Merge the last PGO-green inbound changeset to m-c.

2013-03-28 20:54:59 -04:00 · 2013-03-28 20:54:59 -04:00 · 6ff45132fb
--- a/accessible/src/generic/RootAccessible.cpp
+++ b/accessible/src/generic/RootAccessible.cpp
@ -165,9 +165,9 @@ const char* const kEventTypes[] = {
  "TreeInvalidated",
  // add ourself as a OpenStateChange listener (custom event fired in tree.xml)
  "OpenStateChange",
-  // add ourself as a CheckboxStateChange listener (custom event fired in nsHTMLInputElement.cpp)
+  // add ourself as a CheckboxStateChange listener (custom event fired in HTMLInputElement.cpp)
  "CheckboxStateChange",
-  // add ourself as a RadioStateChange Listener ( custom event fired in in nsHTMLInputElement.cpp  & radio.xml)
+  // add ourself as a RadioStateChange Listener ( custom event fired in in HTMLInputElement.cpp  & radio.xml)
  "RadioStateChange",
  "popupshown",
  "popuphiding",
--- a/accessible/src/html/HTMLFormControlAccessible.cpp
+++ b/accessible/src/html/HTMLFormControlAccessible.cpp
@ -15,7 +15,7 @@
 #include "States.h"

 #include "nsContentList.h"
-#include "nsHTMLInputElement.h"
+#include "mozilla/dom/HTMLInputElement.h"
 #include "nsIAccessibleRelation.h"
 #include "nsIDOMNSEditableElement.h"
 #include "nsIDOMHTMLTextAreaElement.h"
@ -32,6 +32,7 @@
 #include "mozilla/Preferences.h"

 using namespace mozilla;
+using namespace mozilla::dom;
 using namespace mozilla::a11y;

 ////////////////////////////////////////////////////////////////////////////////
@ -91,7 +92,7 @@ HTMLCheckboxAccessible::NativeState()
  uint64_t state = LeafAccessible::NativeState();

  state |= states::CHECKABLE;
-  nsHTMLInputElement* input = nsHTMLInputElement::FromContent(mContent);
+  HTMLInputElement* input = HTMLInputElement::FromContent(mContent);
  if (!input)
    return state;

@ -131,7 +132,7 @@ HTMLRadioButtonAccessible::NativeState()

  state |= states::CHECKABLE;

-  nsHTMLInputElement* input = nsHTMLInputElement::FromContent(mContent);
+  HTMLInputElement* input = HTMLInputElement::FromContent(mContent);
  if (input && input->Checked())
    state |= states::CHECKED;

@ -356,7 +357,7 @@ HTMLTextFieldAccessible::Value(nsString& aValue)
    return;
  }

-  nsHTMLInputElement* input = nsHTMLInputElement::FromContent(mContent);
+  HTMLInputElement* input = HTMLInputElement::FromContent(mContent);
  if (input)
    input->GetValue(aValue);
 }
@ -385,7 +386,7 @@ HTMLTextFieldAccessible::NativeState()
  }

  // Is it an <input> or a <textarea> ?
-  nsHTMLInputElement* input = nsHTMLInputElement::FromContent(mContent);
+  HTMLInputElement* input = HTMLInputElement::FromContent(mContent);
  state |= input && input->IsSingleLineTextControl() ?
    states::SINGLE_LINE : states::MULTI_LINE;

@ -451,7 +452,7 @@ NS_IMETHODIMP
 HTMLTextFieldAccessible::DoAction(uint8_t aIndex)
 {
  if (aIndex == 0) {
-    nsHTMLInputElement* element = nsHTMLInputElement::FromContent(mContent);
+    HTMLInputElement* element = HTMLInputElement::FromContent(mContent);
    if (element)
      return element->Focus();

--- a/configure.in
+++ b/configure.in
@ -6004,7 +6004,7 @@ if test "$MOZ_GAMEPAD"; then
            if ! test -f "$MOZ_DIRECTX_SDK_PATH"/lib/$MOZ_DIRECTX_SDK_CPU_SUFFIX/dxguid.lib ; then
               MOZ_GAMEPAD=
            fi
-        else
+        elif test "$GCC" != "yes"; then
            MOZ_GAMEPAD=
        fi
        if test -z "$MOZ_GAMEPAD"; then
--- a/content/base/public/nsIContent.h
+++ b/content/base/public/nsIContent.h
@ -673,7 +673,7 @@ public:
   * If you also need to determine whether the parser is the one creating your
   * element (through createElement() or cloneNode() generally) then add a
   * uint32_t aFromParser to the NS_NewXXX() constructor for your element and
-   * have the parser pass the appropriate flags. See nsHTMLInputElement.cpp and
+   * have the parser pass the appropriate flags. See HTMLInputElement.cpp and
   * nsHTMLContentSink::MakeContentObject().
   *
   * DO NOT USE THIS METHOD to get around the fact that it's hard to deal with
@ -709,7 +709,7 @@ public:
   * If you also need to determine whether the parser is the one creating your
   * element (through createElement() or cloneNode() generally) then add a
   * boolean aFromParser to the NS_NewXXX() constructor for your element and
-   * have the parser pass true.  See nsHTMLInputElement.cpp and
+   * have the parser pass true.  See HTMLInputElement.cpp and
   * nsHTMLContentSink::MakeContentObject().
   *
   * @param aHaveNotified Whether there has been a
--- a/content/base/public/nsINode.h
+++ b/content/base/public/nsINode.h
@ -282,7 +282,7 @@ public:
  // - HTMLFieldSetElement:   mElements, mDependentElements, mFirstLegend
  // - nsHTMLFormElement:     many!
  // - HTMLFrameSetElement:   mRowSpecs, mColSpecs
-  // - nsHTMLInputElement:    mInputData, mFiles, mFileList, mStaticDocfileList
+  // - HTMLInputElement:      mInputData, mFiles, mFileList, mStaticDocfileList
  // - nsHTMLMapElement:      mAreas
  // - HTMLMediaElement:      many!
  // - nsHTMLOutputElement:   mDefaultValue, mTokenList
--- a/content/base/src/CSPUtils.jsm
+++ b/content/base/src/CSPUtils.jsm
@ -302,7 +302,7 @@ CSPRep.fromString = function(aStr, self, docRequest, csp) {
    // parse "allow" as equivalent to "default-src", at least until the spec
    // stabilizes, at which time we can stop parsing "allow"
    if (dirname === CSPRep.ALLOW_DIRECTIVE) {
-      cspWarn(aCSPR, CSPLocalizer.getStr("allowDirectiveDeprecated"));
+      cspWarn(aCSPR, CSPLocalizer.getStr("allowDirectiveIsDeprecated"));
      if (aCSPR._directives.hasOwnProperty(SD.DEFAULT_SRC)) {
        // Check for duplicate default-src and allow directives
        cspError(aCSPR, CSPLocalizer.getFormatStr("duplicateDirective",
--- a/content/base/src/nsDocument.h
+++ b/content/base/src/nsDocument.h
@ -134,14 +134,15 @@ public:
  }
  ~nsIdentifierMapEntry();

-  void SetInvalidName();
-  bool IsInvalidName();
  void AddNameElement(nsIDocument* aDocument, Element* aElement);
  void RemoveNameElement(Element* aElement);
  bool IsEmpty();
  nsBaseContentList* GetNameContentList() {
    return mNameContentList;
  }
+  bool HasNameElement() const {
+    return mNameContentList && !mNameContentList->Length() != 0;
+  }

  /**
   * Returns the element if we know the element associated with this
--- a/content/base/src/nsGkAtomList.h
+++ b/content/base/src/nsGkAtomList.h
@ -637,7 +637,6 @@ GK_ATOM(onalerting, "onalerting")
 GK_ATOM(onanimationend, "onanimationend")
 GK_ATOM(onanimationiteration, "onanimationiteration")
 GK_ATOM(onanimationstart, "onanimationstart")
-GK_ATOM(onauthorize, "onauthorize")
 GK_ATOM(onAppCommand, "onAppCommand")
 GK_ATOM(onbeforecopy, "onbeforecopy")
 GK_ATOM(onbeforecut, "onbeforecut")
@ -651,7 +650,6 @@ GK_ATOM(onbroadcast, "onbroadcast")
 GK_ATOM(onbusy, "onbusy")
 GK_ATOM(oncached, "oncached")
 GK_ATOM(oncallschanged, "oncallschanged")
-GK_ATOM(oncancel, "oncancel")
 GK_ATOM(oncardstatechange, "oncardstatechange")
 GK_ATOM(oncfstatechange, "oncfstatechange")
 GK_ATOM(onchange, "onchange")
@ -676,8 +674,6 @@ GK_ATOM(ondataerror, "ondataerror")
 GK_ATOM(ondblclick, "ondblclick")
 GK_ATOM(ondeliverysuccess, "ondeliverysuccess")
 GK_ATOM(ondeliveryerror, "ondeliveryerror")
-GK_ATOM(ondevicecreated, "ondevicecreated")
-GK_ATOM(ondevicedisappeared, "ondevicedisappeared")
 GK_ATOM(ondevicefound, "ondevicefound")
 GK_ATOM(ondialing, "ondialing")
 GK_ATOM(ondisabled, "ondisabled")
@ -762,12 +758,8 @@ GK_ATOM(onpopuphidden, "onpopuphidden")
 GK_ATOM(onpopuphiding, "onpopuphiding")
 GK_ATOM(onpopupshowing, "onpopupshowing")
 GK_ATOM(onpopupshown, "onpopupshown")
-GK_ATOM(onpropertychanged, "onpropertychanged")
 GK_ATOM(onreadystatechange, "onreadystatechange")
 GK_ATOM(onreceived, "onreceived")
-GK_ATOM(onrequestconfirmation, "onrequestconfirmation")
-GK_ATOM(onrequestpasskey, "onrequestpasskey")
-GK_ATOM(onrequestpincode, "onrequestpincode")
 GK_ATOM(onRequest, "onRequest")
 GK_ATOM(onreset, "onreset")
 GK_ATOM(onresuming, "onresuming")
--- a/content/html/content/src/nsHTMLInputElement.cpp
+++ b/content/html/content/src/nsHTMLInputElement.cpp
--- a/content/html/content/src/nsHTMLInputElement.h
+++ b/content/html/content/src/nsHTMLInputElement.h
@ -3,8 +3,8 @@
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

-#ifndef nsHTMLInputElement_h__
-#define nsHTMLInputElement_h__
+#ifndef mozilla_dom_HTMLInputElement_h
+#define mozilla_dom_HTMLInputElement_h

 #include "nsGenericHTMLElement.h"
 #include "nsImageLoadingContent.h"
@ -26,6 +26,9 @@ class nsIRadioGroupContainer;
 class nsIRadioGroupVisitor;
 class nsIRadioVisitor;

+namespace mozilla {
+namespace dom {
+
 class UploadLastDir MOZ_FINAL : public nsIObserver, public nsSupportsWeakReference {
 public:
  NS_DECL_ISUPPORTS
@ -50,22 +53,26 @@ public:
  nsresult StoreLastUsedDirectory(nsIDocument* aDoc, nsIDOMFile* aDomFile);
 };

-class nsHTMLInputElement : public nsGenericHTMLFormElement,
-                           public nsImageLoadingContent,
-                           public nsIDOMHTMLInputElement,
-                           public nsITextControlElement,
-                           public nsIPhonetic,
-                           public nsIDOMNSEditableElement,
-                           public nsIConstraintValidation
+class HTMLInputElement : public nsGenericHTMLFormElement,
+                         public nsImageLoadingContent,
+                         public nsIDOMHTMLInputElement,
+                         public nsITextControlElement,
+                         public nsIPhonetic,
+                         public nsIDOMNSEditableElement,
+                         public nsIConstraintValidation
 {
 public:
  using nsIConstraintValidation::GetValidationMessage;
+  using nsIConstraintValidation::CheckValidity;
+  using nsIConstraintValidation::WillValidate;
+  using nsIConstraintValidation::Validity;
+  using nsGenericHTMLFormElement::GetForm;

-  nsHTMLInputElement(already_AddRefed<nsINodeInfo> aNodeInfo,
-                     mozilla::dom::FromParser aFromParser);
-  virtual ~nsHTMLInputElement();
+  HTMLInputElement(already_AddRefed<nsINodeInfo> aNodeInfo,
+                   mozilla::dom::FromParser aFromParser);
+  virtual ~HTMLInputElement();

-  NS_IMPL_FROMCONTENT_HTML_WITH_TAG(nsHTMLInputElement, input)
+  NS_IMPL_FROMCONTENT_HTML_WITH_TAG(HTMLInputElement, input)

  // nsISupports
  NS_DECL_ISUPPORTS_INHERITED
@ -79,7 +86,7 @@ public:
  // nsIDOMHTMLElement
  NS_FORWARD_NSIDOMHTMLELEMENT_TO_GENERIC
  virtual int32_t TabIndexDefault() MOZ_OVERRIDE;
-  virtual void Focus(mozilla::ErrorResult& aError) MOZ_OVERRIDE;
+  virtual void Focus(ErrorResult& aError) MOZ_OVERRIDE;

  // nsIDOMHTMLInputElement
  NS_DECL_NSIDOMHTMLINPUTELEMENT
@ -164,7 +171,12 @@ public:
  NS_IMETHOD_(bool) HasCachedSelection();

  void GetDisplayFileName(nsAString& aFileName) const;
-  const nsCOMArray<nsIDOMFile>& GetFiles() const;
+
+  const nsCOMArray<nsIDOMFile>& GetFilesInternal() const
+  {
+    return mFiles;
+  }
+
  void SetFiles(const nsCOMArray<nsIDOMFile>& aFiles, bool aSetValueChanged);
  void SetFiles(nsIDOMFileList* aFiles, bool aSetValueChanged);

@ -188,7 +200,7 @@ public:

  NS_IMETHOD FireAsyncClickHandler();

-  NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(nsHTMLInputElement,
+  NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(HTMLInputElement,
                                           nsGenericHTMLFormElement)

  static UploadLastDir* gUploadLastDir;
@ -275,13 +287,6 @@ public:
   */
  void UpdateValidityUIBits(bool aIsFocused);

-  bool DefaultChecked() const {
-    return HasAttr(kNameSpaceID_None, nsGkAtoms::checked);
-  }
-
-  bool Indeterminate() const { return mIndeterminate; }
-  bool Checked() const { return mChecked; }
-
  /**
   * Fires change event if mFocusedValue and current value held are unequal.
   */
@ -315,7 +320,319 @@ public:
   */
  double GetMaximum() const;

+  // WebIDL
+
+  // XPCOM GetAccept() is OK
+  void SetAccept(const nsAString& aValue, ErrorResult& aRv)
+  {
+    SetHTMLAttr(nsGkAtoms::accept, aValue, aRv);
+  }
+
+  // XPCOM GetAlt() is OK
+  void SetAlt(const nsAString& aValue, ErrorResult& aRv)
+  {
+    SetHTMLAttr(nsGkAtoms::alt, aValue, aRv);
+  }
+
+  // XPCOM GetAutocomplete() is OK
+  void SetAutocomplete(const nsAString& aValue, ErrorResult& aRv)
+  {
+    SetHTMLAttr(nsGkAtoms::autocomplete, aValue, aRv);
+  }
+
+  bool Autofocus() const
+  {
+    return GetBoolAttr(nsGkAtoms::autofocus);
+  }
+
+  void SetAutofocus(bool aValue, ErrorResult& aRv)
+  {
+    SetHTMLBoolAttr(nsGkAtoms::autofocus, aValue, aRv);
+  }
+
+  bool DefaultChecked() const
+  {
+    return HasAttr(kNameSpaceID_None, nsGkAtoms::checked);
+  }
+
+  void SetDefaultChecked(bool aValue, ErrorResult& aRv)
+  {
+    SetHTMLBoolAttr(nsGkAtoms::checked, aValue, aRv);
+  }
+
+  bool Checked() const
+  {
+    return mChecked;
+  }
+  // XPCOM SetChecked() is OK
+
+  bool Disabled() const
+  {
+    return GetBoolAttr(nsGkAtoms::disabled);
+  }
+
+  void SetDisabled(bool aValue,ErrorResult& aRv)
+  {
+    SetHTMLBoolAttr(nsGkAtoms::disabled, aValue, aRv);
+  }
+
+  // XPCOM GetForm() is OK
+
+  nsDOMFileList* GetFiles();
+
+  // XPCOM GetFormAction() is OK
+  void SetFormAction(const nsAString& aValue, ErrorResult& aRv)
+  {
+    SetHTMLAttr(nsGkAtoms::formaction, aValue, aRv);
+  }
+
+  // XPCOM GetFormEnctype() is OK
+  void SetFormEnctype(const nsAString& aValue, ErrorResult& aRv)
+  {
+    SetHTMLAttr(nsGkAtoms::formenctype, aValue, aRv);
+  }
+
+  // XPCOM GetFormMethod() is OK
+  void SetFormMethod(const nsAString& aValue, ErrorResult& aRv)
+  {
+    SetHTMLAttr(nsGkAtoms::formmethod, aValue, aRv);
+  }
+
+  bool FormNoValidate() const
+  {
+    return GetBoolAttr(nsGkAtoms::formnovalidate);
+  }
+
+  void SetFormNoValidate(bool aValue, ErrorResult& aRv)
+  {
+    SetHTMLBoolAttr(nsGkAtoms::formnovalidate, aValue, aRv);
+  }
+
+  // XPCOM GetFormTarget() is OK
+  void SetFormTarget(const nsAString& aValue, ErrorResult& aRv)
+  {
+    SetHTMLAttr(nsGkAtoms::formtarget, aValue, aRv);
+  }
+
+  uint32_t Height();
+
+  void SetHeight(uint32_t aValue, ErrorResult& aRv)
+  {
+    aRv = nsGenericHTMLElement::SetUnsignedIntAttr(nsGkAtoms::height, aValue);
+  }
+
+  bool Indeterminate() const
+  {
+    return mIndeterminate;
+  }
+  // XPCOM SetIndeterminate() is OK
+
+  // XPCOM GetInputMode() is OK
+  void SetInputMode(const nsAString& aValue, ErrorResult& aRv)
+  {
+    SetHTMLAttr(nsGkAtoms::inputmode, aValue, aRv);
+  }
+
+  nsGenericHTMLElement* GetList() const;
+
+  // XPCOM GetMax() is OK
+  void SetMax(const nsAString& aValue, ErrorResult& aRv)
+  {
+    SetHTMLAttr(nsGkAtoms::max, aValue, aRv);
+  }
+
+  int32_t MaxLength() const
+  {
+    return GetIntAttr(nsGkAtoms::maxlength, -1);
+  }
+
+  void SetMaxLength(int32_t aValue, ErrorResult& aRv)
+  {
+    if (aValue < 0) {
+      aRv.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
+      return;
+    }
+
+    SetHTMLIntAttr(nsGkAtoms::maxlength, aValue, aRv);
+  }
+
+  // XPCOM GetMin() is OK
+  void SetMin(const nsAString& aValue, ErrorResult& aRv)
+  {
+    SetHTMLAttr(nsGkAtoms::min, aValue, aRv);
+  }
+
+  bool Multiple() const
+  {
+    return GetBoolAttr(nsGkAtoms::multiple);
+  }
+
+  void SetMultiple(bool aValue, ErrorResult& aRv)
+  {
+    SetHTMLBoolAttr(nsGkAtoms::multiple, aValue, aRv);
+  }
+
+  // XPCOM GetName() is OK
+  void SetName(const nsAString& aValue, ErrorResult& aRv)
+  {
+    SetHTMLAttr(nsGkAtoms::name, aValue, aRv);
+  }
+
+  // XPCOM GetPattern() is OK
+  void SetPattern(const nsAString& aValue, ErrorResult& aRv)
+  {
+    SetHTMLAttr(nsGkAtoms::pattern, aValue, aRv);
+  }
+
+  // XPCOM GetPlaceholder() is OK
+  void SetPlaceholder(const nsAString& aValue, ErrorResult& aRv)
+  {
+    SetHTMLAttr(nsGkAtoms::placeholder, aValue, aRv);
+  }
+
+  bool ReadOnly() const
+  {
+    return GetBoolAttr(nsGkAtoms::readonly);
+  }
+
+  void SetReadOnly(bool aValue, ErrorResult& aRv)
+  {
+    SetHTMLBoolAttr(nsGkAtoms::readonly, aValue, aRv);
+  }
+
+  bool Required() const
+  {
+    return GetBoolAttr(nsGkAtoms::required);
+  }
+
+  void SetRequired(bool aValue, ErrorResult& aRv)
+  {
+    SetHTMLBoolAttr(nsGkAtoms::required, aValue, aRv);
+  }
+
+  uint32_t Size()
+  {
+    uint32_t value;
+    GetUnsignedIntAttr(nsGkAtoms::size, DEFAULT_COLS, &value);
+    return value;
+  }
+
+  void SetSize(uint32_t aValue, ErrorResult& aRv)
+  {
+    if (aValue == 0) {
+      aRv.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
+      return;
+    }
+
+    SetHTMLUnsignedIntAttr(nsGkAtoms::size, aValue, aRv);
+  }
+
+  // XPCOM GetSrc() is OK
+  void SetSrc(const nsAString& aValue, ErrorResult& aRv)
+  {
+    SetHTMLAttr(nsGkAtoms::src, aValue, aRv);
+  }
+
+  // XPCOM GetStep() is OK
+  void SetStep(const nsAString& aValue, ErrorResult& aRv)
+  {
+    SetHTMLAttr(nsGkAtoms::step, aValue, aRv);
+  }
+
+  // XPCOM GetType() is OK
+  void SetType(const nsAString& aValue, ErrorResult& aRv)
+  {
+    SetHTMLAttr(nsGkAtoms::type, aValue, aRv);
+  }
+
+  // XPCOM GetDefaultValue() is OK
+  void SetDefaultValue(const nsAString& aValue, ErrorResult& aRv)
+  {
+    SetHTMLAttr(nsGkAtoms::value, aValue, aRv);
+  }
+
+  // XPCOM GetValue() is OK
+  void SetValue(const nsAString& aValue, ErrorResult& aRv);
+
+  JS::Value GetValueAsDate(JSContext* aCx, ErrorResult& aRv);
+
+  void SetValueAsDate(JSContext* aCx, JS::Value aValue, ErrorResult& aRv);
+
+  double ValueAsNumber() const
+  {
+    return DoesValueAsNumberApply() ? GetValueAsDouble()
+                                    : MOZ_DOUBLE_NaN();
+  }
+
+  void SetValueAsNumber(double aValue, ErrorResult& aRv);
+
+  uint32_t Width();
+
+  void SetWidth(uint32_t aValue, ErrorResult& aRv)
+  {
+    aRv = nsGenericHTMLElement::SetUnsignedIntAttr(nsGkAtoms::width, aValue);
+  }
+
+  void StepUp(const Optional< int32_t >& n, ErrorResult& aRv)
+  {
+    aRv = ApplyStep(n.WasPassed() ? n.Value() : 1);
+  }
+
+  void StepDown(const Optional< int32_t >& n, ErrorResult& aRv)
+  {
+    aRv = ApplyStep(n.WasPassed() ? -n.Value() : -1);
+  }
+
+  void GetValidationMessage(nsAString& aValidationMessage, ErrorResult& aRv);
+
+  // XPCOM GetCustomVisibility() is OK
+
+  // XPCOM Select() is OK
+
+  int32_t GetSelectionStart(ErrorResult& aRv);
+  void SetSelectionStart(int32_t aValue, ErrorResult& aRv);
+
+  int32_t GetSelectionEnd(ErrorResult& aRv);
+  void SetSelectionEnd(int32_t aValue, ErrorResult& aRv);
+
+  void GetSelectionDirection(nsAString& aValue, ErrorResult& aRv);
+  void SetSelectionDirection(const nsAString& aValue, ErrorResult& aRv);
+
+  void SetSelectionRange(int32_t aStart, int32_t aEnd,
+                         const Optional< nsAString >& direction,
+                         ErrorResult& aRv);
+
+  // XPCOM GetAlign() is OK
+  void SetAlign(const nsAString& aValue, ErrorResult& aRv)
+  {
+    SetHTMLAttr(nsGkAtoms::align, aValue, aRv);
+  }
+
+  // XPCOM GetUseMap() is OK
+  void SetUseMap(const nsAString& aValue, ErrorResult& aRv)
+  {
+    SetHTMLAttr(nsGkAtoms::usemap, aValue, aRv);
+  }
+
+  nsIControllers* GetControllers(ErrorResult& aRv);
+
+  int32_t GetTextLength(ErrorResult& aRv);
+
+  void MozGetFileNameArray(nsTArray< nsString >& aFileNames);
+
+  void MozSetFileNameArray(const Sequence< nsString >& aFileNames);
+
+  bool MozIsTextField(bool aExcludePassword);
+
+  nsIEditor* GetEditor();
+
+  // XPCOM SetUserInput() is OK
+
+  // XPCOM GetPhonetic() is OK
+
 protected:
+  virtual JSObject* WrapNode(JSContext* aCx, JSObject* aScope) MOZ_OVERRIDE;
+
  // Pull IsSingleLineTextControl into our scope, otherwise it'd be hidden
  // by the nsITextControlElement version.
  using nsGenericHTMLFormElement::IsSingleLineTextControl;
@ -401,8 +718,8 @@ protected:
    SetFiles(files, aSetValueChanged);
  }

