Merge m-c to autoland. a=merge

CLOBBER

@@ -22,4 +22,4 @@
 # changes to stick? As of bug 928195, this shouldn't be necessary! Please
 # don't change CLOBBER for WebIDL changes any more.
 
-Bug 1287967 - Changing js/src/old-configure.in seems to require clobber
+Bug 1299332 for the relanding of Bug 1299276.

devtools/client/locales/en-US/components.properties

@@ -13,3 +13,7 @@ frame.unknownSource=(unknown)
 # a source link that links to the debugger.
 # %S represents the URL to match in the debugger.
 frame.viewsourceindebugger=View source in Debugger → %S
+
+# LOCALIZATION NOTE (notificationBox.closeTooltip): The content of a tooltip that
+# appears when hovering over the close button in a notification box.
+notificationBox.closeTooltip=Close this message

devtools/client/shared/components/notification-box.js

@@ -6,6 +6,8 @@
 
 const React = require("devtools/client/shared/vendor/react");
 const Immutable = require("devtools/client/shared/vendor/immutable");
+const { LocalizationHelper } = require("devtools/shared/l10n");
+const l10n = new LocalizationHelper("devtools/locale/components.properties");
 
 // Shortcuts
 const { PropTypes, createClass, DOM } = React;
@@ -74,6 +76,15 @@ var NotificationBox = createClass({
       // with the notification box.
       eventCallback: PropTypes.func,
     })),
+
+    // Message that should be shown when hovering over the close button
+    closeButtonTooltip: PropTypes.string
+  },
+
+  getDefaultProps() {
+    return {
+      closeButtonTooltip: l10n.getStr("notificationBox.closeTooltip")
+    };
   },
 
   getInitialState() {
@@ -224,6 +235,7 @@ var NotificationBox = createClass({
           ),
           div({
             className: "messageCloseButton",
+            title: this.props.closeButtonTooltip,
             onClick: this.close.bind(this, notification)}
           )
         )

devtools/server/actors/object.js

@@ -1852,7 +1852,14 @@ function getPromiseState(obj) {
       "Can't call `getPromiseState` on `Debugger.Object`s that don't " +
       "refer to Promise objects.");
   }
-  return obj.promiseState;
+
+  let state = { state: obj.promiseState };
+  if (state.state === "fulfilled") {
+    state.value = obj.promiseValue;
+  } else if (state.state === "rejected") {
+    state.reason = obj.promiseReason;
+  }
+  return state;
 }
 
 /**

dom/animation/AnimValuesStyleRule.cpp

@@ -39,9 +39,7 @@ AnimValuesStyleRule::MapRuleInfoInto(nsRuleData* aRuleData)
     {
       nsCSSValue *prop = aRuleData->ValueFor(pair.mProperty);
       if (prop->GetUnit() == eCSSUnit_Null) {
-#ifdef DEBUG
-        bool ok =
-#endif
+        DebugOnly<bool> ok =
           StyleAnimationValue::UncomputeValue(pair.mProperty, pair.mValue,
                                               *prop);
         MOZ_ASSERT(ok, "could not store computed value");
@@ -78,7 +76,8 @@ AnimValuesStyleRule::List(FILE* out, int32_t aIndent) const
     str.Append(nsCSSProps::GetStringValue(pair.mProperty));
     str.AppendLiteral(": ");
     nsAutoString value;
-    StyleAnimationValue::UncomputeValue(pair.mProperty, pair.mValue, value);
+    Unused <<
+      StyleAnimationValue::UncomputeValue(pair.mProperty, pair.mValue, value);
     AppendUTF16toUTF8(value, str);
     str.AppendLiteral("; ");
   }

dom/animation/KeyframeEffect.cpp

@@ -645,12 +645,12 @@ DumpAnimationProperties(nsTArray<AnimationProperty>& aAnimationProperties)
     printf("%s\n", nsCSSProps::GetStringValue(p.mProperty).get());
     for (auto& s : p.mSegments) {
       nsString fromValue, toValue;
-      StyleAnimationValue::UncomputeValue(p.mProperty,
-                                          s.mFromValue,
-                                          fromValue);
-      StyleAnimationValue::UncomputeValue(p.mProperty,
-                                          s.mToValue,
-                                          toValue);
+      Unused << StyleAnimationValue::UncomputeValue(p.mProperty,
+                                                    s.mFromValue,
+                                                    fromValue);
+      Unused << StyleAnimationValue::UncomputeValue(p.mProperty,
+                                                    s.mToValue,
+                                                    toValue);
       printf("  %f..%f: %s..%s\n", s.mFromKey, s.mToKey,
              NS_ConvertUTF16toUTF8(fromValue).get(),
              NS_ConvertUTF16toUTF8(toValue).get());
@@ -709,7 +709,9 @@ CreatePropertyValue(nsCSSPropertyID aProperty,
   aResult.mOffset = aOffset;
 
   nsString stringValue;
-  StyleAnimationValue::UncomputeValue(aProperty, aValue, stringValue);
+  DebugOnly<bool> uncomputeResult =
+    StyleAnimationValue::UncomputeValue(aProperty, aValue, stringValue);
+  MOZ_ASSERT(uncomputeResult, "failed to uncompute value");
   aResult.mValue = stringValue;
 
   if (aTimingFunction) {

dom/animation/KeyframeUtils.cpp

@@ -1575,10 +1575,11 @@ GetCumulativeDistances(const nsTArray<ComputedKeyframeValues>& aValues,
         // If the property is longhand, we just use the 1st value.
         // If ComputeDistance() fails, |dist| will remain zero so there will be
         // no distance between the previous paced value and this value.
-        StyleAnimationValue::ComputeDistance(aPacedProperty,
-                                             prevPacedValues[0].mValue,
-                                             pacedValues[0].mValue,
-                                             dist);
+        Unused <<
+          StyleAnimationValue::ComputeDistance(aPacedProperty,
+                                               prevPacedValues[0].mValue,
+                                               pacedValues[0].mValue,
+                                               dist);
       }
       cumulativeDistances[i] = cumulativeDistances[preIdx] + dist;
     }

dom/base/nsImageLoadingContent.cpp

@@ -673,7 +673,7 @@ nsImageLoadingContent::ForceReload(const mozilla::dom::Optional<bool>& aNotify,
   ImageLoadType loadType = \
     (mCurrentRequestFlags & REQUEST_IS_IMAGESET) ? eImageLoadType_Imageset
                                                  : eImageLoadType_Normal;
-  nsresult rv = LoadImage(currentURI, true, notify, loadType, true, nullptr,
+  nsresult rv = LoadImage(currentURI, true, notify, loadType, nullptr,
                           nsIRequest::VALIDATE_ALWAYS);
   if (NS_FAILED(rv)) {
     aError.Throw(rv);
@@ -757,10 +757,7 @@ nsImageLoadingContent::LoadImage(const nsAString& aNewURI,
     return NS_OK;
   }
 
-  // Fire loadstart event
-  FireEvent(NS_LITERAL_STRING("loadstart"));
-
-  // Parse the URI string to get image URI
+  // Second, parse the URI string to get image URI
   nsCOMPtr<nsIURI> imageURI;
   nsresult rv = StringToURI(aNewURI, doc, getter_AddRefs(imageURI));
   if (NS_FAILED(rv)) {
@@ -791,7 +788,7 @@ nsImageLoadingContent::LoadImage(const nsAString& aNewURI,
 
   NS_TryToSetImmutable(imageURI);
 
-  return LoadImage(imageURI, aForce, aNotify, aImageLoadType, false, doc);
+  return LoadImage(imageURI, aForce, aNotify, aImageLoadType, doc);
 }
 
 nsresult
@@ -799,15 +796,9 @@ nsImageLoadingContent::LoadImage(nsIURI* aNewURI,
                                  bool aForce,
                                  bool aNotify,
                                  ImageLoadType aImageLoadType,
-                                 bool aLoadStart,
                                  nsIDocument* aDocument,
                                  nsLoadFlags aLoadFlags)
 {
-  // Fire loadstart event if required
-  if (aLoadStart) {
-    FireEvent(NS_LITERAL_STRING("loadstart"));
-  }
-
   if (!mLoadingEnabled) {
     // XXX Why fire an error here? seems like the callers to SetLoadingEnabled
     // don't want/need it.

dom/base/nsImageLoadingContent.h

@@ -133,15 +133,13 @@ protected:
    * @param aNotify If true, nsIDocumentObserver state change notifications
    *                will be sent as needed.
    * @param aImageLoadType The ImageLoadType for this request
-   * @param aLoadStart If true, dispatch "loadstart" event.
    * @param aDocument Optional parameter giving the document this node is in.
    *        This is purely a performance optimization.
    * @param aLoadFlags Optional parameter specifying load flags to use for
    *        the image load
    */
   nsresult LoadImage(nsIURI* aNewURI, bool aForce, bool aNotify,
-                     ImageLoadType aImageLoadType, bool aLoadStart = true,
-                     nsIDocument* aDocument = nullptr,
+                     ImageLoadType aImageLoadType, nsIDocument* aDocument = nullptr,
                      nsLoadFlags aLoadFlags = nsIRequest::LOAD_NORMAL);
 
   /**

dom/canvas/CanvasRenderingContext2D.cpp

@@ -354,9 +354,16 @@ public:
       aCtx->CurrentState().updateFilterOnWriteOnly = false;
     }
 
-    FilterSupport::ComputeSourceNeededRegions(
-      aCtx->CurrentState().filter, mPostFilterBounds,
-      sourceGraphicNeededRegion, fillPaintNeededRegion, strokePaintNeededRegion);
+    // This should not be empty, but if it is, we want to handle it
+    // rather than crash, as UpdateFilter() call above could have changed
+    // the number of filter primitives.
+    MOZ_ASSERT(!aCtx->CurrentState().filter.mPrimitives.IsEmpty());
+    if (!aCtx->CurrentState().filter.mPrimitives.IsEmpty()) {
+      FilterSupport::ComputeSourceNeededRegions(
+        aCtx->CurrentState().filter, mPostFilterBounds,
+        sourceGraphicNeededRegion, fillPaintNeededRegion,
+        strokePaintNeededRegion);
+    }
 
     mSourceGraphicRect = sourceGraphicNeededRegion.GetBounds();
     mFillPaintRect = fillPaintNeededRegion.GetBounds();
@@ -431,6 +438,7 @@ public:
     AutoRestoreTransform autoRestoreTransform(mFinalTarget);
     mFinalTarget->SetTransform(Matrix());
 
+    MOZ_RELEASE_ASSERT(!mCtx->CurrentState().filter.mPrimitives.IsEmpty());
     gfx::FilterSupport::RenderFilterDescription(
       mFinalTarget, mCtx->CurrentState().filter,
       gfx::Rect(mPostFilterBounds),
@@ -442,7 +450,7 @@ public:
       DrawOptions(1.0f, mCompositionOp));
 
     const gfx::FilterDescription& filter = mCtx->CurrentState().filter;
-    MOZ_ASSERT(!filter.mPrimitives.IsEmpty());
+    MOZ_RELEASE_ASSERT(!filter.mPrimitives.IsEmpty());
     if (filter.mPrimitives.LastElement().IsTainted() && mCtx->mCanvasElement) {
       mCtx->mCanvasElement->SetWriteOnly();
     }

dom/imptests/failures/html/js/builtins/test_WeakMap.prototype-properties.html.json

@@ -1,7 +0,0 @@
-{
-  "WeakMap.prototype.delete.length": true,
-  "WeakMap.prototype.get.length": true,
-  "WeakMap.prototype.has.length": true,
-  "WeakMap.prototype.set.length": true,
-  "WeakMap.prototype.@@toStringTag": true
-}

dom/plugins/base/nsJSNPRuntime.cpp

@@ -1370,6 +1370,19 @@ NPObjWrapper_GetProperty(JSContext *cx, JS::Handle<JSObject*> obj, JS::Handle<js
       vp.setObject(*obj);
       return true;
     }
+
+    if (JS::GetSymbolCode(sym) == JS::SymbolCode::toStringTag) {
+      JS::RootedString tag(cx, JS_NewStringCopyZ(cx, NPRUNTIME_JSCLASS_NAME));
+      if (!tag) {
+        return false;
+      }
+
+      vp.setString(tag);
+      return true;
+    }
+
+    vp.setUndefined();
+    return true;
   }
 
   // Find out what plugin (NPP) is the owner of the object we're

dom/security/nsCSPContext.cpp

@@ -723,14 +723,14 @@ nsCSPContext::logToConsole(const char16_t* aName,
  *
  * @param aURI
  *        The uri to be stripped for reporting
- * @param aProtectedResourcePrincipal
- *        The loadingPrincipal of the protected resource
+ * @param aSelfURI
+ *        The uri of the protected resource
  *        which is needed to enforce the SOP.
  * @return ASCII serialization of the uri to be reported.
  */
 void
 StripURIForReporting(nsIURI* aURI,
-                     nsIPrincipal* aProtectedResourcePrincipal,
+                     nsIURI* aSelfURI,
                      nsACString& outStrippedURI)
 {
   // 1) If the origin of uri is a globally unique identifier (for example,
@@ -751,9 +751,7 @@ StripURIForReporting(nsIURI* aURI,
 
   // 2) If the origin of uri is not the same as the origin of the protected
   // resource, then return the ASCII serialization of uri’s origin.
-  bool sameOrigin =
-    NS_SUCCEEDED(aProtectedResourcePrincipal->CheckMayLoad(aURI, false, false));
-  if (!sameOrigin) {
+  if (!NS_SecurityCompareURIs(aSelfURI, aURI, false)) {
     // cross origin redirects also fall into this category, see:
     // http://www.w3.org/TR/CSP/#violation-reports
     aURI->GetPrePath(outStrippedURI);
@@ -810,7 +808,7 @@ nsCSPContext::SendReports(nsISupports* aBlockedContentSource,
     nsCOMPtr<nsIURI> uri = do_QueryInterface(aBlockedContentSource);
     // could be a string or URI
     if (uri) {
-      StripURIForReporting(uri, mLoadingPrincipal, reportBlockedURI);
+      StripURIForReporting(uri, mSelfURI, reportBlockedURI);
     } else {
       nsCOMPtr<nsISupportsCString> cstr = do_QueryInterface(aBlockedContentSource);
       if (cstr) {
@@ -827,7 +825,7 @@ nsCSPContext::SendReports(nsISupports* aBlockedContentSource,
 
   // document-uri
   nsAutoCString reportDocumentURI;
-  StripURIForReporting(mSelfURI, mLoadingPrincipal, reportDocumentURI);
+  StripURIForReporting(mSelfURI, mSelfURI, reportDocumentURI);
   report.mCsp_report.mDocument_uri = NS_ConvertUTF8toUTF16(reportDocumentURI);
 
   // original-policy

editor/libeditor/CompositionTransaction.cpp

@@ -288,7 +288,10 @@ CompositionTransaction::SetIMESelection(EditorBase& aEditorBase,
 
     // If caret range isn't specified explicitly, we should hide the caret.
     // Hiding the caret benefits a Windows build (see bug 555642 comment #6).
-    aEditorBase.HideCaret(true);
+    // However, when there is no range, we should keep showing caret.
+    if (countOfRanges) {
+      aEditorBase.HideCaret(true);
+    }
   }
 
   rv = selection->EndBatchChangesInternal();

gfx/layers/composite/AsyncCompositionManager.cpp

@@ -561,8 +561,13 @@ SampleValue(float aPortion, Animation& aAnimation, StyleAnimationValue& aStart,
                aStart.GetUnit() == StyleAnimationValue::eUnit_None ||
                aEnd.GetUnit() == StyleAnimationValue::eUnit_None,
                "Must have same unit");
-  StyleAnimationValue::Interpolate(aAnimation.property(), aStart, aEnd,
-                                aPortion, interpolatedValue);
+  // This should never fail because we only pass transform and opacity values
+  // to the compositor and they should never fail to interpolate.
+  DebugOnly<bool> uncomputeResult =
+    StyleAnimationValue::Interpolate(aAnimation.property(), aStart, aEnd,
+                                     aPortion, interpolatedValue);
+  MOZ_ASSERT(uncomputeResult, "could not uncompute value");
+
   if (aAnimation.property() == eCSSProperty_opacity) {
     *aValue = interpolatedValue.GetFloatValue();
     return;

gfx/src/FilterSupport.cpp

@@ -1238,6 +1238,7 @@ FilterNodeGraphFromDescription(DrawTarget* aDT,
                                nsTArray<RefPtr<SourceSurface>>& aAdditionalImages)
 {
   const nsTArray<FilterPrimitiveDescription>& primitives = aFilter.mPrimitives;
+  MOZ_RELEASE_ASSERT(!primitives.IsEmpty());
 
   RefPtr<FilterCachedColorModels> sourceFilters[4];
   nsTArray<RefPtr<FilterCachedColorModels> > primitiveFilters;
@@ -1328,6 +1329,7 @@ FilterNodeGraphFromDescription(DrawTarget* aDT,
     primitiveFilters.AppendElement(primitiveFilter);
   }
 
+  MOZ_RELEASE_ASSERT(!primitiveFilters.IsEmpty());
   return primitiveFilters.LastElement()->ForColorModel(ColorModel::PremulSRGB());
 }
 
@@ -1477,6 +1479,8 @@ FilterSupport::ComputeResultChangeRegion(const FilterDescription& aFilter,
                                          const nsIntRegion& aStrokePaintChange)
 {
   const nsTArray<FilterPrimitiveDescription>& primitives = aFilter.mPrimitives;
+  MOZ_RELEASE_ASSERT(!primitives.IsEmpty());
+
   nsTArray<nsIntRegion> resultChangeRegions;
 
   for (int32_t i = 0; i < int32_t(primitives.Length()); ++i) {
@@ -1498,6 +1502,7 @@ FilterSupport::ComputeResultChangeRegion(const FilterDescription& aFilter,
     resultChangeRegions.AppendElement(changeRegion);
   }
 
+  MOZ_RELEASE_ASSERT(!resultChangeRegions.IsEmpty());
   return resultChangeRegions[resultChangeRegions.Length() - 1];
 }
 
@@ -1638,6 +1643,7 @@ FilterSupport::ComputePostFilterExtents(const FilterDescription& aFilter,
                                         const nsIntRegion& aSourceGraphicExtents)
 {
   const nsTArray<FilterPrimitiveDescription>& primitives = aFilter.mPrimitives;
+  MOZ_RELEASE_ASSERT(!primitives.IsEmpty());
   nsTArray<nsIntRegion> postFilterExtents;
 
   for (int32_t i = 0; i < int32_t(primitives.Length()); ++i) {
@@ -1658,6 +1664,7 @@ FilterSupport::ComputePostFilterExtents(const FilterDescription& aFilter,
     postFilterExtents.AppendElement(extent);
   }
 
+  MOZ_RELEASE_ASSERT(!postFilterExtents.IsEmpty());
   return postFilterExtents[postFilterExtents.Length() - 1];
 }
 
@@ -1768,6 +1775,11 @@ FilterSupport::ComputeSourceNeededRegions(const FilterDescription& aFilter,
                                           nsIntRegion& aStrokePaintNeededRegion)
 {
   const nsTArray<FilterPrimitiveDescription>& primitives = aFilter.mPrimitives;
+  MOZ_ASSERT(!primitives.IsEmpty());
+  if (primitives.IsEmpty()) {
+    return;
+  }
+
   nsTArray<nsIntRegion> primitiveNeededRegions;
   primitiveNeededRegions.AppendElements(primitives.Length());
 
@@ -1791,11 +1803,9 @@ FilterSupport::ComputeSourceNeededRegions(const FilterDescription& aFilter,
   }
 
   // Clip original SourceGraphic to first filter region.
-  if (primitives.Length() > 0) {
-    const FilterPrimitiveDescription& firstDescr = primitives[0];
-    aSourceGraphicNeededRegion.And(aSourceGraphicNeededRegion,
-                                   firstDescr.FilterSpaceBounds());
-  }
+  const FilterPrimitiveDescription& firstDescr = primitives[0];
+  aSourceGraphicNeededRegion.And(aSourceGraphicNeededRegion,
+                                 firstDescr.FilterSpaceBounds());
 }
 
