Merge m-c to autoland. a=merge

browser/components/extensions/ExtensionPopups.jsm

@@ -130,9 +130,11 @@ class BasePopup {
         this.viewNode.style.maxHeight = "";
       }
 
-      if (this.panel) {
-        this.panel.style.removeProperty("--arrowpanel-background");
-        this.panel.style.removeProperty("--panel-arrow-image-vertical");
+      let {panel} = this;
+      if (panel) {
+        panel.style.removeProperty("--arrowpanel-background");
+        panel.style.removeProperty("--panel-arrow-image-vertical");
+        panel.removeAttribute("remote");
       }
 
       this.browser = null;
@@ -377,6 +379,9 @@ class PanelPopup extends BasePopup {
     panel.setAttribute("tabspecific", "true");
     panel.setAttribute("type", "arrow");
     panel.setAttribute("role", "group");
+    if (extension.remote) {
+      panel.setAttribute("remote", "true");
+    }
 
     document.getElementById("mainPopupSet").appendChild(panel);
 
@@ -450,6 +455,10 @@ class ViewPopup extends BasePopup {
     this.viewNode = viewNode;
     this.viewNode.addEventListener(this.DESTROY_EVENT, this);
 
+    if (this.extension.remote) {
+      this.panel.setAttribute("remote", "true");
+    }
+
     // Wait until the browser element is fully initialized, and give it at least
     // a short grace period to finish loading its initial content, if necessary.
     //

browser/config/mozconfigs/linux64/debug-static-analysis-clang

@@ -7,6 +7,9 @@ MOZ_AUTOMATION_L10N_CHECK=0
 ac_add_options --enable-debug
 ac_add_options --enable-dmd
 
+# Disable stylo until bug 1356926 is fixed and we have >= llvm39 on centos.
+ac_add_options --disable-stylo
+
 # Use Clang as specified in manifest
 export CC="$topsrcdir/clang/bin/clang"
 export CXX="$topsrcdir/clang/bin/clang++"

browser/config/mozconfigs/linux64/opt-static-analysis-clang

@@ -6,6 +6,9 @@ MOZ_AUTOMATION_L10N_CHECK=0
 
 ac_add_options --enable-dmd
 
+# Disable stylo until bug 1356926 is fixed and we have >= llvm39 on centos.
+ac_add_options --disable-stylo
+
 # Use Clang as specified in manifest
 CC="$topsrcdir/clang/bin/clang"
 CXX="$topsrcdir/clang/bin/clang++"

browser/config/mozconfigs/linux64/stylo

@@ -1,5 +1,3 @@
 . "$topsrcdir/browser/config/mozconfigs/linux64/nightly"
 
-export LLVM_CONFIG="${TOOLTOOL_DIR}/clang/bin/llvm-config"
-
 ac_add_options --enable-stylo

browser/config/mozconfigs/linux64/stylo-debug

@@ -1,5 +1,3 @@
 . "$topsrcdir/browser/config/mozconfigs/linux64/debug"
 
-export LLVM_CONFIG="${TOOLTOOL_DIR}/clang/bin/llvm-config"
-
 ac_add_options --enable-stylo

browser/config/mozconfigs/linux64/valgrind

@@ -5,6 +5,10 @@ ac_add_options --disable-jemalloc
 ac_add_options --disable-install-strip
 ac_add_options --disable-gtest-in-build
 
+# Rust code gives false positives that we have not entirely suppressed yet.
+# Bug 1365915 tracks fixing these.
+ac_add_options --disable-stylo
+
 # Include the override mozconfig again (even though the above includes it)
 # since it's supposed to override everything.
 . "$topsrcdir/build/mozconfig.common.override"

browser/config/tooltool-manifests/linux32/releng.manifest

@@ -31,5 +31,13 @@
     "unpack": true,
     "digest": "fde0128b9a4df74f268f9d45748534d0314db0467ae22e36101df4a5374c36bb8676514e8b70254fb2e6f2a2d1224ff7ce498305223035d5f1e7e306fda2f5d5",
     "size": 2179220
+  },
+  {
+    "version": "clang + llvm 3.9.0, built from SVN r290136",
+    "size": 166261192,
+    "digest": "52f3fc23f0f5c98050f8b0ac7c92a6752d067582a16f712a5a58074be98975d594f9e36249fc2be7f1cc2ca6d509c663faaf2bea66f949243cc1f41651638ba6",
+    "algorithm": "sha512",
+    "filename": "clang.tar.xz",
+    "unpack": true
   }
 ]