-  nsresult SetIndeterminateInternal(bool aValue,
-                                    bool aShouldInvalidate);
+  void SetIndeterminateInternal(bool aValue,
+                                bool aShouldInvalidate);

  nsresult GetSelectionRange(int32_t* aSelectionStart, int32_t* aSelectionEnd);

@ -887,11 +1204,11 @@ private:
    : public nsRunnable
  {
  public:
-    AsyncClickHandler(nsHTMLInputElement* aInput);
+    AsyncClickHandler(HTMLInputElement* aInput);
    NS_IMETHOD Run();

  protected:
-    nsRefPtr<nsHTMLInputElement> mInput;
+    nsRefPtr<HTMLInputElement> mInput;
    PopupControlState mPopupControlState;
  };

@ -899,7 +1216,7 @@ private:
    : public nsIFilePickerShownCallback
  {
  public:
-    nsFilePickerShownCallback(nsHTMLInputElement* aInput,
+    nsFilePickerShownCallback(HTMLInputElement* aInput,
                              nsIFilePicker* aFilePicker,
                              bool aMulti);
    virtual ~nsFilePickerShownCallback()
@ -911,9 +1228,12 @@ private:

  private:
    nsCOMPtr<nsIFilePicker> mFilePicker;
-    nsRefPtr<nsHTMLInputElement> mInput;
+    nsRefPtr<HTMLInputElement> mInput;
    bool mMulti;
  };
 };

+} // namespace dom
+} // namespace mozilla
+
 #endif
--- a/content/html/content/src/HTMLLabelElement.cpp
+++ b/content/html/content/src/HTMLLabelElement.cpp
@ -184,7 +184,7 @@ HTMLLabelElement::PostHandleEvent(nsEventChainPostVisitor& aVisitor)
          nsIFocusManager* fm = nsFocusManager::GetFocusManager();
          if (fm) {
            // Use FLAG_BYMOVEFOCUS here so that the label is scrolled to.
-            // Also, within nsHTMLInputElement::PostHandleEvent, inputs will
+            // Also, within HTMLInputElement::PostHandleEvent, inputs will
            // be selected only when focused via a key or when the navigation
            // flag is used and we want to select the text on label clicks as
            // well.
--- a/content/html/content/src/HTMLTextAreaElement.cpp
+++ b/content/html/content/src/HTMLTextAreaElement.cpp
@ -147,7 +147,7 @@ HTMLTextAreaElement::Select()

  nsEventStatus status = nsEventStatus_eIgnore;
  nsGUIEvent event(true, NS_FORM_SELECTED, nullptr);
-  // XXXbz nsHTMLInputElement guards against this reentering; shouldn't we?
+  // XXXbz HTMLInputElement guards against this reentering; shouldn't we?
  nsEventDispatcher::Dispatch(static_cast<nsIContent*>(this), presContext,
                              &event, nullptr, &status);

--- a/content/html/content/src/Makefile.in
+++ b/content/html/content/src/Makefile.in
@ -43,6 +43,7 @@ EXPORTS_mozilla/dom = \
 		HTMLHRElement.h \
 		HTMLIFrameElement.h \
 		HTMLImageElement.h \
+		HTMLInputElement.h \
 		HTMLLabelElement.h \
 		HTMLLegendElement.h \
 		HTMLLIElement.h \
@ -110,7 +111,7 @@ CPPSRCS		= \
 		HTMLHeadingElement.cpp \
 		HTMLIFrameElement.cpp \
 		HTMLImageElement.cpp \
-		nsHTMLInputElement.cpp \
+		HTMLInputElement.cpp \
 		HTMLLIElement.cpp \
 		HTMLLabelElement.cpp \
 		HTMLLegendElement.cpp \
--- a/content/html/content/src/nsGenericHTMLElement.h
+++ b/content/html/content/src/nsGenericHTMLElement.h
@ -717,6 +717,19 @@ public:

  static bool TouchEventsEnabled(JSContext* /* unused */, JSObject* /* unused */);

+  static inline bool
+  ShouldExposeIdAsHTMLDocumentProperty(Element* aElement)
+  {
+    if (!aElement->IsHTML()) {
+      return false;
+    }
+    nsIAtom* tag = aElement->Tag();
+    return tag == nsGkAtoms::img ||
+           tag == nsGkAtoms::applet ||
+           tag == nsGkAtoms::embed ||
+           tag == nsGkAtoms::object;
+  }
+
 protected:
  /**
   * Add/remove this element to the documents name cache
--- a/content/html/content/src/nsHTMLFormElement.cpp
+++ b/content/html/content/src/nsHTMLFormElement.cpp
@ -38,7 +38,7 @@

 // radio buttons
 #include "nsIDOMHTMLInputElement.h"
-#include "nsHTMLInputElement.h"
+#include "mozilla/dom/HTMLInputElement.h"
 #include "nsIRadioVisitor.h"

 #include "nsLayoutUtils.h"
@ -1240,8 +1240,8 @@ nsHTMLFormElement::AddElement(nsGenericHTMLFormElement* aChild,
  // This has to be done _after_ UpdateValidity() call to prevent the element
  // being count twice.
  if (type == NS_FORM_INPUT_RADIO) {
-    nsRefPtr<nsHTMLInputElement> radio =
-      static_cast<nsHTMLInputElement*>(aChild);
+    nsRefPtr<HTMLInputElement> radio =
+      static_cast<HTMLInputElement*>(aChild);
    radio->AddedToRadioGroup();
  }

@ -1265,8 +1265,8 @@ nsHTMLFormElement::RemoveElement(nsGenericHTMLFormElement* aChild,
  //
  nsresult rv = NS_OK;
  if (aChild->GetType() == NS_FORM_INPUT_RADIO) {
-    nsRefPtr<nsHTMLInputElement> radio =
-      static_cast<nsHTMLInputElement*>(aChild);
+    nsRefPtr<HTMLInputElement> radio =
+      static_cast<HTMLInputElement*>(aChild);
    radio->WillRemoveFromRadioGroup();
  }

@ -1746,7 +1746,7 @@ nsHTMLFormElement::CheckValidFormSubmission()
          // update the style in that case.
          if (mControls->mElements[i]->IsHTML(nsGkAtoms::input) &&
              nsContentUtils::IsFocusedContent(mControls->mElements[i])) {
-            static_cast<nsHTMLInputElement*>(mControls->mElements[i])
+            static_cast<HTMLInputElement*>(mControls->mElements[i])
              ->UpdateValidityUIBits(true);
          }

--- a/content/html/content/src/nsRadioVisitor.cpp
+++ b/content/html/content/src/nsRadioVisitor.cpp
@ -5,18 +5,19 @@

 #include "nsRadioVisitor.h"
 #include "nsAutoPtr.h"
-#include "nsHTMLInputElement.h"
+#include "mozilla/dom/HTMLInputElement.h"
 #include "nsEventStates.h"
 #include "nsIConstraintValidation.h"

+using namespace mozilla::dom;

 NS_IMPL_ISUPPORTS1(nsRadioVisitor, nsIRadioVisitor)

 bool
 nsRadioSetCheckedChangedVisitor::Visit(nsIFormControl* aRadio)
 {
-  nsRefPtr<nsHTMLInputElement> radio =
-    static_cast<nsHTMLInputElement*>(aRadio);
+  nsRefPtr<HTMLInputElement> radio =
+    static_cast<HTMLInputElement*>(aRadio);
  NS_ASSERTION(radio, "Visit() passed a null button!");

  radio->SetCheckedChangedInternal(mCheckedChanged);
@ -30,8 +31,8 @@ nsRadioGetCheckedChangedVisitor::Visit(nsIFormControl* aRadio)
    return true;
  }

-  nsRefPtr<nsHTMLInputElement> radio =
-    static_cast<nsHTMLInputElement*>(aRadio);
+  nsRefPtr<HTMLInputElement> radio =
+    static_cast<HTMLInputElement*>(aRadio);
  NS_ASSERTION(radio, "Visit() passed a null button!");

  *mCheckedChanged = radio->GetCheckedChanged();
@ -45,7 +46,7 @@ nsRadioSetValueMissingState::Visit(nsIFormControl* aRadio)
    return true;
  }

-  nsHTMLInputElement* input = static_cast<nsHTMLInputElement*>(aRadio);
+  HTMLInputElement* input = static_cast<HTMLInputElement*>(aRadio);

  input->SetValidityState(nsIConstraintValidation::VALIDITY_STATE_VALUE_MISSING,
                          mValidity);
--- a/content/html/content/src/nsTextEditorState.h
+++ b/content/html/content/src/nsTextEditorState.h
@ -33,7 +33,7 @@ class nsITextControlElement;
 * and also XUL controls such as <textbox> which use one of these elements behind
 * the scenes.
 *
- * This class is held as a member of nsHTMLInputElement and nsHTMLTextAreaElement.
+ * This class is held as a member of HTMLInputElement and nsHTMLTextAreaElement.
 * The public functions in this class include the public APIs which content/ uses.
 * Layout code uses the nsITextControlElement interface to invoke functions on this
 * class.
--- a/content/html/content/test/forms/test_experimental_forms_pref.html
+++ b/content/html/content/test/forms/test_experimental_forms_pref.html
@ -27,7 +27,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=764481

    SpecialPowers.pushPrefEnv({'set': [["dom.experimental_forms",true]]}, function() {
      // Change the type of input to text and then back to number, 
-      // so that nsHTMLInputElement::ParseAttribute gets called with the pref enabled.
+      // so that HTMLInputElement::ParseAttribute gets called with the pref enabled.
      input.type = "text";
      input.type = "number";
      is(input.type, "number", "input type should be number when the experimental forms are enabled");
--- a/content/html/content/test/reflect.js
+++ b/content/html/content/test/reflect.js
@ -61,7 +61,6 @@ function reflectString(aParameters)
  // TODO: remove this ugly hack when null stringification will work as expected.
  var todoAttrs = {
    form: [ "acceptCharset", "name", "target" ],
-    input: [ "accept", "alt", "formTarget", "max", "min", "name", "pattern", "placeholder", "step", "defaultValue" ]
  };
  if (!(element.localName in todoAttrs) || todoAttrs[element.localName].indexOf(idlAttr) == -1) {
    if (treatNullAs == "EmptyString") {
--- a/content/html/content/test/test_bug388558.html
+++ b/content/html/content/test/test_bug388558.html
@ -23,12 +23,11 @@ var inputChange = 0;
 var textareaChange = 0;

 function testUserInput() {
-  netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
  var input = document.getElementById("input");
  var textarea = SpecialPowers.wrap(document.getElementById("textarea"));

  input.focus();
-  input.QueryInterface(Components.interfaces.nsIDOMNSEditableElement).setUserInput("foo");
+  SpecialPowers.wrap(input).setUserInput("foo");
  input.blur();
  is(inputChange, 1, "Input element should have got one change event.");

@ -42,7 +41,7 @@ function testUserInput() {
  is(inputChange, 1, 
     "Change event dispatched when setting the value of the input element (2).");

-  input.QueryInterface(Components.interfaces.nsIDOMNSEditableElement).setUserInput("foo");
+  SpecialPowers.wrap(input).setUserInput("foo");
  is(inputChange, 1,
     "Change event dispatched when input element doesn't have focus.");

--- a/content/html/content/test/test_formSubmission.html
+++ b/content/html/content/test/test_formSubmission.html
@ -411,24 +411,22 @@ var myFile1, myFile2, emptyFile;
  multiFile = [basePath + "file_formSubmission_text.txt",
               basePath + "file_formSubmission_img.jpg"];

-  netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
-
  var addList = document.getElementsByClassName("setfile");
  let i = 0;
  var input;
  while (input = addList[i++]) {
    if (input.classList.contains("multi")) {
-      input.mozSetFileNameArray(multiFile, multiFile.length);
+      SpecialPowers.wrap(input).mozSetFileNameArray(multiFile, multiFile.length);
    }
    else {
-      input.value = singleFile;
+      SpecialPowers.wrap(input).value = singleFile;
    }
  }

  input = document.createElement("input");
  input.type = "file";
  input.multiple = true;
-  input.mozSetFileNameArray(multiFile, multiFile.length);
+  SpecialPowers.wrap(input).mozSetFileNameArray(multiFile, multiFile.length);
  myFile1 = input.files[0];
  myFile2 = input.files[1];
  is(myFile1.size, 20, "File1 size");
--- a/content/html/document/src/nsHTMLDocument.cpp
+++ b/content/html/document/src/nsHTMLDocument.cpp
@ -106,6 +106,7 @@
 #include "mozilla/dom/HTMLBodyElement.h"
 #include "nsCharsetSource.h"
 #include "nsIStringBundle.h"
+#include "nsDOMClassInfo.h"

 using namespace mozilla;
 using namespace mozilla::dom;
@ -2311,15 +2312,9 @@ nsHTMLDocument::ResolveName(const nsAString& aName, nsWrapperCache **aCache)
  // No named items were found, see if there's one registerd by id for aName.
  Element *e = entry->GetIdElement();

-  if (e && e->IsHTML()) {
-    nsIAtom *tag = e->Tag();
-    if (tag == nsGkAtoms::embed  ||
-        tag == nsGkAtoms::img    ||
-        tag == nsGkAtoms::object ||
-        tag == nsGkAtoms::applet) {
-      *aCache = e;
-      return e;
-    }
+  if (e && nsGenericHTMLElement::ShouldExposeIdAsHTMLDocumentProperty(e)) {
+    *aCache = e;
+    return e;
  }

  *aCache = nullptr;
@ -2359,6 +2354,55 @@ nsHTMLDocument::ResolveName(const nsAString& aName,
  return node.forget();
 }

+JSObject*
+nsHTMLDocument::NamedGetter(JSContext* cx, const nsAString& aName, bool& aFound,
+                            ErrorResult& rv)
+{
+  nsWrapperCache* cache;
+  nsISupports* supp = ResolveName(aName, &cache);
+  if (!supp) {
+    aFound = false;
+    if (GetCompatibilityMode() == eCompatibility_NavQuirks &&
+        aName.EqualsLiteral("all")) {
+      rv = nsHTMLDocumentSH::TryResolveAll(cx, this, GetWrapper());
+    }
+    return nullptr;
+  }
+
+  JS::Value val;
+  { // Scope for auto-compartment
+    JSObject* wrapper = GetWrapper();
+    JSAutoCompartment ac(cx, wrapper);
+    // XXXbz Should we call the (slightly misnamed, really) WrapNativeParent
+    // here?
+    if (!dom::WrapObject(cx, wrapper, supp, cache, nullptr, &val)) {
+      rv.Throw(NS_ERROR_OUT_OF_MEMORY);
+      return nullptr;
+    }
+  }
+  aFound = true;
+  return &val.toObject();
+}
+
+static PLDHashOperator
+IdentifierMapEntryAddNames(nsIdentifierMapEntry* aEntry, void* aArg)
+{
+  nsTArray<nsString>* aNames = static_cast<nsTArray<nsString>*>(aArg);
+  Element* idElement;
+  if (aEntry->HasNameElement() ||
+      ((idElement = aEntry->GetIdElement()) &&
+       nsGenericHTMLElement::ShouldExposeIdAsHTMLDocumentProperty(idElement))) {
+    aNames->AppendElement(aEntry->GetKey());
+  }
+  return PL_DHASH_NEXT;
+}
+
+void
+nsHTMLDocument::GetSupportedNames(nsTArray<nsString>& aNames)
+{
+  mIdentifierMap.EnumerateEntries(IdentifierMapEntryAddNames, &aNames);
+}
+
 //----------------------------