 // FilterPrimitiveDescription

js/src/builtin/MapObject.cpp

@@ -151,8 +151,11 @@ GlobalObject::initMapIteratorProto(JSContext* cx, Handle<GlobalObject*> global)
     RootedPlainObject proto(cx, NewObjectWithGivenProto<PlainObject>(cx, base));
     if (!proto)
         return false;
-    if (!JS_DefineFunctions(cx, proto, MapIteratorObject::methods))
+    if (!JS_DefineFunctions(cx, proto, MapIteratorObject::methods) ||
+        !DefineToStringTag(cx, proto, cx->names().MapIterator))
+    {
         return false;
+    }
     global->setReservedSlot(MAP_ITERATOR_PROTO, ObjectValue(*proto));
     return true;
 }
@@ -337,6 +340,10 @@ MapObject::initClass(JSContext* cx, JSObject* obj)
         RootedId iteratorId(cx, SYMBOL_TO_JSID(cx->wellKnownSymbols().iterator));
         if (!JS_DefinePropertyById(cx, proto, iteratorId, funval, 0))
             return nullptr;
+
+        // Define Map.prototype[@@toStringTag].
+        if (!DefineToStringTag(cx, proto, cx->names().Map))
+            return nullptr;
     }
     return proto;
 }
@@ -893,8 +900,11 @@ GlobalObject::initSetIteratorProto(JSContext* cx, Handle<GlobalObject*> global)
     RootedPlainObject proto(cx, NewObjectWithGivenProto<PlainObject>(cx, base));
     if (!proto)
         return false;
-    if (!JS_DefineFunctions(cx, proto, SetIteratorObject::methods))
+    if (!JS_DefineFunctions(cx, proto, SetIteratorObject::methods) ||
+        !DefineToStringTag(cx, proto, cx->names().SetIterator))
+    {
         return false;
+    }
     global->setReservedSlot(SET_ITERATOR_PROTO, ObjectValue(*proto));
     return true;
 }
@@ -1053,6 +1063,10 @@ SetObject::initClass(JSContext* cx, JSObject* obj)
         RootedId iteratorId(cx, SYMBOL_TO_JSID(cx->wellKnownSymbols().iterator));
         if (!JS_DefinePropertyById(cx, proto, iteratorId, funval, 0))
             return nullptr;
+
+        // Define Set.prototype[@@toStringTag].
+        if (!DefineToStringTag(cx, proto, cx->names().Set))
+            return nullptr;
     }
     return proto;
 }

js/src/builtin/Object.cpp

@@ -305,63 +305,116 @@ js::ObjectToSource(JSContext* cx, HandleObject obj)
 }
 #endif /* JS_HAS_TOSOURCE */
 
-JSString*
-JS_BasicObjectToString(JSContext* cx, HandleObject obj)
-{
-    // Some classes are really common, don't allocate new strings for them.
-    // The ordering below is based on the measurements in bug 966264.
-    if (obj->is<PlainObject>())
-        return cx->names().objectObject;
-    if (obj->is<StringObject>())
-        return cx->names().objectString;
-    if (obj->is<ArrayObject>())
-        return cx->names().objectArray;
-    if (obj->is<JSFunction>())
-        return cx->names().objectFunction;
-    if (obj->is<NumberObject>())
-        return cx->names().objectNumber;
-
-    const char* className = GetObjectClassName(cx, obj);
-
-    if (strcmp(className, "Window") == 0)
-        return cx->names().objectWindow;
-
-    StringBuffer sb(cx);
-    if (!sb.append("[object ") || !sb.append(className, strlen(className)) ||
-        !sb.append("]"))
-    {
-        return nullptr;
-    }
-    return sb.finishString();
-}
-
-/* ES5 15.2.4.2.  Note steps 1 and 2 are errata. */
+// ES6 19.1.3.6
 bool
 js::obj_toString(JSContext* cx, unsigned argc, Value* vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    /* Step 1. */
+    // Step 1.
     if (args.thisv().isUndefined()) {
         args.rval().setString(cx->names().objectUndefined);
         return true;
     }
 
-    /* Step 2. */
+    // Step 2.
     if (args.thisv().isNull()) {
         args.rval().setString(cx->names().objectNull);
         return true;
     }
 
-    /* Step 3. */
+    // Step 3.
     RootedObject obj(cx, ToObject(cx, args.thisv()));
     if (!obj)
         return false;
 
-    /* Steps 4-5. */
-    JSString* str = JS_BasicObjectToString(cx, obj);
+    // Step 4.
+    bool isArray;
+    if (!IsArray(cx, obj, &isArray))
+        return false;
+
+    // Step 5.
+    RootedString builtinTag(cx);
+    if (isArray) {
+        builtinTag = cx->names().objectArray;
+    } else {
+        // Steps 6-13.
+        ESClass cls;
+        if (!GetBuiltinClass(cx, obj, &cls))
+            return false;
+
+        switch (cls) {
+          case ESClass::String:
+            builtinTag = cx->names().objectString;
+            break;
+          case ESClass::Arguments:
+            builtinTag = cx->names().objectArguments;
+            break;
+          case ESClass::Error:
+            builtinTag = cx->names().objectError;
+            break;
+          case ESClass::Boolean:
+            builtinTag = cx->names().objectBoolean;
+            break;
+          case ESClass::Number:
+            builtinTag = cx->names().objectNumber;
+            break;
+          case ESClass::Date:
+            builtinTag = cx->names().objectDate;
+            break;
+          case ESClass::RegExp:
+            builtinTag = cx->names().objectRegExp;
+            break;
+          default:
+            if (obj->isCallable()) {
+                // Non-standard: Prevent <object> from showing up as Function.
+                RootedObject unwrapped(cx, CheckedUnwrap(obj));
+                if (!unwrapped || !unwrapped->getClass()->isDOMClass())
+                    builtinTag = cx->names().objectFunction;
+            }
+            break;
+        }
+    }
+    // Step 14.
+    // Currently omitted for non-standard fallback.
+
+    // Step 15.
+    RootedValue tag(cx);
+    RootedId toStringTagId(cx, SYMBOL_TO_JSID(cx->wellKnownSymbols().toStringTag));
+    if (!GetProperty(cx, obj, obj, toStringTagId, &tag))
+        return false;
+
+    // Step 16.
+    if (!tag.isString()) {
+        // Non-standard (bug 1277801): Use ClassName as a fallback in the interim
+        if (!builtinTag) {
+            const char* className = GetObjectClassName(cx, obj);
+
+            StringBuffer sb(cx);
+            if (!sb.append("[object ") || !sb.append(className, strlen(className)) ||
+                !sb.append("]"))
+            {
+                return false;
+            }
+
+            builtinTag = sb.finishString();
+            if (!builtinTag)
+                return false;
+        }
+
+        args.rval().setString(builtinTag);
+        return true;
+    }
+
+    // Step 17.
+    StringBuffer sb(cx);
+    if (!sb.append("[object ") || !sb.append(tag.toString()) || !sb.append("]"))
+        return false;
+
+    RootedString str(cx, sb.finishString());
     if (!str)
         return false;
+
     args.rval().setString(str);
     return true;
 }

js/src/builtin/SymbolObject.cpp

@@ -79,6 +79,7 @@ SymbolObject::initClass(JSContext* cx, HandleObject obj)
 
     if (!LinkConstructorAndPrototype(cx, ctor, proto) ||
         !DefinePropertiesAndFunctions(cx, proto, properties, methods) ||
+        !DefineToStringTag(cx, proto, cx->names().Symbol) ||
         !DefinePropertiesAndFunctions(cx, ctor, nullptr, staticMethods) ||
         !GlobalObject::initBuiltinConstructor(cx, global, JSProto_Symbol, ctor, proto))
     {

js/src/builtin/TypedArray.js

@@ -1438,6 +1438,21 @@ function TypedArraySpecies() {
     return this;
 }
 
+// ES 2017 draft June 2, 2016 22.2.3.32
+function TypedArrayToStringTag() {
+    // Step 1.
+    var O = this;
+
+    // Steps 2-3.
+    if (!IsObject(O) || !IsTypedArray(O))
+        return undefined;
+
+    // Steps 4-6.
+    // Modified to retrieve the [[TypedArrayName]] from the constructor.
+    return _NameForTypedArray(O);
+}
+_SetCanonicalName(TypedArrayToStringTag, "get [Symbol.toStringTag]");
+
 // ES 2016 draft Mar 25, 2016 24.1.4.3.
 function ArrayBufferSlice(start, end) {
     // Step 1.

js/src/builtin/WeakMapObject.cpp

@@ -435,6 +435,8 @@ InitWeakMapClass(JSContext* cx, HandleObject obj, bool defineMembers)
     if (defineMembers) {
         if (!DefinePropertiesAndFunctions(cx, proto, nullptr, weak_map_methods))
             return nullptr;
+        if (!DefineToStringTag(cx, proto, cx->names().WeakMap))
+            return nullptr;
     }
 
     if (!GlobalObject::initBuiltinConstructor(cx, global, JSProto_WeakMap, ctor, proto))

js/src/builtin/WeakSetObject.cpp

@@ -51,6 +51,7 @@ WeakSetObject::initClass(JSContext* cx, JSObject* obj)
     if (!ctor ||
         !LinkConstructorAndPrototype(cx, ctor, proto) ||
         !DefinePropertiesAndFunctions(cx, proto, properties, methods) ||
+        !DefineToStringTag(cx, proto, cx->names().WeakSet) ||
         !GlobalObject::initBuiltinConstructor(cx, global, JSProto_WeakSet, ctor, proto))
     {
         return nullptr;

js/src/doc/Debugger/Debugger.Object.md

@@ -205,32 +205,30 @@ from its prototype:
     If the referent is not a (scripted) proxy, return `undefined`.
 
 `promiseState`
-:   If the referent is a [`Promise`][promise], this is an object describing
-    the Promise's current state, with the following properties:
+:   If the referent is a [`Promise`][promise], return a string indicating
+    whether the [`Promise`][promise] is pending, or has been fulfilled or
+    rejected. This string takes one of the following values:
 
-    `state`
-    :   A string indicating whether the [`Promise`][promise] is pending or
-        has been fulfilled or rejected.
-        This accessor returns one of the following values:
+    * `"pending"`, if the [`Promise`][promise] is pending.
 
-        * `"pending"`, if the [`Promise`][promise] hasn't been resolved.
+    * `"fulfilled"`, if the [`Promise`][promise] has been fulfilled.
 
-        * `"fulfilled"`, if the [`Promise`][promise] has been fulfilled.
+    * `"rejected"`, if the [`Promise`][promise] has been rejected.
 
-        * `"rejected"`, if the [`Promise`][promise] has been rejected.
+    If the referent is not a [`Promise`][promise], throw a `TypeError`.
 
-    `value`
-    :   If the [`Promise`][promise] has been *fulfilled*, this is a
-        `Debugger.Object` referring to the value it was fulfilled with,
-        `undefined` otherwise.
+`promiseValue`
+:   If the referent is a [`Promise`][promise] that has been fulfilled, return
+    a debuggee value representing the value the [`Promise`][promise] has been
+    fulfilled with.
 
-    `reason`
-    :   If the [`Promise`][promise] has been *rejected*, this is a
-        `Debugger.Object` referring to the value it was rejected with,
-        `undefined` otherwise.
+    If the [`Promise`][promise] has not been fulfilled, return `undefined`. If
+    the referent is not a [`Promise`][promise], throw a `TypeError`.
 
-    If the referent is not a [`Promise`][promise], throw a `TypeError`
-    exception.
+`promiseReason`
+:   If the referent is a [`Promise`][promise] that has been rejected, return a
+    debuggee value representing the value the [`Promise`][promise] has been
+    rejected with.
 
 `promiseAllocationSite`
 :   If the referent is a [`Promise`][promise], this is the

js/src/jit-test/tests/basic/define-frozen-dense-strict.js

@@ -0,0 +1,16 @@
+"use strict";
+var t = [4];
+var stop;
+Object.freeze(t);
+do {
+    let ok = false;
+    stop = inIon();
+    try {
+        t[1] = 2;
+    } catch(e) {
+        ok = true;
+    }
+    assertEq(ok, true);
+    assertEq(t.length, 1);
+    assertEq(t[1], undefined);
+} while (!stop);

js/src/jit-test/tests/basic/define-frozen-dense.js

@@ -0,0 +1,9 @@
+var t = [4];
+var stop;
+Object.freeze(t);
+do {
+    stop = inIon();
+    t[1] = 2;
+    assertEq(t.length, 1);
+    assertEq(t[1], undefined);
+} while (!stop);

js/src/jit-test/tests/basic/define-frozen-property-strict.js

@@ -0,0 +1,14 @@
+function foo(x) {
+  "use strict";
+  var ok = false;
+  try {
+    x.c = 10;
+  } catch(e) {
+    ok = true;
+  }
+  assertEq(ok, true);
+  assertEq(x.c, undefined);
+}
+x = {a:0,b:1};
+Object.freeze(x);
+foo(x);

js/src/jit-test/tests/basic/define-frozen-property.js

@@ -0,0 +1,7 @@
+function foo(x) {
+  x.c = 10;
+  assertEq(x.c, undefined);
+}
+x = {a:0,b:1};
+Object.freeze(x);
+foo(x);

js/src/jit-test/tests/basic/write-frozen-dense-strict-inlinecache.js

@@ -0,0 +1,20 @@
+// |jit-test| --no-threads; --ion-eager; --ion-shared-stubs=off
+setJitCompilerOption('ion.forceinlineCaches', 1);
+function foo(t) {
+    "use strict";
+    var stop;
+    do {
+        let ok = false;
+        stop = inIon();
+        try {
+            t[0] = 2;
+        } catch(e) {
+            ok = true;
+        }
+        assertEq(ok, true);
+    } while (!stop);
+}
+var t = [4];
+Object.freeze(t);
+foo(t);
+foo(t);

js/src/jit-test/tests/basic/write-frozen-dense-strict.js

@@ -0,0 +1,14 @@
+"use strict";
+var t = [4];
+var stop;
+Object.freeze(t);
+do {
+    let ok = false;
+    stop = inIon();
+    try {
+        t[0] = 2;
+    } catch(e) {
+        ok = true;
+    }
+    assertEq(ok, true);
+} while (!stop);

js/src/jit-test/tests/basic/write-frozen-dense.js

@@ -0,0 +1,8 @@
+var t = [4];
+var stop;
+Object.freeze(t);
+do {
+    stop = inIon();
+    t[0] = 2;
+    assertEq(t[0], 4);
+} while (!stop);

js/src/jit-test/tests/basic/write-frozen-property-strict.js

@@ -0,0 +1,14 @@
+function foo(x) {
+  "use strict";
+  var ok = false;
+  try {
+    x.a = 10;
+  } catch(e) {
+    ok = true;
+  }
+  assertEq(ok, true);
+  assertEq(x.a, 0);
+}
+x = {a:0,b:1};
+Object.freeze(x);
+foo(x);

js/src/jit-test/tests/basic/write-frozen-property.js

@@ -1,4 +1,3 @@
-
 function foo(x) {
   x.a = 10;
   assertEq(x.a, 0);

js/src/jit-test/tests/collections/Map-surfaces-1.js

@@ -13,11 +13,7 @@ assertEq(Map.length, 0);
 assertEq(Map.name, "Map");
 
 assertEq(Object.getPrototypeOf(Map.prototype), Object.prototype);
-assertEq("toStringTag" in Symbol, false,
-         "if this fails, congratulations!  implement " +
-         "Map.prototype[Symbol.toStringTag] = 'Map' in SpiderMonkey and make " +
-         "the next test check for '[object Map]' again");
-assertEq(Object.prototype.toString.call(Map.prototype), "[object Object]");
+assertEq(Object.prototype.toString.call(Map.prototype), "[object Map]");
 assertEq(Object.prototype.toString.call(new Map()), "[object Map]");
 assertEq(Object.keys(Map.prototype).join(), "");
 assertEq(Map.prototype.constructor, Map);

js/src/jit-test/tests/collections/Set-surfaces-1.js

@@ -13,11 +13,7 @@ assertEq(Set.length, 0);
 assertEq(Set.name, "Set");
 
 assertEq(Object.getPrototypeOf(Set.prototype), Object.prototype);
-assertEq("toStringTag" in Symbol, false,
-         "if this fails, congratulations!  implement " +
-         "Set.prototype[Symbol.toStringTag] = 'Set' in SpiderMonkey and make " +
-         "the next test check for '[object Set]' again");
-assertEq(Object.prototype.toString.call(Set.prototype), "[object Object]");
+assertEq(Object.prototype.toString.call(Set.prototype), "[object Set]");
 assertEq(Object.prototype.toString.call(new Set()), "[object Set]");
 assertEq(Object.keys(Set.prototype).join(), "");
 assertEq(Set.prototype.constructor, Set);

js/src/jit-test/tests/collections/WeakMap-surfaces.js

@@ -11,7 +11,7 @@ assertEq(WeakMap.length, 0);
 assertEq(WeakMap.name, "WeakMap");
 
 assertEq(Object.getPrototypeOf(WeakMap.prototype), Object.prototype);
-assertEq(Object.prototype.toString.call(WeakMap.prototype), "[object Object]");
+assertEq(Object.prototype.toString.call(WeakMap.prototype), "[object WeakMap]");
 assertEq(Object.prototype.toString.call(new WeakMap()), "[object WeakMap]");
 assertEq(Object.keys(WeakMap.prototype).join(), "");
 assertEq(WeakMap.prototype.constructor, WeakMap);

js/src/jit-test/tests/collections/WeakSet-surface.js

@@ -11,7 +11,7 @@ assertEq(WeakSet.length, 0);
 assertEq(WeakSet.name, "WeakSet");
 
 assertEq(Object.getPrototypeOf(WeakSet.prototype), Object.prototype);
-assertEq(Object.prototype.toString.call(WeakSet.prototype), "[object Object]");
+assertEq(Object.prototype.toString.call(WeakSet.prototype), "[object WeakSet]");
 assertEq(Object.prototype.toString.call(new WeakSet), "[object WeakSet]");
 assertEq(Object.keys(WeakSet.prototype).length, 0);
 assertEq(WeakSet.prototype.constructor, WeakSet);

js/src/jit-test/tests/collections/iterator-proto-surfaces.js

@@ -9,13 +9,9 @@ function test(constructor) {
     var iter = new constructor()[Symbol.iterator]();
     assertDeepEq(Reflect.ownKeys(iter), []);
 
-    // Iterator prototypes only have a .next property.
-    // At least until we support @@toStringTag.
+    // Iterator prototypes only have a .next and @@toStringTag property.
     var proto1 = Object.getPrototypeOf(iter);
-
-    var names = Reflect.ownKeys(proto1);
-    names.sort();
-    assertDeepEq(Reflect.ownKeys(proto1), ['next']);
+    assertDeepEq(Reflect.ownKeys(proto1), ['next', Symbol.toStringTag]);
 
     var desc = Object.getOwnPropertyDescriptor(proto1, 'next');
     assertEq(desc.configurable, true);

js/src/jit-test/tests/debug/Object-class.js

@@ -12,7 +12,7 @@ dbg.onDebuggerStatement = function (frame) {
     assertEq(arr[3].class, "Date");
     assertEq(arr[4].class, "Object");
     assertEq(arr[5].class, "Function");
-    assertEq(arr[6].class, "Date");
+    assertEq(arr[6].class, "Object");
     hits++;
 };
 g.f(Object.prototype, [], eval, new Date,

js/src/jit-test/tests/debug/inspect-wrapped-promise.js

@@ -1,36 +1,88 @@
 if (typeof Promise === "undefined")
     quit(0);
 
+load(libdir + "asserts.js");
+
 let g = newGlobal();
 let dbg = new Debugger();
 let gw = dbg.addDebuggee(g);
 
-g.promise = Promise.resolve(42);
+g.promise1 = new Promise(() => {});
+g.promise2 = Promise.resolve(42);
+g.promise3 = Promise.reject(42);
+g.promise4 = new Object();
+g.promise5 = Promise.prototype;
 
-let promiseDO = gw.getOwnPropertyDescriptor('promise').value;
+let promiseDO1 = gw.getOwnPropertyDescriptor('promise1').value;
+let promiseDO2 = gw.getOwnPropertyDescriptor('promise2').value;
+let promiseDO3 = gw.getOwnPropertyDescriptor('promise3').value;
+let promiseDO4 = gw.getOwnPropertyDescriptor('promise4').value;
+let promiseDO5 = gw.getOwnPropertyDescriptor('promise5').value;
 