browser/config/tooltool-manifests/linux64/hazard.manifest

@@ -39,5 +39,13 @@
     "unpack": true,
     "digest": "fde0128b9a4df74f268f9d45748534d0314db0467ae22e36101df4a5374c36bb8676514e8b70254fb2e6f2a2d1224ff7ce498305223035d5f1e7e306fda2f5d5",
     "size": 2179220
+  },
+  {
+    "version": "clang + llvm 3.9.0, built from SVN r290136",
+    "size": 166261192,
+    "digest": "52f3fc23f0f5c98050f8b0ac7c92a6752d067582a16f712a5a58074be98975d594f9e36249fc2be7f1cc2ca6d509c663faaf2bea66f949243cc1f41651638ba6",
+    "algorithm": "sha512",
+    "filename": "clang.tar.xz",
+    "unpack": true
   }
 ]

browser/config/tooltool-manifests/win32/releng.manifest

@@ -38,5 +38,13 @@
     "unpack": true,
     "digest": "196ac6a567c85559957dfe511c3d8654d23c94d5603259e19ccafe9d71e0e4ccee63ccc9a778f2699654b786cda54266108b7d4db543d01bb0b42545b4e6ec75",
     "size": 297118
+  },
+  {
+    "version": "clang 5.0pre/r293859",
+    "size": 309009013,
+    "digest": "cd3ed31acefd185f441632158dde73538c62bab7ebf2a8ec630985ab345938ec522983721ddb1bead1de22d5ac1571d50a958ae002364d739f2a78c6e7244222",
+    "algorithm": "sha512",
+    "filename": "clang.tar.bz2",
+    "unpack": true
   }
 ]

browser/config/tooltool-manifests/win64/releng.manifest

@@ -39,5 +39,13 @@
     "unpack": true,
     "digest": "196ac6a567c85559957dfe511c3d8654d23c94d5603259e19ccafe9d71e0e4ccee63ccc9a778f2699654b786cda54266108b7d4db543d01bb0b42545b4e6ec75",
     "size": 297118
+  },
+  {
+    "version": "clang 5.0pre/r293859",
+    "size": 313862839,
+    "digest": "44dee70d525ea93952af27f943d1cc773311970c31d971d2bc2e3437cce0c899f3a03ddd8e42e86f1b4fd9ab1c4bc1767cdb0406eb4b3934ae4fc272dab830dc",
+    "algorithm": "sha512",
+    "filename": "clang.tar.bz2",
+    "unpack": true
   }
 ]

build/mozconfig.common

@@ -16,6 +16,9 @@ ac_add_options --enable-crashreporter
 
 ac_add_options --enable-release
 
+# Tell the build system where to find llvm-config for builds on automation.
+export LLVM_CONFIG="${TOOLTOOL_DIR:-$topsrcdir}/clang/bin/llvm-config"
+
 # Enable checking that add-ons are signed by the trusted root
 MOZ_ADDON_SIGNING=${MOZ_ADDON_SIGNING-1}
 # Disable enforcing that add-ons are signed by the trusted root

devtools/client/debugger/new/panel.js

@@ -65,7 +65,6 @@ DebuggerPanel.prototype = {
       };
     }
 
-    frames = frames.toJS();
     const selectedFrame = this._selectors.getSelectedFrame(this._getState());
     const selected = frames.findIndex(frame => frame.id == selectedFrame.id);
 

devtools/client/debugger/new/parser-worker.js

@@ -29197,7 +29197,7 @@ return /******/ (function(modules) { // webpackBootstrap
 	}
 
 	function isLexicalScope(path) {
-	  return isFunction(path) || t.isProgram(path);
+	  return t.isBlockStatement(path) || isFunction(path) || t.isProgram(path);
 	}
 
 	function getSymbols(source) {

devtools/client/debugger/new/test/mochitest/browser_dbg-chrome-debugging.js

@@ -68,7 +68,7 @@ registerCleanupFunction(function() {
   DebuggerServer = null;
 });
 
-add_task(function* () {
+add_task(function*() {
   gClient = initDebuggerClient();
 
   const [type] = yield gClient.connect();
@@ -82,7 +82,7 @@ add_task(function* () {
   // listen for a new source and global
   gThreadClient.addListener("newSource", onNewSource);
   gClient.addListener("newGlobal", onNewGlobal);
-  yield promise.all([ gNewGlobal.promise, gNewChromeSource.promise ]);
+  yield promise.all([gNewGlobal.promise, gNewChromeSource.promise]);
 
   yield resumeAndCloseConnection();
 });

devtools/client/debugger/new/test/mochitest/head.js

@@ -208,9 +208,11 @@ function assertPausedLocation(dbg, source, line) {
   is(getSelectedSource(getState()).get("id"), source.id);
 
   // Check the pause location
-  const location = getPause(getState()).getIn(["frame", "location"]);
-  is(location.get("sourceId"), source.id);
-  is(location.get("line"), line);
+  const pause = getPause(getState());
+  const location = pause && pause.frame && pause.frame.location;
+
+  is(location.sourceId, source.id);
+  is(location.line, line);
 
