        def = current->getSlot(info().returnValueSlot());
        break;

--- a/js/src/jsanalyze.cpp
+++ b/js/src/jsanalyze.cpp
@ -227,7 +227,7 @@ ScriptAnalysis::analyzeBytecode(JSContext *cx)
        switch (op) {

          case JSOP_RETURN:
-          case JSOP_STOP:
+          case JSOP_RETRVAL:
            numReturnSites_++;
            break;

@ -1221,7 +1221,6 @@ ScriptAnalysis::analyzeSSA(JSContext *cx)

          case JSOP_THROW:
          case JSOP_RETURN:
-          case JSOP_STOP:
          case JSOP_RETRVAL:
            mergeAllExceptionTargets(cx, values, exceptionTargets);
            break;
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@ -1654,52 +1654,52 @@ JS_PUBLIC_API(void)
 JS_RemoveValueRoot(JSContext *cx, jsval *vp)
 {
    CHECK_REQUEST(cx);
-    js_RemoveRoot(cx->runtime(), (void *)vp);
+    RemoveRoot(cx->runtime(), (void *)vp);
 }

 JS_PUBLIC_API(void)
 JS_RemoveStringRoot(JSContext *cx, JSString **rp)
 {
    CHECK_REQUEST(cx);
-    js_RemoveRoot(cx->runtime(), (void *)rp);
+    RemoveRoot(cx->runtime(), (void *)rp);
 }

 JS_PUBLIC_API(void)
 JS_RemoveObjectRoot(JSContext *cx, JSObject **rp)
 {
    CHECK_REQUEST(cx);
-    js_RemoveRoot(cx->runtime(), (void *)rp);
+    RemoveRoot(cx->runtime(), (void *)rp);
 }

 JS_PUBLIC_API(void)
 JS_RemoveScriptRoot(JSContext *cx, JSScript **rp)
 {
    CHECK_REQUEST(cx);
-    js_RemoveRoot(cx->runtime(), (void *)rp);
+    RemoveRoot(cx->runtime(), (void *)rp);
 }

 JS_PUBLIC_API(void)
 JS_RemoveValueRootRT(JSRuntime *rt, jsval *vp)
 {
-    js_RemoveRoot(rt, (void *)vp);
+    RemoveRoot(rt, (void *)vp);
 }

 JS_PUBLIC_API(void)
 JS_RemoveStringRootRT(JSRuntime *rt, JSString **rp)
 {
-    js_RemoveRoot(rt, (void *)rp);
+    RemoveRoot(rt, (void *)rp);
 }

 JS_PUBLIC_API(void)
 JS_RemoveObjectRootRT(JSRuntime *rt, JSObject **rp)
 {
-    js_RemoveRoot(rt, (void *)rp);
+    RemoveRoot(rt, (void *)rp);
 }

 JS_PUBLIC_API(void)
 JS_RemoveScriptRootRT(JSRuntime *rt, JSScript **rp)
 {
-    js_RemoveRoot(rt, (void *)rp);
+    RemoveRoot(rt, (void *)rp);
 }

 JS_NEVER_INLINE JS_PUBLIC_API(void)
--- a/js/src/jsapi.h
+++ b/js/src/jsapi.h
@ -1980,11 +1980,6 @@ JS_RemoveObjectRootRT(JSRuntime *rt, JSObject **rp);
 extern JS_PUBLIC_API(void)
 JS_RemoveScriptRootRT(JSRuntime *rt, JSScript **rp);

-/* TODO: remove these APIs */
-
-extern JS_FRIEND_API(void)
-js_RemoveRoot(JSRuntime *rt, void *rp);
-
 /*
 * C-compatible version of the Anchor class. It should be called after the last
 * use of the variable it protects.
--- a/js/src/jsarray.cpp
+++ b/js/src/jsarray.cpp
@ -1200,7 +1200,7 @@ InitArrayTypes(JSContext *cx, TypeObject *type, const Value *vector, unsigned co
    if (cx->typeInferenceEnabled() && !type->unknownProperties()) {
        AutoEnterAnalysis enter(cx);

-        TypeSet *types = type->getProperty(cx, JSID_VOID);
+        HeapTypeSet *types = type->getProperty(cx, JSID_VOID);
        if (!types)
            return false;

--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@ -1104,11 +1104,11 @@ js_AddObjectRoot(JSRuntime *rt, JSObject **objp)
 extern JS_FRIEND_API(void)
 js_RemoveObjectRoot(JSRuntime *rt, JSObject **objp)
 {
-    js_RemoveRoot(rt, objp);
+    RemoveRoot(rt, objp);
 }

-JS_FRIEND_API(void)
-js_RemoveRoot(JSRuntime *rt, void *rp)
+void
+js::RemoveRoot(JSRuntime *rt, void *rp)
 {
    rt->gcRootsHash.remove(rp);
    rt->gcPoke = true;
--- a/js/src/jsgc.h
+++ b/js/src/jsgc.h
@ -668,6 +668,9 @@ AddObjectRoot(JSRuntime *rt, JSObject **rp, const char *name);
 extern bool
 AddScriptRoot(JSContext *cx, JSScript **rp, const char *name);

+extern void
+RemoveRoot(JSRuntime *rt, void *rp);
+
 } /* namespace js */

 extern bool
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@ -397,10 +397,8 @@ TypeSet::addTypesToConstraint(JSContext *cx, TypeConstraint *constraint)
 }

 void
-TypeSet::add(JSContext *cx, TypeConstraint *constraint, bool callExisting)
+ConstraintTypeSet::add(JSContext *cx, TypeConstraint *constraint, bool callExisting)
 {
-    JS_ASSERT(isStackSet() || isHeapSet());
-
    if (!constraint) {
        /* OOM failure while constructing the constraint. */
        cx->compartment()->types.setPendingNukeTypes(cx);
@ -485,9 +483,7 @@ TypeSet::clone(LifoAlloc *alloc, TemporaryTypeSet *result) const
        PodCopy(newSet, objectSet, capacity);
    }

-    uint32_t newFlags = flags & ~(TYPE_FLAG_STACK_SET | TYPE_FLAG_HEAP_SET);
-
-    new(result) TemporaryTypeSet(newFlags, capacity ? newSet : objectSet);
+    new(result) TemporaryTypeSet(flags, capacity ? newSet : objectSet);
    return true;
 }

@ -1352,7 +1348,7 @@ ObjectStateChange(ExclusiveContext *cxArg, TypeObject *object, bool markingUnkno
        return;

    /* All constraints listening to state changes are on the empty id. */
-    TypeSet *types = object->maybeGetProperty(JSID_EMPTY);
+    HeapTypeSet *types = object->maybeGetProperty(JSID_EMPTY);

    /* Mark as unknown after getting the types, to avoid assertion. */
    if (markingUnknown)
@ -2172,7 +2168,7 @@ TypeCompartment::markSetsUnknown(JSContext *cx, TypeObject *target)
     * types can't be done while iterating over cells as it can potentially make
     * new type objects as well or trigger GC.
     */
-    Vector<TypeSet *> pending(cx);
+    Vector<ConstraintTypeSet *> pending(cx);
    for (gc::CellIter i(cx->zone(), gc::FINALIZE_TYPE_OBJECT); !i.done(); i.next()) {
        TypeObject *object = i.get<TypeObject>();
        unsigned count = object->getPropertyCount();
@ -2192,7 +2188,7 @@ TypeCompartment::markSetsUnknown(JSContext *cx, TypeObject *target)
        RootedScript script(cx, i.get<JSScript>());
        if (script->types) {
            unsigned count = TypeScript::NumTypeSets(script);
-            TypeSet *typeArray = script->types->typeArray();
+            StackTypeSet *typeArray = script->types->typeArray();
            for (unsigned i = 0; i < count; i++) {
                if (typeArray[i].hasType(Type::ObjectType(target)))
                    typeArray[i].addType(cx, Type::AnyObjectType());
@ -2761,7 +2757,7 @@ InlineAddTypeProperty(ExclusiveContext *cx, TypeObject *obj, jsid id, Type type)

    AutoEnterAnalysis enter(cx);

-    TypeSet *types = obj->getProperty(cx, id);
+    HeapTypeSet *types = obj->getProperty(cx, id);
    if (!types || types->hasType(type))
        return;

@ -2811,7 +2807,7 @@ TypeObject::markPropertyConfigured(ExclusiveContext *cx, jsid id)

    id = IdToTypeId(id);