 // forms related stuff
--- a/content/html/document/src/nsHTMLDocument.h
+++ b/content/html/document/src/nsHTMLDocument.h
@ -185,6 +185,9 @@ public:
  void SetDomain(const nsAString& aDomain, mozilla::ErrorResult& rv);
  void GetCookie(nsAString& aCookie, mozilla::ErrorResult& rv);
  void SetCookie(const nsAString& aCookie, mozilla::ErrorResult& rv);
+  JSObject* NamedGetter(JSContext* cx, const nsAString& aName, bool& aFound,
+                        mozilla::ErrorResult& rv);
+  void GetSupportedNames(nsTArray<nsString>& aNames);
  nsGenericHTMLElement *GetBody();
  void SetBody(nsGenericHTMLElement* aBody, mozilla::ErrorResult& rv);
  mozilla::dom::HTMLSharedElement *GetHead() {
--- a/content/media/omx/OmxDecoder.cpp
+++ b/content/media/omx/OmxDecoder.cpp
@ -529,7 +529,14 @@ bool OmxDecoder::ReadVideo(VideoFrame *aFrame, int64_t aTimeUs,
    }

    if (descriptor) {
-      aFrame->mGraphicBuffer = new mozilla::layers::VideoGraphicBuffer(this, mVideoBuffer, descriptor);
+      // Change the descriptor's size to video's size. There are cases that
+      // GraphicBuffer's size and actual video size is different.
+      // See Bug 850566.
+      const mozilla::layers::SurfaceDescriptorGralloc& grallocDesc = descriptor->get_SurfaceDescriptorGralloc();
+      mozilla::layers::SurfaceDescriptor newDescriptor = mozilla::layers::SurfaceDescriptorGralloc(grallocDesc.bufferParent(),
+                                                               grallocDesc.bufferChild(), nsIntSize(mVideoWidth, mVideoHeight), grallocDesc.external());
+
+      aFrame->mGraphicBuffer = new mozilla::layers::VideoGraphicBuffer(this, mVideoBuffer, &newDescriptor);
      aFrame->mRotation = mVideoRotation;
      aFrame->mTimeUs = timeUs;
      aFrame->mEndTimeUs = timeUs + durationUs;
--- a/content/media/webspeech/Makefile.in
+++ b/content/media/webspeech/Makefile.in
@ -37,6 +37,7 @@ CPPSRCS := \

 EXPORTS_NAMESPACES := mozilla/dom
 EXPORTS_mozilla/dom := \
+  FakeSpeechRecognitionService.h \
  SpeechGrammar.h \
  SpeechGrammarList.h \
  SpeechRecognitionAlternative.h \
--- a/content/media/webspeech/recognition/test/Makefile.in
+++ b/content/media/webspeech/recognition/test/Makefile.in
@ -14,11 +14,6 @@ CPPSRCS := \
  FakeSpeechRecognitionService.cpp \
  $(NULL)

-EXPORTS_NAMESPACES := mozilla/dom
-EXPORTS_mozilla/dom := \
-  FakeSpeechRecognitionService.h \
-  $(NULL)
-
 MOCHITEST_FILES := \
  head.js \
  test_success_without_recognition_service.html \
--- a/content/smil/nsSMILAnimationFunction.h
+++ b/content/smil/nsSMILAnimationFunction.h
@ -383,7 +383,6 @@ protected:
  inline void SetKeyPointsErrorFlag(bool aNewValue) {
    SetErrorFlag(BF_KEY_POINTS, aNewValue);
  }
-  // Helper method -- based on SET_BOOLBIT in nsHTMLInputElement.cpp
  inline void SetErrorFlag(AnimationAttributeIdx aField, bool aValue) {
    if (aValue) {
      mErrorFlags |=  (0x01 << aField);
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@ -82,6 +82,7 @@
 #include "mozilla/Telemetry.h"
 #include "mozilla/AutoRestore.h"
 #include "mozilla/Attributes.h"
+#include "mozilla/VisualEventTracer.h"

 // we want to explore making the document own the load group
 // so we can associate the document URI with the load group.
@ -6666,6 +6667,8 @@ nsDocShell::EndPageLoad(nsIWebProgress * aProgress,
    if(!aChannel)
        return NS_ERROR_NULL_POINTER;
    
+    MOZ_EVENT_TRACER_DONE(this, "docshell::pageload");
+
    nsCOMPtr<nsIURI> url;
    nsresult rv = aChannel->GetURI(getter_AddRefs(url));
    if (NS_FAILED(rv)) return rv;
@ -9389,6 +9392,13 @@ nsDocShell::DoURILoad(nsIURI * aURI,
                      bool aBypassClassifier,
                      bool aForceAllowCookies)
 {
+#ifdef MOZ_VISUAL_EVENT_TRACER
+    nsAutoCString urlSpec;
+    aURI->GetAsciiSpec(urlSpec);
+    MOZ_EVENT_TRACER_NAME_OBJECT(this, urlSpec.BeginReading());
+    MOZ_EVENT_TRACER_EXEC(this, "docshell::pageload");
+#endif
+
    nsresult rv;
    nsCOMPtr<nsIURILoader> uriLoader;

--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@ -7120,6 +7120,87 @@ nsHTMLDocumentSH::DocumentAllTagsNewResolve(JSContext *cx, JSHandleObject obj,
 }


+static nsresult
+ResolveAll(JSContext* cx, nsIDocument* doc, JSObject* obj)
+{
+  JSObject *proto;
+  if (!::JS_GetPrototype(cx, obj, &proto)) {
+    return NS_ERROR_FAILURE;
+  }
+
+  JSObject *helper;
+  if (!GetDocumentAllHelper(cx, proto, &helper)) {
+    return NS_ERROR_FAILURE;
+  }
+
+  if (!::JS_GetPrototype(cx, helper ? helper : obj, &proto)) {
+    return NS_ERROR_FAILURE;
+  }
+
+  // Check if the property all is defined on obj's (or helper's
+  // if obj doesn't exist) prototype, if it is, don't expose our
+  // document.all helper.
+
+  JSBool hasAll = JS_FALSE;
+  if (proto && !JS_HasProperty(cx, proto, "all", &hasAll)) {
+    return NS_ERROR_UNEXPECTED;
+  }
+
+  if (hasAll && helper) {
+    // Our helper's prototype now has an "all" property, remove
+    // the helper out of the prototype chain to prevent
+    // shadowing of the now defined "all" property.
+    JSObject *tmp = obj, *tmpProto = tmp;
+
+    do {
+      tmp = tmpProto;
+      if (!::JS_GetPrototype(cx, tmp, &tmpProto)) {
+        return NS_ERROR_UNEXPECTED;
+      }
+    } while (tmpProto != helper);
+
+    ::JS_SetPrototype(cx, tmp, proto);
+  }
+
+  // If we don't already have a helper and "all" isn't already defined on
+  // our prototype, create a helper.
+  if (!helper && !hasAll) {
+    // Print a warning so developers can stop using document.all
+    PrintWarningOnConsole(cx, "DocumentAllUsed");
+
+    if (!::JS_GetPrototype(cx, obj, &proto)) {
+      return NS_ERROR_UNEXPECTED;
+    }
+    helper = ::JS_NewObject(cx, &sHTMLDocumentAllHelperClass,
+                            proto,
+                            ::JS_GetGlobalForObject(cx, obj));
+
+    if (!helper) {
+      return NS_ERROR_OUT_OF_MEMORY;
+    }
+
+    // Insert the helper into our prototype chain. helper's prototype
+    // is already obj's current prototype.
+    if (!::JS_SetPrototype(cx, obj, helper)) {
+      xpc::Throw(cx, NS_ERROR_UNEXPECTED);
+      return NS_ERROR_UNEXPECTED;
+    }
+  }
+
+  return NS_OK;
+}
+
+nsresult
+nsHTMLDocumentSH::TryResolveAll(JSContext* cx, nsHTMLDocument* doc,
+                                JSObject* obj)
+{
+  if (sDisableDocumentAllSupport) {
+    return NS_OK;
+  }
+  JSAutoCompartment ac(cx, obj);
+  return ResolveAll(cx, doc, obj);
+}
+
 NS_IMETHODIMP
 nsHTMLDocumentSH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                             JSObject *obj, jsid id, uint32_t flags,
@ -7156,74 +7237,10 @@ nsHTMLDocumentSH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
    if (id == sAll_id && !sDisableDocumentAllSupport &&
        !ObjectIsNativeWrapper(cx, obj)) {
      nsIDocument *doc = static_cast<nsIDocument*>(wrapper->Native());
-
-      if (doc->GetCompatibilityMode() == eCompatibility_NavQuirks) {
-        JSObject *proto;
-        if (!::JS_GetPrototype(cx, obj, &proto)) {
-          return NS_ERROR_FAILURE;
-        }
-
-        JSObject *helper;
-        if (!GetDocumentAllHelper(cx, proto, &helper)) {
-          return NS_ERROR_FAILURE;
-        }
-
-        if (!::JS_GetPrototype(cx, helper ? helper : obj, &proto)) {
-          return NS_ERROR_FAILURE;
-        }
-
-        // Check if the property all is defined on obj's (or helper's
-        // if obj doesn't exist) prototype, if it is, don't expose our
-        // document.all helper.
-
-        JSBool hasAll = JS_FALSE;
-        if (proto && !JS_HasProperty(cx, proto, "all", &hasAll)) {
-          return NS_ERROR_UNEXPECTED;
-        }
-
-        if (hasAll && helper) {
-          // Our helper's prototype now has an "all" property, remove
-          // the helper out of the prototype chain to prevent
-          // shadowing of the now defined "all" property.
-          JSObject *tmp = obj, *tmpProto = tmp;
-
-          do {
-            tmp = tmpProto;
-            if (!::JS_GetPrototype(cx, tmp, &tmpProto)) {
-              return NS_ERROR_UNEXPECTED;
-            }
-          } while (tmpProto != helper);
-
-          ::JS_SetPrototype(cx, tmp, proto);
-        }
-
-        // If we don't already have a helper and "all" isn't already defined on
-        // our prototype, create a helper.
-        if (!helper && !hasAll) {
-          // Print a warning so developers can stop using document.all
-          PrintWarningOnConsole(cx, "DocumentAllUsed");
-
-          if (!::JS_GetPrototype(cx, obj, &proto)) {
-            return NS_ERROR_UNEXPECTED;
-          }
-          helper = ::JS_NewObject(cx, &sHTMLDocumentAllHelperClass,
-                                  proto,
-                                  ::JS_GetGlobalForObject(cx, obj));
-
-          if (!helper) {
-            return NS_ERROR_OUT_OF_MEMORY;
-          }
-
-          // Insert the helper into our prototype chain. helper's prototype
-          // is already obj's current prototype.
-          if (!::JS_SetPrototype(cx, obj, helper)) {
-            xpc::Throw(cx, NS_ERROR_UNEXPECTED);
-            return NS_ERROR_UNEXPECTED;
-          }
-        }
+      if (doc->GetCompatibilityMode() != eCompatibility_NavQuirks) {
+        return NS_OK;
      }
-
-      return NS_OK;
+      return ResolveAll(cx, doc, obj);
    }
  }

--- a/dom/base/nsDOMClassInfo.h
+++ b/dom/base/nsDOMClassInfo.h
@ -690,6 +690,9 @@ public:
  NS_IMETHOD GetProperty(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                         JSObject *obj, jsid id, jsval *vp, bool *_retval);

+  static nsresult TryResolveAll(JSContext* cx, nsHTMLDocument* doc,
+                                JSObject* obj);
+
  static nsIClassInfo *doCreate(nsDOMClassInfoData* aData)
  {
    return new nsHTMLDocumentSH(aData);
--- a/dom/bindings/Bindings.conf
+++ b/dom/bindings/Bindings.conf
@ -1382,6 +1382,7 @@ addExternalIface('MozRDFCompositeDataSource', nativeType='nsIRDFCompositeDataSou
 addExternalIface('MozRDFResource', nativeType='nsIRDFResource', notflattened=True)
 addExternalIface('MozXULTemplateBuilder', nativeType='nsIXULTemplateBuilder')
 addExternalIface('MozNamedAttrMap')
+addExternalIface('nsIControllers', nativeType='nsIControllers')
 addExternalIface('nsIStreamListener', nativeType='nsIStreamListener', notflattened=True)
 addExternalIface('nsISupports', nativeType='nsISupports')
 addExternalIface('nsIEditor', nativeType='nsIEditor', notflattened=True)
--- a/dom/bindings/DOMJSProxyHandler.cpp
+++ b/dom/bindings/DOMJSProxyHandler.cpp
@ -75,6 +75,20 @@ DOMProxyHandler::EnsureExpandoObject(JSContext* cx, JSObject* obj)
  return expando;
 }

+bool
+DOMProxyHandler::isExtensible(JSObject *proxy)
+{
+  return true; // always extensible per WebIDL
+}
+
+bool
+DOMProxyHandler::preventExtensions(JSContext *cx, JS::Handle<JSObject*> proxy)
+{
+  // Throw a TypeError, per WebIDL.
+  JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_CANT_CHANGE_EXTENSIBILITY);
+  return false;
+}
+
 bool
 DOMProxyHandler::getPropertyDescriptor(JSContext* cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id,
                                       JSPropertyDescriptor* desc, unsigned flags)
--- a/dom/bindings/DOMJSProxyHandler.h
+++ b/dom/bindings/DOMJSProxyHandler.h
@ -36,6 +36,7 @@ public:
  {
  }

+  bool preventExtensions(JSContext *cx, JS::Handle<JSObject*> proxy) MOZ_OVERRIDE;
  bool getPropertyDescriptor(JSContext* cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id,
                            JSPropertyDescriptor* desc, unsigned flags) MOZ_OVERRIDE;
  bool defineProperty(JSContext* cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id,
@ -44,6 +45,7 @@ public:
               JS::Handle<jsid> id, bool* bp) MOZ_OVERRIDE;
  bool enumerate(JSContext* cx, JS::Handle<JSObject*> proxy, JS::AutoIdVector& props) MOZ_OVERRIDE;
  bool has(JSContext* cx, JS::Handle<JSObject*> proxy, JS::Handle<jsid> id, bool* bp) MOZ_OVERRIDE;
+  bool isExtensible(JSObject *proxy) MOZ_OVERRIDE;
  using js::BaseProxyHandler::obj_toString;

  static JSObject* GetExpandoObject(JSObject* obj)
--- a/dom/bluetooth/BluetoothAdapter.cpp
+++ b/dom/bluetooth/BluetoothAdapter.cpp
@ -14,7 +14,6 @@

 #include "nsContentUtils.h"
 #include "nsDOMClassInfo.h"
-#include "nsIDOMBluetoothDeviceAddressEvent.h"
 #include "nsIDOMBluetoothDeviceEvent.h"
 #include "nsTArrayHelpers.h"
 #include "DOMRequest.h"
@ -287,29 +286,6 @@ BluetoothAdapter::Notify(const BluetoothSignal& aData)
    e->InitBluetoothDeviceEvent(NS_LITERAL_STRING("devicefound"),
                                false, false, device);
    DispatchTrustedEvent(event);
-  } else if (aData.name().EqualsLiteral("DeviceDisappeared")) {
-    const nsAString& deviceAddress = aData.value().get_nsString();
-
-    nsCOMPtr<nsIDOMEvent> event;
-    NS_NewDOMBluetoothDeviceAddressEvent(getter_AddRefs(event), this, nullptr, nullptr);
-
-    nsCOMPtr<nsIDOMBluetoothDeviceAddressEvent> e = do_QueryInterface(event);
-    e->InitBluetoothDeviceAddressEvent(NS_LITERAL_STRING("devicedisappeared"),
-                                       false, false, deviceAddress);
-    DispatchTrustedEvent(e);
-  } else if (aData.name().EqualsLiteral("DeviceCreated")) {
-    NS_ASSERTION(aData.value().type() == BluetoothValue::TArrayOfBluetoothNamedValue,
-                 "DeviceCreated: Invalid value type");
-
-    nsRefPtr<BluetoothDevice> device =
-      BluetoothDevice::Create(GetOwner(), GetPath(), aData.value());
-    nsCOMPtr<nsIDOMEvent> event;
-    NS_NewDOMBluetoothDeviceEvent(getter_AddRefs(event), this, nullptr, nullptr);
-
-    nsCOMPtr<nsIDOMBluetoothDeviceEvent> e = do_QueryInterface(event);
-    e->InitBluetoothDeviceEvent(NS_LITERAL_STRING("devicecreated"),
-                                false, false, device);
-    DispatchTrustedEvent(e);
  } else if (aData.name().EqualsLiteral("PropertyChanged")) {
    NS_ASSERTION(v.type() == BluetoothValue::TArrayOfBluetoothNamedValue,
                 "PropertyChanged: Invalid value type");
@ -371,13 +347,6 @@ BluetoothAdapter::StopDiscovery(nsIDOMDOMRequest** aRequest)
  return StartStopDiscovery(false, aRequest);
 }

-NS_IMETHODIMP
-BluetoothAdapter::GetEnabled(bool* aEnabled)
-{
-  *aEnabled = mEnabled;
-  return NS_OK;
-}
-
 NS_IMETHODIMP
 BluetoothAdapter::GetAddress(nsAString& aAddress)
 {
@ -761,12 +730,4 @@ BluetoothAdapter::ConfirmReceivingFile(const nsAString& aDeviceAddress,
  return NS_OK;
 }

-NS_IMPL_EVENT_HANDLER(BluetoothAdapter, propertychanged)
 NS_IMPL_EVENT_HANDLER(BluetoothAdapter, devicefound)
-NS_IMPL_EVENT_HANDLER(BluetoothAdapter, devicedisappeared)
-NS_IMPL_EVENT_HANDLER(BluetoothAdapter, devicecreated)
-NS_IMPL_EVENT_HANDLER(BluetoothAdapter, requestconfirmation)
-NS_IMPL_EVENT_HANDLER(BluetoothAdapter, requestpincode)
-NS_IMPL_EVENT_HANDLER(BluetoothAdapter, requestpasskey)
-NS_IMPL_EVENT_HANDLER(BluetoothAdapter, authorize)
-NS_IMPL_EVENT_HANDLER(BluetoothAdapter, cancel)
--- a/dom/bluetooth/BluetoothAdapter.h
+++ b/dom/bluetooth/BluetoothAdapter.h
@ -69,7 +69,6 @@ private:
  
  nsString mAddress;
  nsString mName;
-  bool mEnabled;
  bool mDiscoverable;
  bool mDiscovering;
  bool mPairable;
--- a/dom/bluetooth/BluetoothDevice.cpp
+++ b/dom/bluetooth/BluetoothDevice.cpp
@ -254,6 +254,3 @@ BluetoothDevice::GetServices(JSContext* aCx, jsval* aServices)
  return NS_OK;
 }

-NS_IMPL_EVENT_HANDLER(BluetoothDevice, propertychanged)
-NS_IMPL_EVENT_HANDLER(BluetoothDevice, connected)
-NS_IMPL_EVENT_HANDLER(BluetoothDevice, disconnected)
--- a/dom/bluetooth/moz.build
+++ b/dom/bluetooth/moz.build
@ -21,7 +21,6 @@ if CONFIG['MOZ_B2G_BT']:
        'nsIDOMBluetoothManager.idl',
        'nsIDOMBluetoothAdapter.idl',
        'nsIDOMBluetoothDevice.idl',
-        'nsIDOMBluetoothDeviceEvent.idl',
-        'nsIDOMBluetoothDeviceAddressEvent.idl',
+        'nsIDOMBluetoothDeviceEvent.idl'
    ]

--- a/dom/bluetooth/nsIDOMBluetoothAdapter.idl
+++ b/dom/bluetooth/nsIDOMBluetoothAdapter.idl
@ -10,12 +10,11 @@ interface nsIDOMDOMRequest;
 interface nsIDOMBlob;
 interface nsIDOMBluetoothDevice;

-[scriptable, builtinclass, uuid(6a4a9415-cda3-4a19-b79e-05d9bc2c2700)]
+[scriptable, builtinclass, uuid(b0e7117a-25e3-4ea0-9cf4-3f8cd85f9e7a)]
 interface nsIDOMBluetoothAdapter : nsIDOMEventTarget
 {
  readonly attribute DOMString address;
  [binaryname(AdapterClass)] readonly attribute unsigned long class;
-  readonly attribute bool enabled;
  readonly attribute bool discovering;

  [implicit_jscontext]
@ -60,16 +59,4 @@ interface nsIDOMBluetoothAdapter : nsIDOMEventTarget

  // Fired when discoverying and any device is discovered.
  [implicit_jscontext] attribute jsval ondevicefound;
-  // Fired when any device is out of discoverable range.
-  [implicit_jscontext] attribute jsval ondevicedisappeared;
-  // Fired when any device is created.
-  [implicit_jscontext] attribute jsval ondevicecreated;
-  // Fired when a property of the adapter is changed
-  [implicit_jscontext] attribute jsval onpropertychanged;
-  // Pairing related events
-  [implicit_jscontext] attribute jsval onrequestconfirmation;
-  [implicit_jscontext] attribute jsval onrequestpincode;
-  [implicit_jscontext] attribute jsval onrequestpasskey;
-  [implicit_jscontext] attribute jsval onauthorize;
-  [implicit_jscontext] attribute jsval oncancel;
 };
--- a/dom/bluetooth/nsIDOMBluetoothDevice.idl
+++ b/dom/bluetooth/nsIDOMBluetoothDevice.idl
@ -6,7 +6,7 @@