   // Check the debug line
   ok(
@@ -280,7 +282,7 @@ function waitForPaused(dbg) {
       }
       // Make sure the source text is completely loaded for the
       // source we are paused in.
-      const sourceId = pause.getIn(["frame", "location", "sourceId"]);
+      const sourceId = pause && pause.frame && pause.frame.location.sourceId;
       const sourceText = dbg.selectors.getSourceText(dbg.getState(), sourceId);
       return sourceText && !sourceText.get("loading");
     });

devtools/client/locales/en-US/debugger.properties

@@ -306,6 +306,18 @@ editor.conditionalPanel.close=Cancel edit breakpoint and close
 # for navigating to a source mapped location
 editor.jumpToMappedLocation1=Jump to %S location
 
+# LOCALIZATION NOTE (framework.disableGrouping): This is the text that appears in the
+# context menu to disable framework grouping.
+framework.disableGrouping=Disable Framework Grouping
+
+# LOCALIZATION NOTE (framework.enableGrouping): This is the text that appears in the
+# context menu to enable framework grouping.
+framework.enableGrouping=Enable Framework Grouping
+
+# LOCALIZATION NOTE (framework.accesskey): Access key to toggle framework grouping from
+# the context menu.
+framework.accesskey=u
+
 # LOCALIZATION NOTE (generated): Source Map term for a server source location
 generated=generated
 

devtools/client/preferences/debugger.js

@@ -30,6 +30,7 @@ pref("devtools.debugger.ui.panes-visible-on-startup", false);
 pref("devtools.debugger.ui.variables-sorting-enabled", true);
 pref("devtools.debugger.ui.variables-only-enum-visible", false);
 pref("devtools.debugger.ui.variables-searchbox-visible", false);
+pref("devtools.debugger.ui.framework-grouping-on", true);
 pref("devtools.debugger.call-stack-visible", false);
 pref("devtools.debugger.scopes-visible", false);
 pref("devtools.debugger.start-panel-collapsed", false);

dom/base/nsContentUtils.cpp

@@ -7176,9 +7176,22 @@ nsContentUtils::IsFullScreenApiEnabled()
 bool
 nsContentUtils::IsRequestFullScreenAllowed(CallerType aCallerType)
 {
-  return !sTrustedFullScreenOnly ||
-         EventStateManager::IsHandlingUserInput() ||
-         aCallerType == CallerType::System;
+  // If more time has elapsed since the user input than is specified by the
+  // dom.event.handling-user-input-time-limit pref (default 1 second), this
+  // function also returns false.
+
+  if (!sTrustedFullScreenOnly || aCallerType == CallerType::System) {
+    return true;
+  }
+
+  if (EventStateManager::IsHandlingUserInput()) {
+    TimeDuration timeout = HandlingUserInputTimeout();
+    return timeout <= TimeDuration(0) ||
+      (TimeStamp::Now() -
+       EventStateManager::GetHandlingInputStart()) <= timeout;
+  }
+
+  return false;
 }
 
 /* static */
@@ -8770,65 +8783,6 @@ nsContentUtils::GetWindowRoot(nsIDocument* aDoc)
   return nullptr;
 }
 
-/* static */
-nsContentPolicyType
-nsContentUtils::InternalContentPolicyTypeToExternal(nsContentPolicyType aType)
-{
-  switch (aType) {
-  case nsIContentPolicy::TYPE_INTERNAL_SCRIPT:
-  case nsIContentPolicy::TYPE_INTERNAL_SCRIPT_PRELOAD:
-  case nsIContentPolicy::TYPE_INTERNAL_WORKER:
-  case nsIContentPolicy::TYPE_INTERNAL_SHARED_WORKER:
-  case nsIContentPolicy::TYPE_INTERNAL_SERVICE_WORKER:
-  case nsIContentPolicy::TYPE_INTERNAL_WORKER_IMPORT_SCRIPTS:
-    return nsIContentPolicy::TYPE_SCRIPT;
-
-  case nsIContentPolicy::TYPE_INTERNAL_EMBED:
-  case nsIContentPolicy::TYPE_INTERNAL_OBJECT:
-    return nsIContentPolicy::TYPE_OBJECT;
-
-  case nsIContentPolicy::TYPE_INTERNAL_FRAME:
-  case nsIContentPolicy::TYPE_INTERNAL_IFRAME:
-    return nsIContentPolicy::TYPE_SUBDOCUMENT;
-
-  case nsIContentPolicy::TYPE_INTERNAL_AUDIO:
-  case nsIContentPolicy::TYPE_INTERNAL_VIDEO:
-  case nsIContentPolicy::TYPE_INTERNAL_TRACK:
-    return nsIContentPolicy::TYPE_MEDIA;
-
-  case nsIContentPolicy::TYPE_INTERNAL_XMLHTTPREQUEST:
-  case nsIContentPolicy::TYPE_INTERNAL_EVENTSOURCE:
-    return nsIContentPolicy::TYPE_XMLHTTPREQUEST;
-
-  case nsIContentPolicy::TYPE_INTERNAL_IMAGE:
-  case nsIContentPolicy::TYPE_INTERNAL_IMAGE_PRELOAD:
-  case nsIContentPolicy::TYPE_INTERNAL_IMAGE_FAVICON:
-    return nsIContentPolicy::TYPE_IMAGE;
-
-  case nsIContentPolicy::TYPE_INTERNAL_STYLESHEET:
-  case nsIContentPolicy::TYPE_INTERNAL_STYLESHEET_PRELOAD:
-    return nsIContentPolicy::TYPE_STYLESHEET;
-
-  default:
-    return aType;
-  }
-}
-
-/* static */
-nsContentPolicyType
-nsContentUtils::InternalContentPolicyTypeToExternalOrWorker(nsContentPolicyType aType)
-{
-  switch (aType) {
-  case nsIContentPolicy::TYPE_INTERNAL_WORKER:
-  case nsIContentPolicy::TYPE_INTERNAL_SHARED_WORKER:
-  case nsIContentPolicy::TYPE_INTERNAL_SERVICE_WORKER:
-    return aType;
-
-  default:
-    return InternalContentPolicyTypeToExternal(aType);
-  }
-}
-
 /* static */
 bool
 nsContentUtils::IsPreloadType(nsContentPolicyType aType)