-    TypeSet *types = getProperty(cx, id);
+    HeapTypeSet *types = getProperty(cx, id);
    if (types)
        types->setConfiguredProperty(cx);
 }
@ -2832,7 +2828,7 @@ TypeObject::markStateChange(ExclusiveContext *cxArg)
        return;

    AutoEnterAnalysis enter(cxArg);
-    TypeSet *types = maybeGetProperty(JSID_EMPTY);
+    HeapTypeSet *types = maybeGetProperty(JSID_EMPTY);
    if (types) {
        if (JSContext *cx = cxArg->maybeJSContext()) {
            TypeConstraint *constraint = types->constraintList;
@ -3186,10 +3182,10 @@ types::AddClearDefiniteFunctionUsesInScript(JSContext *cx, TypeObject *type,
    TypeObjectKey *calleeKey = Type::ObjectType(calleeScript->function()).objectKey();

    unsigned count = TypeScript::NumTypeSets(script);
-    TypeSet *typeArray = script->types->typeArray();
+    StackTypeSet *typeArray = script->types->typeArray();

    for (unsigned i = 0; i < count; i++) {
-        TypeSet *types = &typeArray[i];
+        StackTypeSet *types = &typeArray[i];
        if (!types->unknownObject() && types->getObjectCount() == 1) {
            if (calleeKey != types->getObject(0)) {
                // Also check if the object is the Function.call or
@ -3365,7 +3361,7 @@ types::TypeMonitorResult(JSContext *cx, JSScript *script, jsbytecode *pc, const
    AutoEnterAnalysis enter(cx);

    Type type = GetValueType(rval);
-    TypeSet *types = TypeScript::BytecodeTypes(script, pc);
+    StackTypeSet *types = TypeScript::BytecodeTypes(script, pc);
    if (types->hasType(type))
        return;

@ -3451,7 +3447,7 @@ JSScript::makeTypes(JSContext *cx)

    unsigned count = TypeScript::NumTypeSets(this);

-    types = (TypeScript *) cx->calloc_(sizeof(TypeScript) + (sizeof(TypeSet) * count));
+    types = (TypeScript *) cx->calloc_(sizeof(TypeScript) + (sizeof(StackTypeSet) * count));
    if (!types) {
        cx->compartment()->types.setPendingNukeTypes(cx);
        return false;
@ -3886,7 +3882,7 @@ ExclusiveContext::getLazyType(const Class *clasp, TaggedProto proto)
 /////////////////////////////////////////////////////////////////////

 void
-TypeSet::sweep(Zone *zone)
+ConstraintTypeSet::sweep(Zone *zone)
 {
    /*
     * Purge references to type objects that are no longer live. Type sets hold
@ -4182,7 +4178,7 @@ TypeScript::Sweep(FreeOp *fop, JSScript *script)
    JS_ASSERT(compartment->zone()->types.inferenceEnabled);

    unsigned num = NumTypeSets(script);
-    TypeSet *typeArray = script->types->typeArray();
+    StackTypeSet *typeArray = script->types->typeArray();

    /* Remove constraints and references to dead objects from the persistent type sets. */
    for (unsigned i = 0; i < num; i++)
--- a/js/src/jsinfer.h
+++ b/js/src/jsinfer.h
@ -347,10 +347,10 @@ enum {
                          TYPE_FLAG_INT32 | TYPE_FLAG_DOUBLE | TYPE_FLAG_STRING,

    /* Mask/shift for the number of objects in objectSet */
-    TYPE_FLAG_OBJECT_COUNT_LIMIT  = 7,
+    TYPE_FLAG_OBJECT_COUNT_MASK   = 0x1f00,
    TYPE_FLAG_OBJECT_COUNT_SHIFT  = 8,
-    TYPE_FLAG_OBJECT_COUNT_MASK   = /* = 0x700 */
-        TYPE_FLAG_OBJECT_COUNT_LIMIT << TYPE_FLAG_OBJECT_COUNT_SHIFT,
+    TYPE_FLAG_OBJECT_COUNT_LIMIT  =
+        TYPE_FLAG_OBJECT_COUNT_MASK >> TYPE_FLAG_OBJECT_COUNT_SHIFT,

    /* Whether the contents of this type set are totally unknown. */
    TYPE_FLAG_UNKNOWN             = 0x00002000,
@ -358,23 +358,6 @@ enum {
    /* Mask of normal type flags on a type set. */
    TYPE_FLAG_BASE_MASK           = 0x000020ff,

-    /*
-     * Flags describing the kind of type set this is.
-     *
-     * - StackTypeSet are associated with TypeScripts, for arguments and values
-     *   observed at property reads. These are implicitly frozen on compilation
-     *   and do not have constraints attached to them.
-     *
-     * - HeapTypeSet are associated with the properties of TypeObjects. These
-     *   may have constraints added to them to trigger invalidation of compiled
-     *   code.
-     *
-     * - TemporaryTypeSet are created during compilation and do not outlive
-     *   that compilation.
-     */
-    TYPE_FLAG_STACK_SET           = 0x00004000,
-    TYPE_FLAG_HEAP_SET            = 0x00008000,
-
    /* Additional flags for HeapTypeSet sets. */

    /*
@ -485,7 +468,21 @@ class StackTypeSet;
 class HeapTypeSet;
 class TemporaryTypeSet;

-/* Information about the set of types associated with an lvalue. */
+/*
+ * Information about the set of types associated with an lvalue. There are
+ * three kinds of type sets:
+ *
+ * - StackTypeSet are associated with TypeScripts, for arguments and values
+ *   observed at property reads. These are implicitly frozen on compilation
+ *   and do not have constraints attached to them.
+ *
+ * - HeapTypeSet are associated with the properties of TypeObjects. These
+ *   may have constraints added to them to trigger invalidation of compiled
+ *   code.
+ *
+ * - TemporaryTypeSet are created during compilation and do not outlive
+ *   that compilation.
+ */
 class TypeSet
 {
  protected:
@ -497,17 +494,12 @@ class TypeSet

  public:

-    /* Chain of constraints which propagate changes out from this type set. */
-    TypeConstraint *constraintList;
-
    TypeSet()
-      : flags(0), objectSet(nullptr), constraintList(nullptr)
+      : flags(0), objectSet(nullptr)
    {}

    void print();

-    inline void sweep(JS::Zone *zone);
-
    /* Whether this set contains a specific type. */
    inline bool hasType(Type type) const;

@ -536,15 +528,6 @@ class TypeSet
    /* Add a type to this set using the specified allocator. */
    inline bool addType(Type type, LifoAlloc *alloc, bool *padded = nullptr);

-    /*
-     * Add a type to this set, calling any constraint handlers if this is a new
-     * possible type.
-     */
-    inline void addType(ExclusiveContext *cx, Type type);
-
-    /* Mark this type set as representing a configured property. */
-    inline void setConfiguredProperty(ExclusiveContext *cx);
-
    /* Get a list of all types in this set. */
    typedef Vector<Type, 1, SystemAllocPolicy> TypeList;
    bool enumerateTypes(TypeList *list);
@ -574,13 +557,6 @@ class TypeSet
        flags |= ((slot + 1) << TYPE_FLAG_DEFINITE_SHIFT);
    }

-    bool isStackSet() {
-        return flags & TYPE_FLAG_STACK_SET;
-    }
-    bool isHeapSet() {
-        return flags & TYPE_FLAG_HEAP_SET;
-    }
-
    /* Whether any values in this set might have the specified type. */
    bool mightBeType(JSValueType type);

@ -593,12 +569,6 @@ class TypeSet
    /* Forward all types in this set to the specified constraint. */
    void addTypesToConstraint(JSContext *cx, TypeConstraint *constraint);

-    /* Add a new constraint to this set. */
-    void add(JSContext *cx, TypeConstraint *constraint, bool callExisting = true);
-
-    inline StackTypeSet *toStackSet();
-    inline HeapTypeSet *toHeapSet();
-
    // Clone a type set into an arbitrary allocator.
    TemporaryTypeSet *clone(LifoAlloc *alloc) const;
    bool clone(LifoAlloc *alloc, TemporaryTypeSet *result) const;
@ -612,16 +582,37 @@ class TypeSet
    inline void clearObjects();
 };