-assertEq(promiseDO.isPromise, true);
+assertEq(promiseDO1.isPromise, true);
+assertEq(promiseDO2.isPromise, true);
+assertEq(promiseDO3.isPromise, true);
+assertEq(promiseDO4.isPromise, false);
+assertEq(promiseDO5.isPromise, false);
 
-let state = promiseDO.promiseState;
-assertEq(state.state, "fulfilled");
-assertEq(state.value, 42);
-assertEq("reason" in state, true);
-assertEq(state.reason, undefined);
+assertEq(promiseDO1.promiseState, "pending");
+assertEq(promiseDO2.promiseState, "fulfilled");
+assertEq(promiseDO3.promiseState, "rejected");
+assertThrowsInstanceOf(function () { promiseDO4.promiseState }, TypeError);
+assertThrowsInstanceOf(function () { promiseDO5.promiseState }, TypeError);
+
+assertEq(promiseDO1.promiseValue, undefined);
+assertEq(promiseDO2.promiseValue, 42);
+assertEq(promiseDO3.promiseValue, undefined);
+assertThrowsInstanceOf(function () { promiseDO4.promiseValue }, TypeError);
+assertThrowsInstanceOf(function () { promiseDO5.promiseValue }, TypeError);
+
+assertEq(promiseDO1.promiseReason, undefined);
+assertEq(promiseDO2.promiseReason, undefined);
+assertEq(promiseDO3.promiseReason, 42);
+assertThrowsInstanceOf(function () { promiseDO4.promiseReason }, TypeError);
+assertThrowsInstanceOf(function () { promiseDO5.promiseReason }, TypeError);
 
-let allocationSite = promiseDO.promiseAllocationSite;
 // Depending on whether async stacks are activated, this can be null, which
 // has typeof null.
-assertEq(typeof allocationSite === "object", true);
+assertEq(typeof promiseDO1.promiseAllocationSite === "object", true);
+assertEq(typeof promiseDO2.promiseAllocationSite === "object", true);
+assertEq(typeof promiseDO3.promiseAllocationSite === "object", true);
+assertThrowsInstanceOf(function () { promiseDO4.promiseAllocationSite }, TypeError);
+assertThrowsInstanceOf(function () { promiseDO5.promiseAllocationSite }, TypeError);
 
-let resolutionSite = promiseDO.promiseResolutionSite;
 // Depending on whether async stacks are activated, this can be null, which
 // has typeof null.
-assertEq(typeof resolutionSite === "object", true);
+assertThrowsInstanceOf(function () { promiseDO1.promiseResolutionSite }, TypeError);
+assertEq(typeof promiseDO2.promiseResolutionSite === "object", true);
+assertEq(typeof promiseDO3.promiseResolutionSite === "object", true);
+assertThrowsInstanceOf(function () { promiseDO4.promiseResolutionSite }, TypeError);
+assertThrowsInstanceOf(function () { promiseDO5.promiseResolutionSite }, TypeError);
 
-assertEq(promiseDO.promiseID, 1);
+assertEq(promiseDO1.promiseID, 1);
+assertEq(promiseDO2.promiseID, 2);
+assertEq(promiseDO3.promiseID, 3);
+assertThrowsInstanceOf(function () { promiseDO4.promiseID }, TypeError);
+assertThrowsInstanceOf(function () { promiseDO5.promiseID }, TypeError);
 
-assertEq(typeof promiseDO.promiseDependentPromises, "object");
-assertEq(promiseDO.promiseDependentPromises.length, 0);
+assertEq(typeof promiseDO1.promiseDependentPromises, "object");
+assertEq(typeof promiseDO2.promiseDependentPromises, "object");
+assertEq(typeof promiseDO3.promiseDependentPromises, "object");
+assertThrowsInstanceOf(function () { promiseDO4.promiseDependentPromises }, TypeError);
+assertThrowsInstanceOf(function () { promiseDO5.promiseDependentPromises }, TypeError);
 
-assertEq(typeof promiseDO.promiseLifetime, "number");
-assertEq(typeof promiseDO.promiseTimeToResolution, "number");
+assertEq(promiseDO1.promiseDependentPromises.length, 0);
+assertEq(promiseDO2.promiseDependentPromises.length, 0);
+assertEq(promiseDO3.promiseDependentPromises.length, 0);
+
+assertEq(typeof promiseDO1.promiseLifetime, "number");
+assertEq(typeof promiseDO2.promiseLifetime, "number");
+assertEq(typeof promiseDO3.promiseLifetime, "number");
+assertThrowsInstanceOf(function () { promiseDO4.promiseLifetime }, TypeError);
+assertThrowsInstanceOf(function () { promiseDO5.promiseLifetime }, TypeError);
+
+assertThrowsInstanceOf(function () { promiseDO1.promiseTimeToResolution }, TypeError);
+assertEq(typeof promiseDO2.promiseTimeToResolution, "number");
+assertEq(typeof promiseDO3.promiseTimeToResolution, "number");
+assertThrowsInstanceOf(function () { promiseDO4.promiseTimeToResolution }, TypeError);
+assertThrowsInstanceOf(function () { promiseDO5.promiseTimeToResolution }, TypeError);

js/src/jit-test/tests/proxy/operations-on-revoked.js

@@ -11,8 +11,8 @@ var p2 = r2.proxy;
 assertThrowsInstanceOf(() => ({} instanceof p), TypeError);
 assertThrowsInstanceOf(() => ({} instanceof p2), TypeError);
 
-assertEq(Object.prototype.toString.call(p), "[object Object]");
-assertEq(Object.prototype.toString.call(p2), "[object Function]");
+assertThrowsInstanceOf(() => Object.prototype.toString.call(p), TypeError);
+assertThrowsInstanceOf(() => Object.prototype.toString.call(p2), TypeError);
 
 assertThrowsInstanceOf(() => RegExp.prototype.exec.call(p, ""), TypeError);
 assertThrowsInstanceOf(() => RegExp.prototype.exec.call(p2, ""), TypeError);

js/src/jit/AliasAnalysisShared.cpp

@@ -90,6 +90,7 @@ GetObject(const MDefinition* ins)
       case MDefinition::Op_ArrayLength:
       case MDefinition::Op_SetArrayLength:
       case MDefinition::Op_StoreElementHole:
+      case MDefinition::Op_FallibleStoreElement:
       case MDefinition::Op_TypedObjectDescr:
       case MDefinition::Op_Slots:
       case MDefinition::Op_Elements:

js/src/jit/BaselineIC.cpp

@@ -2822,17 +2822,21 @@ ICSetElem_DenseOrUnboxedArray::Compiler::generateStubCode(MacroAssembler& masm)
         masm.branchTestMagic(Assembler::Equal, element, &failure);
 
         // Perform a single test to see if we either need to convert double
-        // elements or clone the copy on write elements in the object.
+        // elements, clone the copy on write elements in the object or fail
+        // due to a frozen element.
         Label noSpecialHandling;
         Address elementsFlags(scratchReg, ObjectElements::offsetOfFlags());
         masm.branchTest32(Assembler::Zero, elementsFlags,
                           Imm32(ObjectElements::CONVERT_DOUBLE_ELEMENTS |
-                                ObjectElements::COPY_ON_WRITE),
+                                ObjectElements::COPY_ON_WRITE |
+                                ObjectElements::FROZEN),
                           &noSpecialHandling);
 
-        // Fail if we need to clone copy on write elements.
+        // Fail if we need to clone copy on write elements or to throw due
+        // to a frozen element.
         masm.branchTest32(Assembler::NonZero, elementsFlags,
-                          Imm32(ObjectElements::COPY_ON_WRITE),
+                          Imm32(ObjectElements::COPY_ON_WRITE |
+                                ObjectElements::FROZEN),
                           &failure);
 
         // Failure is not possible now.  Free up registers.
@@ -3032,7 +3036,8 @@ ICSetElemDenseOrUnboxedArrayAddCompiler::generateStubCode(MacroAssembler& masm)
         // Check for copy on write elements.
         Address elementsFlags(scratchReg, ObjectElements::offsetOfFlags());
         masm.branchTest32(Assembler::NonZero, elementsFlags,
-                          Imm32(ObjectElements::COPY_ON_WRITE),
+                          Imm32(ObjectElements::COPY_ON_WRITE |
+                                ObjectElements::FROZEN),
                           &failure);
 
         // Failure is not possible now.  Free up registers.

js/src/jit/CodeGenerator.cpp

@@ -7975,7 +7975,8 @@ class OutOfLineStoreElementHole : public OutOfLineCodeBase<CodeGenerator>
     explicit OutOfLineStoreElementHole(LInstruction* ins)
       : ins_(ins)
     {
-        MOZ_ASSERT(ins->isStoreElementHoleV() || ins->isStoreElementHoleT());
+        MOZ_ASSERT(ins->isStoreElementHoleV() || ins->isStoreElementHoleT() ||
+                   ins->isFallibleStoreElementV() || ins->isFallibleStoreElementT());
     }
 
     void accept(CodeGenerator* codegen) {
@@ -8069,9 +8070,12 @@ CodeGenerator::visitStoreElementV(LStoreElementV* lir)
     }
 }
 
-void
-CodeGenerator::visitStoreElementHoleT(LStoreElementHoleT* lir)
+template <typename T> void
+CodeGenerator::emitStoreElementHoleT(T* lir)
 {
+    static_assert(std::is_same<T, LStoreElementHoleT>::value || std::is_same<T, LFallibleStoreElementT>::value,
+                  "emitStoreElementHoleT called with unexpected argument type");
+
     OutOfLineStoreElementHole* ool = new(alloc()) OutOfLineStoreElementHole(lir);
     addOutOfLineCode(ool, lir->mir());
 
@@ -8120,15 +8124,24 @@ CodeGenerator::visitStoreElementHoleT(LStoreElementHoleT* lir)
 }
 
 void
-CodeGenerator::visitStoreElementHoleV(LStoreElementHoleV* lir)
+CodeGenerator::visitStoreElementHoleT(LStoreElementHoleT* lir)
 {
+    emitStoreElementHoleT(lir);
+}
+
+template <typename T> void
+CodeGenerator::emitStoreElementHoleV(T* lir)
+{
+    static_assert(std::is_same<T, LStoreElementHoleV>::value || std::is_same<T, LFallibleStoreElementV>::value,
+                  "emitStoreElementHoleV called with unexpected parameter type");
+
     OutOfLineStoreElementHole* ool = new(alloc()) OutOfLineStoreElementHole(lir);
     addOutOfLineCode(ool, lir->mir());
 
     Register obj = ToRegister(lir->object());
     Register elements = ToRegister(lir->elements());
     const LAllocation* index = lir->index();
-    const ValueOperand value = ToValue(lir, LStoreElementHoleV::Value);
+    const ValueOperand value = ToValue(lir, T::Value);
     RegisterOrInt32Constant key = ToRegisterOrInt32Constant(index);
 
     JSValueType unboxedType = lir->mir()->unboxedType();
@@ -8170,6 +8183,66 @@ CodeGenerator::visitStoreElementHoleV(LStoreElementHoleV* lir)
     masm.bind(ool->rejoin());
 }
 
+void
+CodeGenerator::visitStoreElementHoleV(LStoreElementHoleV* lir)
+{
+    emitStoreElementHoleV(lir);
+}
+
+typedef bool (*ThrowReadOnlyFn)(JSContext*, HandleObject);
+static const VMFunction ThrowReadOnlyInfo =
+    FunctionInfo<ThrowReadOnlyFn>(ThrowReadOnlyError, "ThrowReadOnlyError");
+
+void
+CodeGenerator::visitFallibleStoreElementT(LFallibleStoreElementT* lir)
+{
+    Register elements = ToRegister(lir->elements());
+
+    // Handle frozen objects
+    Label isFrozen;
+    Address flags(elements, ObjectElements::offsetOfFlags());
+    if (!lir->mir()->strict()) {
+        masm.branchTest32(Assembler::NonZero, flags, Imm32(ObjectElements::FROZEN), &isFrozen);
+    } else {
+        Register object = ToRegister(lir->object());
+        OutOfLineCode* ool = oolCallVM(ThrowReadOnlyInfo, lir,
+                ArgList(object), StoreNothing());
+        masm.branchTest32(Assembler::NonZero, flags, Imm32(ObjectElements::FROZEN), ool->entry());
+        // This OOL code should have thrown an exception, so will never return.
+        // So, do not bind ool->rejoin() anywhere, so that it implicitly (and without the cost
+        // of a jump) does a masm.assumeUnreachable().
+    }
+
+    emitStoreElementHoleT(lir);
+
+    masm.bind(&isFrozen);
+}
+
+void
+CodeGenerator::visitFallibleStoreElementV(LFallibleStoreElementV* lir)
+{
+    Register elements = ToRegister(lir->elements());
+
+    // Handle frozen objects
+    Label isFrozen;
+    Address flags(elements, ObjectElements::offsetOfFlags());
+    if (!lir->mir()->strict()) {
+        masm.branchTest32(Assembler::NonZero, flags, Imm32(ObjectElements::FROZEN), &isFrozen);
+    } else {
+        Register object = ToRegister(lir->object());
+        OutOfLineCode* ool = oolCallVM(ThrowReadOnlyInfo, lir,
+                ArgList(object), StoreNothing());
+        masm.branchTest32(Assembler::NonZero, flags, Imm32(ObjectElements::FROZEN), ool->entry());
+        // This OOL code should have thrown an exception, so will never return.
+        // So, do not bind ool->rejoin() anywhere, so that it implicitly (and without the cost
+        // of a jump) does a masm.assumeUnreachable().
+    }
+
+    emitStoreElementHoleV(lir);
+
+    masm.bind(&isFrozen);
+}
+
 typedef bool (*SetDenseOrUnboxedArrayElementFn)(JSContext*, HandleObject, int32_t,
                                                 HandleValue, bool strict);
 static const VMFunction SetDenseOrUnboxedArrayElementInfo =
@@ -8196,7 +8269,16 @@ CodeGenerator::visitOutOfLineStoreElementHole(OutOfLineStoreElementHole* ool)
         value = TypedOrValueRegister(ToValue(store, LStoreElementHoleV::Value));
         unboxedType = store->mir()->unboxedType();
         temp = store->getTemp(0);
-    } else {
+    } else if (ins->isFallibleStoreElementV()) {
+        LFallibleStoreElementV* store = ins->toFallibleStoreElementV();
+        object = ToRegister(store->object());
+        elements = ToRegister(store->elements());
+        index = store->index();
+        valueType = store->mir()->value()->type();
+        value = TypedOrValueRegister(ToValue(store, LFallibleStoreElementV::Value));
+        unboxedType = store->mir()->unboxedType();
+        temp = store->getTemp(0);
+    } else if (ins->isStoreElementHoleT()) {
         LStoreElementHoleT* store = ins->toStoreElementHoleT();
         object = ToRegister(store->object());
         elements = ToRegister(store->elements());
@@ -8208,6 +8290,18 @@ CodeGenerator::visitOutOfLineStoreElementHole(OutOfLineStoreElementHole* ool)
             value = TypedOrValueRegister(valueType, ToAnyRegister(store->value()));
         unboxedType = store->mir()->unboxedType();
         temp = store->getTemp(0);
+    } else { // ins->isFallibleStoreElementT()
+        LFallibleStoreElementT* store = ins->toFallibleStoreElementT();
+        object = ToRegister(store->object());
+        elements = ToRegister(store->elements());
+        index = store->index();
+        valueType = store->mir()->value()->type();
+        if (store->value()->isConstant())
+            value = ConstantOrRegister(store->value()->toConstant()->toJSValue());
+        else
+            value = TypedOrValueRegister(valueType, ToAnyRegister(store->value()));
+        unboxedType = store->mir()->unboxedType();
+        temp = store->getTemp(0);
     }
 
     RegisterOrInt32Constant key = ToRegisterOrInt32Constant(index);
@@ -8264,13 +8358,21 @@ CodeGenerator::visitOutOfLineStoreElementHole(OutOfLineStoreElementHole* ool)
         masm.bind(&dontUpdate);
     }
 
-    if (ins->isStoreElementHoleT() && unboxedType == JSVAL_TYPE_MAGIC && valueType != MIRType::Double) {
-        // The inline path for StoreElementHoleT does not always store the type tag,
-        // so we do the store on the OOL path. We use MIRType::None for the element type
-        // so that storeElementTyped will always store the type tag.
-        emitStoreElementTyped(ins->toStoreElementHoleT()->value(), valueType, MIRType::None,
-                              elements, index, 0);
-        masm.jump(ool->rejoin());
+    if ((ins->isStoreElementHoleT() || ins->isFallibleStoreElementT()) &&
+        unboxedType == JSVAL_TYPE_MAGIC && valueType != MIRType::Double)
+    {
+        // The inline path for StoreElementHoleT and FallibleStoreElementT does not always store
+        // the type tag, so we do the store on the OOL path. We use MIRType::None for the element
+        // type so that storeElementTyped will always store the type tag.
+        if (ins->isStoreElementHoleT()) {
+            emitStoreElementTyped(ins->toStoreElementHoleT()->value(), valueType, MIRType::None,
+                                  elements, index, 0);
+            masm.jump(ool->rejoin());
+        } else if (ins->isFallibleStoreElementT()) {
+            emitStoreElementTyped(ins->toFallibleStoreElementT()->value(), valueType,
+                                  MIRType::None, elements, index, 0);
+            masm.jump(ool->rejoin());
+        }
     } else {
         // Jump to the inline path where we will store the value.
         masm.jump(ool->rejoinStore());

js/src/jit/CodeGenerator.h

@@ -298,8 +298,12 @@ class CodeGenerator final : public CodeGeneratorSpecific
     void visitUnboxObjectOrNull(LUnboxObjectOrNull* lir);
     void visitStoreElementT(LStoreElementT* lir);
     void visitStoreElementV(LStoreElementV* lir);
+    template <typename T> void emitStoreElementHoleT(T* lir);
+    template <typename T> void emitStoreElementHoleV(T* lir);
     void visitStoreElementHoleT(LStoreElementHoleT* lir);
     void visitStoreElementHoleV(LStoreElementHoleV* lir);
+    void visitFallibleStoreElementV(LFallibleStoreElementV* lir);
+    void visitFallibleStoreElementT(LFallibleStoreElementT* lir);
     void visitStoreUnboxedPointer(LStoreUnboxedPointer* lir);
     void visitConvertUnboxedObjectToNative(LConvertUnboxedObjectToNative* lir);
     void emitArrayPopShift(LInstruction* lir, const MArrayPopShift* mir, Register obj,

js/src/jit/IonAnalysis.cpp

@@ -3563,6 +3563,13 @@ jit::AddKeepAliveInstructions(MIRGraph& graph)
                     continue;
                 }
 
+                if (use->isFallibleStoreElement()) {
+                    // See StoreElementHole case above.
+                    MOZ_ASSERT_IF(!use->toFallibleStoreElement()->object()->isUnbox() && !ownerObject->isUnbox(),
+                                  use->toFallibleStoreElement()->object() == ownerObject);
+                    continue;
+                }
+
                 if (use->isInArray()) {
                     // See StoreElementHole case above.
                     MOZ_ASSERT_IF(!use->toInArray()->object()->isUnbox() && !ownerObject->isUnbox(),

js/src/jit/IonBuilder.cpp

@@ -10459,7 +10459,9 @@ IonBuilder::jsop_setelem_dense(TemporaryTypeSet::DoubleConversion conversion,
 
     // Writes which are on holes in the object do not have to bail out if they
     // cannot hit another indexed property on the object or its prototypes.
-    bool writeOutOfBounds = !ElementAccessHasExtraIndexedProperty(this, obj);
+    bool hasNoExtraIndexedProperty = !ElementAccessHasExtraIndexedProperty(this, obj);
+
+    bool mayBeFrozen = ElementAccessMightBeFrozen(constraints(), obj);
 