dom/base/nsContentUtils.h

@@ -1160,7 +1160,8 @@ public:
   /**
    * Map internal content policy types to external ones.
    */
-  static nsContentPolicyType InternalContentPolicyTypeToExternal(nsContentPolicyType aType);
+  static inline nsContentPolicyType
+    InternalContentPolicyTypeToExternal(nsContentPolicyType aType);
 
   /**
    * Map internal content policy types to external ones or preload types:
@@ -1170,7 +1171,8 @@ public:
    *
    * Note: DO NOT call this function unless you know what you're doing!
    */
-  static nsContentPolicyType InternalContentPolicyTypeToExternalOrPreload(nsContentPolicyType aType);
+  static inline nsContentPolicyType
+    InternalContentPolicyTypeToExternalOrPreload(nsContentPolicyType aType);
 
   /**
    * Map internal content policy types to external ones, worker, or preload types:
@@ -3109,6 +3111,65 @@ private:
   static mozilla::LazyLogModule sDOMDumpLog;
 };
 
+/* static */ inline
+nsContentPolicyType
+nsContentUtils::InternalContentPolicyTypeToExternal(nsContentPolicyType aType)
+{
+  switch (aType) {
+  case nsIContentPolicy::TYPE_INTERNAL_SCRIPT:
+  case nsIContentPolicy::TYPE_INTERNAL_SCRIPT_PRELOAD:
+  case nsIContentPolicy::TYPE_INTERNAL_WORKER:
+  case nsIContentPolicy::TYPE_INTERNAL_SHARED_WORKER:
+  case nsIContentPolicy::TYPE_INTERNAL_SERVICE_WORKER:
+  case nsIContentPolicy::TYPE_INTERNAL_WORKER_IMPORT_SCRIPTS:
+    return nsIContentPolicy::TYPE_SCRIPT;
+
+  case nsIContentPolicy::TYPE_INTERNAL_EMBED:
+  case nsIContentPolicy::TYPE_INTERNAL_OBJECT:
+    return nsIContentPolicy::TYPE_OBJECT;
+
+  case nsIContentPolicy::TYPE_INTERNAL_FRAME:
+  case nsIContentPolicy::TYPE_INTERNAL_IFRAME:
+    return nsIContentPolicy::TYPE_SUBDOCUMENT;
+
+  case nsIContentPolicy::TYPE_INTERNAL_AUDIO:
+  case nsIContentPolicy::TYPE_INTERNAL_VIDEO:
+  case nsIContentPolicy::TYPE_INTERNAL_TRACK:
+    return nsIContentPolicy::TYPE_MEDIA;
+
+  case nsIContentPolicy::TYPE_INTERNAL_XMLHTTPREQUEST:
+  case nsIContentPolicy::TYPE_INTERNAL_EVENTSOURCE:
+    return nsIContentPolicy::TYPE_XMLHTTPREQUEST;
+
+  case nsIContentPolicy::TYPE_INTERNAL_IMAGE:
+  case nsIContentPolicy::TYPE_INTERNAL_IMAGE_PRELOAD:
+  case nsIContentPolicy::TYPE_INTERNAL_IMAGE_FAVICON:
+    return nsIContentPolicy::TYPE_IMAGE;
+
+  case nsIContentPolicy::TYPE_INTERNAL_STYLESHEET:
+  case nsIContentPolicy::TYPE_INTERNAL_STYLESHEET_PRELOAD:
+    return nsIContentPolicy::TYPE_STYLESHEET;
+
+  default:
+    return aType;
+  }
+}
+
+/* static */ inline
+nsContentPolicyType
+nsContentUtils::InternalContentPolicyTypeToExternalOrWorker(nsContentPolicyType aType)
+{
+  switch (aType) {
+  case nsIContentPolicy::TYPE_INTERNAL_WORKER:
+  case nsIContentPolicy::TYPE_INTERNAL_SHARED_WORKER:
+  case nsIContentPolicy::TYPE_INTERNAL_SERVICE_WORKER:
+    return aType;
+
+  default:
+    return InternalContentPolicyTypeToExternal(aType);
+  }
+}
+
 class MOZ_RAII nsAutoScriptBlocker {
 public:
   explicit nsAutoScriptBlocker(MOZ_GUARD_OBJECT_NOTIFIER_ONLY_PARAM) {