 #include "nsIDOMEventTarget.idl"

-[scriptable, builtinclass, uuid(4a679fc6-572a-4ddc-8e93-cfbddb9f2d6a)]
+[scriptable, builtinclass, uuid(4ca7697a-9d0c-492e-a6be-ccc5c3ec503c)]
 interface nsIDOMBluetoothDevice : nsIDOMEventTarget
 {
  readonly attribute DOMString address;
@ -17,7 +17,4 @@ interface nsIDOMBluetoothDevice : nsIDOMEventTarget
  [implicit_jscontext] readonly attribute jsval services;
  readonly attribute bool connected;
  readonly attribute bool paired;
-  [implicit_jscontext] attribute jsval onpropertychanged;
-  [implicit_jscontext] attribute jsval onconnected;
-  [implicit_jscontext] attribute jsval ondisconnected;
 };
--- a/dom/bluetooth/nsIDOMBluetoothDeviceAddressEvent.idl
+++ b/dom/bluetooth/nsIDOMBluetoothDeviceAddressEvent.idl
@ -1,21 +0,0 @@
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this file,
- * You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "nsIDOMEvent.idl"
-
-[scriptable, builtinclass, uuid(90c55b1c-2da5-4a30-bf09-0c70369a8d89)]
-interface nsIDOMBluetoothDeviceAddressEvent : nsIDOMEvent
-{
-  readonly attribute DOMString  deviceAddress;
-
-  [noscript] void initBluetoothDeviceAddressEvent(in DOMString aType,
-                                                  in boolean aCanBubble,
-                                                  in boolean aCancelable,
-                                                  in DOMString aDeviceAddress);
-};
-
-dictionary BluetoothDeviceAddressEventInit : EventInit
-{
-  DOMString  deviceAddress;
-};
--- a/dom/identity/nsDOMIdentity.js
+++ b/dom/identity/nsDOMIdentity.js
@ -105,7 +105,7 @@ nsDOMIdentity.prototype = {
      }

      // TODO: Bug 767610 - check email format.
-      // See nsHTMLInputElement::IsValidEmailAddress
+      // See HTMLInputElement::IsValidEmailAddress
      if (aOptions["loggedInUser"].indexOf("@") == -1
          || aOptions["loggedInUser"].length > MAX_STRING_LENGTH) {
        throw new Error("loggedInUser is not valid");
--- a/dom/interfaces/core/nsIDOMNSEditableElement.idl
+++ b/dom/interfaces/core/nsIDOMNSEditableElement.idl
@ -11,8 +11,9 @@ interface nsIEditor;
 * This interface is implemented by elements which have inner editable content,
 * such as HTML input and textarea.
 *
- * Please make sure to update the HTMLTextAreaElement Web IDL interface to
- * mirror this interface when changing it.
+ * Please make sure to update the HTMLTextAreaElement and HTMLInputElement
+ * Web IDL interfaces to mirror this interface when changing it.
+ *
 */

 [scriptable, uuid(b33eb56c-3120-418c-892b-774b00c7dde8)]
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@ -410,10 +410,7 @@ PrivilegesForApp(mozIApplication* aApp)
    const SpecialPermission specialPermissions[] = {
        // FIXME/bug 785592: implement a CameraBridge so we don't have
        // to hack around with OS permissions
-        { "camera", base::PRIVILEGES_CAMERA },
-        // FIXME/bug 793034: change our video architecture so that we
-        // can stream video from remote processes
-        { "deprecated-hwvideo", base::PRIVILEGES_VIDEO }
+        { "camera", base::PRIVILEGES_CAMERA }
    };
    for (size_t i = 0; i < ArrayLength(specialPermissions); ++i) {
        const char* const permission = specialPermissions[i].perm;
--- a/dom/locales/en-US/chrome/security/csp.properties
+++ b/dom/locales/en-US/chrome/security/csp.properties
@ -45,8 +45,10 @@ failedToParseUnrecognizedSource = Failed to parse unrecognized source %1$S
 # LOCALIZATION NOTE (reportPostRedirect):
 # %1$S is the specified report URI before redirect
 reportPostRedirect = Post of violation report to %1$S failed, as a redirect occurred
-# LOCALIZATION NOTE (allowDirectiveDeprecated):
-allowDirectiveDeprecated = allow directive is deprecated, use the equivalent default-source directive instead
+# LOCALIZATION NOTE (allowDirectiveIsDeprecated):
+# Don't translate "allow" and "default-src" as they are keywords and part of
+# the CSP protocol syntax.
+allowDirectiveIsDeprecated = allow directive is deprecated, use the equivalent default-src directive instead

 # CSP Errors:
 policyURINotAlone = policy-uri directive can only appear alone
--- a/dom/plugins/ipc/PluginScriptableObjectChild.cpp
+++ b/dom/plugins/ipc/PluginScriptableObjectChild.cpp
@ -948,11 +948,7 @@ PluginScriptableObjectChild::AnswerEnumerate(InfallibleTArray<PPluginIdentifierC
    return true;
  }

-  if (!aProperties->SetCapacity(idCount)) {
-    PluginModuleChild::sBrowserFuncs.memfree(ids);
-    *aSuccess = false;
-    return true;
-  }
+  aProperties->SetCapacity(idCount);

  for (uint32_t index = 0; index < idCount; index++) {
    PluginIdentifierChild* id = static_cast<PluginIdentifierChild*>(ids[index]);
--- a/dom/plugins/ipc/PluginScriptableObjectParent.cpp
+++ b/dom/plugins/ipc/PluginScriptableObjectParent.cpp
@ -1038,11 +1038,7 @@ PluginScriptableObjectParent::AnswerEnumerate(InfallibleTArray<PPluginIdentifier
    return true;
  }

-  if (!aProperties->SetCapacity(idCount)) {
-    npn->memfree(ids);
-    *aSuccess = false;
-    return true;
-  }
+  aProperties->SetCapacity(idCount);

  JSContext* cx = GetJSContext(instance->GetNPP());
  JSAutoRequest ar(cx);
--- a/dom/telephony/test/marionette/manifest.ini
+++ b/dom/telephony/test/marionette/manifest.ini
@ -12,9 +12,7 @@ qemu = true
 [test_outgoing_hangup_alerting.js]
 [test_outgoing_hangup_held.js]
 [test_outgoing_badNumber.js]
-disabled = Bug 761533
 [test_outgoing_busy.js]
-disabled = Bug 761533
 [test_outgoing_reject.js]
 [test_incoming_hold_resume.js]
 [test_outgoing_hold_resume.js]
--- a/dom/telephony/test/marionette/test_outgoing_badNumber.js
+++ b/dom/telephony/test/marionette/test_outgoing_badNumber.js
@ -6,7 +6,7 @@ MARIONETTE_TIMEOUT = 10000;
 SpecialPowers.addPermission("telephony", true, document);

 let telephony = window.navigator.mozTelephony;
-let number = "not a valid phone number";
+let number = "****5555552368****";
 let outgoing;
 let calls;

@ -38,16 +38,16 @@ function dial() {
  is(outgoing.number, number);
  is(outgoing.state, "dialing");

-  //is(outgoing, telephony.active); // bug 757587
-  //ok(telephony.calls === calls); // bug 757587
-  //is(calls.length, 1); // bug 757587
-  //is(calls[0], outgoing); // bug 757587
+  is(outgoing, telephony.active);
+  //ok(telephony.calls === calls); // bug 717414
+  is(telephony.calls.length, 1);
+  is(telephony.calls[0], outgoing);

  outgoing.onerror = function onerror(event) {
    log("Received 'error' event.");
    is(event.call, outgoing);
-    ok(call.error);
-    is(call.error.name, "BadNumberError");
+    ok(event.call.error);
+    is(event.call.error.name, "BadNumberError");

    runEmulatorCmd("gsm list", function(result) {
      log("Initial call list: " + result);
--- a/dom/telephony/test/marionette/test_outgoing_busy.js
+++ b/dom/telephony/test/marionette/test_outgoing_busy.js
@ -38,21 +38,23 @@ function dial() {
  is(outgoing.number, number);
  is(outgoing.state, "dialing");

-  //is(outgoing, telephony.active); // bug 757587
-  //ok(telephony.calls === calls); // bug 757587
-  //is(calls.length, 1); // bug 757587
-  //is(calls[0], outgoing); // bug 757587
+  is(outgoing, telephony.active);
+  //ok(telephony.calls === calls); // bug 717414
+  is(telephony.calls.length, 1);
+  is(telephony.calls[0], outgoing);

-outgoing.onstatechange = function onstatechange(event) {
-  log("outgoing call state: " + outgoing.state);
-};
+  outgoing.onalerting = function onalerting(event) {
+    log("Received 'onalerting' call event.");
+    is(outgoing, event.call);
+    is(outgoing.state, "alerting");

-  runEmulatorCmd("gsm list", function(result) {
-    log("Call list is now: " + result);
-    is(result[0], "outbound to  " + number + " : unknown");
-    is(result[1], "OK");
-    busy();
-  });
+    runEmulatorCmd("gsm list", function(result) {
+      log("Call list is now: " + result);
+      is(result[0], "outbound to  " + number + " : ringing");
+      is(result[1], "OK");
+      busy();
+    });
+  };
 }

 function busy() {
@ -63,8 +65,6 @@ function busy() {
    is(outgoing, event.call);
    is(outgoing.state, "busy");

-    //is(outgoing, telephony.active);  // bug 757587
-
    runEmulatorCmd("gsm list", function(result) {
      log("Call list is now: " + result);
      is(result[0], "OK");
--- a/dom/webidl/HTMLInputElement.webidl
+++ b/dom/webidl/HTMLInputElement.webidl
@ -0,0 +1,175 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * The origin of this IDL file is
+ * http://www.whatwg.org/specs/web-apps/current-work/#the-input-element
+ * http://www.whatwg.org/specs/web-apps/current-work/#other-elements,-attributes-and-apis
+ *
+ * © Copyright 2004-2011 Apple Computer, Inc., Mozilla Foundation, and
+ * Opera Software ASA. You are granted a license to use, reproduce
+ * and create derivative works of this document.
+ */
+
+interface nsIControllers;
+
+interface HTMLInputElement : HTMLElement {
+           [Pure, SetterThrows]
+           attribute DOMString accept;
+           [Pure, SetterThrows]
+           attribute DOMString alt;
+           [Pure, SetterThrows]
+           attribute DOMString autocomplete;
+           [Pure, SetterThrows]
+           attribute boolean autofocus;
+           [Pure, SetterThrows]
+           attribute boolean defaultChecked;
+           [Pure]
+           attribute boolean checked;
+           // Bug 850337 - attribute DOMString dirName;
+           [Pure, SetterThrows]
+           attribute boolean disabled;
+  readonly attribute HTMLFormElement? form;
+           [Pure]
+  readonly attribute FileList? files;
+           [Pure, SetterThrows]
+           attribute DOMString formAction;
+           [Pure, SetterThrows]
+           attribute DOMString formEnctype;
+           [Pure, SetterThrows]
+           attribute DOMString formMethod;
+           [Pure, SetterThrows]
+           attribute boolean formNoValidate;
+           [Pure, SetterThrows]
+           attribute DOMString formTarget;
+           [Pure, SetterThrows]
+           attribute unsigned long height;
+           [Pure]
+           attribute boolean indeterminate;
+           [Pure, SetterThrows]
+           attribute DOMString inputMode;
+           [Pure]
+  readonly attribute HTMLElement? list;
+           [Pure, SetterThrows]
+           attribute DOMString max;
+           [Pure, SetterThrows]
+           attribute long maxLength;
+           [Pure, SetterThrows]
+           attribute DOMString min;
+           [Pure, SetterThrows]
+           attribute boolean multiple;
+           [Pure, SetterThrows]
+           attribute DOMString name;
+           [Pure, SetterThrows]
+           attribute DOMString pattern;
+           [Pure, SetterThrows]
+           attribute DOMString placeholder;
+           [Pure, SetterThrows]
+           attribute boolean readOnly;
+           [Pure, SetterThrows]
+           attribute boolean required;
+           [Pure, SetterThrows]
+           attribute unsigned long size;
+           [Pure, SetterThrows]
+           attribute DOMString src;
+           [Pure, SetterThrows]
+           attribute DOMString step;
+           [Pure, SetterThrows]
+           attribute DOMString type;
+           [Pure, SetterThrows]
+           attribute DOMString defaultValue;
+           [Pure, TreatNullAs=EmptyString, SetterThrows]
+           attribute DOMString value;
+           // Bug 742206 - any to Date?
+           [Throws]
+           attribute any valueAsDate;
+           [Pure, SetterThrows]
+           attribute unrestricted double valueAsNumber;
+           attribute unsigned long width;
+
+           [Throws]
+           void stepUp(optional long n);
+           [Throws]
+           void stepDown(optional long n);
+
+           [Pure]
+  readonly attribute boolean willValidate;
+           [Pure]
+  readonly attribute ValidityState validity;
+           [GetterThrows]
+  readonly attribute DOMString validationMessage;
+           boolean checkValidity();
+           void setCustomValidity(DOMString error);
+
+  // Bug 850365 readonly attribute NodeList labels;
+
+           void select();
+
+           [Throws]
+           // TODO: unsigned vs signed
+           attribute long selectionStart;
+           [Throws]
+           attribute long selectionEnd;
+           [Throws]
+           attribute DOMString selectionDirection;
+  // Bug 850364 void setRangeText(DOMString replacement);
+  // Bug 850364 setRangeText(DOMString replacement, unsigned long start, unsigned long end, optional SelectionMode selectionMode);
+
+  // also has obsolete members
+};
+
+partial interface HTMLInputElement {
+           [Pure, SetterThrows]
+           attribute DOMString align;
+           [Pure, SetterThrows]
+           attribute DOMString useMap;
+};
+
+// Mozilla extensions
+
+partial interface HTMLInputElement {
+           [Throws]
+           void setSelectionRange(long start, long end, optional DOMString direction);
+
+           [GetterThrows]
+  readonly attribute nsIControllers        controllers;
+           [GetterThrows]
+  readonly attribute long                  textLength;
+
+           [ChromeOnly]
+           sequence<DOMString> mozGetFileNameArray();
+
+           [ChromeOnly]
+           void mozSetFileNameArray(sequence<DOMString> fileNames);
+
+           /**
+            * This non-standard method prevents to check types manually to know if the
+            * element is a text field.
+            */
+           boolean mozIsTextField(boolean aExcludePassword);
+};
+
+partial interface HTMLInputElement {
+           // Mirrored chrome-only nsIDOMNSEditableElement methods.  Please make sure
+           // to update this list if nsIDOMNSEditableElement changes.
+
+           [Pure, ChromeOnly]
+  readonly attribute nsIEditor? editor;
+
+           // This is similar to set .value on nsIDOMInput/TextAreaElements, but
+           // handling of the value change is closer to the normal user input, so
+           // 'change' event for example will be dispatched when focusing out the
+           // element.
+           [ChromeOnly]
+           void setUserInput(DOMString input);
+};
+
+[NoInterfaceObject]
+interface MozPhonetic {
+           [Pure, ChromeOnly]
+  readonly attribute DOMString phonetic;
+};
+
+HTMLInputElement implements MozImageLoadingContent;
+HTMLInputElement implements MozPhonetic;
--- a/dom/webidl/WebIDL.mk
+++ b/dom/webidl/WebIDL.mk
@ -95,6 +95,7 @@ webidl_files = \
  HTMLHtmlElement.webidl \
  HTMLIFrameElement.webidl \
  HTMLImageElement.webidl \
+  HTMLInputElement.webidl \
  HTMLLabelElement.webidl \
  HTMLLegendElement.webidl \
  HTMLLIElement.webidl \
--- a/editor/libeditor/base/tests/test_bug502673.html
+++ b/editor/libeditor/base/tests/test_bug502673.html
@ -33,11 +33,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=502673
      listener.prototype =
      {
        NotifyDocumentWillBeDestroyed: function () {
-          netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
-         
-          if (this.input instanceof
-                Components.interfaces.nsIDOMNSEditableElement) {
-            var editor = this.input.editor;
+          if (this.input instanceof SpecialPowers.Ci.nsIDOMNSEditableElement) {
+            var editor = SpecialPowers.wrap(this.input).editor;
            editor.removeDocumentStateListener(this);
          }
        },
@ -46,30 +43,25 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=502673
        },

        NotifyDocumentStateChanged: function (aNowDirty) {
-          netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
-
-          if (this.input instanceof
-                Components.interfaces.nsIDOMNSEditableElement) {
-            var editor = this.input.editor;
+          if (this.input instanceof SpecialPowers.Ci.nsIDOMNSEditableElement) {
+            var editor = SpecialPowers.wrap(this.input).editor;
            editor.removeDocumentStateListener(this);
          }
        },

        QueryInterface: function(iid) {
-          netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
-          if (iid.equals(Components.interfaces.nsIDocumentStateListener) ||
-              iid.equals(Components.interfaces.nsISupports))
+          if (iid.equals(SpecialPowers.Ci.nsIDocumentStateListener) ||
+              iid.equals(SpecialPowers.Ci.nsISupports))
            return this;
-          throw Components.results.NS_ERROR_NO_INTERFACE;
+          throw SpecialPowers.Cr.NS_ERROR_NO_INTERFACE;
        },
      };

      function doTest() {
-        netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
        var input = document.getElementById("ip");
-        if (input instanceof Components.interfaces.nsIDOMNSEditableElement) {
+        if (input instanceof SpecialPowers.Ci.nsIDOMNSEditableElement) {
          // Add multiple listeners to the same editor
-          var editor = input.editor;
+          var editor = SpecialPowers.wrap(input).editor;
          var listener1 = new listener();
          listener1.input = input;
          var listener2 = new listener();
--- a/editor/libeditor/text/tests/test_bug471722.html
+++ b/editor/libeditor/text/tests/test_bug471722.html
@ -31,9 +31,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=471722
        var t1 = $("t1");
        var editor = null;

-        netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect"); 
-        if (t1 instanceof Components.interfaces.nsIDOMNSEditableElement)
-          editor = t1.editor;
+        if (t1 instanceof SpecialPowers.Ci.nsIDOMNSEditableElement)
+          editor = SpecialPowers.wrap(t1).editor;
        ok(editor, "able to get editor for the element");
        t1.focus();
        t1.select();
--- a/editor/libeditor/text/tests/test_bug602130.html
+++ b/editor/libeditor/text/tests/test_bug602130.html
@ -21,13 +21,12 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=602130

 SimpleTest.waitForExplicitFinish();
 addLoadEvent(function() {
-  netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
  var i = document.createElement("input");
  document.body.appendChild(i);
-  i.QueryInterface(Components.interfaces.nsIDOMNSEditableElement);
+  SpecialPowers.wrap(i).QueryInterface(SpecialPowers.Ci.nsIDOMNSEditableElement);
  i.select();
  i.focus();
-  is(i.editor.transactionManager.numberOfUndoItems, 0,
+  is(SpecialPowers.wrap(i).editor.transactionManager.numberOfUndoItems, 0,
     "The number of undo items should be 0 after initing the editor");
  i.style.display = "none";
  document.offsetWidth;
@ -35,7 +34,7 @@ addLoadEvent(function() {
  document.offsetWidth;
  i.select();
  i.focus();
-  is(i.editor.transactionManager.numberOfUndoItems, 0,
+  is(SpecialPowers.wrap(i).editor.transactionManager.numberOfUndoItems, 0,
     "The number of undo items should be 0 after re-initing the editor");
  SimpleTest.finish();
 });
--- a/gfx/layers/ipc/ImageBridgeChild.cpp
+++ b/gfx/layers/ipc/ImageBridgeChild.cpp
@ -370,7 +370,7 @@ ImageBridgeChild::AllocSurfaceDescriptorGrallocNow(const gfxIntSize& aSize,
  GrallocBufferActor* gba = static_cast<GrallocBufferActor*>(gc);
  gba->InitFromHandle(handle.get_MagicGrallocBufferHandle());

-  *aBuffer = SurfaceDescriptorGralloc(nullptr, gc, /* external */ false);
+  *aBuffer = SurfaceDescriptorGralloc(nullptr, gc, aSize, /* external */ false);
  return true;
 #else
  NS_RUNTIMEABORT("No gralloc buffers for you");
--- a/gfx/layers/ipc/LayersSurfaces.ipdlh
+++ b/gfx/layers/ipc/LayersSurfaces.ipdlh
@ -46,6 +46,12 @@ struct SharedTextureDescriptor {

 struct SurfaceDescriptorGralloc {
  PGrallocBuffer buffer;
+  /**
+   * android::GraphicBuffer has a size information. But there are cases
+   * that GraphicBuffer's size and actual video's size are different.
+   * Extra size member is necessary. See Bug 850566.
+   */
+  nsIntSize size;