-class StackTypeSet : public TypeSet
+/* Superclass common to stack and heap type sets. */
+class ConstraintTypeSet : public TypeSet
 {
  public:
-    StackTypeSet() { flags |= TYPE_FLAG_STACK_SET; }
+    /* Chain of constraints which propagate changes out from this type set. */
+    TypeConstraint *constraintList;
+
+    ConstraintTypeSet() : constraintList(nullptr) {}
+
+    /*
+     * Add a type to this set, calling any constraint handlers if this is a new
+     * possible type.
+     */
+    inline void addType(ExclusiveContext *cx, Type type);
+
+    /* Add a new constraint to this set. */
+    void add(JSContext *cx, TypeConstraint *constraint, bool callExisting = true);
+
+    inline void sweep(JS::Zone *zone);
 };

-class HeapTypeSet : public TypeSet
+class StackTypeSet : public ConstraintTypeSet
 {
  public:
-    HeapTypeSet() { flags |= TYPE_FLAG_HEAP_SET; }
+};
+
+class HeapTypeSet : public ConstraintTypeSet
+{
+  public:
+    /* Mark this type set as representing a configured property. */
+    inline void setConfiguredProperty(ExclusiveContext *cx);
 };

 class CompilerConstraintList;
@ -638,7 +629,6 @@ class TemporaryTypeSet : public TypeSet
    TemporaryTypeSet(uint32_t flags, TypeObjectKey **objectSet) {
        this->flags = flags;
        this->objectSet = objectSet;
-        JS_ASSERT(!isStackSet() && !isHeapSet());
    }

    /*
@ -725,20 +715,6 @@ class TemporaryTypeSet : public TypeSet
    DoubleConversion convertDoubleElements(CompilerConstraintList *constraints);
 };

-inline StackTypeSet *
-TypeSet::toStackSet()
-{
-    JS_ASSERT(isStackSet());
-    return (StackTypeSet *) this;
-}
-
-inline HeapTypeSet *
-TypeSet::toHeapSet()
-{
-    JS_ASSERT(isHeapSet());
-    return (HeapTypeSet *) this;
-}
-
 bool
 AddClearDefiniteGetterSetterForPrototypeChain(JSContext *cx, TypeObject *type, jsid id);

@ -1398,7 +1374,7 @@ struct TypeCompartment
    struct PendingWork
    {
        TypeConstraint *constraint;
-        TypeSet *source;
+        ConstraintTypeSet *source;
        Type type;
    };
    PendingWork *pendingArray;
@ -1441,7 +1417,8 @@ struct TypeCompartment
    inline JSCompartment *compartment();

    /* Add a type to register with a list of constraints. */
-    inline void addPending(JSContext *cx, TypeConstraint *constraint, TypeSet *source, Type type);
+    inline void addPending(JSContext *cx, TypeConstraint *constraint,
+                           ConstraintTypeSet *source, Type type);
    bool growPendingArray(JSContext *cx);

    /* Resolve pending type registrations, excluding delayed ones. */
--- a/js/src/jsinferinlines.h
+++ b/js/src/jsinferinlines.h
@ -853,7 +853,8 @@ TypeCompartment::compartment()
 }

 inline void
-TypeCompartment::addPending(JSContext *cx, TypeConstraint *constraint, TypeSet *source, Type type)
+TypeCompartment::addPending(JSContext *cx, TypeConstraint *constraint,
+                            ConstraintTypeSet *source, Type type)
 {
    JS_ASSERT(this == &cx->compartment()->types);
    JS_ASSERT(!cx->runtime()->isHeapBusy());
@ -1198,15 +1199,12 @@ TypeSet::addType(Type type, LifoAlloc *alloc, bool *padded)
 }

 inline void
-TypeSet::addType(ExclusiveContext *cxArg, Type type)
+ConstraintTypeSet::addType(ExclusiveContext *cxArg, Type type)
 {
    JS_ASSERT(cxArg->compartment()->activeAnalysis);

-    // Temporary type sets use a separate LifoAlloc for storage.
-    JS_ASSERT(isStackSet() || isHeapSet());
-
    bool added = false;
-    if (!addType(type, &cxArg->typeLifoAlloc(), &added)) {
+    if (!TypeSet::addType(type, &cxArg->typeLifoAlloc(), &added)) {
        cxArg->compartment()->types.setPendingNukeTypes(cxArg);
        return;
    }
@ -1231,7 +1229,7 @@ TypeSet::addType(ExclusiveContext *cxArg, Type type)
 }

 inline void
-TypeSet::setConfiguredProperty(ExclusiveContext *cxArg)
+HeapTypeSet::setConfiguredProperty(ExclusiveContext *cxArg)
 {
    if (flags & TYPE_FLAG_CONFIGURED_PROPERTY)
        return;
--- a/js/src/jsopcode.h
+++ b/js/src/jsopcode.h
@ -257,7 +257,6 @@ BytecodeFallsThrough(JSOp op)
      case JSOP_GOTO:
      case JSOP_DEFAULT:
      case JSOP_RETURN:
-      case JSOP_STOP:
      case JSOP_RETRVAL:
      case JSOP_THROW:
      case JSOP_TABLESWITCH:
@ -557,7 +556,7 @@ inline bool
 FlowsIntoNext(JSOp op)
 {
    /* JSOP_YIELD is considered to flow into the next instruction, like JSOP_CALL. */
-    return op != JSOP_STOP && op != JSOP_RETURN && op != JSOP_RETRVAL && op != JSOP_THROW &&
+    return op != JSOP_RETRVAL && op != JSOP_RETURN && op != JSOP_THROW &&
           op != JSOP_GOTO && op != JSOP_RETSUB;
 }

--- a/js/src/jsopcode.tbl
+++ b/js/src/jsopcode.tbl
@ -45,7 +45,7 @@ OPDEF(JSOP_NOP,       0,  "nop",        NULL,         1,  0,  0, JOF_BYTE)

 /* Long-standing JavaScript bytecodes. */
 OPDEF(JSOP_UNDEFINED, 1,  js_undefined_str, "",       1,  0,  1, JOF_BYTE)
-OPDEF(JSOP_POPV,      2,  "popv",       NULL,         1,  1,  0, JOF_BYTE)
+OPDEF(JSOP_UNUSED2,   2,  "unused2",    NULL,         1,  1,  0, JOF_BYTE)
 OPDEF(JSOP_ENTERWITH, 3,  "enterwith",  NULL,         1,  1,  1, JOF_BYTE)
 OPDEF(JSOP_LEAVEWITH, 4,  "leavewith",  NULL,         1,  1,  0, JOF_BYTE)
 OPDEF(JSOP_RETURN,    5,  "return",     NULL,         1,  1,  0, JOF_BYTE)
@ -353,9 +353,14 @@ OPDEF(JSOP_UNUSED150,     150,"unused150", NULL,      1,  0,  0,  JOF_BYTE)
 /* Set pending exception from the stack, to trigger rethrow. */
 OPDEF(JSOP_THROWING,      151,"throwing", NULL,       1,  1,  0,  JOF_BYTE)

-/* Set and get return value pseudo-register in stack frame. */
-OPDEF(JSOP_SETRVAL,       152,"setrval",  NULL,       1,  1,  0,  JOF_BYTE)
-OPDEF(JSOP_RETRVAL,       153,"retrval",  NULL,       1,  0,  0,  JOF_BYTE)
+/* Set the return value pseudo-register in stack frame. */
+OPDEF(JSOP_SETRVAL,       152,"setrval",    NULL,       1,  1,  0,  JOF_BYTE)
+/*
+ * Stop interpretation and return value set by JSOP_SETRVAL. When not set,
+ * returns UndefinedValue. Also emitted at end of script so interpreter
+ * don't need to check if opcode is still in script range.
+ */
+OPDEF(JSOP_RETRVAL,       153,"retrval",    NULL,       1,  0,  0,  JOF_BYTE)

 /* Free variable references that must either be found on the global or a ReferenceError */
 OPDEF(JSOP_GETGNAME,      154,"getgname",  NULL,       5,  0,  1, JOF_ATOM|JOF_NAME|JOF_TYPESET|JOF_GNAME)
@ -415,11 +420,7 @@ OPDEF(JSOP_UNUSED192,     192,"unused192",   NULL,    1,  0,  0,  JOF_BYTE)

 OPDEF(JSOP_CALLELEM,      193, "callelem",   NULL,    1,  2,  1, JOF_BYTE |JOF_ELEM|JOF_TYPESET|JOF_LEFTASSOC)

-/*
- * Stop interpretation, emitted at end of script to save the threaded bytecode
- * interpreter an extra branch test on every DO_NEXT_OP (see jsinterp.c).
- */
-OPDEF(JSOP_STOP,          194,"stop",        NULL,    1,  0,  0,  JOF_BYTE)
+OPDEF(JSOP_UNUSED194,     194,"unused194",   NULL,    1,  0,  0,  JOF_BYTE)