dom/base/nsGkAtomList.h

@@ -1103,6 +1103,7 @@ GK_ATOM(refresh, "refresh")
 GK_ATOM(rel, "rel")
 GK_ATOM(onreloadpage, "onreloadpage")
 GK_ATOM(rem, "rem")
+GK_ATOM(remote, "remote")
 GK_ATOM(removeelement, "removeelement")
 GK_ATOM(renderingobserverlist, "renderingobserverlist")
 GK_ATOM(repeat, "repeat")

dom/base/nsGlobalWindow.cpp

@@ -8433,7 +8433,17 @@ nsGlobalWindow::ScrollTo(double aXScroll, double aYScroll)
 void
 nsGlobalWindow::ScrollTo(const ScrollToOptions& aOptions)
 {
-  FlushPendingNotifications(FlushType::Layout);
+  // When scrolling to a non-zero offset, we need to determine whether that
+  // position is within our scrollable range, so we need updated layout
+  // information which requires a layout flush, otherwise all we need is to
+  // flush frames to be able to access our scrollable frame here.
+  FlushType flushType = ((aOptions.mLeft.WasPassed() &&
+                          aOptions.mLeft.Value() > 0) ||
+                         (aOptions.mTop.WasPassed() &&
+                          aOptions.mTop.Value() > 0)) ?
+                          FlushType::Layout :
+                          FlushType::Frames;
+  FlushPendingNotifications(flushType);
   nsIScrollableFrame *sf = GetScrollFrame();
 
   if (sf) {
@@ -8459,7 +8469,14 @@ void
 nsGlobalWindow::ScrollTo(const CSSIntPoint& aScroll,
                          const ScrollOptions& aOptions)
 {
-  FlushPendingNotifications(FlushType::Layout);
+  // When scrolling to a non-zero offset, we need to determine whether that
+  // position is within our scrollable range, so we need updated layout
+  // information which requires a layout flush, otherwise all we need is to
+  // flush frames to be able to access our scrollable frame here.
+  FlushType flushType = (aScroll.x || aScroll.y) ?
+                          FlushType::Layout :
+                          FlushType::Frames;
+  FlushPendingNotifications(flushType);
   nsIScrollableFrame *sf = GetScrollFrame();
 
   if (sf) {

dom/base/test/test_bug1118689.html

@@ -13,26 +13,9 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1118689
   /** Test for Bug 1118689 **/
   SimpleTest.requestFlakyTimeout("Just need some random timeout.");
 
-  function test1() {
-    // test 1, check that error handling in data documents is still the same
-    //         as it has been for ages.
-    var d = document.implementation.createHTMLDocument();
-    d.body.innerHTML = "<img onerror='ok(false, \"EventHandler shouldn't be called in data document\")'>";
-    d.body.firstChild.addEventListener("error",
-      function() {
-        ok(true, "EventListener should be called in data document");
-        test2();
-      });
-    d.body.firstChild.addEventListener("load",
-      function() {
-        ok(false, "Images in data document shouldn't be loaded");
-      });
-    d.body.firstChild.src = "data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP";
-  }
-
-  function test2() {
-    // test 2, check that load event doesn't keep up being dispatched if
-    //         window has been closed.
+  function test() {
+    // check that load event doesn't keep up being dispatched if
+    // window has been closed.
     var win = window.open('data:text/html,<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP" onload="this.src = this.src">',
                           "", "height=100,width=100");
     setTimeout(function() {
@@ -45,7 +28,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=1118689
 
   </script>
 </head>
-<body onload="test1();">
+<body onload="test();">
 <a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=1118689">Mozilla Bug 1118689</a>
 <p id="display"></p>
 <div id="content" style="display: none">

dom/events/EventStateManager.cpp

@@ -3868,13 +3868,7 @@ public:
 /*static*/ bool
 EventStateManager::IsHandlingUserInput()
 {
-  if (sUserInputEventDepth <= 0) {
-    return false;
-  }
-
-  TimeDuration timeout = nsContentUtils::HandlingUserInputTimeout();
-  return timeout <= TimeDuration(0) ||
-         (TimeStamp::Now() - sHandlingInputStart) <= timeout;
+  return sUserInputEventDepth > 0;
 }
 