  /**
   * We can have one source producing gralloc buffers and sharing them
--- a/gfx/layers/ipc/ShadowLayerUtilsGralloc.cpp
+++ b/gfx/layers/ipc/ShadowLayerUtilsGralloc.cpp
@ -315,7 +315,7 @@ ShadowLayerForwarder::PlatformAllocBuffer(const gfxIntSize& aSize,
  GrallocBufferActor* gba = static_cast<GrallocBufferActor*>(gc);
  gba->InitFromHandle(handle.get_MagicGrallocBufferHandle());

-  *aBuffer = SurfaceDescriptorGralloc(nullptr, gc, /* external */ false);
+  *aBuffer = SurfaceDescriptorGralloc(nullptr, gc, aSize, /* external */ false);
  return true;
 }

@ -355,7 +355,7 @@ ShadowLayerForwarder::PlatformOpenDescriptor(OpenMode aMode,
  // If we fail to lock, we'll just end up aborting anyway.
  MOZ_ASSERT(status == OK);

-  gfxIntSize size = gfxIntSize(buffer->getWidth(), buffer->getHeight());
+  gfxIntSize size = aSurface.get_SurfaceDescriptorGralloc().size();
  gfxImageFormat format = ImageFormatForPixelFormat(buffer->getPixelFormat());
  long pixelStride = buffer->getStride();
  long byteStride = pixelStride * gfxASurface::BytePerPixelFromFormat(format);
@ -393,7 +393,7 @@ ShadowLayerForwarder::PlatformGetDescriptorSurfaceSize(

  sp<GraphicBuffer> buffer =
    GrallocBufferActor::GetFrom(aDescriptor.get_SurfaceDescriptorGralloc());
-  *aSize = gfxIntSize(buffer->getWidth(), buffer->getHeight());
+  *aSize = aDescriptor.get_SurfaceDescriptorGralloc().size();
  return true;
 }

--- a/gfx/layers/opengl/ImageLayerOGL.cpp
+++ b/gfx/layers/opengl/ImageLayerOGL.cpp
@ -996,6 +996,7 @@ ShadowImageLayerOGL::RenderLayer(int aPreviousFrameBuffer,
      const SurfaceDescriptorGralloc& desc = img->get_SurfaceDescriptor().get_SurfaceDescriptorGralloc();
      sp<GraphicBuffer> graphicBuffer = GrallocBufferActor::GetFrom(desc);
      mSize = gfxIntSize(graphicBuffer->getWidth(), graphicBuffer->getHeight());
+      mPictureRect = nsIntRect(0, 0, desc.size().width, desc.size().height);
      if (!mExternalBufferTexture.IsAllocated()) {
        mExternalBufferTexture.Allocate(gl());
      }
@ -1061,14 +1062,17 @@ ShadowImageLayerOGL::RenderLayer(int aPreviousFrameBuffer,

    program->Activate();
    program->SetLayerQuadRect(nsIntRect(0, 0,
-                                        mSize.width, mSize.height));
+                                           mPictureRect.width,
+                                           mPictureRect.height));
    program->SetLayerTransform(GetEffectiveTransform());
    program->SetLayerOpacity(GetEffectiveOpacity());
    program->SetRenderOffset(aOffset);
    program->SetTextureUnit(0);
    program->LoadMask(GetMaskLayer());

-    mOGLManager->BindAndDrawQuad(program);
+    mOGLManager->BindAndDrawQuadWithTextureRect(program,
+                                                mPictureRect,
+                                                nsIntSize(mSize.width, mSize.height));

    // Make sure that we release the underlying external image
    gl()->fActiveTexture(LOCAL_GL_TEXTURE0);
--- a/ipc/chromium/src/base/process_util.h
+++ b/ipc/chromium/src/base/process_util.h
@ -130,7 +130,6 @@ enum ChildPrivileges {
  PRIVILEGES_DEFAULT,
  PRIVILEGES_UNPRIVILEGED,
  PRIVILEGES_CAMERA,
-  PRIVILEGES_VIDEO,
  PRIVILEGES_INHERIT,
  PRIVILEGES_LAST
 };
--- a/ipc/chromium/src/base/process_util_linux.cc
+++ b/ipc/chromium/src/base/process_util_linux.cc
@ -303,14 +303,7 @@ void SetCurrentProcessPrivileges(ChildPrivileges privs) {
    uid += getpid();
  }
  if (privs == PRIVILEGES_CAMERA) {
-    gid_t groups[] = { AID_AUDIO, AID_CAMERA, AID_SDCARD_RW };
-    if (setgroups(sizeof(groups) / sizeof(groups[0]), groups) != 0) {
-      DLOG(ERROR) << "FAILED TO setgroups() CHILD PROCESS";
-      _exit(127);
-    }
-  }
-  else if (privs == PRIVILEGES_VIDEO) {
-    gid_t groups[] = { AID_AUDIO, AID_MEDIA };
+    gid_t groups[] = { AID_SDCARD_RW };
    if (setgroups(sizeof(groups) / sizeof(groups[0]), groups) != 0) {
      DLOG(ERROR) << "FAILED TO setgroups() CHILD PROCESS";
      _exit(127);
--- a/js/src/builtin/Object.cpp
+++ b/js/src/builtin/Object.cpp
@ -791,6 +791,20 @@ obj_keys(JSContext *cx, unsigned argc, Value *vp)
    return true;
 }

+/* ES6 draft 15.2.3.16 */
+static JSBool
+obj_is(JSContext *cx, unsigned argc, Value *vp)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+
+    bool same;
+    if (!SameValue(cx, args.get(0), args.get(1), &same))
+        return false;
+
+    args.rval().setBoolean(same);
+    return true;
+}
+
 static JSBool
 obj_getOwnPropertyNames(JSContext *cx, unsigned argc, Value *vp)
 {
@ -900,7 +914,7 @@ obj_preventExtensions(JSContext *cx, unsigned argc, Value *vp)
    if (!obj->isExtensible())
        return true;

-    return obj->preventExtensions(cx);
+    return JSObject::preventExtensions(cx, obj);
 }

 static JSBool
@ -982,6 +996,7 @@ JSFunctionSpec js::object_static_methods[] = {
    JS_FN("getPrototypeOf",            obj_getPrototypeOf,          1,0),
    JS_FN("getOwnPropertyDescriptor",  obj_getOwnPropertyDescriptor,2,0),
    JS_FN("keys",                      obj_keys,                    1,0),
+    JS_FN("is",                        obj_is,                      2,0),
    JS_FN("defineProperty",            obj_defineProperty,          3,0),
    JS_FN("defineProperties",          obj_defineProperties,        2,0),
    JS_FN("create",                    obj_create,                  2,0),
--- a/js/src/builtin/ParallelArray.js
+++ b/js/src/builtin/ParallelArray.js
@ -953,7 +953,7 @@ function ParallelArrayScatter(targets, defaultValue, conflictFunc, length, mode)
      if ((t | 0) !== t)
        ThrowError(JSMSG_PAR_ARRAY_SCATTER_BAD_TARGET, i);

-      if (t >= length)
+      if (t < 0 || t >= length)
        ThrowError(JSMSG_PAR_ARRAY_SCATTER_BOUNDS);
  }
 }
--- a/js/src/ion/IonCaches.cpp
+++ b/js/src/ion/IonCaches.cpp
@ -488,10 +488,66 @@ EmitLoadSlot(MacroAssembler &masm, JSObject *holder, Shape *shape, Register hold
    }
 }

+static void
+GenerateListBaseChecks(JSContext *cx, MacroAssembler &masm, JSObject *obj,
+                       PropertyName *name, Register object, Label *stubFailure)
+{
+    MOZ_ASSERT(IsCacheableListBase(obj));
+
+    // Guard the following:
+    //      1. The object is a ListBase.
+    //      2. The object does not have expando properties, or has an expando
+    //          which is known to not have the desired property.
+    Address handlerAddr(object, JSObject::getFixedSlotOffset(JSSLOT_PROXY_HANDLER));
+    Address expandoAddr(object, JSObject::getFixedSlotOffset(GetListBaseExpandoSlot()));
+
+    // Check that object is a ListBase.
+    masm.branchPrivatePtr(Assembler::NotEqual, handlerAddr, ImmWord(GetProxyHandler(obj)), stubFailure);
+
+    // For the remaining code, we need to reserve some registers to load a value.
+    // This is ugly, but unvaoidable.
+    RegisterSet listBaseRegSet(RegisterSet::All());
+    listBaseRegSet.take(AnyRegister(object));
+    ValueOperand tempVal = listBaseRegSet.takeValueOperand();
+    masm.pushValue(tempVal);
+
+    Label failListBaseCheck;
+    Label listBaseOk;
+
+    masm.loadValue(expandoAddr, tempVal);
+
+    // If the incoming object does not have an expando object then we're sure we're not
+    // shadowing.
+    masm.branchTestUndefined(Assembler::Equal, tempVal, &listBaseOk);
+
+    Value expandoVal = obj->getFixedSlot(GetListBaseExpandoSlot());
+    if (expandoVal.isObject()) {
+        JS_ASSERT(!expandoVal.toObject().nativeContains(cx, name));
+
+        // Reference object has an expando object that doesn't define the name. Check that
+        // the incoming object has an expando object with the same shape.
+        masm.branchTestObject(Assembler::NotEqual, tempVal, &failListBaseCheck);
+        masm.extractObject(tempVal, tempVal.scratchReg());
+        masm.branchPtr(Assembler::Equal,
+                       Address(tempVal.scratchReg(), JSObject::offsetOfShape()),
+                       ImmGCPtr(expandoVal.toObject().lastProperty()),
+                       &listBaseOk);
+    }
+
+    // Failure case: restore the tempVal registers and jump to failures.
+    masm.bind(&failListBaseCheck);
+    masm.popValue(tempVal);
+    masm.jump(stubFailure);
+
+    // Success case: restore the tempval and proceed.
+    masm.bind(&listBaseOk);
+    masm.popValue(tempVal);
+}
+
 static void
 GenerateReadSlot(JSContext *cx, MacroAssembler &masm, IonCache::StubAttacher &attacher,
-                 JSObject *obj, JSObject *holder, Shape *shape, Register object,
-                 TypedOrValueRegister output, Label *failures = NULL)
+                 JSObject *obj, PropertyName *name, JSObject *holder, Shape *shape,
+                 Register object, TypedOrValueRegister output, Label *failures = NULL)
 {
    // If there's a single jump to |failures|, we can patch the shape guard
    // jump directly. Otherwise, jump to the end of the stub, so there's a
@ -510,6 +566,13 @@ GenerateReadSlot(JSContext *cx, MacroAssembler &masm, IonCache::StubAttacher &at
                                   ImmGCPtr(obj->lastProperty()),
                                   failures);

+    bool isCacheableListBase = IsCacheableListBase(obj);
+    Label listBaseFailures;
+    if (isCacheableListBase) {
+        JS_ASSERT(multipleFailureJumps);
+        GenerateListBaseChecks(cx, masm, obj, name, object, &listBaseFailures);
+    }
+
    // If we need a scratch register, use either an output register or the
    // object register. After this point, we cannot jump directly to
    // |failures| since we may still have to pop the object register.
@ -598,6 +661,8 @@ GenerateReadSlot(JSContext *cx, MacroAssembler &masm, IonCache::StubAttacher &at
        masm.bind(&prototypeFailures);
        if (restoreScratch)
            masm.pop(scratchReg);
+        if (isCacheableListBase)
+            masm.bind(&listBaseFailures);
        masm.bind(failures);
    }

@ -618,57 +683,8 @@ GenerateCallGetter(JSContext *cx, MacroAssembler &masm, IonCache::StubAttacher &
    masm.branchPtr(Assembler::NotEqual, Address(object, JSObject::offsetOfShape()),
                   ImmGCPtr(obj->lastProperty()), &stubFailure);

-    // If this is a stub for a ListBase object, guard the following:
-    //      1. The object is a ListBase.
-    //      2. The object does not have expando properties, or has an expando
-    //          which is known to not have the desired property.
-    if (IsCacheableListBase(obj)) {
-        Address handlerAddr(object, JSObject::getFixedSlotOffset(JSSLOT_PROXY_HANDLER));
-        Address expandoAddr(object, JSObject::getFixedSlotOffset(GetListBaseExpandoSlot()));
-
-        // Check that object is a ListBase.
-        masm.branchPrivatePtr(Assembler::NotEqual, handlerAddr, ImmWord(GetProxyHandler(obj)), &stubFailure);
-
-        // For the remaining code, we need to reserve some registers to load a value.
-        // This is ugly, but unvaoidable.
-        RegisterSet listBaseRegSet(RegisterSet::All());
-        listBaseRegSet.take(AnyRegister(object));
-        ValueOperand tempVal = listBaseRegSet.takeValueOperand();
-        masm.pushValue(tempVal);
-
-        Label failListBaseCheck;
-        Label listBaseOk;
-
-        Value expandoVal = obj->getFixedSlot(GetListBaseExpandoSlot());
-        JSObject *expando = expandoVal.isObject() ? &(expandoVal.toObject()) : NULL;
-        JS_ASSERT_IF(expando, expando->isNative() && expando->getProto() == NULL);
-
-        masm.loadValue(expandoAddr, tempVal);
-
-        // If the incoming object does not have an expando object then we're sure we're not
-        // shadowing.
-        masm.branchTestUndefined(Assembler::Equal, tempVal, &listBaseOk);
-
-        if (expando && !expando->nativeContains(cx, name)) {
-            // Reference object has an expando object that doesn't define the name. Check that
-            // the incoming object has an expando object with the same shape.
-            masm.branchTestObject(Assembler::NotEqual, tempVal, &failListBaseCheck);
-            masm.extractObject(tempVal, tempVal.scratchReg());
-            masm.branchPtr(Assembler::Equal,
-                           Address(tempVal.scratchReg(), JSObject::offsetOfShape()),
-                           ImmGCPtr(expando->lastProperty()),
-                           &listBaseOk);
-        }
-
-        // Failure case: restore the tempVal registers and jump to failures.
-        masm.bind(&failListBaseCheck);
-        masm.popValue(tempVal);
-        masm.jump(&stubFailure);
-
-        // Success case: restore the tempval and proceed.
-        masm.bind(&listBaseOk);
-        masm.popValue(tempVal);
-    }
+    if (IsCacheableListBase(obj))
+        GenerateListBaseChecks(cx, masm, obj, name, object, &stubFailure);

    JS_ASSERT(output.hasValue());
    Register scratchReg = output.valueReg().scratchReg();
@ -844,7 +860,7 @@ GetPropertyIC::attachReadSlot(JSContext *cx, IonScript *ion, JSObject *obj, JSOb
    MacroAssembler masm(cx);

    RepatchStubAppender attacher(rejoinLabel(), fallbackLabel_, &lastJump_);
-    GenerateReadSlot(cx, masm, attacher, obj, holder, shape, object(), output());
+    GenerateReadSlot(cx, masm, attacher, obj, name(), holder, shape, object(), output());

    const char *attachKind = "non idempotent reading";
    if (idempotent())
@ -976,9 +992,19 @@ TryAttachNativeGetPropStub(JSContext *cx, IonScript *ion,
    JS_ASSERT(!*isCacheable);

    RootedObject checkObj(cx, obj);
-    bool isListBase = IsCacheableListBase(obj);
-    if (isListBase)
+    if (IsCacheableListBase(obj)) {
+        Value expandoVal = obj->getFixedSlot(GetListBaseExpandoSlot());
+
+        // Expando objects just hold any extra properties the object has been given by a script,
+        // and have no prototype or anything else that will complicate property lookups on them.
+        JS_ASSERT_IF(expandoVal.isObject(),
+                     expandoVal.toObject().isNative() && !expandoVal.toObject().getProto());
+
+        if (expandoVal.isObject() && expandoVal.toObject().nativeContains(cx, name))
+            return true;
+
        checkObj = obj->getTaggedProto().toObjectOrNull();
+    }

    if (!checkObj || !checkObj->isNative())
        return true;
@ -1003,13 +1029,13 @@ TryAttachNativeGetPropStub(JSContext *cx, IonScript *ion,
    jsbytecode *pc;
    cache.getScriptedLocation(&script, &pc);

-    if (IsCacheableGetPropReadSlot(obj, holder, shape) ||
-        IsCacheableNoProperty(obj, holder, shape, pc, cache.output()))
+    if (IsCacheableGetPropReadSlot(checkObj, holder, shape) ||
+        IsCacheableNoProperty(checkObj, holder, shape, pc, cache.output()))
    {
        // With Proxies, we cannot garantee any property access as the proxy can
        // mask any property from the prototype chain.
-        if (!obj->isProxy())
-            readSlot = true;
+        JS_ASSERT(!checkObj->isProxy());
+        readSlot = true;
    } else if (IsCacheableGetPropCallNative(checkObj, holder, shape) ||
               IsCacheableGetPropCallPropertyOp(checkObj, holder, shape))
    {
@ -1638,7 +1664,7 @@ GetElementIC::attachGetProp(JSContext *cx, IonScript *ion, HandleObject obj,
    masm.branchTestValue(Assembler::NotEqual, val, idval, &failures);

    RepatchStubAppender attacher(rejoinLabel(), fallbackLabel_, &lastJump_);
-    GenerateReadSlot(cx, masm, attacher, obj, holder, shape, object(), output(),
+    GenerateReadSlot(cx, masm, attacher, obj, name, holder, shape, object(), output(),
                     &failures);

    return linkAndAttachStub(cx, masm, attacher, ion, "property");
@ -1711,7 +1737,6 @@ GetElementIC::attachTypedArrayElement(JSContext *cx, IonScript *ion, JSObject *o
                                      const Value &idval)
 {
    JS_ASSERT(obj->isTypedArray());
-    JS_ASSERT(idval.isInt32());

    Label failures;
    MacroAssembler masm(cx);
@ -1733,19 +1758,55 @@ GetElementIC::attachTypedArrayElement(JSContext *cx, IonScript *ion, JSObject *o
    // because load size differ in function of the typed array data width.
    masm.branchTestObjClass(Assembler::NotEqual, object(), tmpReg, obj->getClass(), &failures);

-    // Ensure the index is an int32 value.
+    // Decide to what type index the stub should be optimized
    Register indexReg = tmpReg;
-
    JS_ASSERT(!index().constant());
-    if (index().reg().hasValue()) {
-        ValueOperand val = index().reg().valueReg();
-        masm.branchTestInt32(Assembler::NotEqual, val, &failures);
+    if (idval.isString()) {
+        JS_ASSERT(GetIndexFromString(idval.toString()) != UINT32_MAX);
+
+        // Part 1: Get the string into a register
+        Register str;
+        if (index().reg().hasValue()) {
+            ValueOperand val = index().reg().valueReg();
+            masm.branchTestString(Assembler::NotEqual, val, &failures);
+
+            str = masm.extractString(val, indexReg);
+        } else {
+            JS_ASSERT(!index().reg().typedReg().isFloat());
+            str = index().reg().typedReg().gpr();
+        }
+
+        // Part 2: Call to translate the str into index
+        RegisterSet regs = RegisterSet::Volatile();
+        masm.PushRegsInMask(regs);
+        regs.maybeTake(str);
+
+        Register temp = regs.takeGeneral();
+
+        masm.setupUnalignedABICall(1, temp);
+        masm.passABIArg(str);
+        masm.callWithABI(JS_FUNC_TO_DATA_PTR(void *, GetIndexFromString));
+        masm.mov(ReturnReg, indexReg);
+
+        RegisterSet ignore = RegisterSet();
+        ignore.add(indexReg);
+        masm.PopRegsInMaskIgnore(RegisterSet::Volatile(), ignore);
+
+        masm.branch32(Assembler::Equal, indexReg, Imm32(UINT32_MAX), &failures);

-        // Unbox the index.
-        masm.unboxInt32(val, indexReg);
    } else {
-        JS_ASSERT(!index().reg().typedReg().isFloat());
-        indexReg = index().reg().typedReg().gpr();
+        JS_ASSERT(idval.isInt32());
+
+        if (index().reg().hasValue()) {
+            ValueOperand val = index().reg().valueReg();
+            masm.branchTestInt32(Assembler::NotEqual, val, &failures);
+
+            // Unbox the index.
+            masm.unboxInt32(val, indexReg);
+        } else {
+            JS_ASSERT(!index().reg().typedReg().isFloat());
+            indexReg = index().reg().typedReg().gpr();
+        }
    }