 /*
 * Get an extant property value, throwing ReferenceError if the identified
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@ -1806,7 +1806,7 @@ JSScript::fullyInitTrivial(ExclusiveContext *cx, Handle<JSScript*> script)
    if (!ssd)
        return false;

-    ssd->data[0] = JSOP_STOP;
+    ssd->data[0] = JSOP_RETRVAL;
    ssd->data[1] = SRC_NULL;
    script->length = 1;
    return SaveSharedScriptData(cx, script, ssd, 1);
--- a/js/src/jsscript.h
+++ b/js/src/jsscript.h
@ -1006,7 +1006,7 @@ class JSScript : public js::gc::BarrieredCell<JSScript>
        jsbytecode *pc = code;
        if (noScriptRval && JSOp(*pc) == JSOP_FALSE)
            ++pc;
-        return JSOp(*pc) == JSOP_STOP;
+        return JSOp(*pc) == JSOP_RETRVAL;
    }

    bool varIsAliased(unsigned varSlot);
--- a/js/src/tests/lib/jittests.py
+++ b/js/src/tests/lib/jittests.py
@ -101,6 +101,7 @@ class Test:
        return t

    COOKIE = '|jit-test|'
+    CacheDir = JS_CACHE_DIR

    @classmethod
    def from_file(cls, path, options):
@ -179,7 +180,8 @@ class Test:

        # We may have specified '-a' or '-d' twice: once via --jitflags, once
        # via the "|jit-test|" line.  Remove dups because they are toggles.
-        cmd = prefix + list(set(self.jitflags)) + ['-e', expr, '-f', path]
+        cmd = prefix + ['--js-cache', Test.CacheDir]
+        cmd += list(set(self.jitflags)) + ['-e', expr, '-f', path]
        if self.valgrind:
            cmd = self.VALGRIND_CMD + cmd
        return cmd
@ -656,6 +658,9 @@ def run_tests_remote(tests, prefix, options):
    push_progs(options, dm, [prefix[0]])
    dm.chmodDir(options.remote_test_root)

+    Test.CacheDir = posixpath.join(options.remote_test_root, '.js-cache')
+    dm.mkDirs(Test.CacheDir)
+
    dm.pushDir(ECMA6_DIR, posixpath.join(jit_tests_dir, 'tests', 'ecma_6'), timeout=600)
    dm.pushDir(os.path.dirname(TEST_DIR), options.remote_test_root, timeout=600)
    prefix[0] = os.path.join(options.remote_test_root, 'js')
--- a/js/src/vm/Interpreter.cpp
+++ b/js/src/vm/Interpreter.cpp
@ -465,7 +465,7 @@ js::Invoke(JSContext *cx, CallArgs args, MaybeConstruct construct)
    if (!fun->getOrCreateScript(cx))
        return false;

-    /* Run function until JSOP_STOP, JSOP_RETURN or error. */
+    /* Run function until JSOP_RETRVAL, JSOP_RETURN or error. */
    InvokeState state(cx, args, initial);

    // Check to see if useNewType flag should be set for this frame.
@ -1368,7 +1368,7 @@ Interpret(JSContext *cx, RunState &state)
    } else {
        probes::EnterScript(cx, script, script->function(), activation.entryFrame());
    }
-    if (cx->compartment()->debugMode()) {
+    if (JS_UNLIKELY(cx->compartment()->debugMode())) {
        JSTrapStatus status = ScriptDebugPrologue(cx, activation.entryFrame());
        switch (status) {
          case JSTRAP_CONTINUE:
@ -1469,6 +1469,7 @@ CASE(EnableInterruptsPseudoOpcode)

 /* Various 1-byte no-ops. */
 CASE(JSOP_NOP)
+CASE(JSOP_UNUSED2)
 CASE(JSOP_UNUSED44)
 CASE(JSOP_UNUSED45)
 CASE(JSOP_UNUSED46)
@ -1525,6 +1526,7 @@ CASE(JSOP_UNUSED189)
 CASE(JSOP_UNUSED190)
 CASE(JSOP_UNUSED191)
 CASE(JSOP_UNUSED192)
+CASE(JSOP_UNUSED194)
 CASE(JSOP_UNUSED196)
 CASE(JSOP_UNUSED200)
 CASE(JSOP_UNUSED201)
@ -1600,9 +1602,8 @@ CASE(JSOP_POPN)
 END_CASE(JSOP_POPN)

 CASE(JSOP_SETRVAL)
-CASE(JSOP_POPV)
    POP_RETURN_VALUE();
-END_CASE(JSOP_POPV)
+END_CASE(JSOP_SETRVAL)

 CASE(JSOP_ENTERWITH)
 {
@ -1635,8 +1636,7 @@ CASE(JSOP_RETURN)
    POP_RETURN_VALUE();
    /* FALL THROUGH */

-CASE(JSOP_RETRVAL)    /* fp return value already set */
-CASE(JSOP_STOP)
+CASE(JSOP_RETRVAL)
 {
    /*
     * When the inlined frame exits with an exception or an error, ok will be
@ -1652,7 +1652,7 @@ CASE(JSOP_STOP)
        TraceLogging::defaultLogger()->log(TraceLogging::SCRIPT_STOP);
 #endif

-        if (cx->compartment()->debugMode())
+        if (JS_UNLIKELY(cx->compartment()->debugMode()))
            interpReturnOK = ScriptDebugEpilogue(cx, REGS.fp(), interpReturnOK);

        if (!REGS.fp()->isYielding())
@ -2561,7 +2561,7 @@ CASE(JSOP_FUNCALL)

    if (!REGS.fp()->prologue(cx))
        goto error;
-    if (cx->compartment()->debugMode()) {
+    if (JS_UNLIKELY(cx->compartment()->debugMode())) {
        switch (ScriptDebugPrologue(cx, REGS.fp())) {
          case JSTRAP_CONTINUE:
            break;
@ -2576,7 +2576,7 @@ CASE(JSOP_FUNCALL)
        }
    }

-    /* Load first op and dispatch it (safe since JSOP_STOP). */
+    /* Load first op and dispatch it (safe since JSOP_RETRVAL). */
    ADVANCE_AND_DISPATCH(0);
 }

@ -3324,7 +3324,7 @@ DEFAULT()

    if (cx->isExceptionPending()) {
        /* Call debugger throw hooks. */
-        if (cx->compartment()->debugMode()) {
+        if (JS_UNLIKELY(cx->compartment()->debugMode())) {
            JSTrapStatus status = DebugExceptionUnwind(cx, REGS.fp(), REGS.pc);
            switch (status) {
              case JSTRAP_ERROR:
@ -3430,7 +3430,7 @@ DEFAULT()
        goto inline_return;

  exit:
-    if (cx->compartment()->debugMode())
+    if (JS_UNLIKELY(cx->compartment()->debugMode()))
        interpReturnOK = ScriptDebugEpilogue(cx, REGS.fp(), interpReturnOK);
    if (!REGS.fp()->isYielding())
        REGS.fp()->epilogue(cx);
--- a/js/src/vm/OldDebugAPI.cpp
+++ b/js/src/vm/OldDebugAPI.cpp
@ -754,10 +754,10 @@ JS_PutPropertyDescArray(JSContext *cx, JSPropertyDescArray *pda)

    pd = pda->array;
    for (i = 0; i < pda->length; i++) {
-        js_RemoveRoot(cx->runtime(), &pd[i].id);
-        js_RemoveRoot(cx->runtime(), &pd[i].value);
+        RemoveRoot(cx->runtime(), &pd[i].id);
+        RemoveRoot(cx->runtime(), &pd[i].value);
        if (pd[i].flags & JSPD_ALIAS)
-            js_RemoveRoot(cx->runtime(), &pd[i].alias);
+            RemoveRoot(cx->runtime(), &pd[i].alias);
    }
    js_free(pd);
    pda->array = nullptr;
--- a/js/src/vm/Stack.cpp
+++ b/js/src/vm/Stack.cpp
@ -123,7 +123,7 @@ StackFrame::copyFrameAndValues(JSContext *cx, Value *vp, StackFrame *otherfp,
            HeapValue::writeBarrierPost(*dst, dst);
    }

-    if (cx->compartment()->debugMode())
+    if (JS_UNLIKELY(cx->compartment()->debugMode()))
        DebugScopes::onGeneratorFrameChange(otherfp, this, cx);
 }