 static void

dom/events/EventStateManager.h

@@ -215,15 +215,16 @@ public:
     }
   }
 
+  static TimeStamp GetHandlingInputStart() {
+    return sHandlingInputStart;
+  }
+
   /**
    * Returns true if the current code is being executed as a result of
    * user input.  This includes anything that is initiated by user,
    * with the exception of page load events or mouse over events. If
    * this method is called from asynchronously executed code, such as
-   * during layout reflows, it will return false. If more time has
-   * elapsed since the user input than is specified by the
-   * dom.event.handling-user-input-time-limit pref (default 1 second),
-   * this function also returns false.
+   * during layout reflows, it will return false.
    */
   static bool IsHandlingUserInput();
 

dom/html/HTMLImageElement.cpp

@@ -535,7 +535,7 @@ HTMLImageElement::SetAttr(int32_t aNameSpaceID, nsIAtom* aName,
         mResponsiveSelector->SetDefaultSource(aValue);
       }
       QueueImageLoadTask(true);
-    } else if (aNotify) {
+    } else if (aNotify && OwnerDoc()->IsCurrentActiveDocument()) {
       // If aNotify is false, we are coming from the parser or some such place;
       // we'll get bound after all the attributes have been set, so we'll do the
       // sync image load from BindToTree. Skip the LoadImage call in that case.
@@ -594,7 +594,7 @@ HTMLImageElement::SetAttr(int32_t aNameSpaceID, nsIAtom* aName,
       // per spec, full selection runs when this changes, even though
       // it doesn't directly affect the source selection
       QueueImageLoadTask(true);
-    } else {
+    } else if (OwnerDoc()->IsCurrentActiveDocument()) {
       // Bug 1076583 - We still use the older synchronous algorithm in
       // non-responsive mode. Force a new load of the image with the
       // new cross origin policy
@@ -660,7 +660,8 @@ HTMLImageElement::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
     // If loading is temporarily disabled, don't even launch MaybeLoadImage.
     // Otherwise MaybeLoadImage may run later when someone has reenabled
     // loading.
-    if (LoadingEnabled()) {
+    if (LoadingEnabled() &&
+        OwnerDoc()->IsCurrentActiveDocument()) {
       nsContentUtils::AddScriptRunner(
           NewRunnableMethod(this, &HTMLImageElement::MaybeLoadImage));
     }
@@ -865,7 +866,8 @@ HTMLImageElement::CopyInnerTo(Element* aDest, bool aPreallocateChildren)
     // really do want it to do the load, so set it up to happen once the cloning
     // reaches a stable state.
     if (!dest->InResponsiveMode() &&
-        dest->HasAttr(kNameSpaceID_None, nsGkAtoms::src)) {
+        dest->HasAttr(kNameSpaceID_None, nsGkAtoms::src) &&
+        dest->OwnerDoc()->IsCurrentActiveDocument()) {
       // Mark channel as urgent-start before load image if the image load is
       // initaiated by a user interaction.
       mUseUrgentStartForChannel = EventStateManager::IsHandlingUserInput();

dom/ipc/ContentChild.cpp

@@ -551,28 +551,32 @@ ContentChild::Init(MessageLoop* aIOLoop,
   // to use, and when starting under XWayland, it may choose to start with
   // the wayland backend instead of the x11 backend.
   // The DISPLAY environment variable is normally set by the parent process.
-  const char* display_name = DetectDisplay();
-  if (display_name) {
-    int argc = 3;
-    char option_name[] = "--display";
-    char* argv[] = {
-      // argv0 is unused because g_set_prgname() was called in
-      // XRE_InitChildProcess().
-      nullptr,
-      option_name,
-      const_cast<char*>(display_name),
-      nullptr
-    };
-    char** argvp = argv;
-    gtk_init(&argc, &argvp);
-  } else {
-    gtk_init(nullptr, nullptr);
+  if (!gfxPlatform::IsHeadless()) {
+    const char* display_name = DetectDisplay();
+    if (display_name) {
+      int argc = 3;
+      char option_name[] = "--display";
+      char* argv[] = {
+        // argv0 is unused because g_set_prgname() was called in
+        // XRE_InitChildProcess().
+        nullptr,
+        option_name,
+        const_cast<char*>(display_name),
+        nullptr
+      };
+      char** argvp = argv;
+      gtk_init(&argc, &argvp);
+    } else {
+      gtk_init(nullptr, nullptr);
+    }
   }
 #endif
 
 #ifdef MOZ_X11
-  // Do this after initializing GDK, or GDK will install its own handler.
-  XRE_InstallX11ErrorHandler();
+  if (!gfxPlatform::IsHeadless()) {
+    // Do this after initializing GDK, or GDK will install its own handler.
+    XRE_InstallX11ErrorHandler();
+  }
 #endif
 
   NS_ASSERTION(!sSingleton, "only one ContentChild per child");
@@ -603,10 +607,12 @@ ContentChild::Init(MessageLoop* aIOLoop,
   GetIPCChannel()->SendBuildID();
 