     // Ensure id is an integer.
     MInstruction* idInt32 = MToInt32::New(alloc(), id);
@@ -10505,20 +10507,31 @@ IonBuilder::jsop_setelem_dense(TemporaryTypeSet::DoubleConversion conversion,
     // Use MStoreElementHole if this SETELEM has written to out-of-bounds
     // indexes in the past. Otherwise, use MStoreElement so that we can hoist
     // the initialized length and bounds check.
+    // If an object may have been frozen, no previous expectation hold and we
+    // fallback to MFallibleStoreElement.
     MInstruction* store;
     MStoreElementCommon *common = nullptr;
-    if (writeHole && writeOutOfBounds) {
+    if (writeHole && hasNoExtraIndexedProperty && !mayBeFrozen) {
         MStoreElementHole* ins = MStoreElementHole::New(alloc(), obj, elements, id, newValue, unboxedType);
         store = ins;
         common = ins;
 
+        current->add(ins);
+        current->push(value);
+    } else if (hasNoExtraIndexedProperty && mayBeFrozen) {
+        bool strict = IsStrictSetPC(pc);
+        MFallibleStoreElement* ins = MFallibleStoreElement::New(alloc(), obj, elements, id,
+                                                                newValue, unboxedType, strict);
+        store = ins;
+        common = ins;
+
         current->add(ins);
         current->push(value);
     } else {
         MInstruction* initLength = initializedLength(obj, elements, unboxedType);
 
         id = addBoundsCheck(id, initLength);
-        bool needsHoleCheck = !packed && !writeOutOfBounds;
+        bool needsHoleCheck = !packed && !hasNoExtraIndexedProperty;
 
         if (unboxedType != JSVAL_TYPE_MAGIC) {
             store = storeUnboxedValue(obj, elements, 0, id, unboxedType, newValue);

js/src/jit/IonCaches.cpp

@@ -3599,6 +3599,10 @@ SetPropertyIC::tryAttachStub(JSContext* cx, HandleScript outerScript, IonScript*
     if (!canAttachStub() || obj->watched())
         return true;
 
+    // Fail cache emission if the object is frozen
+    if (obj->is<NativeObject>() && obj->as<NativeObject>().getElementsHeader()->isFrozen())
+        return true;
+
     bool nameOrSymbol;
     if (!ValueToNameOrSymbolId(cx, idval, id, &nameOrSymbol))
         return false;
@@ -3643,6 +3647,10 @@ SetPropertyIC::tryAttachAddSlot(JSContext* cx, HandleScript outerScript, IonScri
     if (!JSID_IS_STRING(id) && !JSID_IS_SYMBOL(id))
         return true;
 
+    // Fail cache emission if the object is frozen
+    if (obj->is<NativeObject>() && obj->as<NativeObject>().getElementsHeader()->isFrozen())
+        return true;
+
     // A GC may have caused cache.value() to become stale as it is not traced.
     // In this case the IonScript will have been invalidated, so check for that.
     // Assert no further GC is possible past this point.

js/src/jit/Lowering.cpp

@@ -3156,6 +3156,38 @@ LIRGenerator::visitStoreElementHole(MStoreElementHole* ins)
     assignSafepoint(lir, ins);
 }
 
+void
+LIRGenerator::visitFallibleStoreElement(MFallibleStoreElement* ins)
+{
+    MOZ_ASSERT(ins->elements()->type() == MIRType::Elements);
+    MOZ_ASSERT(ins->index()->type() == MIRType::Int32);
+
+    const LUse object = useRegister(ins->object());
+    const LUse elements = useRegister(ins->elements());
+    const LAllocation index = useRegisterOrConstant(ins->index());
+
+    // Use a temp register when adding new elements to unboxed arrays.
+    LDefinition tempDef = LDefinition::BogusTemp();
+    if (ins->unboxedType() != JSVAL_TYPE_MAGIC)
+        tempDef = temp();
+
+    LInstruction* lir;
+    switch (ins->value()->type()) {
+      case MIRType::Value:
+        lir = new(alloc()) LFallibleStoreElementV(object, elements, index, useBox(ins->value()),
+                                                  tempDef);
+        break;
+      default:
+        const LAllocation value = useRegisterOrNonDoubleConstant(ins->value());
+        lir = new(alloc()) LFallibleStoreElementT(object, elements, index, value, tempDef);
+        break;
+    }
+
+    add(lir, ins);
+    assignSafepoint(lir, ins);
+}
+
+
 void
 LIRGenerator::visitStoreUnboxedObjectOrNull(MStoreUnboxedObjectOrNull* ins)
 {

js/src/jit/Lowering.h

@@ -223,6 +223,7 @@ class LIRGenerator : public LIRGeneratorSpecific
     void visitLoadUnboxedString(MLoadUnboxedString* ins);
     void visitStoreElement(MStoreElement* ins);
     void visitStoreElementHole(MStoreElementHole* ins);
+    void visitFallibleStoreElement(MFallibleStoreElement* ins);
     void visitStoreUnboxedObjectOrNull(MStoreUnboxedObjectOrNull* ins);
     void visitStoreUnboxedString(MStoreUnboxedString* ins);
     void visitConvertUnboxedObjectToNative(MConvertUnboxedObjectToNative* ins);

js/src/jit/MIR.cpp

@@ -2917,6 +2917,7 @@ NeedNegativeZeroCheck(MDefinition* def)
           }
           case MDefinition::Op_StoreElement:
           case MDefinition::Op_StoreElementHole:
+          case MDefinition::Op_FallibleStoreElement:
           case MDefinition::Op_LoadElement:
           case MDefinition::Op_LoadElementHole:
           case MDefinition::Op_LoadUnboxedScalar:
@@ -5709,6 +5710,13 @@ jit::ElementAccessMightBeCopyOnWrite(CompilerConstraintList* constraints, MDefin
     return !types || types->hasObjectFlags(constraints, OBJECT_FLAG_COPY_ON_WRITE);
 }
 
+bool
+jit::ElementAccessMightBeFrozen(CompilerConstraintList* constraints, MDefinition* obj)
+{
+    TemporaryTypeSet* types = obj->resultTypeSet();
+    return !types || types->hasObjectFlags(constraints, OBJECT_FLAG_FROZEN);
+}
+
 bool
 jit::ElementAccessHasExtraIndexedProperty(IonBuilder* builder, MDefinition* obj)
 {

js/src/jit/MIR.h

@@ -9400,6 +9400,50 @@ class MStoreElementHole
     ALLOW_CLONE(MStoreElementHole)
 };
 
+// Try to store a value to a dense array slots vector. May fail due to the object being frozen.
+// Cannot be used on an object that has extra indexed properties.
+class MFallibleStoreElement
+  : public MAryInstruction<4>,
+    public MStoreElementCommon,
+    public MixPolicy<SingleObjectPolicy, NoFloatPolicy<3> >::Data
+{
+    JSValueType unboxedType_;
+    bool strict_;
+
+    MFallibleStoreElement(MDefinition* object, MDefinition* elements,
+                          MDefinition* index, MDefinition* value,
+                          JSValueType unboxedType, bool strict)
+      : unboxedType_(unboxedType)
+    {
+        initOperand(0, object);
+        initOperand(1, elements);
+        initOperand(2, index);
+        initOperand(3, value);
+        strict_ = strict;
+        MOZ_ASSERT(elements->type() == MIRType::Elements);
+        MOZ_ASSERT(index->type() == MIRType::Int32);
+    }
+
+  public:
+    INSTRUCTION_HEADER(FallibleStoreElement)
+    TRIVIAL_NEW_WRAPPERS
+    NAMED_OPERANDS((0, object), (1, elements), (2, index), (3, value))
+
+    JSValueType unboxedType() const {
+        return unboxedType_;
+    }
+    AliasSet getAliasSet() const override {
+        return AliasSet::Store(AliasSet::ObjectFields |
+                               AliasSet::BoxedOrUnboxedElements(unboxedType()));
+    }
+    bool strict() const {
+        return strict_;
+    }
+
+    ALLOW_CLONE(MFallibleStoreElement)
+};
+
+
 // Store an unboxed object or null pointer to a v\ector.
 class MStoreUnboxedObjectOrNull
   : public MAryInstruction<4>,
@@ -13890,6 +13934,7 @@ bool ElementAccessIsTypedArray(CompilerConstraintList* constraints,
                                Scalar::Type* arrayType);
 bool ElementAccessIsPacked(CompilerConstraintList* constraints, MDefinition* obj);
 bool ElementAccessMightBeCopyOnWrite(CompilerConstraintList* constraints, MDefinition* obj);
+bool ElementAccessMightBeFrozen(CompilerConstraintList* constraints, MDefinition* obj);
 bool ElementAccessHasExtraIndexedProperty(IonBuilder* builder, MDefinition* obj);
 MIRType DenseNativeElementType(CompilerConstraintList* constraints, MDefinition* obj);
 BarrierKind PropertyReadNeedsTypeBarrier(JSContext* propertycx,

js/src/jit/MOpcodes.h

@@ -212,6 +212,7 @@ namespace jit {
     _(LoadUnboxedString)                                                    \
     _(StoreElement)                                                         \
     _(StoreElementHole)                                                     \
+    _(FallibleStoreElement)                                                 \
     _(StoreUnboxedScalar)                                                   \
     _(StoreUnboxedObjectOrNull)                                             \
     _(StoreUnboxedString)                                                   \

js/src/jit/VMFunctions.cpp

@@ -1298,6 +1298,15 @@ ThrowRuntimeLexicalError(JSContext* cx, unsigned errorNumber)
     return false;
 }
 
+bool
+ThrowReadOnlyError(JSContext* cx, HandleObject handle)
+{
+    HandleNativeObject obj = handle.as<NativeObject>();
+    RootedValue val(cx, ObjectValue(*obj));
+    ReportValueError(cx, JSMSG_READ_ONLY, JSDVG_IGNORE_STACK, val, nullptr);
+    return false;
+}
+
 bool
 ThrowBadDerivedReturn(JSContext* cx, HandleValue v)
 {

js/src/jit/VMFunctions.h

@@ -786,6 +786,8 @@ bool ObjectIsConstructor(JSObject* obj);
 MOZ_MUST_USE bool
 ThrowRuntimeLexicalError(JSContext* cx, unsigned errorNumber);
 MOZ_MUST_USE bool
+ThrowReadOnlyError(JSContext* cx, HandleObject obj);
+MOZ_MUST_USE bool
 BaselineThrowUninitializedThis(JSContext* cx, BaselineFrame* frame);
 MOZ_MUST_USE bool
 ThrowBadDerivedReturn(JSContext* cx, HandleValue v);

js/src/jit/shared/LIR-shared.h

@@ -5734,6 +5734,71 @@ class LStoreElementHoleT : public LInstructionHelper<0, 4, 1>
     }
 };
 
+// Like LStoreElementV, but can just ignore assignment (for eg. frozen objects)
+class LFallibleStoreElementV : public LInstructionHelper<0, 3 + BOX_PIECES, 1>
+{
+  public:
+    LIR_HEADER(FallibleStoreElementV)
+
+    LFallibleStoreElementV(const LAllocation& object, const LAllocation& elements,
+                           const LAllocation& index, const LBoxAllocation& value,
+                           const LDefinition& temp) {
+        setOperand(0, object);
+        setOperand(1, elements);
+        setOperand(2, index);
+        setBoxOperand(Value, value);
+        setTemp(0, temp);
+    }
+
+    static const size_t Value = 3;
+
+    const MFallibleStoreElement* mir() const {
+        return mir_->toFallibleStoreElement();
+    }
+    const LAllocation* object() {
+        return getOperand(0);
+    }
+    const LAllocation* elements() {
+        return getOperand(1);
+    }
+    const LAllocation* index() {
+        return getOperand(2);
+    }
+};
+
+// Like LStoreElementT, but can just ignore assignment (for eg. frozen objects)
+class LFallibleStoreElementT : public LInstructionHelper<0, 4, 1>
+{
+  public:
+    LIR_HEADER(FallibleStoreElementT)
+
+    LFallibleStoreElementT(const LAllocation& object, const LAllocation& elements,
+                           const LAllocation& index, const LAllocation& value,
+                           const LDefinition& temp) {
+        setOperand(0, object);
+        setOperand(1, elements);
+        setOperand(2, index);
+        setOperand(3, value);
+        setTemp(0, temp);
+    }
+
+    const MFallibleStoreElement* mir() const {
+        return mir_->toFallibleStoreElement();
+    }
+    const LAllocation* object() {
+        return getOperand(0);
+    }
+    const LAllocation* elements() {
+        return getOperand(1);
+    }
+    const LAllocation* index() {
+        return getOperand(2);
+    }
+    const LAllocation* value() {
+        return getOperand(3);
+    }
+};
+
 class LStoreUnboxedPointer : public LInstructionHelper<0, 3, 0>
 {
   public:

js/src/jit/shared/LOpcodes-shared.h

@@ -294,6 +294,8 @@
     _(ArrayJoin)                    \
     _(StoreElementHoleV)            \
     _(StoreElementHoleT)            \
+    _(FallibleStoreElementV)        \
+    _(FallibleStoreElementT)        \
     _(LoadTypedArrayElementHole)    \
     _(LoadTypedArrayElementStatic)  \
     _(StoreTypedArrayElementHole)   \

js/src/jsapi.cpp

@@ -2941,6 +2941,15 @@ JS_FreezeObject(JSContext* cx, HandleObject obj)
     return FreezeObject(cx, obj);
 }
 
+static bool
+DeepFreezeSlot(JSContext* cx, const Value& v)
+{
+    if (v.isPrimitive())
+        return true;
+    RootedObject obj(cx, &v.toObject());
+    return JS_DeepFreezeObject(cx, obj);
+}
+
 JS_PUBLIC_API(bool)
 JS_DeepFreezeObject(JSContext* cx, HandleObject obj)
 {
@@ -2960,12 +2969,13 @@ JS_DeepFreezeObject(JSContext* cx, HandleObject obj)
 
     /* Walk slots in obj and if any value is a non-null object, seal it. */
     if (obj->isNative()) {
-        for (uint32_t i = 0, n = obj->as<NativeObject>().slotSpan(); i < n; ++i) {
-            const Value& v = obj->as<NativeObject>().getSlot(i);
-            if (v.isPrimitive())
-                continue;
-            RootedObject obj(cx, &v.toObject());
-            if (!JS_DeepFreezeObject(cx, obj))
+        RootedNativeObject nobj(cx, &obj->as<NativeObject>());
+        for (uint32_t i = 0, n = nobj->slotSpan(); i < n; ++i) {
+            if (!DeepFreezeSlot(cx, nobj->getSlot(i)))
+                return false;
+        }
+        for (uint32_t i = 0, n = nobj->getDenseInitializedLength(); i < n; ++i) {
+            if (!DeepFreezeSlot(cx, nobj->getDenseElement(i)))
                 return false;
         }
     }

js/src/jsapi.h

@@ -4967,6 +4967,7 @@ GetSymbolDescription(HandleSymbol symbol);
     macro(hasInstance) \
     macro(split) \
     macro(toPrimitive) \
+    macro(toStringTag) \
     macro(unscopables)
 
 enum class SymbolCode : uint32_t {

js/src/jsiter.cpp

@@ -1495,8 +1495,12 @@ GlobalObject::initArrayIteratorProto(JSContext* cx, Handle<GlobalObject*> global
 
     const Class* cls = &ArrayIteratorPrototypeClass;
     RootedObject proto(cx, global->createBlankPrototypeInheriting(cx, cls, iteratorProto));
-    if (!proto || !DefinePropertiesAndFunctions(cx, proto, nullptr, array_iterator_methods))
+    if (!proto ||
+        !DefinePropertiesAndFunctions(cx, proto, nullptr, array_iterator_methods) ||
+        !DefineToStringTag(cx, proto, cx->names().ArrayIterator))
+    {
         return false;
+    }
 
     global->setReservedSlot(ARRAY_ITERATOR_PROTO, ObjectValue(*proto));
     return true;
@@ -1514,8 +1518,12 @@ GlobalObject::initStringIteratorProto(JSContext* cx, Handle<GlobalObject*> globa
 
     const Class* cls = &StringIteratorPrototypeClass;
     RootedObject proto(cx, global->createBlankPrototypeInheriting(cx, cls, iteratorProto));
-    if (!proto || !DefinePropertiesAndFunctions(cx, proto, nullptr, string_iterator_methods))
+    if (!proto ||
+        !DefinePropertiesAndFunctions(cx, proto, nullptr, string_iterator_methods) ||
+        !DefineToStringTag(cx, proto, cx->names().StringIterator))
+    {
         return false;
+    }
 
     global->setReservedSlot(STRING_ITERATOR_PROTO, ObjectValue(*proto));
     return true;

js/src/jsmath.cpp

@@ -1388,6 +1388,8 @@ js::InitMathClass(JSContext* cx, HandleObject obj)
         return nullptr;
     if (!JS_DefineConstDoubles(cx, Math, math_constants))
         return nullptr;
+    if (!DefineToStringTag(cx, Math, cx->names().Math))
+        return nullptr;
 
     obj->as<GlobalObject>().setConstructor(JSProto_Math, ObjectValue(*Math));
 

js/src/jsobj.cpp

@@ -476,7 +476,7 @@ js::SetIntegrityLevel(JSContext* cx, HandleObject obj, IntegrityLevel level)
     assertSameCompartment(cx, obj);
 
     // Steps 3-5. (Steps 1-2 are redundant assertions.)
-    if (!PreventExtensions(cx, obj))
+    if (!PreventExtensions(cx, obj, level))
         return false;
 
     // Steps 6-7.
@@ -484,10 +484,6 @@ js::SetIntegrityLevel(JSContext* cx, HandleObject obj, IntegrityLevel level)
     if (!GetPropertyKeys(cx, obj, JSITER_HIDDEN | JSITER_OWNONLY | JSITER_SYMBOLS, &keys))
         return false;
 
-    // PreventExtensions must sparsify dense objects, so we can assign to holes
-    // without checks.
-    MOZ_ASSERT_IF(obj->isNative(), obj->as<NativeObject>().getDenseCapacity() == 0);
-
     // Steps 8-9, loosely interpreted.
     if (obj->isNative() && !obj->as<NativeObject>().inDictionaryMode() &&
         !obj->is<TypedArrayObject>())
@@ -2640,7 +2636,7 @@ js::SetPrototype(JSContext* cx, HandleObject obj, HandleObject proto)
 }
 
 bool
-js::PreventExtensions(JSContext* cx, HandleObject obj, ObjectOpResult& result)
+js::PreventExtensions(JSContext* cx, HandleObject obj, ObjectOpResult& result, IntegrityLevel level)
 {
     if (obj->is<ProxyObject>())
         return js::Proxy::preventExtensions(cx, obj, result);
@@ -2656,13 +2652,19 @@ js::PreventExtensions(JSContext* cx, HandleObject obj, ObjectOpResult& result)
     if (!js::GetPropertyKeys(cx, obj, JSITER_HIDDEN | JSITER_OWNONLY, &props))
         return false;
 
-    // Convert all dense elements to sparse properties. This will shrink the
-    // initialized length and capacity of the object to zero and ensure that no
-    // new dense elements can be added without calling growElements(), which
-    // checks isExtensible().
+    // Actually prevent extension. If the object is being frozen, do it by
+    // setting the frozen flag on both the object and the object group.
+    // Otherwise, fallback to sparsifying the object, which makes sure no
+    // element can be added without a call to isExtensible, at the cost of
+    // performance.
     if (obj->isNative()) {
-        if (!NativeObject::sparsifyDenseElements(cx, obj.as<NativeObject>()))
+        if (level == IntegrityLevel::Frozen) {
+            MarkObjectGroupFlags(cx, obj, OBJECT_FLAG_FROZEN);
+            if (!ObjectElements::FreezeElements(cx, obj.as<NativeObject>()))
+                return false;
+        } else if (!NativeObject::sparsifyDenseElements(cx, obj.as<NativeObject>())) {
             return false;
+        }
     }
 
     if (!obj->setFlags(cx, BaseShape::NOT_EXTENSIBLE, JSObject::GENERATE_SHAPE))
@@ -2671,10 +2673,10 @@ js::PreventExtensions(JSContext* cx, HandleObject obj, ObjectOpResult& result)
 }
 
 bool
-js::PreventExtensions(JSContext* cx, HandleObject obj)
+js::PreventExtensions(JSContext* cx, HandleObject obj, IntegrityLevel level)
 {
     ObjectOpResult result;
-    return PreventExtensions(cx, obj, result) && result.checkStrict(cx, obj);
+    return PreventExtensions(cx, obj, result, level) && result.checkStrict(cx, obj);
 }
 
 bool

js/src/jsobj.h

@@ -75,8 +75,13 @@ extern const Class MathClass;
 class GlobalObject;
 class NewObjectCache;
 