@ -304,7 +304,7 @@ StackFrame::epilogue(JSContext *cx)
    if (isEvalFrame()) {
        if (isStrictEvalFrame()) {
            JS_ASSERT_IF(hasCallObj(), scopeChain()->as<CallObject>().isForEval());
-            if (cx->compartment()->debugMode())
+            if (JS_UNLIKELY(cx->compartment()->debugMode()))
                DebugScopes::onPopStrictEvalScope(this);
        } else if (isDirectEvalFrame()) {
            if (isDebuggerFrame())
@ -340,7 +340,7 @@ StackFrame::epilogue(JSContext *cx)
    else
        AssertDynamicScopeMatchesStaticScope(cx, script, scopeChain());

-    if (cx->compartment()->debugMode())
+    if (JS_UNLIKELY(cx->compartment()->debugMode()))
        DebugScopes::onPopCall(this, cx);

    if (isConstructing() && thisValue().isObject() && returnValue().isPrimitive())
@ -374,7 +374,7 @@ StackFrame::popBlock(JSContext *cx)
 {
    JS_ASSERT(hasBlockChain());

-    if (cx->compartment()->debugMode())
+    if (JS_UNLIKELY(cx->compartment()->debugMode()))
        DebugScopes::onPopBlock(cx, this);

    if (blockChain_->needsClone()) {
@ -388,7 +388,7 @@ StackFrame::popBlock(JSContext *cx)
 void
 StackFrame::popWith(JSContext *cx)
 {
-    if (cx->compartment()->debugMode())
+    if (JS_UNLIKELY(cx->compartment()->debugMode()))
        DebugScopes::onPopWith(this);

    JS_ASSERT(scopeChain()->is<WithObject>());
@ -464,8 +464,8 @@ FrameRegs::setToEndOfScript()
 {
    JSScript *script = fp()->script();
    sp = fp()->base();
-    pc = script->code + script->length - JSOP_STOP_LENGTH;
-    JS_ASSERT(*pc == JSOP_STOP);
+    pc = script->code + script->length - JSOP_RETRVAL_LENGTH;
+    JS_ASSERT(*pc == JSOP_RETRVAL);
 }

 /*****************************************************************************/
--- a/js/src/vm/ThreadPool.cpp
+++ b/js/src/vm/ThreadPool.cpp
@ -186,10 +186,7 @@ ThreadPoolWorker::terminate()
 // them down when requested.

 ThreadPool::ThreadPool(JSRuntime *rt)
-  :
-#if defined(JS_THREADSAFE) || defined(DEBUG)
-    runtime_(rt)
-#endif
+  : runtime_(rt)
 {
 }

--- a/js/src/vm/ThreadPool.h
+++ b/js/src/vm/ThreadPool.h
@ -61,9 +61,7 @@ class ThreadPool
    friend class ThreadPoolWorker;

    // Initialized at startup only:
-#if defined(JS_THREADSAFE) || defined(DEBUG)
    JSRuntime *const runtime_;
-#endif
    js::Vector<ThreadPoolWorker*, 8, SystemAllocPolicy> workers_;

    bool lazyStartWorkers(JSContext *cx);
--- a/js/xpconnect/public/nsAutoJSValHolder.h
+++ b/js/xpconnect/public/nsAutoJSValHolder.h
@ -64,7 +64,7 @@ public:
  bool Hold(JSRuntime* aRt) {
    // Do we really care about different runtimes?
    if (mRt && aRt != mRt) {
-      js_RemoveRoot(mRt, &mVal);
+      JS_RemoveValueRootRT(mRt, &mVal);
      mRt = nullptr;
    }

--- a/layout/build/nsLayoutStatics.cpp
+++ b/layout/build/nsLayoutStatics.cpp
@ -50,6 +50,7 @@
 #include "nsCrossSiteListenerProxy.h"
 #include "nsHTMLDNSPrefetch.h"
 #include "nsHtml5Module.h"
+#include "mozilla/dom/FallbackEncoding.h"
 #include "nsFocusManager.h"
 #include "nsListControlFrame.h"
 #include "mozilla/dom/HTMLInputElement.h"
@ -258,6 +259,7 @@ nsLayoutStatics::Initialize()

  nsContentSink::InitializeStatics();
  nsHtml5Module::InitializeStatics();
+  mozilla::dom::FallbackEncoding::Initialize();
  nsLayoutUtils::Initialize();
  nsIPresShell::InitializeStatics();
  nsRefreshDriver::InitializeStatics();
@ -384,6 +386,8 @@ nsLayoutStatics::Shutdown()

  nsHtml5Module::ReleaseStatics();

+  mozilla::dom::FallbackEncoding::Shutdown();
+
  nsRegion::ShutdownStatic();

  NS_ShutdownEventTargetChainRecycler();
--- a/modules/libpref/src/init/all.js
+++ b/modules/libpref/src/init/all.js
@ -1520,7 +1520,7 @@ pref("intl.charsetmenu.mailview.cache",     "");
 pref("intl.charsetmenu.composer.cache",     "");
 pref("intl.charsetmenu.browser.cache.size", 5);
 pref("intl.charset.detector",               "chrome://global/locale/intl.properties");
-pref("intl.charset.default",                "chrome://global-platform/locale/intl.properties");
+pref("intl.charset.fallback.override",      "");
 pref("intl.ellipsis",                       "chrome://global-platform/locale/intl.properties");
 pref("intl.locale.matchOS",                 false);
 // fallback charset list for Unicode conversion (converting from Unicode)
@ -2752,12 +2752,12 @@ pref("font.name-list.serif.ja", "Hiragino Mincho ProN,Hiragino Mincho Pro");
 pref("font.name-list.sans-serif.ja", "Hiragino Kaku Gothic ProN,Hiragino Kaku Gothic Pro");
 pref("font.name-list.monospace.ja", "Osaka-Mono"); 

-pref("font.name.serif.ko", "AppleMyungjo"); 
-pref("font.name.sans-serif.ko", "AppleGothic"); 
-pref("font.name.monospace.ko", "AppleGothic"); 
-pref("font.name-list.serif.ko", "AppleMyungjo"); 
-pref("font.name-list.sans-serif.ko", "AppleGothic"); 
-pref("font.name-list.monospace.ko", "AppleGothic"); 
+pref("font.name.serif.ko", "AppleMyungjo");
+pref("font.name.sans-serif.ko", "Apple SD Gothic Neo");
+pref("font.name.monospace.ko", "Apple SD Gothic Neo");
+pref("font.name-list.serif.ko", "AppleMyungjo");
+pref("font.name-list.sans-serif.ko", "Apple SD Gothic Neo,AppleGothic");
+pref("font.name-list.monospace.ko", "Apple SD Gothic Neo,AppleGothic");

 pref("font.name.serif.th", "Thonburi");
 pref("font.name.sans-serif.th", "Thonburi");
--- a/netwerk/streamconv/converters/nsDirIndexParser.cpp
+++ b/netwerk/streamconv/converters/nsDirIndexParser.cpp
@ -13,9 +13,7 @@
 #include "nsEscape.h"
 #include "nsIInputStream.h"
 #include "nsCRT.h"
-#include "nsIPrefService.h"
-#include "nsIPrefBranch.h"
-#include "nsIPrefLocalizedString.h"
+#include "mozilla/dom/FallbackEncoding.h"
 #include "nsITextToSubURI.h"
 #include "nsIDirIndex.h"
 #include "nsServiceManagerUtils.h"
@ -35,24 +33,7 @@ nsDirIndexParser::Init() {
  mLineStart = 0;
  mHasDescription = false;
  mFormat = nullptr;
-
-  // get default charset to be used for directory listings (fallback to
-  // ISO-8859-1 if pref is unavailable).
-  NS_NAMED_LITERAL_CSTRING(kFallbackEncoding, "ISO-8859-1");
-  nsXPIDLString defCharset;
-  nsCOMPtr<nsIPrefBranch> prefs(do_GetService(NS_PREFSERVICE_CONTRACTID));
-  if (prefs) {
-    nsCOMPtr<nsIPrefLocalizedString> prefVal;
-    prefs->GetComplexValue("intl.charset.default",
-                           NS_GET_IID(nsIPrefLocalizedString),
-                           getter_AddRefs(prefVal));
-    if (prefVal)
-      prefVal->ToString(getter_Copies(defCharset));
-  }
-  if (!defCharset.IsEmpty())
-    LossyCopyUTF16toASCII(defCharset, mEncoding); // charset labels are always ASCII
-  else
-    mEncoding.Assign(kFallbackEncoding);
+  mozilla::dom::FallbackEncoding::FromLocale(mEncoding);
 