 #ifdef MOZ_X11
-  // Send the parent our X socket to act as a proxy reference for our X
-  // resources.
-  int xSocketFd = ConnectionNumber(DefaultXDisplay());
-  SendBackUpXResources(FileDescriptor(xSocketFd));
+  if (!gfxPlatform::IsHeadless()) {
+    // Send the parent our X socket to act as a proxy reference for our X
+    // resources.
+    int xSocketFd = ConnectionNumber(DefaultXDisplay());
+    SendBackUpXResources(FileDescriptor(xSocketFd));
+  }
 #endif
 
 #ifdef MOZ_CRASHREPORTER

dom/ipc/TabChild.cpp

@@ -2500,7 +2500,8 @@ TabChild::RecvSetDocShellIsActive(const bool& aIsActive,
     MOZ_ASSERT(mPuppetWidget);
     MOZ_ASSERT(mPuppetWidget->GetLayerManager());
     MOZ_ASSERT(mPuppetWidget->GetLayerManager()->GetBackendType() == LayersBackend::LAYERS_CLIENT
-            || mPuppetWidget->GetLayerManager()->GetBackendType() == LayersBackend::LAYERS_WR);
+            || mPuppetWidget->GetLayerManager()->GetBackendType() == LayersBackend::LAYERS_WR
+            || (gfxPlatform::IsHeadless() && mPuppetWidget->GetLayerManager()->GetBackendType() == LayersBackend::LAYERS_BASIC));
 
     // We send the current layer observer epoch to the compositor so that
     // TabParent knows whether a layer update notification corresponds to the
@@ -3017,7 +3018,8 @@ TabChild::DidComposite(uint64_t aTransactionId,
   MOZ_ASSERT(mPuppetWidget);
   MOZ_ASSERT(mPuppetWidget->GetLayerManager());
   MOZ_ASSERT(mPuppetWidget->GetLayerManager()->GetBackendType() == LayersBackend::LAYERS_CLIENT
-             || mPuppetWidget->GetLayerManager()->GetBackendType() == LayersBackend::LAYERS_WR);
+             || mPuppetWidget->GetLayerManager()->GetBackendType() == LayersBackend::LAYERS_WR
+             || (gfxPlatform::IsHeadless() && mPuppetWidget->GetLayerManager()->GetBackendType() == LayersBackend::LAYERS_BASIC));
 
   mPuppetWidget->GetLayerManager()->DidComposite(aTransactionId, aCompositeStart, aCompositeEnd);
 }
@@ -3054,7 +3056,8 @@ TabChild::ClearCachedResources()
   MOZ_ASSERT(mPuppetWidget);
   MOZ_ASSERT(mPuppetWidget->GetLayerManager());
   MOZ_ASSERT(mPuppetWidget->GetLayerManager()->GetBackendType() == LayersBackend::LAYERS_CLIENT
-             || mPuppetWidget->GetLayerManager()->GetBackendType() == LayersBackend::LAYERS_WR);
+             || mPuppetWidget->GetLayerManager()->GetBackendType() == LayersBackend::LAYERS_WR
+             || (gfxPlatform::IsHeadless() && mPuppetWidget->GetLayerManager()->GetBackendType() == LayersBackend::LAYERS_BASIC));
 
   mPuppetWidget->GetLayerManager()->ClearCachedResources();
 }
@@ -3065,7 +3068,8 @@ TabChild::InvalidateLayers()
   MOZ_ASSERT(mPuppetWidget);
   MOZ_ASSERT(mPuppetWidget->GetLayerManager());
   MOZ_ASSERT(mPuppetWidget->GetLayerManager()->GetBackendType() == LayersBackend::LAYERS_CLIENT
-             || mPuppetWidget->GetLayerManager()->GetBackendType() == LayersBackend::LAYERS_WR);
+             || mPuppetWidget->GetLayerManager()->GetBackendType() == LayersBackend::LAYERS_WR
+             || (gfxPlatform::IsHeadless() && mPuppetWidget->GetLayerManager()->GetBackendType() == LayersBackend::LAYERS_BASIC));
 
   RefPtr<LayerManager> lm = mPuppetWidget->GetLayerManager();
   FrameLayerBuilder::InvalidateAllLayers(lm);
@@ -3154,7 +3158,8 @@ TabChild::CompositorUpdated(const TextureFactoryIdentifier& aNewIdentifier,
                             uint64_t aDeviceResetSeqNo)
 {
   MOZ_ASSERT(mPuppetWidget->GetLayerManager()->GetBackendType() == LayersBackend::LAYERS_CLIENT
-             || mPuppetWidget->GetLayerManager()->GetBackendType() == LayersBackend::LAYERS_WR);
+             || mPuppetWidget->GetLayerManager()->GetBackendType() == LayersBackend::LAYERS_WR
+             || (gfxPlatform::IsHeadless() && mPuppetWidget->GetLayerManager()->GetBackendType() == LayersBackend::LAYERS_BASIC));
 