    // Guard on the initialized length.
@ -1824,14 +1885,18 @@ GetElementIC::update(JSContext *cx, size_t cacheIndex, HandleObject obj,
            if (!cache.attachDenseElement(cx, ion, obj, idval))
                return false;
            attachedStub = true;
-        } else if (obj->isTypedArray() && idval.isInt32()) {
-            int arrayType = TypedArray::type(obj);
-            bool floatOutput = arrayType == TypedArray::TYPE_FLOAT32 ||
-                               arrayType == TypedArray::TYPE_FLOAT64;
-            if (!floatOutput || cache.output().hasValue()) {
-                if (!cache.attachTypedArrayElement(cx, ion, obj, idval))
-                    return false;
-                attachedStub = true;
+        } else if (obj->isTypedArray()) {
+            if ((idval.isInt32()) ||
+                (idval.isString() && GetIndexFromString(idval.toString()) != UINT32_MAX))
+            {
+                int arrayType = TypedArray::type(obj);
+                bool floatOutput = arrayType == TypedArray::TYPE_FLOAT32 ||
+                                   arrayType == TypedArray::TYPE_FLOAT64;
+                if (!floatOutput || cache.output().hasValue()) {
+                    if (!cache.attachTypedArrayElement(cx, ion, obj, idval))
+                        return false;
+                    attachedStub = true;
+                }
            }
        }
    }
--- a/js/src/ion/IonMacroAssembler.cpp
+++ b/js/src/ion/IonMacroAssembler.cpp
@ -131,10 +131,10 @@ MacroAssembler::PushRegsInMask(RegisterSet set)
    int32_t diffF = set.fpus().size() * sizeof(double);
    int32_t diffG = set.gprs().size() * STACK_SLOT_SIZE;

-    reserveStack(diffG);
 #ifdef JS_CPU_ARM
    if (set.gprs().size() > 1) {
-        startDataTransferM(IsStore, StackPointer, IA, NoWriteBack);
+        adjustFrame(diffG);
+        startDataTransferM(IsStore, StackPointer, DB, WriteBack);
        for (GeneralRegisterIterator iter(set.gprs()); iter.more(); iter++) {
            diffG -= STACK_SLOT_SIZE;
            transferReg(*iter);
@ -143,6 +143,7 @@ MacroAssembler::PushRegsInMask(RegisterSet set)
    } else
 #endif
    {
+        reserveStack(diffG);
        for (GeneralRegisterIterator iter(set.gprs()); iter.more(); iter++) {
            diffG -= STACK_SLOT_SIZE;
            storePtr(*iter, Address(StackPointer, diffG));
@ -191,12 +192,13 @@ MacroAssembler::PopRegsInMaskIgnore(RegisterSet set, RegisterSet ignore)

 #ifdef JS_CPU_ARM
    if (set.gprs().size() > 1 && ignore.empty(false)) {
-        startDataTransferM(IsLoad, StackPointer, IA, NoWriteBack);
+        startDataTransferM(IsLoad, StackPointer, IA, WriteBack);
        for (GeneralRegisterIterator iter(set.gprs()); iter.more(); iter++) {
            diffG -= STACK_SLOT_SIZE;
            transferReg(*iter);
        }
        finishDataTransfer();
+        adjustFrame(-reservedG);
    } else
 #endif
    {
@ -205,8 +207,8 @@ MacroAssembler::PopRegsInMaskIgnore(RegisterSet set, RegisterSet ignore)
            if (!ignore.has(*iter))
                loadPtr(Address(StackPointer, diffG), *iter);
        }
+        freeStack(reservedG);
    }
-    freeStack(reservedG);
    JS_ASSERT(diffG == 0);
 }

--- a/js/src/ion/VMFunctions.cpp
+++ b/js/src/ion/VMFunctions.cpp
@ -567,5 +567,24 @@ FilterArguments(JSContext *cx, JSString *str)
    return !StringHasPattern(chars, str->length(), arguments, mozilla::ArrayLength(arguments));
 }

+uint32_t
+GetIndexFromString(JSString *str)
+{
+    // Masks the return value UINT32_MAX as failure to get the index.
+    // I.e. it is impossible to distinguish between failing to get the index
+    // or the actual index UINT32_MAX.
+
+    if (!str->isAtom())
+        return UINT32_MAX;
+
+    uint32_t index;
+    JSAtom *atom = &str->asAtom();
+    if (!atom->isIndex(&index))
+        return UINT32_MAX;
+
+    return index;
+}
+
+
 } // namespace ion
 } // namespace js
--- a/js/src/ion/VMFunctions.h
+++ b/js/src/ion/VMFunctions.h
@ -478,6 +478,8 @@ void GetDynamicName(JSContext *cx, JSObject *scopeChain, JSString *str, Value *v

 JSBool FilterArguments(JSContext *cx, JSString *str);

+uint32_t GetIndexFromString(JSString *str);
+
 } // namespace ion
 } // namespace js

--- a/js/src/jit-test/tests/basic/object-is.js
+++ b/js/src/jit-test/tests/basic/object-is.js
@ -0,0 +1,41 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+var list = [
+    [1, 1, true],
+    [0, 1, false],
+    [3.5, 3.5, true],
+    [0, 0, true],
+    [0, -0, false],
+    [-0, 0, false],
+    [-0, -0, true],
+
+    [true, true, true],
+    [true, false, false],
+    [false, false, true],
+
+    [NaN, NaN, true],
+    [NaN, undefined, false],
+    [Infinity, -Infinity, false],
+    [Infinity, Infinity, true],
+]
+
+for (var test of list) {
+    assertEq(Object.is(test[0], test[1]), test[2])
+}
+
+var obj = {}
+assertEq(Object.is(obj, obj), true);
+assertEq(Object.is(obj, {}), false);
+assertEq(Object.is([], []), false);
+
+assertEq(Object.is(null, null, null), true);
+
+/* Not defined parameters are undefined ... */
+assertEq(Object.is(null), false);
+assertEq(Object.is(undefined), true);
+assertEq(Object.is(), true);
+
+assertEq(Object.is.length, 2);
--- a/js/src/jit-test/tests/ion/bug851792.js
+++ b/js/src/jit-test/tests/ion/bug851792.js
@ -0,0 +1,135 @@
+// Based on tests/ion/typed-arrays-1.js, but with string indexes
+function testInt8() {
+    var arr1 = new Int8Array(50);
+    var arr2 = new Uint8Array(50);
+    var arr3 = new Uint8ClampedArray(50);
+
+    for (var i=0; i<arr1.length; i++) {
+        arr1[i] = arr2[i] = arr3[i] = i * 8;
+    }
+    var res = 0;
+    for (var i=0; i<arr1.length; i++) {
+        res += arr1[i+""] + arr2[i+""] + arr3[i+""] + arr2["10".concat("")];
+    }
+    assertEq(res, 18334);
+}
+testInt8();
+
+function testInt16() {
+    var arr1 = new Int16Array(70);
+    var arr2 = new Uint16Array(70);
+
+    for (var i=0; i<arr1.length; i++) {
+        arr1[i] = arr2[i] = i * 1000;
+    }
+    var res = 0;
+    for (var i=0; i<arr1.length; i++) {
+        res += arr1[i+""] + arr2[i+""] + arr2["1".concat("")] + arr1["3".concat("")];
+    }
+    assertEq(res, 2423024);
+}
+testInt16();
+
+function testInt32() {
+    var arr = new Int32Array(60);
+    arr[0] = -50;
+    for (var i=1; i<arr.length; i++) {
+        arr[i] = arr[(i-1)+""] + arr["0".concat("")];
+        ++arr[0];
+    }
+    assertEq(arr[(arr.length-1)+""], -1289);
+}
+testInt32();
+
+function testUint32() {
+    function sum(arr) {
+        var res = 0;
+        for (var i=0; i<arr.length; i++) {
+            res += arr[i+""];
+        }
+        return res;
+    }
+    var arr = new Uint32Array(100);
+    for (var i=0; i<arr.length; i++) {
+        arr[i] = i;
+    }
+
+    // Compile sum() to read int32 values.
+    assertEq(sum(arr), 4950);
+
+    // Add a large uint32 so that the sum no longer fits in an
+    // int32. sum() should be recompiled to return a double.
+    arr[50] = 0xffffeeee;
+    assertEq(sum(arr), 4294967826);
+}
+testUint32();
+
+function testFloat() {
+    var arr1 = new Float32Array(75);
+    var arr2 = new Float64Array(75);
+    arr1[0] = arr2[0] = Math.PI * 1234567.8;
+
+    for (var i=1; i<75; i++) {
+        arr1[i] = arr1[(i-1)+""] + arr1[0];
+        arr2[i] = arr2[(i-1)+""] + arr2[0];
+    }
+    assertEq(arr1["74".concat("")] > 290888255, true);
+    assertEq(arr1["74".concat("")] < 290888257, true);
+
+    assertEq(arr2["74".concat("")] > 290888184, true);
+    assertEq(arr2["74".concat("")] < 290888185, true);
+}
+testFloat();
+
+function testCanonicalNaN() {
+    // NaN values have to be canonicalized. Otherwise, malicious scripts could
+    // construct arbitrary Value's (due to our NaN boxing Value representation).
+    var buf = new ArrayBuffer(16);
+    var uint32 = new Uint32Array(buf);
+    var f64 = new Float64Array(buf);
+    var f32 = new Float32Array(buf);
+
+    // Evil: write a JSVAL_TYPE_OBJECT type tag...
+    uint32[0] = 0xffffff87;
+    uint32[1] = 0xffffff87;
+
+    // Make sure this value is interpreted as a double.
+    for (var i=0; i<3; i++) {
+        assertEq(isNaN(f64["0".concat("")]), true);
+        assertEq(isNaN(f32["0".concat("")]), true);
+    }
+}
+testCanonicalNaN();
+
+function testOutOfBounds() {
+    var buf = new ArrayBuffer(16);
+    var uint32 = new Uint32Array(buf);
+
+    uint32[0] = 0;
+    uint32[1] = 1;
+
+    for (var i=0; i<3; i++) {
+      assertEq(uint32["0".concat("")], 0);
+      assertEq(uint32["1".concat("")], 1);
+      assertEq(uint32["2".concat("")], 0);
+      assertEq(uint32["17".concat("")], undefined);
+    }
+}
+testOutOfBounds();
+
+function testStrangeIndexes() {
+    var buf = new ArrayBuffer(16);
+    var uint32 = new Uint32Array(buf);
+
+    uint32[0] = 0;
+    uint32[1] = 1;
+
+    indexes = ["0", "1", "2", "3", "17", "3.5", "NaN", "undefined", "null"];
+    solutions = [0, 1, 0, 0, undefined, undefined, undefined, undefined, undefined];
+
+    for (var i=0; i<indexes.length; i++) {
+      assertEq(uint32[indexes[i]], solutions[i]);
+    }
+}
+testStrangeIndexes();
+
--- a/js/src/jit-test/tests/parallelarray/bug853576.js
+++ b/js/src/jit-test/tests/parallelarray/bug853576.js
@ -0,0 +1,8 @@
+// |jit-test| error: Error;
+
+var len = 2;
+function add1(x) { return x+1; }
+var p = new ParallelArray(len, add1);
+var idx = [0,0].concat(build(len-4, add1)).concat([len-3,len-3]);
+var revidx = idx.reverse();
+var r = p.scatter(revidx, 0, function (x,y) { return x+y; }, len-2, {});
--- a/js/src/jit-test/tests/proxy/testDirectProxyDefineProperty2.js
+++ b/js/src/jit-test/tests/proxy/testDirectProxyDefineProperty2.js
@ -24,5 +24,12 @@ var desc = {
    enumerable: false,
    configurable: true
 };
-Object.defineProperty(new Proxy(target, handler), 'foo', desc);
+
+var p = new Proxy(target, handler);
+Object.defineProperty(p, 'foo', desc);
 assertEq(called, true);
+assertEq(Object.isExtensible(target), true);
+assertEq(Object.isExtensible(p), true);
+Object.preventExtensions(target);
+assertEq(Object.isExtensible(target), false);
+assertEq(Object.isExtensible(p), false);
--- a/js/src/jit-test/tests/proxy/testDirectProxyPreventExtensions1.js
+++ b/js/src/jit-test/tests/proxy/testDirectProxyPreventExtensions1.js
@ -0,0 +1,4 @@
+// Forward to the target if the trap is not defined
+var target = {};
+Object.preventExtensions(new Proxy(target, {}));
+assertEq(Object.isExtensible(target), false);
--- a/js/src/jit-test/tests/proxy/testDirectProxyPreventExtensions2.js
+++ b/js/src/jit-test/tests/proxy/testDirectProxyPreventExtensions2.js
@ -0,0 +1,17 @@
+/*
+ * Call the trap with the handler as the this value and the target as the first
+ * argument.
+ */
+var target = {};
+var called = false;
+var handler = {
+    preventExtensions: function (target1) {
+        assertEq(this, handler);
+        assertEq(target1, target);
+        Object.preventExtensions(target1);
+        called = true;
+        return true;
+    }
+};
+Object.preventExtensions(new Proxy(target, handler));
+assertEq(called, true);
--- a/js/src/jit-test/tests/proxy/testDirectProxyPreventExtensions3.js
+++ b/js/src/jit-test/tests/proxy/testDirectProxyPreventExtensions3.js
@ -0,0 +1,10 @@
+load(libdir + "asserts.js");
+
+// Throw a TypeError if the trap reports an extensible object as non-extensible
+assertThrowsInstanceOf(function () {
+    Object.preventExtensions(new Proxy({}, {
+        preventExtensions: function () {
+            return true;
+        }
+    }));
+}, TypeError);
--- a/js/src/jit-test/tests/proxy/testDirectProxyPreventExtensions4.js
+++ b/js/src/jit-test/tests/proxy/testDirectProxyPreventExtensions4.js
@ -0,0 +1,10 @@
+load(libdir + "asserts.js");
+
+// Throw a TypeError if the object refuses to be made non-extensible
+assertThrowsInstanceOf(function () {
+    Object.preventExtensions(new Proxy({}, {
+        preventExtensions: function () {
+            return false;
+        }
+    }));
+}, TypeError);
--- a/js/src/js.msg
+++ b/js/src/js.msg
@ -235,7 +235,7 @@ MSG_DEF(JSMSG_UNUSED181,              181, 0, JSEXN_NONE, "")
 MSG_DEF(JSMSG_BAD_GENERATOR_SEND,     182, 1, JSEXN_TYPEERR, "attempt to send {0} to newborn generator")
 MSG_DEF(JSMSG_UNUSED183,              183, 0, JSEXN_NONE, "")
 MSG_DEF(JSMSG_UNUSED184,              184, 0, JSEXN_NONE, "")
-MSG_DEF(JSMSG_UNUSED185,              185, 0, JSEXN_NONE, "")
+MSG_DEF(JSMSG_CANT_REPORT_AS_NON_EXTENSIBLE, 185, 0, JSEXN_TYPEERR, "proxy can't report an extensible object as non-extensible")
 MSG_DEF(JSMSG_UNUSED186,              186, 0, JSEXN_NONE, "")
 MSG_DEF(JSMSG_UNUSED187,              187, 0, JSEXN_NONE, "")
 MSG_DEF(JSMSG_INCOMPATIBLE_METHOD,    188, 3, JSEXN_TYPEERR, "{0} {1} called on incompatible {2}")
--- a/js/src/jscompartment.cpp
+++ b/js/src/jscompartment.cpp
@ -485,12 +485,6 @@ JSCompartment::markCrossCompartmentWrappers(JSTracer *trc)
            Value referent = GetProxyPrivate(wrapper);
            MarkValueRoot(trc, &referent, "cross-compartment wrapper");
            JS_ASSERT(referent == GetProxyPrivate(wrapper));
-
-            if (IsFunctionProxy(wrapper)) {
-                Value call = GetProxyCall(wrapper);
-                MarkValueRoot(trc, &call, "cross-compartment wrapper");
-                JS_ASSERT(call == GetProxyCall(wrapper));
-            }
        }
    }
 }
--- a/js/src/jsfriendapi.cpp
+++ b/js/src/jsfriendapi.cpp
@ -1037,3 +1037,20 @@ js::AutoCTypesActivityCallback::AutoCTypesActivityCallback(JSContext *cx,
    if (callback)
        callback(cx, beginType);
 }
+
+JS_FRIEND_API(JSBool)
+js_DefineOwnProperty(JSContext *cx, JSObject *objArg, jsid idArg,
+                     const js::PropertyDescriptor& descriptor, JSBool *bp)
+{
+    RootedObject obj(cx, objArg);
+    RootedId id(cx, idArg);
+    JS_ASSERT(cx->runtime->heapState == js::Idle);
+    CHECK_REQUEST(cx);
+    assertSameCompartment(cx, obj, id, descriptor.value);
+    if (descriptor.attrs & JSPROP_GETTER)
+        assertSameCompartment(cx, CastAsObjectJsval(descriptor.getter));
+    if (descriptor.attrs & JSPROP_SETTER)
+        assertSameCompartment(cx, CastAsObjectJsval(descriptor.setter));
+
+    return js_DefineOwnProperty(cx, HandleObject(obj), id, descriptor, bp);
+}
--- a/js/src/jsfriendapi.h
+++ b/js/src/jsfriendapi.h
@ -1440,4 +1440,8 @@ inline void assertEnteredPolicy(JSContext *cx, JSObject *obj, jsid id) {};

 } /* namespace js */

+extern JS_FRIEND_API(JSBool)
+js_DefineOwnProperty(JSContext *cx, JSObject *objArg, jsid idArg,
+                     const js::PropertyDescriptor& descriptor, JSBool *bp);
+
 #endif /* jsfriendapi_h___ */
--- a/js/src/jsgc.cpp
+++ b/js/src/jsgc.cpp
@ -3260,11 +3260,6 @@ JSCompartment::findOutgoingEdges(ComponentFinder<JS::Zone> &finder)
            if (w->isGCMarking())
                finder.addEdgeTo(w);
        }
-
-#ifdef DEBUG
-        JSObject *wrapper = &e.front().value.toObject();
-        JS_ASSERT_IF(IsFunctionProxy(wrapper), &GetProxyCall(wrapper).toObject() == other);
-#endif
    }

    Debugger::findCompartmentEdges(zone(), finder);
--- a/js/src/jsobj.cpp
+++ b/js/src/jsobj.cpp
@ -992,6 +992,24 @@ js_DefineOwnProperty(JSContext *cx, HandleObject obj, HandleId id, const Value &
    return true;
 }

+JSBool
+js_DefineOwnProperty(JSContext *cx, HandleObject obj, HandleId id,
+                     const PropertyDescriptor &descriptor, JSBool *bp)
+{
+    AutoPropDescArrayRooter descs(cx);
+    PropDesc *desc = descs.append();
+    if (!desc)
+        return false;
+
+    desc->initFromPropertyDescriptor(descriptor);
+
+    bool rval;
+    if (!DefineProperty(cx, obj, id, *desc, true, &rval))
+        return false;
+    *bp = !!rval;
+    return true;
+}
+

 bool
 js::ReadPropertyDescriptors(JSContext *cx, HandleObject props, bool checkAccessors,
@ -1054,7 +1072,7 @@ JSObject::sealOrFreeze(JSContext *cx, HandleObject obj, ImmutabilityType it)
    assertSameCompartment(cx, obj);
    JS_ASSERT(it == SEAL || it == FREEZE);

-    if (obj->isExtensible() && !obj->preventExtensions(cx))
+    if (obj->isExtensible() && !JSObject::preventExtensions(cx, obj))
        return false;

    AutoIdVector props(cx);
--- a/js/src/jsobj.h
+++ b/js/src/jsobj.h
@ -548,8 +548,6 @@ class JSObject : public js::ObjectImpl
    static inline unsigned getSealedOrFrozenAttributes(unsigned attrs, ImmutabilityType it);

  public:
-    bool preventExtensions(JSContext *cx);
-
    /* ES5 15.2.3.8: non-extensible, all props non-configurable */
    static inline bool seal(JSContext *cx, js::HandleObject obj) { return sealOrFreeze(cx, obj, SEAL); }
    /* ES5 15.2.3.9: non-extensible, all properties non-configurable, all data props read-only */
@ -960,7 +958,7 @@ class JSObject : public js::ObjectImpl
    inline bool isObject() const;
    inline bool isPrimitive() const;
    inline bool isPropertyIterator() const;
-    inline bool isProxy() const;
+    using js::ObjectImpl::isProxy;
    inline bool isRegExp() const;
    inline bool isRegExpStatics() const;
    inline bool isScope() const;
@ -1156,6 +1154,10 @@ extern JSBool
 js_DefineOwnProperty(JSContext *cx, JS::HandleObject obj, JS::HandleId id,
                     const JS::Value &descriptor, JSBool *bp);

+extern JSBool
+js_DefineOwnProperty(JSContext *cx, JS::HandleObject obj, JS::HandleId id,
+                     const js::PropertyDescriptor &descriptor, JSBool *bp);
+
 namespace js {