  nsresult rv;
  // XXX not threadsafe
--- a/parser/html/nsHtml5StreamParser.cpp
+++ b/parser/html/nsHtml5StreamParser.cpp
@ -302,7 +302,7 @@ nsHtml5StreamParser::SetupDecodingAndWriteSniffingBufferAndCurrentSegment(const
  rv = convManager->GetUnicodeDecoder(mCharset.get(), getter_AddRefs(mUnicodeDecoder));
  if (rv == NS_ERROR_UCONV_NOCONV) {
    mCharset.AssignLiteral("windows-1252"); // lower case is the raw form
-    mCharsetSource = kCharsetFromWeakDocTypeDefault;
+    mCharsetSource = kCharsetFromFallback;
    rv = convManager->GetUnicodeDecoderRaw(mCharset.get(), getter_AddRefs(mUnicodeDecoder));
    mTreeBuilder->SetDocumentCharset(mCharset, mCharsetSource);
  }
@ -612,10 +612,10 @@ nsHtml5StreamParser::FinalizeSniffing(const uint8_t* aFromSegment, // can be nul
  if (mCharsetSource == kCharsetUninitialized) {
    // Hopefully this case is never needed, but dealing with it anyway
    mCharset.AssignLiteral("windows-1252");
-    mCharsetSource = kCharsetFromWeakDocTypeDefault;
+    mCharsetSource = kCharsetFromFallback;
    mTreeBuilder->SetDocumentCharset(mCharset, mCharsetSource);
  } else if (mMode == LOAD_AS_DATA &&
-             mCharsetSource == kCharsetFromWeakDocTypeDefault) {
+             mCharsetSource == kCharsetFromFallback) {
    NS_ASSERTION(mReparseForbidden, "Reparse should be forbidden for XHR");
    NS_ASSERTION(!mFeedChardet, "Should not feed chardet for XHR");
    NS_ASSERTION(mCharset.EqualsLiteral("UTF-8"),
@ -731,7 +731,7 @@ nsHtml5StreamParser::SniffStreamBytes(const uint8_t* aFromSegment,
      // nsHTMLDocument is supposed to make sure this does not happen. Let's
      // deal with this anyway, since who knows how kCharsetFromOtherComponent
      // is used.
-      mCharsetSource = kCharsetFromWeakDocTypeDefault;
+      mCharsetSource = kCharsetFromFallback;
    }
  }

@ -981,7 +981,7 @@ nsHtml5StreamParser::OnStartRequest(nsIRequest* aRequest, nsISupports* aContext)
  // if we failed to get a decoder, there will be fallback, so don't propagate
  //  the error.
  if (NS_FAILED(rv)) {
-    mCharsetSource = kCharsetFromWeakDocTypeDefault;
+    mCharsetSource = kCharsetFromFallback;
  }
  return NS_OK;
 }
--- a/parser/nsCharsetSource.h
+++ b/parser/nsCharsetSource.h
@ -7,7 +7,7 @@

 // note: the value order defines the priority; higher numbers take priority
 #define kCharsetUninitialized           0
-#define kCharsetFromWeakDocTypeDefault  1
+#define kCharsetFromFallback            1
 #define kCharsetFromDocTypeDefault      2 // This and up confident for XHR
 #define kCharsetFromCache               3
 #define kCharsetFromParentFrame         4
--- a/testing/mochitest/b2g-desktop.json
+++ b/testing/mochitest/b2g-desktop.json
@ -427,6 +427,314 @@
    "layout/style/test/test_visited_reftests.html":"bug 870262, :visited support",