+enum class IntegrityLevel {
+    Sealed,
+    Frozen
+};
+
 // Forward declarations, required for later friend declarations.
-bool PreventExtensions(JSContext* cx, JS::HandleObject obj, JS::ObjectOpResult& result);
+bool PreventExtensions(JSContext* cx, JS::HandleObject obj, JS::ObjectOpResult& result, IntegrityLevel level = IntegrityLevel::Sealed);
 bool SetImmutablePrototype(js::ExclusiveContext* cx, JS::HandleObject obj, bool* succeeded);
 
 }  /* namespace js */
@@ -106,7 +111,7 @@ class JSObject : public js::gc::Cell
     friend class js::NewObjectCache;
     friend class js::Nursery;
     friend class js::gc::RelocationOverlay;
-    friend bool js::PreventExtensions(JSContext* cx, JS::HandleObject obj, JS::ObjectOpResult& result);
+    friend bool js::PreventExtensions(JSContext* cx, JS::HandleObject obj, JS::ObjectOpResult& result, js::IntegrityLevel level);
     friend bool js::SetImmutablePrototype(js::ExclusiveContext* cx, JS::HandleObject obj,
                                           bool* succeeded);
 
@@ -748,13 +753,16 @@ IsExtensible(ExclusiveContext* cx, HandleObject obj, bool* extensible);
  * ES6 [[PreventExtensions]]. Attempt to change the [[Extensible]] bit on |obj|
  * to false.  Indicate success or failure through the |result| outparam, or
  * actual error through the return value.
+ *
+ * The `level` argument is SM-specific. `obj` should have an integrity level of
+ * at least `level`.
  */
 extern bool
-PreventExtensions(JSContext* cx, HandleObject obj, ObjectOpResult& result);
+PreventExtensions(JSContext* cx, HandleObject obj, ObjectOpResult& result, IntegrityLevel level);
 
 /* Convenience function. As above, but throw on failure. */
 extern bool
-PreventExtensions(JSContext* cx, HandleObject obj);
+PreventExtensions(JSContext* cx, HandleObject obj, IntegrityLevel level = IntegrityLevel::Sealed);
 
 /*
  * ES6 [[GetOwnProperty]]. Get a description of one of obj's own properties.
@@ -1339,11 +1347,6 @@ Throw(JSContext* cx, jsid id, unsigned errorNumber);
 extern bool
 Throw(JSContext* cx, JSObject* obj, unsigned errorNumber);
 
-enum class IntegrityLevel {
-    Sealed,
-    Frozen
-};
-
 /*
  * ES6 rev 29 (6 Dec 2014) 7.3.13. Mark obj as non-extensible, and adjust each
  * of obj's own properties' attributes appropriately: each property becomes

js/src/json.cpp

@@ -990,6 +990,9 @@ js::InitJSONClass(JSContext* cx, HandleObject obj)
     if (!JS_DefineFunctions(cx, JSON, json_static_methods))
         return nullptr;
 
+    if (!DefineToStringTag(cx, JSON, cx->names().JSON))
+        return nullptr;
+
     global->setConstructor(JSProto_JSON, ObjectValue(*JSON));
 
     return JSON;

js/src/proxy/ScriptedProxyHandler.cpp

@@ -1253,12 +1253,9 @@ const char*
 ScriptedProxyHandler::className(JSContext* cx, HandleObject proxy) const
 {
     // Right now the caller is not prepared to handle failures.
-    RootedObject target(cx, proxy->as<ProxyObject>().target());
-    if (!target)
-        return BaseProxyHandler::className(cx, proxy);
-
-    return GetObjectClassName(cx, target);
+    return BaseProxyHandler::className(cx, proxy);
 }
+
 JSString*
 ScriptedProxyHandler::fun_toString(JSContext* cx, HandleObject proxy, unsigned indent) const
 {

js/src/tests/ecma_6/Generators/runtime.js

@@ -74,9 +74,7 @@ function TestGeneratorObjectPrototype() {
     found_property_names.sort();
 
     assertDeepEq(found_property_names, expected_property_names);
-
-    // No symbol properties, at least until we have @@toStringTag.
-    assertEq(Object.getOwnPropertySymbols(GeneratorObjectPrototype).length, 0);
+    assertDeepEq(Object.getOwnPropertySymbols(GeneratorObjectPrototype), [Symbol.toStringTag]);
 }
 TestGeneratorObjectPrototype();
 

js/src/tests/ecma_6/Symbol/toStringTag.js

@@ -0,0 +1,153 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/ */
+
+// ES6 19.1.3.6 Object.prototype.toString ( )
+function testToString() {
+    var tests = [
+        [undefined, "[object Undefined]"],
+        [null, "[object Null]"],
+        [[], "[object Array]"],
+        [new String("abc"), "[object String]"],
+        [(function () {return arguments;})(), "[object Arguments]"],
+        [(function () {"use strict"; return arguments;})(), "[object Arguments]"],
+        [function() {}, "[object Function]"],
+        [new Error("abc"), "[object Error]"],
+        [true, "[object Boolean]"],
+        [5, "[object Number]"],
+        [new Date(), "[object Date]"],
+        [/regexp/, "[object RegExp]"],
+        [{[Symbol.toStringTag]: "abc"}, "[object abc]"],
+        [Object.create(JSON), "[object JSON]"],
+        [Object.create(new Number), "[object Object]"],
+        [Object.create(new Number, {[Symbol.toStringTag]: {value: "abc"}}), "[object abc]"],
+        [(function() { var x = new Number(); x[Symbol.toStringTag] = "abc"; return x; })(), "[object abc]"],
+        [[], "[object Array]"]
+    ];
+
+    // Testing if the values are obtained the right way.
+    for (let [value, expected] of tests) {
+        let result = Object.prototype.toString.call(value);
+        assertEq(result, expected);
+    }
+}
+testToString();
+
+function testProxy() {
+    var count = 0;
+    var metaHandler = new Proxy({}, {
+        get(target, property, receiver) {
+            assertEq(property, "get");
+
+            return function(target, property, receiver) {
+                assertEq(property, Symbol.toStringTag);
+                count++;
+                return undefined;
+            }
+        }
+    });
+
+    assertEq(Object.prototype.toString.call(new Proxy({}, metaHandler)), "[object Object]")
+    assertEq(Object.prototype.toString.call(new Proxy(new Date, metaHandler)), "[object Object]")
+    assertEq(Object.prototype.toString.call(new Proxy([], metaHandler)), "[object Array]")
+    assertEq(Object.prototype.toString.call(new Proxy(function() {}, metaHandler)), "[object Function]")
+    var {proxy, revoke} = Proxy.revocable({}, metaHandler);
+    revoke();
+    assertThrowsInstanceOf(() => Object.prototype.toString.call(proxy), TypeError);
+
+    assertEq(count, 4);
+}
+testProxy();
+
+// Tests the passed objects toStringTag values and ensures it's
+// desc is writable: false, enumerable: false, configurable: true
+function testDefault(object, expected) {
+    let desc = Object.getOwnPropertyDescriptor(object, Symbol.toStringTag);
+    assertEq(desc.value, expected);
+    assertEq(desc.writable, false);
+    assertEq(desc.enumerable, false);
+    assertEq(desc.configurable, true);
+}
+
+// ES6 19.4.3.5 Symbol.prototype [ @@toStringTag ]
+testDefault(Symbol.prototype, "Symbol");
+
+// ES6 20.2.1.9 Math [ @@toStringTag ]
+testDefault(Math, "Math");
+
+// ES6 21.1.5.2.2 %StringIteratorPrototype% [ @@toStringTag ]
+testDefault(""[Symbol.iterator]().__proto__, "String Iterator")
+
+// ES6 22.1.5.2.2 %ArrayIteratorPrototype% [ @@toStringTag ]
+testDefault([][Symbol.iterator]().__proto__, "Array Iterator")
+
+// ES6 22.2.3.31 get %TypedArray%.prototype [ @@toStringTag ]
+function testTypedArray() {
+    let ta = (new Uint8Array(0)).__proto__.__proto__;
+    let desc = Object.getOwnPropertyDescriptor(ta, Symbol.toStringTag);
+    assertEq(desc.enumerable, false);
+    assertEq(desc.configurable, true);
+    assertEq(desc.set, undefined);
+
+    let get = desc.get;
+    assertEq(get.name, "get [Symbol.toStringTag]");
+    assertEq(get.call(3.14), undefined);
+    assertEq(get.call({}), undefined);
+    assertEq(get.call(ta), undefined);
+
+    let types = [
+        Int8Array,
+        Uint8Array,
+        Int16Array,
+        Uint16Array,
+        Int32Array,
+        Uint32Array,
+        Float32Array,
+        Float64Array
+    ];
+
+    for (let type of types) {
+        let array = new type(0);
+        assertEq(get.call(array), type.name);
+        assertEq(Object.prototype.toString.call(array), `[object ${type.name}]`);
+    }
+}
+testTypedArray();
+
+// ES6 23.1.3.13 Map.prototype [ @@toStringTag ]
+testDefault(Map.prototype, "Map");
+
+// ES6 23.1.5.2.2 %MapIteratorPrototype% [ @@toStringTag ]
+testDefault(new Map()[Symbol.iterator]().__proto__, "Map Iterator")
+
+// ES6 23.2.3.12 Set.prototype [ @@toStringTag ]
+testDefault(Set.prototype, "Set");
+
+// ES6 23.2.5.2.2 %SetIteratorPrototype% [ @@toStringTag ]
+testDefault(new Set()[Symbol.iterator]().__proto__, "Set Iterator")
+
+// ES6 23.3.3.6 WeakMap.prototype [ @@toStringTag ]
+testDefault(WeakMap.prototype, "WeakMap");
+
+// ES6 23.4.3.5 WeakSet.prototype [ @@toStringTag ]
+testDefault(WeakSet.prototype, "WeakSet");
+
+// ES6 24.1.4.4 ArrayBuffer.prototype [ @@toStringTag ]
+testDefault(ArrayBuffer.prototype, "ArrayBuffer");
+
+// ES6 24.2.4.21 DataView.prototype[ @@toStringTag ]
+testDefault(DataView.prototype, "DataView");
+
+// ES6 24.3.3 JSON [ @@toStringTag ]
+testDefault(JSON, "JSON");
+
+// ES6 25.2.3.3 GeneratorFunction.prototype [ @@toStringTag ]
+testDefault(function* () {}.constructor.prototype, "GeneratorFunction");
+
+// ES6 25.3.1.5 Generator.prototype [ @@toStringTag ]
+testDefault(function* () {}().__proto__.__proto__, "Generator");
+
+// ES6 25.4.5.4 Promise.prototype [ @@toStringTag ]
+// testDefault(Promise.prototype, "Promise");
+// Promise is not yet implemented.
+
+reportCompare(true, true);

js/src/tests/ecma_6/shell.js

@@ -99,7 +99,8 @@ if (typeof assertDeepEq === 'undefined') {
             assertSameValue(ac, bc, msg);
             switch (ac) {
             case "[object Function]":
-                assertSameValue(Function_toString(a), Function_toString(b), msg);
+                if (typeof isProxy !== "undefined" && !isProxy(a) && !isProxy(b))
+                    assertSameValue(Function_toString(a), Function_toString(b), msg);
             }
         }
 

js/src/tests/js1_8_5/extensions/dataview.js

@@ -1532,7 +1532,7 @@ function test() {
     assertEq(Object.prototype.toString.apply(new Float32Array(0)), "[object Float32Array]");
     assertEq(Object.prototype.toString.apply(new ArrayBuffer()), "[object ArrayBuffer]");
     assertEq(Object.prototype.toString.apply(new DataView(view.buffer)), "[object DataView]");
-    assertEq(Object.prototype.toString.apply(DataView.prototype), "[object DataViewPrototype]");
+    assertEq(Object.prototype.toString.apply(DataView.prototype), "[object DataView]");
 
     // Technically the spec requires these throw a TypeError -- right now.  It's
     // not clear this is desirable.  Once we implement @@toStringTag we can see

js/src/vm/ArrayBufferObject.cpp

@@ -1771,6 +1771,9 @@ js::InitArrayBufferClass(JSContext* cx, HandleObject obj)
     if (!JS_DefineFunctions(cx, arrayBufferProto, ArrayBufferObject::jsfuncs))
         return nullptr;
 
+    if (!DefineToStringTag(cx, arrayBufferProto, cx->names().ArrayBuffer))
+        return nullptr;
+
     if (!GlobalObject::initBuiltinConstructor(cx, global, JSProto_ArrayBuffer,
                                               ctor, arrayBufferProto))
     {

js/src/vm/CommonPropertyNames.h

@@ -20,6 +20,7 @@
     macro(arguments, arguments, "arguments") \
     macro(as, as, "as") \
     macro(ArrayBufferSpecies, ArrayBufferSpecies, "ArrayBufferSpecies") \
+    macro(ArrayIterator, ArrayIterator, "Array Iterator") \
     macro(ArrayIteratorNext, ArrayIteratorNext, "ArrayIteratorNext") \
     macro(ArraySpecies, ArraySpecies, "ArraySpecies") \
     macro(ArraySpeciesCreate, ArraySpeciesCreate, "ArraySpeciesCreate") \
@@ -121,6 +122,7 @@
     macro(futexNotEqual, futexNotEqual, "not-equal") \
     macro(futexTimedOut, futexTimedOut, "timed-out") \
     macro(gcCycleNumber, gcCycleNumber, "gcCycleNumber") \
+    macro(Generator, Generator, "Generator") \
     macro(GeneratorFunction, GeneratorFunction, "GeneratorFunction") \
     macro(get, get, "get") \
     macro(getPrefix, getPrefix, "get ") \
@@ -175,6 +177,7 @@
     macro(locale, locale, "locale") \
     macro(lookupGetter, lookupGetter, "__lookupGetter__") \
     macro(lookupSetter, lookupSetter, "__lookupSetter__") \
+    macro(MapIterator, MapIterator, "Map Iterator") \
     macro(maximumFractionDigits, maximumFractionDigits, "maximumFractionDigits") \
     macro(maximumSignificantDigits, maximumSignificantDigits, "maximumSignificantDigits") \
     macro(message, message, "message") \
@@ -203,15 +206,18 @@
     macro(NumberFormat, NumberFormat, "NumberFormat") \
     macro(NumberFormatFormatGet, NumberFormatFormatGet, "Intl_NumberFormat_format_get") \
     macro(numeric, numeric, "numeric") \
-    macro(objectArray, objectArray, "[object Array]") \
-    macro(objectFunction, objectFunction, "[object Function]") \
-    macro(objectNull, objectNull, "[object Null]") \
-    macro(objectNumber, objectNumber, "[object Number]") \
-    macro(objectObject, objectObject, "[object Object]") \
-    macro(objects, objects, "objects") \
-    macro(objectString, objectString, "[object String]") \
     macro(objectUndefined, objectUndefined, "[object Undefined]") \
-    macro(objectWindow, objectWindow, "[object Window]") \
+    macro(objectNull, objectNull, "[object Null]") \
+    macro(objectArray, objectArray, "[object Array]") \
+    macro(objectString, objectString, "[object String]") \
+    macro(objectArguments, objectArguments, "[object Arguments]") \
+    macro(objectFunction, objectFunction, "[object Function]") \
+    macro(objectError, objectError, "[object Error]") \
+    macro(objectBoolean, objectBoolean, "[object Boolean]") \
+    macro(objectNumber, objectNumber, "[object Number]") \
+    macro(objectDate, objectDate, "[object Date]") \
+    macro(objectRegExp, objectRegExp, "[object RegExp]") \
+    macro(objects, objects, "objects") \
     macro(of, of, "of") \
     macro(offset, offset, "offset") \
     macro(optimizedOut, optimizedOut, "optimizedOut") \
@@ -223,6 +229,7 @@
     macro(pattern, pattern, "pattern") \
     macro(preventExtensions, preventExtensions, "preventExtensions") \
     macro(promise, promise, "promise") \
+    macro(SetIterator, SetIterator, "Set Iterator") \
     macro(state, state, "state") \
     macro(pending, pending, "pending") \
     macro(fulfillHandler, fulfillHandler, "fulfillHandler") \
@@ -260,6 +267,7 @@
     macro(static, static_, "static") \
     macro(sticky, sticky, "sticky") \
     macro(strings, strings, "strings") \
+    macro(StringIterator, StringIterator, "String Iterator") \
     macro(StructType, StructType, "StructType") \
     macro(style, style, "style") \
     macro(super, super, "super") \

js/src/vm/Debugger.cpp

@@ -8613,40 +8613,58 @@ DebuggerObject::isPromiseGetter(JSContext* cx, unsigned argc, Value* vp)
 /* static */ bool
 DebuggerObject::promiseStateGetter(JSContext* cx, unsigned argc, Value* vp)
 {
-    THIS_DEBUGOBJECT_OWNER_PROMISE(cx, argc, vp, "get promiseState", args, dbg, refobj);
+    THIS_DEBUGOBJECT_PROMISE(cx, argc, vp, "get promiseState", args, refobj);
 
-    RootedPlainObject obj(cx, NewBuiltinClassInstance<PlainObject>(cx));
-    RootedValue result(cx, UndefinedValue());
-    RootedValue reason(cx, UndefinedValue());
-    if (!obj)
-        return false;
-    RootedValue state(cx);
+    RootedValue result(cx);
     switch (promise->state()) {
       case JS::PromiseState::Pending:
-        state.setString(cx->names().pending);
+        result.setString(cx->names().pending);
         break;
       case JS::PromiseState::Fulfilled:
-        state.setString(cx->names().fulfilled);
-        result = promise->value();
+        result.setString(cx->names().fulfilled);
         break;
       case JS::PromiseState::Rejected:
-        state.setString(cx->names().rejected);
-        reason = promise->reason();
+        result.setString(cx->names().rejected);
         break;
     }
 
+    args.rval().set(result);
+    return true;
+}
+
+/* static */ bool
+DebuggerObject::promiseValueGetter(JSContext* cx, unsigned argc, Value* vp)
+{
+    THIS_DEBUGOBJECT_OWNER_PROMISE(cx, argc, vp, "get promiseValue", args, dbg, refobj);
+
+    if (promise->state() != JS::PromiseState::Fulfilled) {
+        args.rval().setUndefined();
+        return true;
+    }
+
+    RootedValue result(cx, promise->value());
     if (!dbg->wrapDebuggeeValue(cx, &result))
         return false;
-    if (!dbg->wrapDebuggeeValue(cx, &reason))
+
+    args.rval().set(result);
+    return true;
+}
+
+/* static */ bool
+DebuggerObject::promiseReasonGetter(JSContext* cx, unsigned argc, Value* vp)
+{
+    THIS_DEBUGOBJECT_OWNER_PROMISE(cx, argc, vp, "get promiseReason", args, dbg, refobj);
+
+    if (promise->state() != JS::PromiseState::Rejected) {
+        args.rval().setUndefined();
+        return true;
+    }
+
+    RootedValue result(cx, promise->reason());
+    if (!dbg->wrapDebuggeeValue(cx, &result))
         return false;
 
-    if (!DefineProperty(cx, obj, cx->names().state.get(), state))
-        return false;
-    if (!DefineProperty(cx, obj, cx->names().value.get(), result))
-        return false;
-    if (!DefineProperty(cx, obj, cx->names().reason.get(), reason))
-        return false;
-    args.rval().setObject(*obj);
+    args.rval().set(result);
     return true;
 }
 