 /*
--- a/js/src/jsobjinlines.h
+++ b/js/src/jsobjinlines.h
@ -1258,9 +1258,9 @@ JSObject::getSpecialAttributes(JSContext *cx, js::HandleObject obj,
 }

 inline bool
-JSObject::isProxy() const
+js::ObjectImpl::isProxy() const
 {
-    return js::IsProxy(const_cast<JSObject*>(this));
+    return js::IsProxy(const_cast<JSObject*>(this->asObjectPtr()));
 }

 inline bool
--- a/js/src/jsproxy.cpp
+++ b/js/src/jsproxy.cpp
@ -310,24 +310,16 @@ bool
 BaseProxyHandler::call(JSContext *cx, HandleObject proxy, unsigned argc,
                       Value *vp)
 {
-    assertEnteredPolicy(cx, proxy, JSID_VOID);
-    AutoValueRooter rval(cx);
-    RootedValue call(cx, GetCall(proxy));
-    JSBool ok = Invoke(cx, vp[1], call, argc, JS_ARGV(cx, vp), rval.addr());
-    if (ok)
-        JS_SET_RVAL(cx, vp, rval.value());
-    return ok;
+    JS_NOT_REACHED("callable proxies should implement call trap");
+    return false;
 }

 bool
 BaseProxyHandler::construct(JSContext *cx, HandleObject proxy, unsigned argc,
                            Value *argv, MutableHandleValue rval)
 {
-    assertEnteredPolicy(cx, proxy, JSID_VOID);
-    RootedValue fval(cx, GetConstruct(proxy));
-    if (fval.isUndefined())
-        fval = GetCall(proxy);
-    return InvokeConstructor(cx, fval, argc, argv, rval.address());
+    JS_NOT_REACHED("callable proxies should implement construct trap");
+    return false;
 }

 JSString *
@ -341,19 +333,8 @@ BaseProxyHandler::obj_toString(JSContext *cx, HandleObject proxy)
 JSString *
 BaseProxyHandler::fun_toString(JSContext *cx, HandleObject proxy, unsigned indent)
 {
-    assertEnteredPolicy(cx, proxy, JSID_VOID);
-    Value fval = GetCall(proxy);
-    if (IsFunctionProxy(proxy) &&
-        (fval.isPrimitive() || !fval.toObject().isFunction())) {
-        JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
-                             JSMSG_INCOMPATIBLE_PROTO,
-                             js_Function_str, js_toString_str,
-                             "object");
-        return NULL;
-    }
-    RootedObject obj(cx, &fval.toObject());
-    return fun_toStringHelper(cx, obj, indent);
-
+    JS_NOT_REACHED("callable proxies should implement fun_toString trap");
+    return NULL;
 }

 bool
@ -494,6 +475,28 @@ DirectProxyHandler::enumerate(JSContext *cx, HandleObject proxy,
    return GetPropertyNames(cx, target, 0, &props);
 }

+bool
+DirectProxyHandler::call(JSContext *cx, HandleObject proxy, unsigned argc,
+                         Value *vp)
+{
+    assertEnteredPolicy(cx, proxy, JSID_VOID);
+    AutoValueRooter rval(cx);
+    RootedValue target(cx, GetProxyPrivate(proxy));
+    JSBool ok = Invoke(cx, vp[1], target, argc, JS_ARGV(cx, vp), rval.addr());
+    if (ok)
+        JS_SET_RVAL(cx, vp, rval.value());
+    return ok;
+}
+
+bool
+DirectProxyHandler::construct(JSContext *cx, HandleObject proxy, unsigned argc,
+                              Value *argv, MutableHandleValue rval)
+{
+    assertEnteredPolicy(cx, proxy, JSID_VOID);
+    RootedValue target(cx, GetProxyPrivate(proxy));
+    return InvokeConstructor(cx, target, argc, argv, rval.address());
+}
+
 bool
 DirectProxyHandler::nativeCall(JSContext *cx, IsAcceptableThis test, NativeImpl impl,
                               CallArgs args)
@ -636,6 +639,19 @@ DirectProxyHandler::iterate(JSContext *cx, HandleObject proxy, unsigned flags,
    return GetIterator(cx, target, flags, vp);
 }

+bool
+DirectProxyHandler::isExtensible(JSObject *proxy)
+{
+    return GetProxyTargetObject(proxy)->isExtensible();
+}
+
+bool
+DirectProxyHandler::preventExtensions(JSContext *cx, HandleObject proxy)
+{
+    RootedObject target(cx, GetProxyTargetObject(proxy));
+    return JSObject::preventExtensions(cx, target);
+}
+
 static bool
 GetFundamentalTrap(JSContext *cx, HandleObject handler, HandlePropertyName name,
                   MutableHandleValue fvalp)
@ -760,6 +776,7 @@ class ScriptedIndirectProxyHandler : public BaseProxyHandler {
    virtual ~ScriptedIndirectProxyHandler();

    /* ES5 Harmony fundamental proxy traps. */
+    virtual bool preventExtensions(JSContext *cx, HandleObject proxy) MOZ_OVERRIDE;
    virtual bool getPropertyDescriptor(JSContext *cx, HandleObject proxy, HandleId id,
                                       PropertyDescriptor *desc, unsigned flags) MOZ_OVERRIDE;
    virtual bool getOwnPropertyDescriptor(JSContext *cx, HandleObject proxy, HandleId id,
@ -782,8 +799,13 @@ class ScriptedIndirectProxyHandler : public BaseProxyHandler {
                         MutableHandleValue vp) MOZ_OVERRIDE;

    /* Spidermonkey extensions. */
+    virtual bool isExtensible(JSObject *proxy) MOZ_OVERRIDE;
+    virtual bool call(JSContext *cx, HandleObject proxy, unsigned argc, Value *vp) MOZ_OVERRIDE;
+    virtual bool construct(JSContext *cx, HandleObject proxy, unsigned argc,
+                           Value *argv, MutableHandleValue rval) MOZ_OVERRIDE;
    virtual bool nativeCall(JSContext *cx, IsAcceptableThis test, NativeImpl impl,
                            CallArgs args) MOZ_OVERRIDE;
+    virtual JSString *fun_toString(JSContext *cx, HandleObject proxy, unsigned indent) MOZ_OVERRIDE;
    virtual bool defaultValue(JSContext *cx, HandleObject obj, JSType hint,
                              MutableHandleValue vp) MOZ_OVERRIDE;

@ -801,6 +823,14 @@ ScriptedIndirectProxyHandler::~ScriptedIndirectProxyHandler()
 {
 }

+bool
+ScriptedIndirectProxyHandler::preventExtensions(JSContext *cx, HandleObject proxy)
+{
+    // Scripted indirect proxies don't support extensibility changes.
+    JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_CANT_CHANGE_EXTENSIBILITY);
+    return false;
+}
+
 static bool
 ReturnedValueMustNotBePrimitive(JSContext *cx, HandleObject proxy, JSAtom *atom, const Value &v)
 {
@ -981,6 +1011,37 @@ ScriptedIndirectProxyHandler::iterate(JSContext *cx, HandleObject proxy, unsigne
           ReturnedValueMustNotBePrimitive(cx, proxy, cx->names().iterate, vp);
 }

+bool
+ScriptedIndirectProxyHandler::isExtensible(JSObject *proxy)
+{
+    // Scripted indirect proxies don't support extensibility changes.
+    return true;
+}
+
+bool
+ScriptedIndirectProxyHandler::call(JSContext *cx, HandleObject proxy, unsigned argc,
+                                   Value *vp)
+{
+    assertEnteredPolicy(cx, proxy, JSID_VOID);
+    AutoValueRooter rval(cx);
+    RootedValue call(cx, GetCall(proxy));
+    JSBool ok = Invoke(cx, vp[1], call, argc, JS_ARGV(cx, vp), rval.addr());
+    if (ok)
+        JS_SET_RVAL(cx, vp, rval.value());
+    return ok;
+}
+
+bool
+ScriptedIndirectProxyHandler::construct(JSContext *cx, HandleObject proxy, unsigned argc,
+                                        Value *argv, MutableHandleValue rval)
+{
+    assertEnteredPolicy(cx, proxy, JSID_VOID);
+    RootedValue fval(cx, GetConstruct(proxy));
+    if (fval.isUndefined())
+        fval = GetCall(proxy);
+    return InvokeConstructor(cx, fval, argc, argv, rval.address());
+}
+
 bool
 ScriptedIndirectProxyHandler::nativeCall(JSContext *cx, IsAcceptableThis test, NativeImpl impl,
                                         CallArgs args)
@ -988,6 +1049,23 @@ ScriptedIndirectProxyHandler::nativeCall(JSContext *cx, IsAcceptableThis test, N
    return BaseProxyHandler::nativeCall(cx, test, impl, args);
 }

+JSString *
+ScriptedIndirectProxyHandler::fun_toString(JSContext *cx, HandleObject proxy, unsigned indent)
+{
+    assertEnteredPolicy(cx, proxy, JSID_VOID);
+    Value fval = GetCall(proxy);
+    if (IsFunctionProxy(proxy) &&
+        (fval.isPrimitive() || !fval.toObject().isFunction())) {
+        JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
+                             JSMSG_INCOMPATIBLE_PROTO,
+                             js_Function_str, js_toString_str,
+                             "object");
+        return NULL;
+    }
+    RootedObject obj(cx, &fval.toObject());
+    return fun_toStringHelper(cx, obj, indent);
+}
+
 bool
 ScriptedIndirectProxyHandler::defaultValue(JSContext *cx, HandleObject proxy, JSType hint,
                                           MutableHandleValue vp)
@ -1014,6 +1092,7 @@ class ScriptedDirectProxyHandler : public DirectProxyHandler {
    virtual ~ScriptedDirectProxyHandler();

    /* ES5 Harmony fundamental proxy traps. */
+    virtual bool preventExtensions(JSContext *cx, HandleObject proxy) MOZ_OVERRIDE;
    virtual bool getPropertyDescriptor(JSContext *cx, HandleObject proxy, HandleId id,
                                       PropertyDescriptor *desc, unsigned flags) MOZ_OVERRIDE;
    virtual bool getOwnPropertyDescriptor(JSContext *cx, HandleObject proxy, HandleId id,
@ -1582,6 +1661,48 @@ ScriptedDirectProxyHandler::~ScriptedDirectProxyHandler()
 {
 }

+bool
+ScriptedDirectProxyHandler::preventExtensions(JSContext *cx, HandleObject proxy)
+{
+    // step a
+    RootedObject handler(cx, GetDirectProxyHandlerObject(proxy));
+
+    // step b
+    RootedObject target(cx, GetProxyTargetObject(proxy));
+
+    // step c
+    RootedValue trap(cx);
+    if (!JSObject::getProperty(cx, handler, handler, cx->names().preventExtensions, &trap))
+        return false;
+
+    // step d
+    if (trap.isUndefined())
+        return DirectProxyHandler::preventExtensions(cx, proxy);
+
+    // step e
+    Value argv[] = {
+        ObjectValue(*target)
+    };
+    RootedValue trapResult(cx);
+    if (!Invoke(cx, ObjectValue(*handler), trap, 1, argv, trapResult.address()))
+        return false;
+
+    // step f
+    bool success = ToBoolean(trapResult);
+    if (success) {
+        // step g
+        if (target->isExtensible()) {
+            JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_CANT_REPORT_AS_NON_EXTENSIBLE);
+            return false;
+        }
+        return true;
+    }
+
+    // step h
+    JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_CANT_CHANGE_EXTENSIBILITY);
+    return false;
+}
+
 // FIXME: Move to Proxy::getPropertyDescriptor once ScriptedIndirectProxy is removed
 bool
 ScriptedDirectProxyHandler::getPropertyDescriptor(JSContext *cx, HandleObject proxy, HandleId id,
@ -2474,6 +2595,20 @@ Proxy::iterate(JSContext *cx, HandleObject proxy, unsigned flags, MutableHandleV
    return EnumeratedIdVectorToIterator(cx, proxy, flags, props, vp);
 }

+bool
+Proxy::preventExtensions(JSContext *cx, HandleObject proxy)
+{
+    JS_CHECK_RECURSION(cx, return false);
+    BaseProxyHandler *handler = GetProxyHandler(proxy);
+    return handler->preventExtensions(cx, proxy);
+}
+
+bool
+Proxy::isExtensible(JSObject *proxy)
+{
+    return GetProxyHandler(proxy)->isExtensible(proxy);
+}
+
 bool
 Proxy::call(JSContext *cx, HandleObject proxy, unsigned argc, Value *vp)
 {
@ -3126,19 +3261,16 @@ JS_FRIEND_DATA(Class) js::FunctionProxyClass = {

 static JSObject *
 NewProxyObject(JSContext *cx, BaseProxyHandler *handler, const Value &priv_, TaggedProto proto_,
-                   JSObject *parent_, JSObject *call_, JSObject *construct_)
+               JSObject *parent_, ProxyCallable callable)
 {
    RootedValue priv(cx, priv_);
    Rooted<TaggedProto> proto(cx, proto_);
-    RootedObject parent(cx, parent_), call(cx, call_), construct(cx, construct_);
+    RootedObject parent(cx, parent_);

    JS_ASSERT_IF(proto.isObject(), cx->compartment == proto.toObject()->compartment());
    JS_ASSERT_IF(parent, cx->compartment == parent->compartment());
-    JS_ASSERT_IF(construct, cx->compartment == construct->compartment());
-    JS_ASSERT_IF(call && cx->compartment != call->compartment(), priv.get() == ObjectValue(*call));
-    bool fun = call || construct;
    Class *clasp;
-    if (fun)
+    if (callable)
        clasp = &FunctionProxyClass;
    else
        clasp = handler->isOuterWindow() ? &OuterWindowProxyClass : &ObjectProxyClass;
@ -3163,12 +3295,6 @@ NewProxyObject(JSContext *cx, BaseProxyHandler *handler, const Value &priv_, Tag
        return NULL;
    obj->initSlot(JSSLOT_PROXY_HANDLER, PrivateValue(handler));
    obj->initCrossCompartmentSlot(JSSLOT_PROXY_PRIVATE, priv);
-    if (fun) {
-        obj->initCrossCompartmentSlot(JSSLOT_PROXY_CALL, call ? ObjectValue(*call) : UndefinedValue());
-        if (construct) {
-            obj->initSlot(JSSLOT_PROXY_CONSTRUCT, ObjectValue(*construct));
-        }
-    }

    /* Don't track types of properties of proxies. */
    if (newKind != SingletonObject)
@ -3179,9 +3305,29 @@ NewProxyObject(JSContext *cx, BaseProxyHandler *handler, const Value &priv_, Tag

 JS_FRIEND_API(JSObject *)
 js::NewProxyObject(JSContext *cx, BaseProxyHandler *handler, const Value &priv_, JSObject *proto_,
-                   JSObject *parent_, JSObject *call_, JSObject *construct_)
+                   JSObject *parent_, ProxyCallable callable)
 {
-    return NewProxyObject(cx, handler, priv_, TaggedProto(proto_), parent_, call_, construct_);
+    return NewProxyObject(cx, handler, priv_, TaggedProto(proto_), parent_, callable);
+}
+
+static JSObject *
+NewProxyObject(JSContext *cx, BaseProxyHandler *handler, const Value &priv_, JSObject *proto_,
+               JSObject *parent_, JSObject *call, JSObject *construct)
+{
+    JS_ASSERT_IF(construct, cx->compartment == construct->compartment());
+    JS_ASSERT_IF(call && cx->compartment != call->compartment(), priv_ == ObjectValue(*call));
+
+    JSObject *proxy = NewProxyObject(cx, handler, priv_, TaggedProto(proto_), parent_,
+                                     call || construct ? ProxyIsCallable : ProxyNotCallable);
+    if (!proxy)
+        return NULL;
+
+    if (call)
+        proxy->initCrossCompartmentSlot(JSSLOT_PROXY_CALL, ObjectValue(*call));
+    if (construct)
+        proxy->initCrossCompartmentSlot(JSSLOT_PROXY_CONSTRUCT, ObjectValue(*construct));
+
+    return proxy;
 }

 JSObject *
@ -3310,7 +3456,8 @@ proxy_createFunction(JSContext *cx, unsigned argc, Value *vp)
    }

    JSObject *proxy = NewProxyObject(cx, &ScriptedIndirectProxyHandler::singleton,
-                                     ObjectValue(*handler), proto, parent, call, construct);
+                                     ObjectValue(*handler), proto, parent,
+                                     call, construct);
    if (!proxy)
        return false;

--- a/js/src/jsproxy.h
+++ b/js/src/jsproxy.h
@ -104,6 +104,7 @@ class JS_FRIEND_API(BaseProxyHandler) {
                       bool *bp);

    /* ES5 Harmony fundamental proxy traps. */
+    virtual bool preventExtensions(JSContext *cx, HandleObject proxy) = 0;
    virtual bool getPropertyDescriptor(JSContext *cx, HandleObject proxy, HandleId id,
                                       PropertyDescriptor *desc, unsigned flags) = 0;
    virtual bool getOwnPropertyDescriptor(JSContext *cx, HandleObject proxy,
@ -128,6 +129,7 @@ class JS_FRIEND_API(BaseProxyHandler) {
                         MutableHandleValue vp);

    /* Spidermonkey extensions. */
+    virtual bool isExtensible(JSObject *proxy) = 0;
    virtual bool call(JSContext *cx, HandleObject proxy, unsigned argc, Value *vp);
    virtual bool construct(JSContext *cx, HandleObject proxy, unsigned argc,
                           Value *argv, MutableHandleValue rval);
@ -158,6 +160,7 @@ public:
    explicit DirectProxyHandler(void *family);

    /* ES5 Harmony fundamental proxy traps. */
+    virtual bool preventExtensions(JSContext *cx, HandleObject proxy) MOZ_OVERRIDE;
    virtual bool getPropertyDescriptor(JSContext *cx, HandleObject proxy, HandleId id,
                                       PropertyDescriptor *desc, unsigned flags) MOZ_OVERRIDE;
    virtual bool getOwnPropertyDescriptor(JSContext *cx, HandleObject proxy,
@ -187,6 +190,10 @@ public:
                         MutableHandleValue vp) MOZ_OVERRIDE;

    /* Spidermonkey extensions. */
+    virtual bool isExtensible(JSObject *proxy) MOZ_OVERRIDE;
+    virtual bool call(JSContext *cx, HandleObject proxy, unsigned argc, Value *vp) MOZ_OVERRIDE;
+    virtual bool construct(JSContext *cx, HandleObject proxy, unsigned argc,
+                           Value *argv, MutableHandleValue rval) MOZ_OVERRIDE;
    virtual bool nativeCall(JSContext *cx, IsAcceptableThis test, NativeImpl impl,
                            CallArgs args) MOZ_OVERRIDE;
    virtual bool hasInstance(JSContext *cx, HandleObject proxy, MutableHandleValue v,
@ -207,6 +214,7 @@ public:
 class Proxy {
  public:
    /* ES5 Harmony fundamental proxy traps. */
+    static bool preventExtensions(JSContext *cx, HandleObject proxy);
    static bool getPropertyDescriptor(JSContext *cx, HandleObject proxy, HandleId id,
                                      PropertyDescriptor *desc, unsigned flags);
    static bool getPropertyDescriptor(JSContext *cx, HandleObject proxy, unsigned flags, HandleId id,
@ -234,6 +242,7 @@ class Proxy {
    static bool iterate(JSContext *cx, HandleObject proxy, unsigned flags, MutableHandleValue vp);

    /* Spidermonkey extensions. */
+    static bool isExtensible(JSObject *proxy);
    static bool call(JSContext *cx, HandleObject proxy, unsigned argc, Value *vp);
    static bool construct(JSContext *cx, HandleObject proxy, unsigned argc, Value *argv,
                          MutableHandleValue rval);
@ -310,13 +319,6 @@ GetProxyTargetObject(RawObject obj)
    return GetProxyPrivate(obj).toObjectOrNull();
 }

-inline const Value &
-GetProxyCall(RawObject obj)
-{
-    JS_ASSERT(IsFunctionProxy(obj));
-    return GetReservedSlot(obj, JSSLOT_PROXY_CALL);
-}
-
 inline const Value &
 GetProxyExtra(RawObject obj, size_t n)
 {
@ -339,10 +341,14 @@ SetProxyExtra(RawObject obj, size_t n, const Value &extra)
    SetReservedSlot(obj, JSSLOT_PROXY_EXTRA + n, extra);
 }

+enum ProxyCallable {
+    ProxyNotCallable = false,
+    ProxyIsCallable = true
+};
+
 JS_FRIEND_API(JSObject *)
 NewProxyObject(JSContext *cx, BaseProxyHandler *handler, const Value &priv,
-               JSObject *proto, JSObject *parent,
-               JSObject *call = NULL, JSObject *construct = NULL);
+               JSObject *proto, JSObject *parent, ProxyCallable callable = ProxyNotCallable);