    "Harness_sanity/test_sanityEventUtils.html": "bug 688052",
-    "Harness_sanity/test_sanitySimpletest.html": "bug 688052"
+    "Harness_sanity/test_sanitySimpletest.html": "bug 688052",
+
+    "caps/tests/mochitest/test_bug292789.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/base/test/csp/test_policyuri_regression_from_multipolicy.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/base/test/test_bug326337.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/base/test/test_bug426646.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/base/test/test_bug557892.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/base/test/test_bug578096.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/base/test/test_copyimage.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/events/test/test_bug322588.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/events/test/test_bug493251.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/events/test/test_bug545268.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/events/test/test_bug650493.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/events/test/test_bug656379-1.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/events/test/test_bug656379-2.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/events/test/test_bug656954.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/events/test/test_bug659350.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/events/test/test_bug662678.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/events/test/test_bug667612.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/events/test/test_bug698929.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/events/test/test_bug741666.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/events/test/test_bug742376.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/events/test/test_bug812744.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/events/test/test_bug847597.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/events/test/test_bug855741.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/events/test/test_bug864040.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/events/test/test_clickevent_on_input.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/events/test/test_dblclick_explicit_original_target.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/events/test/test_dom_keyboard_event.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/events/test/test_dom_mouse_event.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/events/test/test_draggableprop.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/events/test/test_eventctors.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/events/test/test_focus_disabled.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/events/test/test_moz_mouse_pixel_scroll_event.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/html/content/test/forms/test_button_attributes_reflection.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/html/content/test/forms/test_change_event.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/html/content/test/forms/test_form_attribute-1.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/html/content/test/forms/test_input_event.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/html/content/test/forms/test_input_range_key_events.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/html/content/test/forms/test_input_range_rounding.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/html/content/test/test_bug633058.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/html/content/test/test_bug643051.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/html/content/test/test_bug651956.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/html/content/test/test_bug659743.xml": "Bug 931116, b2g desktop specific, initial triage",
+    "content/html/content/test/test_bug674558.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/html/content/test/test_iframe_sandbox_general.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/html/content/test/test_iframe_sandbox_modal.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/html/content/test/test_iframe_sandbox_popups.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/html/content/test/test_iframe_sandbox_popups_inheritance.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/html/content/test/test_mozaudiochannel.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/html/content/test/test_mozaudiochannel.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/html/content/test/test_mozaudiochannel.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/html/content/test/test_mozaudiochannel.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/html/content/test/test_mozaudiochannel.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/html/document/test/test_bug196523.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/html/document/test/test_bug199692.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/html/document/test/test_bug871161.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/xbl/test/test_bug310107.html": "Bug 931116, b2g desktop specific, initial triage",
+    "content/xml/document/test/test_bug691215.html": "Bug 931116, b2g desktop specific, initial triage",
+    "docshell/test/navigation/test_bug278916.html": "Bug 931116, b2g desktop specific, initial triage",
+    "docshell/test/navigation/test_bug279495.html": "Bug 931116, b2g desktop specific, initial triage",
+    "docshell/test/navigation/test_bug430723.html": "Bug 931116, b2g desktop specific, initial triage",
+    "docshell/test/navigation/test_opener.html": "Bug 931116, b2g desktop specific, initial triage",
+    "docshell/test/navigation/test_sessionhistory.html": "Bug 931116, b2g desktop specific, initial triage",
+    "docshell/test/navigation/test_sibling-off-domain.html": "Bug 931116, b2g desktop specific, initial triage",
+    "docshell/test/test_bfcache_plus_hash.html": "Bug 931116, b2g desktop specific, initial triage",
+    "docshell/test/test_bug369814.html": "Bug 931116, b2g desktop specific, initial triage",
+    "docshell/test/test_bug404548.html": "Bug 931116, b2g desktop specific, initial triage",
+    "docshell/test/test_bug509055.html": "Bug 931116, b2g desktop specific, initial triage",
+    "docshell/test/test_bug529119-1.html": "Bug 931116, b2g desktop specific, initial triage",
+    "docshell/test/test_bug529119-2.html": "Bug 931116, b2g desktop specific, initial triage",
+    "docshell/test/test_bug540462.html": "Bug 931116, b2g desktop specific, initial triage",
+    "docshell/test/test_bug598895.html": "Bug 931116, b2g desktop specific, initial triage",
+    "docshell/test/test_bug637644.html": "Bug 931116, b2g desktop specific, initial triage",
+    "docshell/test/test_bug640387_1.html": "Bug 931116, b2g desktop specific, initial triage",
+    "docshell/test/test_bug660404.html": "Bug 931116, b2g desktop specific, initial triage",
+    "docshell/test/test_bug669671.html": "Bug 931116, b2g desktop specific, initial triage",
+    "docshell/test/test_bug680257.html": "Bug 931116, b2g desktop specific, initial triage",
+    "docshell/test/test_bug728939.html": "Bug 931116, b2g desktop specific, initial triage",
+    "docshell/test/test_windowedhistoryframes.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/alarm/test/test_alarm_add_data.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/alarm/test/test_alarm_add_date.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/alarm/test/test_alarm_add_respectTimezone.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/alarm/test/test_alarm_remove.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/base/test/test_setting_opener.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/datastore/tests/test_oop.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/datastore/tests/test_readonly.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/datastore/tests/test_revision.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/datastore/tests/test_sync.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_add_put.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_add_twice_failure.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_advance.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_app_isolation_inproc.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_app_isolation_oop.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_autoIncrement.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_autoIncrement_indexes.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_bfcache.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_blob_archive.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_blob_simple.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_clear.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_complex_keyPaths.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_count.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_create_index.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_create_index_with_integer_keys.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_create_objectStore.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_cursor_mutation.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_cursor_update_updates_indexes.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_cursors.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_deleteDatabase.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_deleteDatabase_interactions.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_error_events_abort_transactions.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_event_propagation.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_event_source.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_exceptions_in_events.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_file_array.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_file_cross_database_copying.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_file_delete.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_file_os_delete.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_file_put_get_object.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_file_put_get_values.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_file_quota.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_file_replace.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_file_resurrection_delete.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_file_resurrection_transaction_abort.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_file_sharing.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_file_transaction_abort.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_filehandle_quota.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_filehandle_serialization.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_filehandle_store_snapshot.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_getAll.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_get_filehandle.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_globalObjects.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_global_data.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_index_empty_keyPath.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_index_getAll.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_index_getAllObjects.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_index_object_cursors.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_index_update_delete.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_indexes.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_indexes_bad_values.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_indexes_funny_things.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_key_requirements.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_keys.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_leaving_page.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_multientry.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_names_sorted.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_objectCursors.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_objectStore_getAllKeys.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_objectStore_inline_autoincrement_key_added_on_put.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_objectStore_openKeyCursor.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_objectStore_remove_values.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_object_identity.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_odd_result_order.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_open_empty_db.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_open_for_principal.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_open_objectStore.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_optionalArguments.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_overlapping_transactions.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_persistenceType.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_put_get_values.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_put_get_values_autoIncrement.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_readonly_transactions.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_remove_index.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_remove_objectStore.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_request_readyState.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_setVersion.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_setVersion_abort.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_setVersion_events.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_setVersion_exclusion.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_success_events_after_abort.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_third_party.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_traffic_jam.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_transaction_abort.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_transaction_abort_hang.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_transaction_lifetimes.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_transaction_lifetimes_nested.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_transaction_ordering.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_unique_index_update.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_webapp_clearBrowserData_inproc_inproc.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_webapp_clearBrowserData_inproc_oop.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/indexedDB/test/test_webapp_clearBrowserData_oop_inproc.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/permission/tests/test_embed-apps.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/permission/tests/test_wifi-manage.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_GCrace.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_NPNVdocumentOrigin.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_NPPVpluginWantsAllNetworkStreams.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_bug532208.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_bug539565-1.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_bug539565-2.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_bug771202.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_bug777098.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_bug784131.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_bug813906.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_bug854082.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_bug863792.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_cookies.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_copyText.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_crash_nested_loop.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_crashing.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_defaultValue.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_enumerate.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_fullpage.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_getauthenticationinfo.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_hanging.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_instance_re-parent.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_instance_unparent1.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_instance_unparent2.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_instance_unparent3.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_instantiation.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_multipleinstanceobjects.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_newstreamondestroy.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_npn_asynccall.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_npn_timers.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_npobject_getters.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_npruntime_construct.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_npruntime_identifiers.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_npruntime_npnevaluate.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_npruntime_npninvoke.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_npruntime_npninvokedefault.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_npruntime_npnsetexception.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_painting.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_pluginstream_asfile.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_pluginstream_asfileonly.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_pluginstream_err.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_pluginstream_geturl.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_pluginstream_geturlnotify.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_pluginstream_newstream.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_pluginstream_post.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_pluginstream_poststream.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_pluginstream_referer.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_pluginstream_seek.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_pluginstream_seek_close.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_pluginstream_src.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_pluginstream_src_dynamic.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_pluginstream_src_referer.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_propertyAndMethod.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_redirect_handling.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_secondPlugin.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_src_url_change.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_streamNotify.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_streamatclose.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_twostreams.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_visibility.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/plugins/test/mochitest/test_zero_opacity.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/bugs/test_bug346659.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/bugs/test_bug38959.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/bugs/test_bug458091.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/bugs/test_bug49312.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/bugs/test_bug562433.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/bugs/test_bug593174.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/bugs/test_bug622361.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/bugs/test_bug648465.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/dom-level0/test_innerWidthHeight_script.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/gamepad/test_gamepad.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/gamepad/test_gamepad.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/gamepad/test_gamepad.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/gamepad/test_gamepad.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/gamepad/test_gamepad_connect_events.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/gamepad/test_gamepad_connect_events.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/gamepad/test_gamepad_connect_events.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/gamepad/test_gamepad_connect_events.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/gamepad/test_gamepad_frame_state_sync.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/gamepad/test_gamepad_frame_state_sync.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/gamepad/test_gamepad_frame_state_sync.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/gamepad/test_gamepad_frame_state_sync.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/gamepad/test_gamepad_hidden_frame.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/gamepad/test_gamepad_hidden_frame.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/gamepad/test_gamepad_hidden_frame.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/gamepad/test_gamepad_hidden_frame.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/gamepad/test_navigator_gamepads.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/gamepad/test_navigator_gamepads.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/gamepad/test_navigator_gamepads.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/gamepad/test_navigator_gamepads.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/general/test_497898.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/general/test__content.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/general/test_bug628069_1.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/general/test_bug631440.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/general/test_frameElementWrapping.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/general/test_framedhistoryframes.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/general/test_interfaces.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/general/test_offsets.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/general/test_outerHTML.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/general/test_outerHTML.xhtml": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/general/test_stylesheetPI.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/general/test_vibrator.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/general/test_windowProperties.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/general/test_windowedhistoryframes.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/sessionstorage/test_sessionStorageClone.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/sessionstorage/test_sessionStorageReplace.html": "Bug 931116, b2g desktop specific, initial triage",
+    "dom/tests/mochitest/whatwg/test_postMessage_closed.html": "Bug 931116, b2g desktop specific, initial triage",
+    "layout/base/tests/test_bug607529.html": "Bug 931116, b2g desktop specific, initial triage",
+    "layout/base/tests/test_bug749186.html": "Bug 931116, b2g desktop specific, initial triage",
+    "layout/base/tests/test_bug770106.html": "Bug 931116, b2g desktop specific, initial triage",
+    "layout/base/tests/test_bug842853.html": "Bug 931116, b2g desktop specific, initial triage",
+    "layout/base/tests/test_bug842853-2.html": "Bug 931116, b2g desktop specific, initial triage",
+    "layout/base/tests/test_bug858459.html": "Bug 931116, b2g desktop specific, initial triage",
+    "layout/base/tests/test_reftests_with_caret.html": "Bug 931116, b2g desktop specific, initial triage",
+    "layout/base/tests/test_remote_frame.html": "Bug 931116, b2g desktop specific, initial triage",
+    "layout/generic/test/test_bug735641.html": "Bug 931116, b2g desktop specific, initial triage",
+    "layout/generic/test/test_bug784410.html": "Bug 931116, b2g desktop specific, initial triage",
+    "layout/generic/test/test_plugin_clipping.xhtml": "Bug 931116, b2g desktop specific, initial triage",
+    "layout/generic/test/test_plugin_clipping2.xhtml": "Bug 931116, b2g desktop specific, initial triage",
+    "layout/generic/test/test_plugin_clipping_table.xhtml": "Bug 931116, b2g desktop specific, initial triage",
+    "layout/generic/test/test_plugin_clipping_transformed.xhtml": "Bug 931116, b2g desktop specific, initial triage",
+    "layout/style/test/test_property_syntax_errors.html": "Bug 931116, b2g desktop specific, initial triage",
+    "layout/style/test/test_redundant_font_download.html": "Bug 931116, b2g desktop specific, initial triage",
+    "layout/style/test/test_rem_unit.html": "Bug 931116, b2g desktop specific, initial triage",
+    "layout/style/test/test_rule_serialization.html": "Bug 931116, b2g desktop specific, initial triage",
+    "toolkit/devtools/apps/tests/test_webapps_actor.html": "Bug 931116, b2g desktop specific, initial triage"
  }
 }
--- a/testing/mochitest/mach_commands.py
+++ b/testing/mochitest/mach_commands.py
@ -136,6 +136,8 @@ class MochitestRunner(MozbuildObject):
                print('Specified test path does not exist: %s' % test_root_file)
                return 1
            options.testPath = test_path
+        elif conditions.is_b2g_desktop:
+            options.testManifest = 'b2g-desktop.json'
        else:
            options.testManifest = 'b2g.json'