@@ -9186,6 +9204,8 @@ const JSPropertySpec DebuggerObject::properties_[] = {
 const JSPropertySpec DebuggerObject::promiseProperties_[] = {
     JS_PSG("isPromise", DebuggerObject::isPromiseGetter, 0),
     JS_PSG("promiseState", DebuggerObject::promiseStateGetter, 0),
+    JS_PSG("promiseValue", DebuggerObject::promiseValueGetter, 0),
+    JS_PSG("promiseReason", DebuggerObject::promiseReasonGetter, 0),
     JS_PSG("promiseLifetime", DebuggerObject::promiseLifetimeGetter, 0),
     JS_PSG("promiseTimeToResolution", DebuggerObject::promiseTimeToResolutionGetter, 0),
     JS_PSG("promiseAllocationSite", DebuggerObject::promiseAllocationSiteGetter, 0),

js/src/vm/Debugger.h

@@ -1363,6 +1363,8 @@ class DebuggerObject : public NativeObject
 #ifdef SPIDERMONKEY_PROMISE
     static MOZ_MUST_USE bool isPromiseGetter(JSContext* cx, unsigned argc, Value* vp);
     static MOZ_MUST_USE bool promiseStateGetter(JSContext* cx, unsigned argc, Value* vp);
+    static MOZ_MUST_USE bool promiseValueGetter(JSContext* cx, unsigned argc, Value* vp);
+    static MOZ_MUST_USE bool promiseReasonGetter(JSContext* cx, unsigned argc, Value* vp);
     static MOZ_MUST_USE bool promiseLifetimeGetter(JSContext* cx, unsigned argc, Value* vp);
     static MOZ_MUST_USE bool promiseTimeToResolutionGetter(JSContext* cx, unsigned argc, Value* vp);
     static MOZ_MUST_USE bool promiseAllocationSiteGetter(JSContext* cx, unsigned argc, Value* vp);

js/src/vm/GeneratorObject.cpp

@@ -300,14 +300,20 @@ GlobalObject::initStarGenerators(JSContext* cx, Handle<GlobalObject*> global)
                                                                            iteratorProto));
     if (!genObjectProto)
         return false;
-    if (!DefinePropertiesAndFunctions(cx, genObjectProto, nullptr, star_generator_methods))
+    if (!DefinePropertiesAndFunctions(cx, genObjectProto, nullptr, star_generator_methods) ||
+        !DefineToStringTag(cx, genObjectProto, cx->names().Generator))
+    {
         return false;
+    }
 
     RootedObject genFunctionProto(cx, NewSingletonObjectWithFunctionPrototype(cx, global));
     if (!genFunctionProto || !genFunctionProto->setDelegate(cx))
         return false;
-    if (!LinkConstructorAndPrototype(cx, genFunctionProto, genObjectProto))
+    if (!LinkConstructorAndPrototype(cx, genFunctionProto, genObjectProto) ||
+        !DefineToStringTag(cx, genFunctionProto, cx->names().GeneratorFunction))
+    {
         return false;
+    }
 
     RootedValue function(cx, global->getConstructor(JSProto_Function));
     if (!function.toObjectOrNull())

js/src/vm/GlobalObject.cpp

@@ -657,6 +657,14 @@ js::DefinePropertiesAndFunctions(JSContext* cx, HandleObject obj,
     return true;
 }
 
+bool
+js::DefineToStringTag(JSContext *cx, HandleObject obj, JSAtom* tag)
+{
+    RootedId toStringTagId(cx, SYMBOL_TO_JSID(cx->wellKnownSymbols().toStringTag));
+    RootedValue tagString(cx, StringValue(tag));
+    return DefineProperty(cx, obj, toStringTagId, tagString, nullptr, nullptr, JSPROP_READONLY);
+}
+
 static void
 GlobalDebuggees_finalize(FreeOp* fop, JSObject* obj)
 {

js/src/vm/GlobalObject.h

@@ -953,6 +953,9 @@ DefinePropertiesAndFunctions(JSContext* cx, HandleObject obj,
 
 typedef HashSet<GlobalObject*, DefaultHasher<GlobalObject*>, SystemAllocPolicy> GlobalObjectSet;
 
+extern bool
+DefineToStringTag(JSContext *cx, HandleObject obj, JSAtom* tag);
+
 /*
  * Convenience templates to generic constructor and prototype creation functions
  * for ClassSpecs.

js/src/vm/NativeObject.cpp

@@ -101,6 +101,24 @@ ObjectElements::MakeElementsCopyOnWrite(ExclusiveContext* cx, NativeObject* obj)
     return true;
 }
 
+/* static */ bool
+ObjectElements::FreezeElements(ExclusiveContext* cx, HandleNativeObject obj)
+{
+    if (!obj->maybeCopyElementsForWrite(cx))
+        return false;
+
+    if (obj->hasEmptyElements())
+        return true;
+
+    ObjectElements* header = obj->getElementsHeader();
+
+    // Note: this method doesn't update type information to indicate that the
+    // elements might be frozen. Handling this is left to the caller.
+    header->freeze();
+
+    return true;
+}
+
 #ifdef DEBUG
 void
 js::NativeObject::checkShapeConsistency()
@@ -2305,7 +2323,9 @@ SetExistingProperty(JSContext* cx, HandleNativeObject obj, HandleId id, HandleVa
 {
     // Step 5 for dense elements.
     if (IsImplicitDenseOrTypedArrayElement(shape)) {
-        // Step 5.a is a no-op: all dense elements are writable.
+        // Step 5.a.
+        if (obj->getElementsHeader()->isFrozen())
+            return result.fail(JSMSG_READ_ONLY);
 
         // Pure optimization for the common case:
         if (receiver.isObject() && pobj == &receiver.toObject())

js/src/vm/NativeObject.h

@@ -182,6 +182,9 @@ class ObjectElements
         // memory.  This is a static property of the TypedArray, set when it
         // is created and never changed.
         SHARED_MEMORY               = 0x8,
+
+        // These elements are set to integrity level "frozen".
+        FROZEN                      = 0x10,
     };
 
   private:
@@ -286,6 +289,15 @@ class ObjectElements
 
     static bool ConvertElementsToDoubles(JSContext* cx, uintptr_t elements);
     static bool MakeElementsCopyOnWrite(ExclusiveContext* cx, NativeObject* obj);
+    static bool FreezeElements(ExclusiveContext* cx, HandleNativeObject obj);
+
+    bool isFrozen() const {
+        return flags & FROZEN;
+    }
+    void freeze() {
+        MOZ_ASSERT(!isFrozen());
+        flags |= FROZEN;
+    }
 
     // This is enough slots to store an object of this class. See the static
     // assertion below.

js/src/vm/SelfHosting.cpp

@@ -46,6 +46,7 @@
 #include "vm/TypedArrayCommon.h"
 #include "vm/WrapperObject.h"
 
+#include "jsatominlines.h"
 #include "jsfuninlines.h"
 #include "jsobjinlines.h"
 #include "jsscriptinlines.h"
@@ -1970,6 +1971,23 @@ intrinsic_ConstructorForTypedArray(JSContext* cx, unsigned argc, Value* vp)
     return true;
 }
 
+static bool
+intrinsic_NameForTypedArray(JSContext* cx, unsigned argc, Value* vp)
+{
+    CallArgs args = CallArgsFromVp(argc, vp);
+    MOZ_ASSERT(args.length() == 1);
+    MOZ_ASSERT(args[0].isObject());
+
+    RootedObject object(cx, &args[0].toObject());
+    MOZ_ASSERT(object->is<TypedArrayObject>());
+
+    JSProtoKey protoKey = StandardProtoKeyOrNull(object);
+    MOZ_ASSERT(protoKey);
+
+    args.rval().setString(ClassName(protoKey, cx));
+    return true;
+}
+
 /**
  * Returns an object created in the embedding-provided incumbent global.
  *
@@ -2292,6 +2310,7 @@ static const JSFunctionSpec intrinsic_functions[] = {
     JS_FN("OwnPropertyKeys",         intrinsic_OwnPropertyKeys,         1,0),
     JS_FN("MakeDefaultConstructor",  intrinsic_MakeDefaultConstructor,  2,0),
     JS_FN("_ConstructorForTypedArray", intrinsic_ConstructorForTypedArray, 1,0),
+    JS_FN("_NameForTypedArray",      intrinsic_NameForTypedArray, 1,0),
     JS_FN("DecompileArg",            intrinsic_DecompileArg,            2,0),
     JS_FN("_FinishBoundFunctionInit", intrinsic_FinishBoundFunctionInit, 4,0),
     JS_FN("RuntimeDefaultLocale",    intrinsic_RuntimeDefaultLocale,    0,0),

js/src/vm/Shape-inl.h

@@ -175,6 +175,8 @@ GetShapeAttributes(JSObject* obj, Shape* shape)
     if (IsImplicitDenseOrTypedArrayElement(shape)) {
         if (obj->is<TypedArrayObject>())
             return JSPROP_ENUMERATE | JSPROP_PERMANENT;
+        if (obj->as<NativeObject>().getElementsHeader()->isFrozen())
+            return JSPROP_ENUMERATE | JSPROP_PERMANENT | JSPROP_READONLY;
         return JSPROP_ENUMERATE;
     }
 

js/src/vm/TypeInference.h

@@ -145,7 +145,8 @@ enum : uint32_t {
     /* Whether any objects have been iterated over. */
     OBJECT_FLAG_ITERATED              = 0x00080000,
 
-    /* 0x00100000 is not used. */
+    /* Whether any object this represents may be frozen. */
+    OBJECT_FLAG_FROZEN                = 0x00100000,
 
     /*
      * For the function on a run-once script, whether the function has actually

js/src/vm/TypedArrayObject.cpp

@@ -1339,6 +1339,7 @@ TypedArrayObject::protoAccessors[] = {
     JS_PSG("buffer", TypedArray_bufferGetter, 0),
     JS_PSG("byteLength", TypedArray_byteLengthGetter, 0),
     JS_PSG("byteOffset", TypedArray_byteOffsetGetter, 0),
+    JS_SELF_HOSTED_SYM_GET(toStringTag, "TypedArrayToStringTag", 0),
     JS_PS_END
 };
 
@@ -2732,6 +2733,9 @@ DataViewObject::initClass(JSContext* cx)
     if (!JS_DefineFunctions(cx, proto, DataViewObject::jsfuncs))
         return false;
 
+    if (!DefineToStringTag(cx, proto, cx->names().DataView))
+        return false;
+
     /*
      * Create a helper function to implement the craziness of
      * |new DataView(new otherWindow.ArrayBuffer())|, and install it in the

layout/base/nsLayoutUtils.cpp

@@ -2899,12 +2899,12 @@ TransformGfxRectToAncestor(nsIFrame *aFrame,
       // and put it in the cache, if provided
       *aMatrixCache = Some(ctm);
     }
-    // If we computed it, also fill out the axis-alignment flag
-    if (aPreservesAxisAlignedRectangles) {
-      Matrix matrix2d;
-      *aPreservesAxisAlignedRectangles =
-        ctm.Is2D(&matrix2d) && matrix2d.PreservesAxisAlignedRectangles();
-    }
+  }
+  // Fill out the axis-alignment flag
+  if (aPreservesAxisAlignedRectangles) {
+    Matrix matrix2d;
+    *aPreservesAxisAlignedRectangles =
+      ctm.Is2D(&matrix2d) && matrix2d.PreservesAxisAlignedRectangles();
   }
   Rect maxBounds = Rect(-std::numeric_limits<float>::max() * 0.5,
                         -std::numeric_limits<float>::max() * 0.5,

layout/reftests/writing-mode/abspos/reftest.list

@@ -4,102 +4,105 @@
 default-preferences pref(layout.css.vertical-text.enabled,true)
 
 # All of these are fuzzy-if on skia content on OS X due to subpixel text positioning.
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-003.xht s71-abs-pos-non-replaced-vlr-003-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-005.xht s71-abs-pos-non-replaced-vlr-005-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-007.xht s71-abs-pos-non-replaced-vlr-007-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-009.xht s71-abs-pos-non-replaced-vlr-009-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-011.xht s71-abs-pos-non-replaced-vlr-011-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-013.xht s71-abs-pos-non-replaced-vlr-013-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-015.xht s71-abs-pos-non-replaced-vlr-015-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-017.xht s71-abs-pos-non-replaced-vlr-017-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-019.xht s71-abs-pos-non-replaced-vlr-019-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-021.xht s71-abs-pos-non-replaced-vlr-021-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-023.xht s71-abs-pos-non-replaced-vlr-023-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-025.xht s71-abs-pos-non-replaced-vlr-025-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-027.xht s71-abs-pos-non-replaced-vlr-027-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-029.xht s71-abs-pos-non-replaced-vlr-029-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-031.xht s71-abs-pos-non-replaced-vlr-031-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-033.xht s71-abs-pos-non-replaced-vlr-033-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-035.xht s71-abs-pos-non-replaced-vlr-035-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-037.xht s71-abs-pos-non-replaced-vlr-037-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-039.xht s71-abs-pos-non-replaced-vlr-039-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-041.xht s71-abs-pos-non-replaced-vlr-041-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-043.xht s71-abs-pos-non-replaced-vlr-043-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-045.xht s71-abs-pos-non-replaced-vlr-045-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-047.xht s71-abs-pos-non-replaced-vlr-047-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-049.xht s71-abs-pos-non-replaced-vlr-049-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-051.xht s71-abs-pos-non-replaced-vlr-051-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-053.xht s71-abs-pos-non-replaced-vlr-053-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-055.xht s71-abs-pos-non-replaced-vlr-055-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-057.xht s71-abs-pos-non-replaced-vlr-057-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-059.xht s71-abs-pos-non-replaced-vlr-059-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-061.xht s71-abs-pos-non-replaced-vlr-061-ref.xht
-fuzzy-if(cocoaWidget,118,242) fuzzy-if(winWidget,116,240) fuzzy-if(skiaContent,154,320) == s71-abs-pos-non-replaced-vlr-063.xht s71-abs-pos-non-replaced-vlr-063-ref.xht
-fuzzy-if(cocoaWidget,118,242) fuzzy-if(winWidget,116,240) fuzzy-if(skiaContent,154,320) == s71-abs-pos-non-replaced-vlr-065.xht s71-abs-pos-non-replaced-vlr-065-ref.xht
-fuzzy-if(cocoaWidget,118,242) fuzzy-if(winWidget,116,240) fuzzy-if(skiaContent,154,320) == s71-abs-pos-non-replaced-vlr-067.xht s71-abs-pos-non-replaced-vlr-067-ref.xht
-fuzzy-if(cocoaWidget,118,242) fuzzy-if(winWidget,116,240) fuzzy-if(skiaContent,154,320) == s71-abs-pos-non-replaced-vlr-069.xht s71-abs-pos-non-replaced-vlr-069-ref.xht
-fuzzy-if(cocoaWidget,118,242) fuzzy-if(winWidget,116,240) fuzzy-if(skiaContent,154,320) == s71-abs-pos-non-replaced-vlr-071.xht s71-abs-pos-non-replaced-vlr-071-ref.xht
-fuzzy-if(cocoaWidget,118,242) fuzzy-if(winWidget,116,240) fuzzy-if(skiaContent,154,320) == s71-abs-pos-non-replaced-vlr-073.xht s71-abs-pos-non-replaced-vlr-073-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-075.xht s71-abs-pos-non-replaced-vlr-075-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-077.xht s71-abs-pos-non-replaced-vlr-077-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-079.xht s71-abs-pos-non-replaced-vlr-079-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-081.xht s71-abs-pos-non-replaced-vlr-081-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-083.xht s71-abs-pos-non-replaced-vlr-083-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-085.xht s71-abs-pos-non-replaced-vlr-085-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-087.xht s71-abs-pos-non-replaced-vlr-087-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-089.xht s71-abs-pos-non-replaced-vlr-089-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-091.xht s71-abs-pos-non-replaced-vlr-091-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-093.xht s71-abs-pos-non-replaced-vlr-093-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-095.xht s71-abs-pos-non-replaced-vlr-095-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vlr-097.xht s71-abs-pos-non-replaced-vlr-097-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-002.xht s71-abs-pos-non-replaced-vrl-002-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-004.xht s71-abs-pos-non-replaced-vrl-004-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-006.xht s71-abs-pos-non-replaced-vrl-006-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-008.xht s71-abs-pos-non-replaced-vrl-008-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-010.xht s71-abs-pos-non-replaced-vrl-010-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-012.xht s71-abs-pos-non-replaced-vrl-012-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-014.xht s71-abs-pos-non-replaced-vrl-014-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-016.xht s71-abs-pos-non-replaced-vrl-016-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-018.xht s71-abs-pos-non-replaced-vrl-018-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-020.xht s71-abs-pos-non-replaced-vrl-020-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-022.xht s71-abs-pos-non-replaced-vrl-022-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-024.xht s71-abs-pos-non-replaced-vrl-024-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-026.xht s71-abs-pos-non-replaced-vrl-026-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-028.xht s71-abs-pos-non-replaced-vrl-028-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-030.xht s71-abs-pos-non-replaced-vrl-030-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-032.xht s71-abs-pos-non-replaced-vrl-032-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-034.xht s71-abs-pos-non-replaced-vrl-034-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-036.xht s71-abs-pos-non-replaced-vrl-036-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-038.xht s71-abs-pos-non-replaced-vrl-038-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-040.xht s71-abs-pos-non-replaced-vrl-040-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-042.xht s71-abs-pos-non-replaced-vrl-042-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-044.xht s71-abs-pos-non-replaced-vrl-044-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-046.xht s71-abs-pos-non-replaced-vrl-046-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-048.xht s71-abs-pos-non-replaced-vrl-048-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-050.xht s71-abs-pos-non-replaced-vrl-050-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-052.xht s71-abs-pos-non-replaced-vrl-052-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-054.xht s71-abs-pos-non-replaced-vrl-054-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-056.xht s71-abs-pos-non-replaced-vrl-056-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-058.xht s71-abs-pos-non-replaced-vrl-058-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-060.xht s71-abs-pos-non-replaced-vrl-060-ref.xht
-fuzzy-if(cocoaWidget,118,242) fuzzy-if(winWidget,116,240) fuzzy-if(skiaContent,154,320) == s71-abs-pos-non-replaced-vrl-062.xht s71-abs-pos-non-replaced-vrl-062-ref.xht
-fuzzy-if(cocoaWidget,118,242) fuzzy-if(winWidget,116,240) fuzzy-if(skiaContent,154,320) == s71-abs-pos-non-replaced-vrl-064.xht s71-abs-pos-non-replaced-vrl-064-ref.xht
-fuzzy-if(cocoaWidget,118,242) fuzzy-if(winWidget,116,240) fuzzy-if(skiaContent,154,320) == s71-abs-pos-non-replaced-vrl-066.xht s71-abs-pos-non-replaced-vrl-066-ref.xht
-fuzzy-if(cocoaWidget,118,242) fuzzy-if(winWidget,116,240) fuzzy-if(skiaContent,154,320) == s71-abs-pos-non-replaced-vrl-068.xht s71-abs-pos-non-replaced-vrl-068-ref.xht
-fuzzy-if(cocoaWidget,118,242) fuzzy-if(winWidget,116,240) fuzzy-if(skiaContent,154,320) == s71-abs-pos-non-replaced-vrl-070.xht s71-abs-pos-non-replaced-vrl-070-ref.xht
-fuzzy-if(cocoaWidget,118,242) fuzzy-if(winWidget,116,240) fuzzy-if(skiaContent,154,320) == s71-abs-pos-non-replaced-vrl-072.xht s71-abs-pos-non-replaced-vrl-072-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-074.xht s71-abs-pos-non-replaced-vrl-074-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-076.xht s71-abs-pos-non-replaced-vrl-076-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-078.xht s71-abs-pos-non-replaced-vrl-078-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-080.xht s71-abs-pos-non-replaced-vrl-080-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-082.xht s71-abs-pos-non-replaced-vrl-082-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-084.xht s71-abs-pos-non-replaced-vrl-084-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-086.xht s71-abs-pos-non-replaced-vrl-086-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-088.xht s71-abs-pos-non-replaced-vrl-088-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-090.xht s71-abs-pos-non-replaced-vrl-090-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-092.xht s71-abs-pos-non-replaced-vrl-092-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-094.xht s71-abs-pos-non-replaced-vrl-094-ref.xht
-fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) == s71-abs-pos-non-replaced-vrl-096.xht s71-abs-pos-non-replaced-vrl-096-ref.xht
+# Frequent Windows 7 load failed: timed out waiting for test to complete (waiting for onload scripts to complete), bug 1167155 and friends
+# Even though the whole reftest.list here is skipped, it doesn't actually work because reftests match the last
+# **-if, which means even though we tried to skip this list,the fuzzy-if still matched forcing us to run the test.
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-003.xht s71-abs-pos-non-replaced-vlr-003-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-005.xht s71-abs-pos-non-replaced-vlr-005-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-007.xht s71-abs-pos-non-replaced-vlr-007-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-009.xht s71-abs-pos-non-replaced-vlr-009-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-011.xht s71-abs-pos-non-replaced-vlr-011-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-013.xht s71-abs-pos-non-replaced-vlr-013-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-015.xht s71-abs-pos-non-replaced-vlr-015-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-017.xht s71-abs-pos-non-replaced-vlr-017-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-019.xht s71-abs-pos-non-replaced-vlr-019-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-021.xht s71-abs-pos-non-replaced-vlr-021-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-023.xht s71-abs-pos-non-replaced-vlr-023-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-025.xht s71-abs-pos-non-replaced-vlr-025-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-027.xht s71-abs-pos-non-replaced-vlr-027-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-029.xht s71-abs-pos-non-replaced-vlr-029-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-031.xht s71-abs-pos-non-replaced-vlr-031-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-033.xht s71-abs-pos-non-replaced-vlr-033-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-035.xht s71-abs-pos-non-replaced-vlr-035-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-037.xht s71-abs-pos-non-replaced-vlr-037-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-039.xht s71-abs-pos-non-replaced-vlr-039-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-041.xht s71-abs-pos-non-replaced-vlr-041-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-043.xht s71-abs-pos-non-replaced-vlr-043-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-045.xht s71-abs-pos-non-replaced-vlr-045-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-047.xht s71-abs-pos-non-replaced-vlr-047-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-049.xht s71-abs-pos-non-replaced-vlr-049-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-051.xht s71-abs-pos-non-replaced-vlr-051-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-053.xht s71-abs-pos-non-replaced-vlr-053-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-055.xht s71-abs-pos-non-replaced-vlr-055-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-057.xht s71-abs-pos-non-replaced-vlr-057-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-059.xht s71-abs-pos-non-replaced-vlr-059-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-061.xht s71-abs-pos-non-replaced-vlr-061-ref.xht
+fuzzy-if(cocoaWidget,118,242) fuzzy-if(winWidget,116,240) fuzzy-if(skiaContent,154,320) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-063.xht s71-abs-pos-non-replaced-vlr-063-ref.xht
+fuzzy-if(cocoaWidget,118,242) fuzzy-if(winWidget,116,240) fuzzy-if(skiaContent,154,320) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-065.xht s71-abs-pos-non-replaced-vlr-065-ref.xht
+fuzzy-if(cocoaWidget,118,242) fuzzy-if(winWidget,116,240) fuzzy-if(skiaContent,154,320) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-067.xht s71-abs-pos-non-replaced-vlr-067-ref.xht
+fuzzy-if(cocoaWidget,118,242) fuzzy-if(winWidget,116,240) fuzzy-if(skiaContent,154,320) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-069.xht s71-abs-pos-non-replaced-vlr-069-ref.xht
+fuzzy-if(cocoaWidget,118,242) fuzzy-if(winWidget,116,240) fuzzy-if(skiaContent,154,320) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-071.xht s71-abs-pos-non-replaced-vlr-071-ref.xht
+fuzzy-if(cocoaWidget,118,242) fuzzy-if(winWidget,116,240) fuzzy-if(skiaContent,154,320) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-073.xht s71-abs-pos-non-replaced-vlr-073-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-075.xht s71-abs-pos-non-replaced-vlr-075-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-077.xht s71-abs-pos-non-replaced-vlr-077-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-079.xht s71-abs-pos-non-replaced-vlr-079-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-081.xht s71-abs-pos-non-replaced-vlr-081-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-083.xht s71-abs-pos-non-replaced-vlr-083-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-085.xht s71-abs-pos-non-replaced-vlr-085-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-087.xht s71-abs-pos-non-replaced-vlr-087-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-089.xht s71-abs-pos-non-replaced-vlr-089-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-091.xht s71-abs-pos-non-replaced-vlr-091-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-093.xht s71-abs-pos-non-replaced-vlr-093-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-095.xht s71-abs-pos-non-replaced-vlr-095-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vlr-097.xht s71-abs-pos-non-replaced-vlr-097-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-002.xht s71-abs-pos-non-replaced-vrl-002-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-004.xht s71-abs-pos-non-replaced-vrl-004-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-006.xht s71-abs-pos-non-replaced-vrl-006-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-008.xht s71-abs-pos-non-replaced-vrl-008-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-010.xht s71-abs-pos-non-replaced-vrl-010-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-012.xht s71-abs-pos-non-replaced-vrl-012-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-014.xht s71-abs-pos-non-replaced-vrl-014-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-016.xht s71-abs-pos-non-replaced-vrl-016-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-018.xht s71-abs-pos-non-replaced-vrl-018-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-020.xht s71-abs-pos-non-replaced-vrl-020-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-022.xht s71-abs-pos-non-replaced-vrl-022-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-024.xht s71-abs-pos-non-replaced-vrl-024-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-026.xht s71-abs-pos-non-replaced-vrl-026-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-028.xht s71-abs-pos-non-replaced-vrl-028-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-030.xht s71-abs-pos-non-replaced-vrl-030-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-032.xht s71-abs-pos-non-replaced-vrl-032-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-034.xht s71-abs-pos-non-replaced-vrl-034-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-036.xht s71-abs-pos-non-replaced-vrl-036-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-038.xht s71-abs-pos-non-replaced-vrl-038-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-040.xht s71-abs-pos-non-replaced-vrl-040-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-042.xht s71-abs-pos-non-replaced-vrl-042-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-044.xht s71-abs-pos-non-replaced-vrl-044-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-046.xht s71-abs-pos-non-replaced-vrl-046-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-048.xht s71-abs-pos-non-replaced-vrl-048-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-050.xht s71-abs-pos-non-replaced-vrl-050-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-052.xht s71-abs-pos-non-replaced-vrl-052-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-054.xht s71-abs-pos-non-replaced-vrl-054-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-056.xht s71-abs-pos-non-replaced-vrl-056-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-058.xht s71-abs-pos-non-replaced-vrl-058-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-060.xht s71-abs-pos-non-replaced-vrl-060-ref.xht
+fuzzy-if(cocoaWidget,118,242) fuzzy-if(winWidget,116,240) fuzzy-if(skiaContent,154,320) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-062.xht s71-abs-pos-non-replaced-vrl-062-ref.xht
+fuzzy-if(cocoaWidget,118,242) fuzzy-if(winWidget,116,240) fuzzy-if(skiaContent,154,320) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-064.xht s71-abs-pos-non-replaced-vrl-064-ref.xht
+fuzzy-if(cocoaWidget,118,242) fuzzy-if(winWidget,116,240) fuzzy-if(skiaContent,154,320) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-066.xht s71-abs-pos-non-replaced-vrl-066-ref.xht
+fuzzy-if(cocoaWidget,118,242) fuzzy-if(winWidget,116,240) fuzzy-if(skiaContent,154,320) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-068.xht s71-abs-pos-non-replaced-vrl-068-ref.xht
+fuzzy-if(cocoaWidget,118,242) fuzzy-if(winWidget,116,240) fuzzy-if(skiaContent,154,320) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-070.xht s71-abs-pos-non-replaced-vrl-070-ref.xht
+fuzzy-if(cocoaWidget,118,242) fuzzy-if(winWidget,116,240) fuzzy-if(skiaContent,154,320) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-072.xht s71-abs-pos-non-replaced-vrl-072-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-074.xht s71-abs-pos-non-replaced-vrl-074-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-076.xht s71-abs-pos-non-replaced-vrl-076-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-078.xht s71-abs-pos-non-replaced-vrl-078-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-080.xht s71-abs-pos-non-replaced-vrl-080-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-082.xht s71-abs-pos-non-replaced-vrl-082-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-084.xht s71-abs-pos-non-replaced-vrl-084-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-086.xht s71-abs-pos-non-replaced-vrl-086-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-088.xht s71-abs-pos-non-replaced-vrl-088-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-090.xht s71-abs-pos-non-replaced-vrl-090-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-092.xht s71-abs-pos-non-replaced-vrl-092-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-094.xht s71-abs-pos-non-replaced-vrl-094-ref.xht
+fuzzy-if(cocoaWidget,15,5) fuzzy-if(d2d,102,164) fuzzy-if(skiaContent,255,248) skip-if(/^Windows\x20NT\x206\.1/.test(http.oscpu)) == s71-abs-pos-non-replaced-vrl-096.xht s71-abs-pos-non-replaced-vrl-096-ref.xht
 