 JSObject *
 RenewProxyObject(JSContext *cx, JSObject *obj, BaseProxyHandler *handler, Value priv);
--- a/js/src/jswrapper.cpp
+++ b/js/src/jswrapper.cpp
@ -46,7 +46,7 @@ Wrapper::New(JSContext *cx, JSObject *obj, JSObject *proto, JSObject *parent,
    AutoMarkInDeadZone amd(cx->zone());

    return NewProxyObject(cx, handler, ObjectValue(*obj), proto, parent,
-                          obj->isCallable() ? obj : NULL, NULL);
+                          obj->isCallable() ? ProxyIsCallable : ProxyNotCallable);
 }

 JSObject *
@ -626,6 +626,25 @@ SecurityWrapper<Base>::SecurityWrapper(unsigned flags)
    BaseProxyHandler::setHasPolicy(true);
 }

+template <class Base>
+bool
+SecurityWrapper<Base>::isExtensible(JSObject *wrapper)
+{
+    // Just like BaseProxyHandler, SecurityWrappers claim by default to always
+    // be extensible, so as not to leak information about the state of the
+    // underlying wrapped thing.
+    return true;
+}
+
+template <class Base>
+bool
+SecurityWrapper<Base>::preventExtensions(JSContext *cx, HandleObject wrapper)
+{
+    // See above.
+    JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_UNWRAP_DENIED);
+    return false;
+}
+
 template <class Base>
 bool
 SecurityWrapper<Base>::enter(JSContext *cx, HandleObject wrapper, HandleId id,
@ -636,8 +655,8 @@ SecurityWrapper<Base>::enter(JSContext *cx, HandleObject wrapper, HandleId id,
    return false;
 }

- template <class Base>
- bool
+template <class Base>
+bool
 SecurityWrapper<Base>::nativeCall(JSContext *cx, IsAcceptableThis test, NativeImpl impl,
                                  CallArgs args)
 {
@ -668,6 +687,13 @@ DeadObjectProxy::DeadObjectProxy()
 {
 }

+bool
+DeadObjectProxy::preventExtensions(JSContext *cx, HandleObject proxy)
+{
+    JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_DEAD_OBJECT);
+    return false;
+}
+
 bool
 DeadObjectProxy::getPropertyDescriptor(JSContext *cx, HandleObject wrapper, HandleId id,
                                       PropertyDescriptor *desc, unsigned flags)
@ -714,6 +740,14 @@ DeadObjectProxy::enumerate(JSContext *cx, HandleObject wrapper, AutoIdVector &pr
    return false;
 }

+bool
+DeadObjectProxy::isExtensible(JSObject *proxy)
+{
+    // This is kind of meaningless, but dead-object semantics aside,
+    // [[Extensible]] always being true is consistent with other proxy types.
+    return true;
+}
+
 bool
 DeadObjectProxy::call(JSContext *cx, HandleObject wrapper, unsigned argc, Value *vp)
 {
@ -798,7 +832,7 @@ JSObject *
 js::NewDeadProxyObject(JSContext *cx, JSObject *parent)
 {
    return NewProxyObject(cx, &DeadObjectProxy::singleton, NullValue(),
-                          NULL, parent, NULL, NULL);
+                          NULL, parent, ProxyNotCallable);
 }

 bool
--- a/js/src/jswrapper.h
+++ b/js/src/jswrapper.h
@ -143,6 +143,8 @@ class JS_FRIEND_API(SecurityWrapper) : public Base
  public:
    SecurityWrapper(unsigned flags);

+    virtual bool isExtensible(JSObject *wrapper) MOZ_OVERRIDE;
+    virtual bool preventExtensions(JSContext *cx, HandleObject wrapper) MOZ_OVERRIDE;
    virtual bool enter(JSContext *cx, HandleObject wrapper, HandleId id, Wrapper::Action act,
                       bool *bp) MOZ_OVERRIDE;
    virtual bool nativeCall(JSContext *cx, IsAcceptableThis test, NativeImpl impl,
@ -170,6 +172,7 @@ class JS_FRIEND_API(DeadObjectProxy) : public BaseProxyHandler
    explicit DeadObjectProxy();

    /* ES5 Harmony fundamental wrapper traps. */
+    virtual bool preventExtensions(JSContext *cx, HandleObject proxy) MOZ_OVERRIDE;
    virtual bool getPropertyDescriptor(JSContext *cx, HandleObject wrapper, HandleId id,
                                       PropertyDescriptor *desc, unsigned flags) MOZ_OVERRIDE;
    virtual bool getOwnPropertyDescriptor(JSContext *cx, HandleObject wrapper, HandleId id,
@ -182,6 +185,7 @@ class JS_FRIEND_API(DeadObjectProxy) : public BaseProxyHandler
    virtual bool enumerate(JSContext *cx, HandleObject wrapper, AutoIdVector &props) MOZ_OVERRIDE;

    /* Spidermonkey extensions. */
+    virtual bool isExtensible(JSObject *proxy) MOZ_OVERRIDE;
    virtual bool call(JSContext *cx, HandleObject proxy, unsigned argc, Value *vp);
    virtual bool construct(JSContext *cx, HandleObject proxy, unsigned argc,
                           Value *argv, MutableHandleValue rval);
--- a/js/src/methodjit/BaseAssembler.h
+++ b/js/src/methodjit/BaseAssembler.h
@ -1147,6 +1147,9 @@ static const JSC::MacroAssembler::RegisterID JSParamReg_Argc  = JSC::MIPSRegiste
    }

    template <typename T>
+#if defined(__GNUC__) && __GNUC__ == 4 && __GNUC_MINOR__ == 7 && defined(JS_CPU_ARM)
+    __attribute__((optimize("-O1")))
+#endif
    void storeToTypedArray(int atype, ValueRemat vr, T address)
    {
        if (atype == js::TypedArray::TYPE_FLOAT32 || atype == js::TypedArray::TYPE_FLOAT64) {
--- a/js/src/methodjit/PolyIC.cpp
+++ b/js/src/methodjit/PolyIC.cpp
@ -677,8 +677,20 @@ struct GetPropHelper {

    LookupStatus lookup() {
        RootedObject aobj(cx, obj);
-        if (IsCacheableListBase(obj))
+        if (IsCacheableListBase(obj)) {
+            Value expandoValue = obj->getFixedSlot(GetListBaseExpandoSlot());
+
+            // Expando objects just hold any extra properties the object has been given by a
+            // script, and have no prototype or anything else that will complicate property
+            // lookups on them.
+            JS_ASSERT_IF(expandoValue.isObject(),
+                         expandoValue.toObject().isNative() && !expandoValue.toObject().getProto());
+
+            if (expandoValue.isObject() && expandoValue.toObject().nativeContains(cx, name))
+                return Lookup_Uncacheable;
+
            aobj = obj->getTaggedProto().toObjectOrNull();
+        }

        if (!aobj->isNative())
            return ic.disable(f, "non-native");
@ -1293,14 +1305,11 @@ class GetPropCompiler : public PICStubCompiler
            Address expandoAddress(pic.objReg, JSObject::getFixedSlotOffset(GetListBaseExpandoSlot()));

            Value expandoValue = obj->getFixedSlot(GetListBaseExpandoSlot());
-            JSObject *expando = expandoValue.isObject() ? &expandoValue.toObject() : NULL;
+            if (expandoValue.isObject()) {
+                JS_ASSERT(!expandoValue.toObject().nativeContains(cx, name));

-            // Expando objects just hold any extra properties the object has
-            // been given by a script, and have no prototype or anything else
-            // that will complicate property lookups on them.
-            JS_ASSERT_IF(expando, expando->isNative() && expando->getProto() == NULL);
-
-            if (expando && !expando->nativeContains(cx, name)) {
+                // Reference object has an expando object that doesn't define the name. Check that
+                // the incoming object has an expando object with the same shape.
                Jump expandoGuard = masm.testObject(Assembler::NotEqual, expandoAddress);
                if (!shapeMismatches.append(expandoGuard))
                    return error();
@ -1310,10 +1319,12 @@ class GetPropCompiler : public PICStubCompiler

                Jump shapeGuard = masm.branchPtr(Assembler::NotEqual,
                                                 Address(pic.shapeReg, JSObject::offsetOfShape()),
-                                                 ImmPtr(expando->lastProperty()));
+                                                 ImmPtr(expandoValue.toObject().lastProperty()));
                if (!shapeMismatches.append(shapeGuard))
                    return error();
            } else {
+                // If the incoming object does not have an expando object then
+                // we're sure we're not shadowing.
                Jump expandoGuard = masm.testUndefined(Assembler::NotEqual, expandoAddress);
                if (!shapeMismatches.append(expandoGuard))
                    return error();
--- a/js/src/vm/CommonPropertyNames.h
+++ b/js/src/vm/CommonPropertyNames.h
@ -114,6 +114,7 @@
    macro(parseFloat, parseFloat, "parseFloat") \
    macro(parseInt, parseInt, "parseInt") \
    macro(pattern, pattern, "pattern") \
+    macro(preventExtensions, preventExtensions, "preventExtensions") \
    macro(propertyIsEnumerable, propertyIsEnumerable, "propertyIsEnumerable") \
    macro(proto, proto, "__proto__") \
    macro(return, return_, "return") \
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@ -4499,7 +4499,7 @@ DebuggerObject_sealHelper(JSContext *cx, unsigned argc, Value *vp, SealHelperOp
            args.rval().setUndefined();
            return true;
        }
-        ok = obj->preventExtensions(cx);
+        ok = JSObject::preventExtensions(cx, obj);
    }
    if (!ok)
        return false;
--- a/js/src/vm/GlobalObject.cpp
+++ b/js/src/vm/GlobalObject.cpp
@ -376,7 +376,7 @@ GlobalObject::initFunctionAndObjectClasses(JSContext *cx)
                                                  JSFunction::NATIVE_FUN, self, NullPtr()));
    if (!throwTypeError)
        return NULL;
-    if (!throwTypeError->preventExtensions(cx))
+    if (!JSObject::preventExtensions(cx, throwTypeError))
        return NULL;
    self->setThrowTypeError(throwTypeError);

--- a/js/src/vm/ObjectImpl-inl.h
+++ b/js/src/vm/ObjectImpl-inl.h
@ -13,6 +13,7 @@
 #include "jscompartment.h"
 #include "jsgc.h"
 #include "jsinterp.h"
+#include "jsproxy.h"

 #include "gc/Heap.h"
 #include "gc/Marking.h"
@ -85,6 +86,10 @@ js::ObjectImpl::nativeContains(JSContext *cx, Shape *shape)
 inline bool
 js::ObjectImpl::isExtensible() const
 {
+    if (this->isProxy())
+        return Proxy::isExtensible(const_cast<JSObject*>(this->asObjectPtr()));
+
+    // [[Extensible]] for ordinary non-proxy objects is an object flag.
    return !lastProperty()->hasObjectFlag(BaseShape::NOT_EXTENSIBLE);
 }

--- a/js/src/vm/ObjectImpl.h
+++ b/js/src/vm/ObjectImpl.h
@ -1112,6 +1112,11 @@ class ObjectImpl : public gc::Cell

    inline bool isExtensible() const;

+    // Attempt to change the [[Extensible]] bit on |obj| to false.  Callers
+    // must ensure that |obj| is currently extensible before calling this!
+    static bool
+    preventExtensions(JSContext *cx, Handle<ObjectImpl*> obj);
+
    inline HeapSlotArray getDenseElements();
    inline const Value & getDenseElement(uint32_t idx);
    inline bool containsDenseElement(uint32_t idx);
@ -1124,6 +1129,8 @@ class ObjectImpl : public gc::Cell
        return false;
    }

+    inline bool isProxy() const;
+
  protected:
 #ifdef DEBUG
    void checkShapeConsistency();
--- a/js/src/vm/ScopeObject.cpp
+++ b/js/src/vm/ScopeObject.cpp
@ -1307,6 +1307,12 @@ class DebugScopeProxy : public BaseProxyHandler

    DebugScopeProxy() : BaseProxyHandler(&family) {}

+    bool preventExtensions(JSContext *cx, HandleObject proxy) MOZ_OVERRIDE
+    {
+        JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_CANT_CHANGE_EXTENSIBILITY);
+        return false;
+    }
+
    bool getPropertyDescriptor(JSContext *cx, HandleObject proxy, HandleId id, PropertyDescriptor *desc,
                               unsigned flags) MOZ_OVERRIDE
    {
@ -1466,6 +1472,13 @@ class DebugScopeProxy : public BaseProxyHandler
        return js_ReportValueErrorFlags(cx, JSREPORT_ERROR, JSMSG_CANT_DELETE,
                                        JSDVG_IGNORE_STACK, idval, NullPtr(), NULL, NULL);
    }
+
+    bool isExtensible(JSObject *proxy) MOZ_OVERRIDE
+    {
+        // always [[Extensible]], can't be made non-[[Extensible]], like most
+        // proxies
+        return true;
+    }
 };

 int DebugScopeProxy::family = 0;
@ -1476,8 +1489,7 @@ DebugScopeObject::create(JSContext *cx, ScopeObject &scope, HandleObject enclosi
 {
    JS_ASSERT(scope.compartment() == cx->compartment);
    JSObject *obj = NewProxyObject(cx, &DebugScopeProxy::singleton, ObjectValue(scope),
-                                   NULL /* proto */, &scope.global(),
-                                   NULL /* call */, NULL /* construct */);
+                                   NULL /* proto */, &scope.global(), ProxyNotCallable);
    if (!obj)
        return NULL;

--- a/js/src/vm/Shape.cpp
+++ b/js/src/vm/Shape.cpp
@ -1028,12 +1028,19 @@ Shape::setObjectParent(JSContext *cx, JSObject *parent, TaggedProto proto, Shape
    return replaceLastProperty(cx, base, proto, lastRoot);
 }

-bool
-JSObject::preventExtensions(JSContext *cx)
+/* static */ bool
+js::ObjectImpl::preventExtensions(JSContext *cx, Handle<ObjectImpl*> obj)
 {
-    JS_ASSERT(isExtensible());
+    MOZ_ASSERT(obj->isExtensible(),
+               "Callers must ensure |obj| is extensible before calling "
+               "preventExtensions");

-    RootedObject self(cx, this);
+    if (obj->isProxy()) {
+        RootedObject object(cx, obj->asObjectPtr());
+        return js::Proxy::preventExtensions(cx, object);
+    }
+
+    RootedObject self(cx, obj->asObjectPtr());

    /*
     * Force lazy properties to be resolved by iterating over the objects' own
--- a/js/xpconnect/src/XPCComponents.cpp
+++ b/js/xpconnect/src/XPCComponents.cpp
@ -3057,8 +3057,7 @@ bool
 xpc::SandboxCallableProxyHandler::call(JSContext *cx, JS::Handle<JSObject*> proxy,
                                       unsigned argc, Value *vp)
 {
-    // We forward the call to our underlying callable. The callable to forward
-    // to can be gotten via GetProxyCall.
+    // We forward the call to our underlying callable.

    // The parent of our proxy is the SandboxProxyHandler proxy
    JSObject *sandboxProxy = JS_GetParent(proxy);
@ -3106,7 +3105,7 @@ xpc::SandboxCallableProxyHandler::call(JSContext *cx, JS::Handle<JSObject*> prox
        thisVal = ObjectValue(*js::GetProxyTargetObject(sandboxProxy));
    }

-    return JS::Call(cx, thisVal, js::GetProxyCall(proxy), argc,
+    return JS::Call(cx, thisVal, js::GetProxyPrivate(proxy), argc,
                    JS_ARGV(cx, vp), vp);
 }

@ -3125,11 +3124,9 @@ WrapCallable(JSContext *cx, JSObject *callable, JSObject *sandboxProtoProxy)
               js::GetProxyHandler(sandboxProtoProxy) ==
                 &xpc::sandboxProxyHandler);

-    // We need to pass the given callable in as the "call" and
-    // "construct" so we get a function proxy.
    return js::NewProxyObject(cx, &xpc::sandboxCallableProxyHandler,
                              ObjectValue(*callable), nullptr,
-                              sandboxProtoProxy, callable, callable);
+                              sandboxProtoProxy, js::ProxyIsCallable);
 }

 template<typename Op>
--- a/js/xpconnect/src/event_impl_gen.conf.in
+++ b/js/xpconnect/src/event_impl_gen.conf.in
@ -26,7 +26,6 @@ simple_events = [
    'SmartCardEvent',
 #ifdef MOZ_B2G_BT
    'BluetoothDeviceEvent',
-    'BluetoothDeviceAddressEvent',
 #endif
 #ifdef MOZ_B2G_RIL
    'CallEvent',
--- a/js/xpconnect/wrappers/XrayWrapper.cpp
+++ b/js/xpconnect/wrappers/XrayWrapper.cpp
@ -1337,7 +1337,7 @@ IsXrayResolving(JSContext *cx, JSObject *wrapper, jsid id)
    return XPCWrappedNativeXrayTraits::isResolving(cx, holder, id);
 }

-}
+} // namespace XrayUtils

 static JSBool
 XrayToString(JSContext *cx, unsigned argc, jsval *vp)
@ -1416,6 +1416,27 @@ DEBUG_CheckXBLLookup(JSContext *cx, JSPropertyDescriptor *desc)
 #define DEBUG_CheckXBLLookup(a, b) {}
 #endif

+template <typename Base, typename Traits>
+bool
+XrayWrapper<Base, Traits>::isExtensible(JSObject *wrapper)
+{
+    // Xray wrappers are supposed to provide a clean view of the target
+    // reflector, hiding any modifications by script in the target scope.  So
+    // even if that script freezes the reflector, we don't want to make that
+    // visible to the caller. DOM reflectors are always extensible by default,
+    // so we can just return true here.
+    return true;
+}
+
+template <typename Base, typename Traits>
+bool
+XrayWrapper<Base, Traits>::preventExtensions(JSContext *cx, JS::Handle<JSObject*> wrapper)
+{
+    // See above.
+    JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_CANT_CHANGE_EXTENSIBILITY);
+    return false;
+}
+
 template <typename Base, typename Traits>
 bool
 XrayWrapper<Base, Traits>::getPropertyDescriptor(JSContext *cx, JS::Handle<JSObject*> wrapper,
--- a/js/xpconnect/wrappers/XrayWrapper.h
+++ b/js/xpconnect/wrappers/XrayWrapper.h
@ -66,6 +66,8 @@ class XrayWrapper : public Base {
    virtual ~XrayWrapper();

    /* Fundamental proxy traps. */
+    virtual bool isExtensible(JSObject *wrapper) MOZ_OVERRIDE;
+    virtual bool preventExtensions(JSContext *cx, JS::Handle<JSObject*> wrapper) MOZ_OVERRIDE;
    virtual bool getPropertyDescriptor(JSContext *cx, JS::Handle<JSObject*> wrapper, JS::Handle<jsid> id,
                                       js::PropertyDescriptor *desc, unsigned flags);
    virtual bool getOwnPropertyDescriptor(JSContext *cx, JS::Handle<JSObject*> wrapper, JS::Handle<jsid> id,
--- a/layout/base/nsDocumentViewer.cpp
+++ b/layout/base/nsDocumentViewer.cpp
@ -1018,15 +1018,15 @@ nsDocumentViewer::LoadComplete(nsresult aStatus)

    docShell->GetRestoringDocument(&restoring);
    if (!restoring) {
-      MOZ_ASSERT(mDocument->IsXUL() || // readyState for XUL is bogus
-                 mDocument->GetReadyStateEnum() ==
-                   nsIDocument::READYSTATE_INTERACTIVE ||
-                 // test_stricttransportsecurity.html has old-style
-                 // docshell-generated about:blank docs reach this code!
-                 (mDocument->GetReadyStateEnum() ==
-                    nsIDocument::READYSTATE_UNINITIALIZED &&
-                  NS_IsAboutBlank(mDocument->GetDocumentURI())),
-                 "Bad readystate");
+      NS_ASSERTION(mDocument->IsXUL() || // readyState for XUL is bogus
+                   mDocument->GetReadyStateEnum() ==
+                     nsIDocument::READYSTATE_INTERACTIVE ||
+                   // test_stricttransportsecurity.html has old-style
+                   // docshell-generated about:blank docs reach this code!
+                   (mDocument->GetReadyStateEnum() ==
+                      nsIDocument::READYSTATE_UNINITIALIZED &&
+                    NS_IsAboutBlank(mDocument->GetDocumentURI())),
+                   "Bad readystate");
      nsCOMPtr<nsIDocument> d = mDocument;
      mDocument->SetReadyStateInternal(nsIDocument::READYSTATE_COMPLETE);

--- a/Показать больше
+++ b/Показать больше