--- a/toolkit/components/passwordmgr/test/chrome.ini
+++ b/toolkit/components/passwordmgr/test/chrome.ini
@ -5,3 +5,5 @@ support-files =
  pwmgr_common.js

 [test_privbrowsing_perwindowpb.html]
+# Too many intermittent failures (bug 919016)
+skip-if = os == "win"
--- a/toolkit/components/search/nsSearchService.js
+++ b/toolkit/components/search/nsSearchService.js
@ -564,7 +564,8 @@ function queryCharsetFromCode(aCode) {
  if (codes[aCode])
    return codes[aCode];

-  return getLocalizedPref("intl.charset.default", DEFAULT_QUERY_CHARSET);
+  // Don't bother being fancy about what to return in the failure case.
+  return "windows-1252";
 }
 function fileCharsetFromCode(aCode) {
  const codes = [
--- a/toolkit/locales/en-US/chrome/global-platform/mac/intl.properties
+++ b/toolkit/locales/en-US/chrome/global-platform/mac/intl.properties
@ -2,8 +2,6 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

-# moved from navigator/locale/navigator.properties
-intl.charset.default=ISO-8859-1
 # LOCALIZATION NOTE (intl.ellipsis): Use the unicode ellipsis char, \u2026,
 # or use "..." if \u2026 doesn't suit traditions in your locale.
 intl.ellipsis=…
--- a/toolkit/locales/en-US/chrome/global-platform/unix/intl.properties
+++ b/toolkit/locales/en-US/chrome/global-platform/unix/intl.properties
@ -2,8 +2,6 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

-# moved from navigator/locale/navigator.properties
-intl.charset.default=ISO-8859-1
 # LOCALIZATION NOTE (intl.ellipsis): Use the unicode ellipsis char, \u2026,
 # or use "..." if \u2026 doesn't suit traditions in your locale.
 intl.ellipsis=…
--- a/toolkit/locales/en-US/chrome/global-platform/win/intl.properties
+++ b/toolkit/locales/en-US/chrome/global-platform/win/intl.properties
@ -2,8 +2,6 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

-# moved from navigator/locale/navigator.properties
-intl.charset.default=ISO-8859-1
 # LOCALIZATION NOTE (intl.ellipsis): Use the unicode ellipsis char, \u2026,
 # or use "..." if \u2026 doesn't suit traditions in your locale.
 intl.ellipsis=…
--- a/toolkit/locales/en-US/chrome/global/intl.properties
+++ b/toolkit/locales/en-US/chrome/global/intl.properties
@ -40,7 +40,7 @@ intl.accept_languages=en-US, en
 # http://mxr.mozilla.org/mozilla/source/browser/components/preferences/fonts.xul
 font.language.group=x-western

-# LOCALIZATION NOTE (intl.charset.detector, intl.charset.default, intl.charsetmenu.browser.static, intl.charsetmenu.mailedit):
+# LOCALIZATION NOTE (intl.charset.detector, intl.charsetmenu.browser.static, intl.charsetmenu.mailedit):
 # For the list of canonical charset values, refer to:
 # http://mxr.mozilla.org/mozilla-central/source/intl/locale/src/charsetalias.properties
 #
@ -51,7 +51,6 @@ font.language.group=x-western
 # Note also that the list of charsets in 'intl.charsetmenu.browser.static'
 # must always include "UTF-8".
 intl.charset.detector=
-intl.charset.default=ISO-8859-1
 intl.charsetmenu.browser.static=ISO-8859-1, UTF-8
 intl.charsetmenu.mailedit=ISO-8859-1, ISO-8859-15, ISO-8859-6, armscii-8, ISO-8859-13, ISO-8859-14, ISO-8859-2, GB2312, GB18030, Big5, KOI8-R, windows-1251, KOI8-U, ISO-8859-7, ISO-8859-8-I, windows-1255, ISO-2022-JP, EUC-KR, ISO-8859-10, ISO-8859-3, TIS-620, ISO-8859-9, UTF-8, VISCII

--- a/xpcom/tests/TestPLDHash.cpp
+++ b/xpcom/tests/TestPLDHash.cpp
@ -18,8 +18,7 @@ static bool test_pldhash_Init_capacity_ok()
 {
  // Try the largest allowed capacity.  With PL_DHASH_MAX_SIZE==1<<26, this
  // will allocate 0.5GB of entry store on 32-bit platforms and 1GB on 64-bit
-  // platforms.  Hopefully that's not too much for the test machines to handle
-  // reliably.
+  // platforms.
  PLDHashTable t;
  bool ok = PL_DHashTableInit(&t, PL_DHashGetStubOps(), nullptr,
                              sizeof(PLDHashEntryStub), PL_DHASH_MAX_SIZE);
@ -62,6 +61,8 @@ static bool test_pldhash_Init_overflow()
  return !ok;   // expected to fail
 }

+// See bug 931062, we skip this test on Android due to OOM.
+#ifndef MOZ_WIDGET_ANDROID
 // We insert the integers 0.., so this is has function is (a) as simple as
 // possible, and (b) collision-free.  Both of which are good, because we want
 // this test to be as fast as possible.
@ -102,6 +103,7 @@ static bool test_pldhash_grow_to_max_capacity()
  // MaxLoadOnGrowthFailure()).
  return numInserted == PL_DHASH_MAX_SIZE - (PL_DHASH_MAX_SIZE >> 5);
 }
+#endif

 //----

@ -115,7 +117,10 @@ static const struct Test {
  DECL_TEST(test_pldhash_Init_capacity_ok),
  DECL_TEST(test_pldhash_Init_capacity_too_large),
  DECL_TEST(test_pldhash_Init_overflow),
+// See bug 931062, we skip this test on Android due to OOM.
+#ifndef MOZ_WIDGET_ANDROID
  DECL_TEST(test_pldhash_grow_to_max_capacity),
+#endif
  { nullptr, nullptr }
 };

--- a/xulrunner/config/mozconfigs/macosx-universal/xulrunner
+++ b/xulrunner/config/mozconfigs/macosx-universal/xulrunner
@ -4,5 +4,6 @@ export MOZILLA_OFFICIAL=1

 ac_add_options --enable-application=xulrunner
 ac_add_options --disable-tests
+ac_add_options --with-xulrunner-stub-name=xulrunner-stub

 . "$topsrcdir/xulrunner/config/mozconfigs/common.override"
--- a/xulrunner/stub/moz.build
+++ b/xulrunner/stub/moz.build
@ -8,8 +8,8 @@ MODULE = 'xulrunner'

 # The value of XULRUNNER_STUB_NAME is generated by configure to allow XULRunner
 # apps to override it using the --with-xulrunner-stub-name=<appname> argument.
-# If this configure argument is not present then the default name is 'xulrunner'
-# for Mac OS X and 'xulrunner-stub' for all other platforms.
+# If this configure argument is not present then the default name is
+# 'xulrunner-stub'.
 PROGRAM = CONFIG['XULRUNNER_STUB_NAME']

 SOURCES += [
--- a/xulrunner/stub/nsXULStub.cpp
+++ b/xulrunner/stub/nsXULStub.cpp
@ -350,7 +350,7 @@ main(int argc, char **argv)

  if (!greFound) {
 #ifdef XP_MACOSX
-    // Check for <bundle>/Contents/Frameworks/XUL.framework/libxpcom.dylib
+    // Check for <bundle>/Contents/Frameworks/XUL.framework/Versions/Current/libmozglue.dylib
    CFURLRef fwurl = CFBundleCopyPrivateFrameworksURL(appBundle);
    CFURLRef absfwurl = nullptr;
    if (fwurl) {
@ -361,13 +361,13 @@ main(int argc, char **argv)
    if (absfwurl) {
      CFURLRef xulurl =
        CFURLCreateCopyAppendingPathComponent(nullptr, absfwurl,
-                                              CFSTR("XUL.framework"),
+                                              CFSTR("XUL.framework/Versions/Current"),
                                              true);

      if (xulurl) {
        CFURLRef xpcomurl =
          CFURLCreateCopyAppendingPathComponent(nullptr, xulurl,
-                                                CFSTR("libxpcom.dylib"),
+                                                CFSTR("libmozglue.dylib"),
                                                false);

        if (xpcomurl) {