 == 1183431-orthogonal-modes-1a.html 1183431-orthogonal-modes-1-ref.html
 == 1183431-orthogonal-modes-1b.html 1183431-orthogonal-modes-1-ref.html

layout/style/StyleAnimationValue.cpp

@@ -849,9 +849,7 @@ StyleAnimationValue::ComputeDistance(nsCSSPropertyID aProperty,
             (color2.GetColorValue(), StyleAnimationValue::ColorConstructor);
           double colorDistance;
 
-        #ifdef DEBUG
-          bool ok =
-        #endif
+          DebugOnly<bool> ok =
             StyleAnimationValue::ComputeDistance(eCSSProperty_color,
                                                  color1Value, color2Value,
                                                  colorDistance);
@@ -1260,9 +1258,7 @@ AddShadowItems(double aCoeff1, const nsCSSValue &aValue1,
     StyleAnimationValue color2Value
       (color2.GetColorValue(), StyleAnimationValue::ColorConstructor);
     StyleAnimationValue resultColorValue;
-  #ifdef DEBUG
-    bool ok =
-  #endif
+    DebugOnly<bool> ok =
       StyleAnimationValue::AddWeighted(eCSSProperty_color,
                                        aCoeff1, color1Value,
                                        aCoeff2, color2Value,

layout/style/StyleAnimationValue.h

@@ -53,8 +53,9 @@ public:
    * @param aCount      The number of times to add aValueToAdd.
    * @return true on success, false on failure.
    */
-  static bool Add(nsCSSPropertyID aProperty, StyleAnimationValue& aDest,
-                  const StyleAnimationValue& aValueToAdd, uint32_t aCount) {
+  static MOZ_MUST_USE bool
+  Add(nsCSSPropertyID aProperty, StyleAnimationValue& aDest,
+      const StyleAnimationValue& aValueToAdd, uint32_t aCount) {
     return AddWeighted(aProperty, 1.0, aDest, aCount, aValueToAdd, aDest);
   }
 
@@ -76,10 +77,11 @@ public:
    * @param aDistance   The result of the calculation.
    * @return true on success, false on failure.
    */
-  static bool ComputeDistance(nsCSSPropertyID aProperty,
-                              const StyleAnimationValue& aStartValue,
-                              const StyleAnimationValue& aEndValue,
-                              double& aDistance);
+  static MOZ_MUST_USE bool
+  ComputeDistance(nsCSSPropertyID aProperty,
+                  const StyleAnimationValue& aStartValue,
+                  const StyleAnimationValue& aEndValue,
+                  double& aDistance);
 
   /**
    * Calculates an interpolated value that is the specified |aPortion| between
@@ -97,11 +99,12 @@ public:
    * @param [out] aResultValue The resulting interpolated value.
    * @return true on success, false on failure.
    */
-  static bool Interpolate(nsCSSPropertyID aProperty,
-                          const StyleAnimationValue& aStartValue,
-                          const StyleAnimationValue& aEndValue,
-                          double aPortion,
-                          StyleAnimationValue& aResultValue) {
+  static MOZ_MUST_USE bool
+  Interpolate(nsCSSPropertyID aProperty,
+              const StyleAnimationValue& aStartValue,
+              const StyleAnimationValue& aEndValue,
+              double aPortion,
+              StyleAnimationValue& aResultValue) {
     return AddWeighted(aProperty, 1.0 - aPortion, aStartValue,
                        aPortion, aEndValue, aResultValue);
   }
@@ -120,10 +123,11 @@ public:
    * difficulty, we might change this to restrict them to being
    * positive.
    */
-  static bool AddWeighted(nsCSSPropertyID aProperty,
-                          double aCoeff1, const StyleAnimationValue& aValue1,
-                          double aCoeff2, const StyleAnimationValue& aValue2,
-                          StyleAnimationValue& aResultValue);
+  static MOZ_MUST_USE bool
+  AddWeighted(nsCSSPropertyID aProperty,
+              double aCoeff1, const StyleAnimationValue& aValue1,
+              double aCoeff2, const StyleAnimationValue& aValue2,
+              StyleAnimationValue& aResultValue);
 
   // Type-conversion methods
   // -----------------------
@@ -157,13 +161,14 @@ public:
    *                        nullptr.
    * @return true on success, false on failure.
    */
-  static bool ComputeValue(nsCSSPropertyID aProperty,
-                           mozilla::dom::Element* aTargetElement,
-                           nsStyleContext* aStyleContext,
-                           const nsAString& aSpecifiedValue,
-                           bool aUseSVGMode,
-                           StyleAnimationValue& aComputedValue,
-                           bool* aIsContextSensitive = nullptr);
+  static MOZ_MUST_USE bool
+  ComputeValue(nsCSSPropertyID aProperty,
+               mozilla::dom::Element* aTargetElement,
+               nsStyleContext* aStyleContext,
+               const nsAString& aSpecifiedValue,
+               bool aUseSVGMode,
+               StyleAnimationValue& aComputedValue,
+               bool* aIsContextSensitive = nullptr);
 
   /**
    * Like ComputeValue, but returns an array of StyleAnimationValues.
@@ -175,25 +180,27 @@ public:
    * to aResult.  On failure, aResult might still have partial results
    * in it.
    */
-  static bool ComputeValues(nsCSSPropertyID aProperty,
-                            mozilla::CSSEnabledState aEnabledState,
-                            mozilla::dom::Element* aTargetElement,
-                            nsStyleContext* aStyleContext,
-                            const nsAString& aSpecifiedValue,
-                            bool aUseSVGMode,
-                            nsTArray<PropertyStyleAnimationValuePair>& aResult);
+  static MOZ_MUST_USE bool
+  ComputeValues(nsCSSPropertyID aProperty,
+                mozilla::CSSEnabledState aEnabledState,
+                mozilla::dom::Element* aTargetElement,
+                nsStyleContext* aStyleContext,
+                const nsAString& aSpecifiedValue,
+                bool aUseSVGMode,
+                nsTArray<PropertyStyleAnimationValuePair>& aResult);
 
   /**
    * A variant on ComputeValues that takes an nsCSSValue as the specified
    * value. Only longhand properties are supported.
    */
-  static bool ComputeValues(nsCSSPropertyID aProperty,
-                            mozilla::CSSEnabledState aEnabledState,
-                            mozilla::dom::Element* aTargetElement,
-                            nsStyleContext* aStyleContext,
-                            const nsCSSValue& aSpecifiedValue,
-                            bool aUseSVGMode,
-                            nsTArray<PropertyStyleAnimationValuePair>& aResult);
+  static MOZ_MUST_USE bool
+  ComputeValues(nsCSSPropertyID aProperty,
+                mozilla::CSSEnabledState aEnabledState,
+                mozilla::dom::Element* aTargetElement,
+                nsStyleContext* aStyleContext,
+                const nsCSSValue& aSpecifiedValue,
+                bool aUseSVGMode,
+                nsTArray<PropertyStyleAnimationValuePair>& aResult);
 
   /**
    * Creates a specified value for the given computed value.
@@ -211,16 +218,22 @@ public:
    * @param aComputedValue The computed value to be converted.
    * @param [out] aSpecifiedValue The resulting specified value.
    * @return true on success, false on failure.
+   *
+   * These functions are not MOZ_MUST_USE because failing to check the return
+   * value is common and reasonable.
    */
-  static bool UncomputeValue(nsCSSPropertyID aProperty,
-                             const StyleAnimationValue& aComputedValue,
-                             nsCSSValue& aSpecifiedValue);
-  static bool UncomputeValue(nsCSSPropertyID aProperty,
-                             StyleAnimationValue&& aComputedValue,
-                             nsCSSValue& aSpecifiedValue);
-  static bool UncomputeValue(nsCSSPropertyID aProperty,
-                             const StyleAnimationValue& aComputedValue,
-                             nsAString& aSpecifiedValue);
+  static MOZ_MUST_USE bool
+  UncomputeValue(nsCSSPropertyID aProperty,
+                 const StyleAnimationValue& aComputedValue,
+                 nsCSSValue& aSpecifiedValue);
+  static MOZ_MUST_USE bool
+  UncomputeValue(nsCSSPropertyID aProperty,
+                 StyleAnimationValue&& aComputedValue,
+                 nsCSSValue& aSpecifiedValue);
+  static MOZ_MUST_USE bool
+  UncomputeValue(nsCSSPropertyID aProperty,
+                 const StyleAnimationValue& aComputedValue,
+                 nsAString& aSpecifiedValue);
 
   /**
    * Gets the computed value for the given property from the given style
@@ -236,9 +249,10 @@ public:
    * @param [out] aComputedValue The resulting computed value.
    * @return true on success, false on failure.
    */
-  static bool ExtractComputedValue(nsCSSPropertyID aProperty,
-                                   nsStyleContext* aStyleContext,
-                                   StyleAnimationValue& aComputedValue);
+  static MOZ_MUST_USE bool ExtractComputedValue(
+    nsCSSPropertyID aProperty,
+    nsStyleContext* aStyleContext,
+    StyleAnimationValue& aComputedValue);
 
   /**
    * Interpolates between 2 matrices by decomposing them.

layout/style/nsAnimationManager.cpp

@@ -1036,7 +1036,11 @@ CSSAnimationBuilder::GetComputedValue(nsPresContext* aPresContext,
   if (StyleAnimationValue::ExtractComputedValue(aProperty,
                                                 mStyleWithoutAnimation,
                                                 computedValue)) {
-    StyleAnimationValue::UncomputeValue(aProperty, Move(computedValue), result);
+    DebugOnly<bool> uncomputeResult =
+      StyleAnimationValue::UncomputeValue(aProperty, Move(computedValue),
+                                          result);
+    MOZ_ASSERT(uncomputeResult,
+               "Unable to get specified value from computed value");
   }
 
   // If we hit this assertion, it probably means we are fetching a value from

mobile/android/base/java/org/mozilla/gecko/BrowserApp.java

@@ -11,7 +11,6 @@ import android.os.Environment;
 import android.support.annotation.CheckResult;
 import android.support.annotation.NonNull;
 
-import android.widget.VideoView;
 import android.graphics.Rect;
 
 import org.json.JSONArray;
@@ -57,6 +56,7 @@ import org.mozilla.gecko.home.HomePanelsManager;
 import org.mozilla.gecko.home.HomeScreen;
 import org.mozilla.gecko.home.SearchEngine;
 import org.mozilla.gecko.javaaddons.JavaAddonManager;
+import org.mozilla.gecko.media.VideoPlayer;
 import org.mozilla.gecko.menu.GeckoMenu;
 import org.mozilla.gecko.menu.GeckoMenuItem;
 import org.mozilla.gecko.mozglue.SafeIntent;
@@ -235,6 +235,7 @@ public class BrowserApp extends GeckoApp
     public ViewGroup mBrowserChrome;
     public ViewFlipper mActionBarFlipper;
     public ActionModeCompatView mActionBar;
+    private VideoPlayer mVideoPlayer;
     private BrowserToolbar mBrowserToolbar;
     private View mDoorhangerOverlay;
     // We can't name the TabStrip class because it's not included on API 9.
@@ -581,6 +582,15 @@ public class BrowserApp extends GeckoApp
         mActionBarFlipper = (ViewFlipper) findViewById(R.id.browser_actionbar);
         mActionBar = (ActionModeCompatView) findViewById(R.id.actionbar);
 
+        mVideoPlayer = (VideoPlayer) findViewById(R.id.video_player);
+        mVideoPlayer.setFullScreenListener(new VideoPlayer.FullScreenListener() {
+            @Override
+            public void onFullScreenChanged(boolean fullScreen) {
+                mVideoPlayer.setFullScreen(fullScreen);
+                setFullScreen(fullScreen);
+            }
+        });
+
         mBrowserToolbar = (BrowserToolbar) findViewById(R.id.browser_toolbar);
         mBrowserToolbar.setTouchEventInterceptor(new TouchEventInterceptor() {
             @Override
@@ -964,6 +974,17 @@ public class BrowserApp extends GeckoApp
             return;
         }
 
+        if (mVideoPlayer.isFullScreen()) {
+            mVideoPlayer.setFullScreen(false);
+            setFullScreen(false);
+            return;
+        }
+
+        if (mVideoPlayer.isPlaying()) {
+            mVideoPlayer.stop();
+            return;
+        }
+
         super.onBackPressed();
     }
 
@@ -1977,13 +1998,7 @@ public class BrowserApp extends GeckoApp
                 ThreadUtils.postToUiThread(new Runnable() {
                     @Override
                     public void run() {
-                        VideoView view = new VideoView(BrowserApp.this);
-                        android.widget.MediaController mediaController = new android.widget.MediaController(BrowserApp.this);
-                        view.setMediaController(mediaController);
-                        view.setVideoURI(Uri.parse(uri));
-                        BrowserApp.this.addFullScreenPluginView(view);
-                        view.start();
-
+                        mVideoPlayer.start(Uri.parse(uri));
                         Telemetry.sendUIEvent(TelemetryContract.Event.SHOW, TelemetryContract.Method.CONTENT, "playhls");
                     }
                 });

mobile/android/base/java/org/mozilla/gecko/PresentationMediaPlayerManager.java

@@ -123,17 +123,23 @@ public class PresentationMediaPlayerManager extends MediaPlayerManager {
         public void surfaceChanged(SurfaceHolder holder, int format, int width,
                                    int height) {
             // Surface changed so force a composite
-            invalidateAndScheduleComposite(mGeckoView);
+            if (GeckoThread.isStateAtLeast(GeckoThread.State.PROFILE_READY)) {
+                invalidateAndScheduleComposite(mGeckoView);
+            }
         }
 
         @Override
         public void surfaceCreated(SurfaceHolder holder) {
-            addPresentationSurface(mGeckoView, holder.getSurface());
+            if (GeckoThread.isStateAtLeast(GeckoThread.State.PROFILE_READY)) {
+                addPresentationSurface(mGeckoView, holder.getSurface());
+            }
         }
 
         @Override
         public void surfaceDestroyed(SurfaceHolder holder) {
-            removePresentationSurface();
+            if (GeckoThread.isStateAtLeast(GeckoThread.State.PROFILE_READY)) {
+                removePresentationSurface();
+            }
         }
     }
 }

mobile/android/base/java/org/mozilla/gecko/media/VideoPlayer.java

@@ -0,0 +1,204 @@
+/* -*- Mode: Java; c-basic-offset: 4; tab-width: 4; indent-tabs-mode: nil; -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+package org.mozilla.gecko.media;
+
+import android.content.Context;
+
+import android.graphics.Color;
+
+import android.net.Uri;
+
+import android.util.AttributeSet;
+import android.util.Log;
+import android.view.Gravity;
+import android.view.KeyEvent;
+import android.view.MotionEvent;
+import android.view.View;
+import android.view.ViewGroup;
+
+import android.widget.ImageButton;
+import android.widget.FrameLayout;
+import android.widget.ImageView;
+import android.widget.LinearLayout;
+import android.widget.MediaController;
+import android.widget.VideoView;
+
+import org.mozilla.gecko.R;
+
+public class VideoPlayer extends FrameLayout {
+    private VideoView video;
+    private FullScreenMediaController controller;
+    private FullScreenListener fullScreenListener;
+
+    private boolean isFullScreen;
+
+    public VideoPlayer(Context ctx) {
+        this(ctx, null);
+    }
+
+    public VideoPlayer(Context ctx, AttributeSet attrs) {
+        this(ctx, attrs, 0);
+    }
+
+    public VideoPlayer(Context ctx, AttributeSet attrs, int defStyle) {
+        super(ctx, attrs, defStyle);
+        setFullScreen(false);
+        setVisibility(View.GONE);
+    }
+
+    public void start(Uri uri) {
+        stop();
+
+        video = new VideoView(getContext());
+        controller = new FullScreenMediaController(getContext());
+        video.setMediaController(controller);
+        controller.setAnchorView(video);
+
+        video.setVideoURI(uri);
+
+        FrameLayout.LayoutParams layoutParams = new FrameLayout.LayoutParams(
+            FrameLayout.LayoutParams.MATCH_PARENT,
+            FrameLayout.LayoutParams.WRAP_CONTENT,
+            Gravity.CENTER);
+
+        addView(video, layoutParams);
+        setVisibility(View.VISIBLE);
+
+        video.setZOrderOnTop(true);
+        video.start();
+    }
+
+    public boolean isPlaying() {
+        return video != null;
+    }
+
+    public void stop() {
+        if (video == null) {
+            return;
+        }
+
+        removeAllViews();
+        setVisibility(View.GONE);
+        video.stopPlayback();
+
+        video = null;
+        controller = null;
+    }
+
+    public void setFullScreenListener(FullScreenListener listener) {
+        fullScreenListener = listener;
+    }
+
+    public boolean isFullScreen() {
+        return isFullScreen;
+    }
+
+    public void setFullScreen(boolean fullScreen) {
+        isFullScreen = fullScreen;
+        if (fullScreen) {
+            setBackgroundColor(Color.BLACK);
+        } else {
+            setBackgroundResource(R.color.dark_transparent_overlay);
+        }
+
+        if (controller != null) {
+            controller.setFullScreen(fullScreen);
+        }
+    }
+
+    @Override
+    public boolean onKeyDown(int keyCode, KeyEvent event) {
+        if (event.isSystem()) {
+            return super.onKeyDown(keyCode, event);
+        }
+        return true;
+    }
+
+    @Override
+    public boolean onKeyUp(int keyCode, KeyEvent event) {
+        if (event.isSystem()) {
+            return super.onKeyUp(keyCode, event);
+        }
+        return true;
+    }
+
+    @Override
+    public boolean onTouchEvent(MotionEvent event) {
+        super.onTouchEvent(event);
+        return true;
+    }
+
+    @Override
+    public boolean onTrackballEvent(MotionEvent event) {
+        super.onTrackballEvent(event);
+        return true;
+    }
+
+    public interface FullScreenListener {
+        void onFullScreenChanged(boolean fullScreen);
+    }
+
+    private class FullScreenMediaController extends MediaController {
+        private ImageButton mButton;
+
+        public FullScreenMediaController(Context ctx) {
+            super(ctx);
+
+            mButton = new ImageButton(getContext());
+            mButton.setScaleType(ImageView.ScaleType.FIT_CENTER);
+            mButton.setBackgroundColor(Color.TRANSPARENT);
+            mButton.setOnClickListener(new View.OnClickListener() {
+                @Override
+                public void onClick(View v) {
+                    FullScreenMediaController.this.onFullScreenClicked();
+                }
+            });
+
+            updateFullScreenButton(false);
+        }
+
+        public void setFullScreen(boolean fullScreen) {
+            updateFullScreenButton(fullScreen);
+        }
+
+        private void updateFullScreenButton(boolean fullScreen) {
+            mButton.setImageResource(fullScreen ? R.drawable.exit_fullscreen : R.drawable.fullscreen);
+        }
+
+        private void onFullScreenClicked() {
+            if (VideoPlayer.this.fullScreenListener != null) {
+                boolean fullScreen = !VideoPlayer.this.isFullScreen();
+                VideoPlayer.this.fullScreenListener.onFullScreenChanged(fullScreen);
+            }
+        }
+
+        @Override
+        public void setAnchorView(final View view) {
+            super.setAnchorView(view);
+
+            // Add the fullscreen button here because this is where the parent class actually creates
+            // the media buttons and their layout.
+            //
+            // http://androidxref.com/6.0.1_r10/xref/frameworks/base/core/java/android/widget/MediaController.java#239
+            //
+            // The media buttons are in a horizontal linear layout which is itself packed into
+            // a vertical layout. The vertical layout is the only child of the FrameLayout which
+            // MediaController inherits from.
+            LinearLayout child = (LinearLayout) getChildAt(0);
+            LinearLayout buttons = (LinearLayout) child.getChildAt(0);
+
+            LinearLayout.LayoutParams params = new LinearLayout.LayoutParams(LayoutParams.WRAP_CONTENT,
+                                                                             LayoutParams.FILL_PARENT);
+            params.gravity = Gravity.CENTER_VERTICAL;
+
+            if (mButton.getParent() != null) {
+                ((ViewGroup)mButton.getParent()).removeView(mButton);
+            }
+
+            buttons.addView(mButton, params);
+        }
+    }
+}

mobile/android/base/moz.build

@@ -517,6 +517,7 @@ gbjar.sources += ['java/org/mozilla/gecko/' + x for x in [
     'media/MediaControlService.java',
     'media/RemoteManager.java',
     'media/Sample.java',
+    'media/VideoPlayer.java',
     'MediaCastingBar.java',
     'MemoryMonitor.java',
     'menu/GeckoMenu.java',

mobile/android/base/resources/layout/gecko_app.xml

@@ -50,6 +50,11 @@
                          android:layout_alignParentBottom="true">
             </FrameLayout>
 
+            <view class="org.mozilla.gecko.media.VideoPlayer" android:id="@+id/video_player"
+                         android:layout_height="match_parent"
+                         android:layout_width="match_parent">
+            </view>
+
             <ViewStub android:id="@+id/zoomed_view_stub"
                       android:inflatedId="@+id/zoomed_view"
                       android:layout="@layout/zoomed_view"

netwerk/protocol/http/HttpChannelChild.cpp

@@ -770,8 +770,6 @@ HttpChannelChild::DoOnProgress(nsIRequest* aRequest, int64_t progress, int64_t p
     // OnProgress
     //
     if (progress > 0) {
-      MOZ_ASSERT((progressMax == -1) || (progress <= progressMax),
-                 "unexpected progress values");
       mProgressSink->OnProgress(aRequest, nullptr, progress, progressMax);
     }
   }
@@ -1016,8 +1014,6 @@ HttpChannelChild::OnProgress(const int64_t& progress,
   if (mProgressSink && NS_SUCCEEDED(mStatus) && mIsPending)
   {
     if (progress > 0) {
-      MOZ_ASSERT((progressMax == -1) || (progress <= progressMax),
-                 "unexpected progress values");
       mProgressSink->OnProgress(this, nullptr, progress, progressMax);
     }
   }

testing/mozharness/configs/releases/bouncer_firefox_beta.py

@@ -74,10 +74,8 @@ config = {
         },
         "sha1-installer": {
             "product-name": "Firefox-%(version)s-sha1",
-            # TODO: enable when sha1 installers are automated in bug 1290179
-            "check_uptake": False,
-            # TODO: enable when sha1 installers are automated in bug 1290179
-            # "alias": "firefox-beta-sha1",
+            "check_uptake": True,
+            "alias": "firefox-beta-sha1",
             "ssl-only": True,
             "add-locales": True,
             "paths": {

testing/mozharness/configs/releases/bouncer_firefox_release.py

@@ -106,10 +106,8 @@ config = {
         },
         "sha1-installer": {
             "product-name": "Firefox-%(version)s-sha1",
-            # TODO: enable when sha1 installers are automated in bug 1290179
-            "check_uptake": False,
-            # TODO: enable when sha1 installers are automated in bug 1290179
-            # "alias": "firefox-sha1",
+            "check_uptake": True,
+            "alias": "firefox-sha1",
             "ssl-only": True,
             "add-locales": True,
             "paths": {

testing/web-platform/meta/js/builtins/WeakMap.prototype-properties.html.ini

@@ -1,5 +0,0 @@
-[WeakMap.prototype-properties.html]
-  type: testharness
-  [WeakMap.prototype.@@toStringTag]
-    expected: FAIL
-

toolkit/components/ctypes/tests/unit/test_jsctypes.js

@@ -35,14 +35,6 @@ function do_check_throws(f, type, stack)
   do_throw("expected " + type.name + " exception, none thrown", stack);
 }
 
-function do_check_class(obj, classname, stack)
-{
-  if (!stack)
-    stack = Components.stack.caller;
-
-  do_check_eq(Object.prototype.toString.call(obj), "[object " + classname + "]", stack);
-}
-
 function run_test()
 {
   // Test ctypes.CType and ctypes.CData are set up correctly.
@@ -232,10 +224,6 @@ function run_abstract_class_tests()
   do_check_throws(function() { ctypes.CType(); }, TypeError);
   do_check_throws(function() { new ctypes.CType() }, TypeError);
 
-  // Test that classes and prototypes are set up correctly.
-  do_check_class(ctypes.CType, "Function");
-  do_check_class(ctypes.CType.prototype, "CType");
-
   do_check_true(ctypes.CType.hasOwnProperty("prototype"));
   do_check_throws(function() { ctypes.CType.prototype(); }, TypeError);
   do_check_throws(function() { new ctypes.CType.prototype() }, TypeError);
@@ -270,10 +258,6 @@ function run_abstract_class_tests()
   do_check_throws(function() { ctypes.CData(); }, TypeError);
   do_check_throws(function() { new ctypes.CData() }, TypeError);
 
-  // Test that classes and prototypes are set up correctly.
-  do_check_class(ctypes.CData, "Function");
-  do_check_class(ctypes.CData.prototype, "CData");
-
   do_check_true(ctypes.CData.__proto__ === ctypes.CType.prototype);
   do_check_true(ctypes.CData instanceof ctypes.CType);
 
@@ -303,10 +287,6 @@ function run_abstract_class_tests()
 function run_Int64_tests() {
   do_check_throws(function() { ctypes.Int64(); }, TypeError);
 
-  // Test that classes and prototypes are set up correctly.
-  do_check_class(ctypes.Int64, "Function");
-  do_check_class(ctypes.Int64.prototype, "Int64");
-
   do_check_true(ctypes.Int64.hasOwnProperty("prototype"));
   do_check_true(ctypes.Int64.prototype.hasOwnProperty("constructor"));
   do_check_true(ctypes.Int64.prototype.constructor === ctypes.Int64);
@@ -477,10 +457,6 @@ function run_Int64_tests() {
 function run_UInt64_tests() {
   do_check_throws(function() { ctypes.UInt64(); }, TypeError);
 
-  // Test that classes and prototypes are set up correctly.
-  do_check_class(ctypes.UInt64, "Function");
-  do_check_class(ctypes.UInt64.prototype, "UInt64");
-
   do_check_true(ctypes.UInt64.hasOwnProperty("prototype"));
   do_check_true(ctypes.UInt64.prototype.hasOwnProperty("constructor"));
   do_check_true(ctypes.UInt64.prototype.constructor === ctypes.UInt64);
@@ -746,10 +722,6 @@ function offsetof(struct, member) {
 // Test the class and prototype hierarchy for a given basic type 't'.
 function run_basic_class_tests(t)
 {
-  // Test that classes and prototypes are set up correctly.
-  do_check_class(t, "CType");
-  do_check_class(t.prototype, "CData");
-
   do_check_true(t.__proto__ === ctypes.CType.prototype);
   do_check_true(t instanceof ctypes.CType);
 
@@ -770,7 +742,6 @@ function run_basic_class_tests(t)
 
   // Test that an instance 'd' of 't' is a CData.
   let d = t();
-  do_check_class(d, "CData");
   do_check_true(d.__proto__ === t.prototype);
   do_check_true(d instanceof t);
   do_check_true(d.constructor === t);
@@ -1291,10 +1262,6 @@ function run_char16_tests(library, t, name, limits) {
 // Test the class and prototype hierarchy for a given type constructor 'c'.
 function run_type_ctor_class_tests(c, t, t2, props=[], fns=[], instanceProps=[], instanceFns=[], specialProps=[])
 {
-  // Test that classes and prototypes are set up correctly on the type ctor 'c'.
-  do_check_class(c, "Function");
-  do_check_class(c.prototype, "CType");
-
   do_check_true(c.prototype.__proto__ === ctypes.CType.prototype);
   do_check_true(c.prototype instanceof ctypes.CType);
   do_check_true(c.prototype.constructor === c);
@@ -1311,15 +1278,9 @@ function run_type_ctor_class_tests(c, t, t2, props=[], fns=[], instanceProps=[],
   for (let f of fns)
     do_check_throws(function() { c.prototype[f](); }, TypeError);
 
-  // Test that classes and prototypes are set up correctly on a constructed
-  // type 't'.
-  do_check_class(t, "CType");
-  do_check_class(t.prototype, "CData");
-
   do_check_true(t.__proto__ === c.prototype);
   do_check_true(t instanceof c);
 
-  do_check_class(t.prototype.__proto__, "CData");
   // 't.prototype.__proto__' is the common ancestor of all types constructed
   // from 'c'; while not available from 'c' directly, it should be identically
   // equal to 't2.prototype.__proto__' where 't2' is a different CType
@@ -1367,7 +1328,6 @@ function run_type_ctor_class_tests(c, t, t2, props=[], fns=[], instanceProps=[],
   // Test that an instance 'd' of 't' is a CData.
   if (t.__proto__ != ctypes.FunctionType.prototype) {
     let d = t();
-    do_check_class(d, "CData");
     do_check_true(d.__proto__ === t.prototype);
     do_check_true(d instanceof t);
     do_check_true(d.constructor === t);

toolkit/components/telemetry/docs/data/main-ping.rst

@@ -104,20 +104,30 @@ Structure:
       "parent": {
         scalars: {...},
       },
+      "content": {
+        histograms: {...},
+        keyedHistograms: {...},
+      },
     }
 
+histograms and keyedHistograms
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+This section contains histograms and keyed histograms accumulated on content processes. Histograms recorded on a content child process have different character than parent histograms. For instance, ``GC_MS`` will be much different in ``processes.content`` as it has to contend with web content, whereas the instance in ``payload.histograms`` has only to contend with browser JS. Also, some histograms may be absent if never recorded on a content child process (``EVENTLOOP_UI_ACTIVITY`` is parent-process-only).
+
+This format was adopted in Firefox 51 via bug 1218576.
+
 scalars
 ~~~~~~~
 This section contains the :doc:`../collection/scalars` that are valid for the current platform. Scalars are not created nor submitted if no data was added to them, and are only reported with subsession pings. Scalar data is only currently reported for the main process. Their type and format is described by the ``Scalars.yaml`` file. Its most recent version is available `here <https://dxr.mozilla.org/mozilla-central/source/toolkit/components/telemetry/Scalars.yaml>`_. The ``info.revision`` field indicates the revision of the file that describes the reported scalars.
 
 childPayloads
 -------------
-The Telemetry payloads sent by child processes, recorded on child process shutdown (event ``content-child-shutdown`` observed) and whenever ``TelemetrySession.requestChildPayloads()`` is called (currently only used in tests). They are reduced session payloads, only available with e10s. Among some other things, they don't report addon details, addon histograms or UI Telemetry.
-
-Any histogram whose Accumulate call happens on a child process will be accumulated into a childPayload's histogram, not the parent's. As such, some histograms in childPayloads will contain different data (e.g. ``GC_MS`` will be much different in childPayloads, for instance, because the child GC needs to content with content scripts and parent doesn't) and some histograms will be absent (``EVENTLOOP_UI_ACTIVITY`` is parent-process-only because it measures inter-event timings where the OS delivers the events in the parent).
+The Telemetry payloads sent by child processes, recorded on child process shutdown (event ``content-child-shutdown`` observed). They are reduced session payloads, only available with e10s. Among some other things, they don't contain histograms, keyed histograms, addon details, addon histograms, or UI Telemetry.
 
 Note: Child payloads are not collected and cleared with subsession splits, they are currently only meaningful when analysed from ``saved-session`` or ``main`` pings with ``reason`` set to ``shutdown``.
 
+Note: Before Firefox 51 and bug 1218576, content process histograms and keyedHistograms were in the individual child payloads instead of being aggregated into ``processes.content``.
+
 simpleMeasurements
 ------------------
 This section contains a list of simple measurements, or counters. In addition to the ones highlighted below, Telemetry timestamps (see `here <https://dxr.mozilla.org/mozilla-central/search?q=%22TelemetryTimestamps.add%22&redirect=false&case=true>`_ and `here <https://dxr.mozilla.org/mozilla-central/search?q=%22recordTimestamp%22&redirect=false&case=true>`_) can be reported.

toolkit/content/aboutTelemetry.css

@@ -229,6 +229,14 @@ body[dir="rtl"] .copy-node {
   display: inline;
 }
 
+.processes-ui {
+  display: none;
+}
+
+.has-data.expanded .processes-ui {
+  display: initial;
+}
+
 .filter-blocked {
   display: none;
 }
@@ -257,3 +265,7 @@ body[dir="rtl"] .copy-node {
   font-size: larger;
   margin: 5px 0;
 }
+
+.process-picker {
+  margin: 0 0.5em;
+}