   RefPtr<LayerManager> lm = mPuppetWidget->GetLayerManager();
 

dom/workers/ServiceWorkerClients.cpp

@@ -34,7 +34,7 @@
 #include "nsWeakReference.h"
 
 #ifdef MOZ_WIDGET_ANDROID
-#include "AndroidBridge.h"
+#include "FennecJNIWrappers.h"
 #endif
 
 using namespace mozilla;
@@ -554,7 +554,9 @@ public:
 #ifdef MOZ_WIDGET_ANDROID
     // This fires an intent that will start launching Fennec and foreground it,
     // if necessary.
-    java::GeckoAppShell::LaunchOrBringToFront();
+    if (jni::IsFennec()) {
+      java::GeckoApp::LaunchOrBringToFront();
+    }
 #endif
 
     nsCOMPtr<nsPIDOMWindowOuter> window;
@@ -596,7 +598,7 @@ public:
       return NS_OK;
     }
 #ifdef MOZ_WIDGET_ANDROID
-    else if (rv == NS_ERROR_NOT_AVAILABLE) {
+    else if (rv == NS_ERROR_NOT_AVAILABLE && jni::IsFennec()) {
       // We couldn't get a browser window, so Fennec must not be running.
       // Send an Intent to launch Fennec and wait for "BrowserChrome:Ready"
       // to try opening a window again.

gfx/thebes/gfxPlatform.cpp

@@ -836,7 +836,13 @@ gfxPlatform::InitMoz2DLogging()
 /* static */ bool
 gfxPlatform::IsHeadless()
 {
-    return PR_GetEnv("MOZ_HEADLESS");
+    static bool initialized = false;
+    static bool headless = false;
+    if (!initialized) {
+      initialized = true;
+      headless = PR_GetEnv("MOZ_HEADLESS");
+    }
+    return headless;
 }
 
 static bool sLayersIPCIsUp = false;

js/src/frontend/BytecodeCompiler.cpp

@@ -645,10 +645,11 @@ frontend::CompileLazyFunction(JSContext* cx, Handle<LazyScript*> lazy, const cha
 {
     MOZ_ASSERT(cx->compartment() == lazy->functionNonDelazifying()->compartment());
 
+    uint32_t sourceStartColumn = lazy->scriptSource()->startColumn();
     CompileOptions options(cx, lazy->version());
     options.setMutedErrors(lazy->mutedErrors())
            .setFileAndLine(lazy->filename(), lazy->lineno())
-           .setColumn(lazy->column())
+           .setColumn(lazy->column(), sourceStartColumn)
            .setNoScriptRval(false)
            .setSelfHostingMode(false);
 
@@ -681,7 +682,7 @@ frontend::CompileLazyFunction(JSContext* cx, Handle<LazyScript*> lazy, const cha
 
     Rooted<JSFunction*> fun(cx, lazy->functionNonDelazifying());
     MOZ_ASSERT(!lazy->isLegacyGenerator());
-    ParseNode* pn = parser.standaloneLazyFunction(fun, lazy->toStringStart() + lazy->column(),
+    ParseNode* pn = parser.standaloneLazyFunction(fun, lazy->toStringStart() + sourceStartColumn,
                                                   lazy->strict(), lazy->generatorKind(), lazy->asyncKind());
     if (!pn)
         return false;

js/src/frontend/BytecodeEmitter.cpp

@@ -10687,7 +10687,15 @@ BytecodeEmitter::emitClass(ParseNode* pn)
         // offsets in the source buffer as source notes so that when we
         // actually make the constructor during execution, we can give it the
         // correct toString output.
-        if (!newSrcNote3(SRC_CLASS_SPAN, ptrdiff_t(pn->pn_pos.begin), ptrdiff_t(pn->pn_pos.end)))
+        //
+        // Token positions are already offset from the start column. Since
+        // toString offsets are absolute offsets into the ScriptSource,
+        // de-offset from the starting column.
+        ptrdiff_t classStart = ptrdiff_t(pn->pn_pos.begin) -
+                               tokenStream().options().sourceStartColumn;
+        ptrdiff_t classEnd = ptrdiff_t(pn->pn_pos.end) -
+                             tokenStream().options().sourceStartColumn;
+        if (!newSrcNote3(SRC_CLASS_SPAN, classStart, classEnd))
             return false;
 
         JSAtom *name = names ? names->innerBinding()->pn_atom : cx->names().empty;

js/src/frontend/SharedContext.h

@@ -566,10 +566,12 @@ class FunctionBox : public ObjectBox, public SharedContext
         // absolute positions within the ScriptSource buffer, and need to
         // de-offset from the starting column.
         uint32_t offset = tokenStream.currentToken().pos.begin;
-        MOZ_ASSERT(offset >= tokenStream.options().column);
-        MOZ_ASSERT(toStringStart >= tokenStream.options().column);
-        toStringStart -= tokenStream.options().column;
-        bufStart = offset - tokenStream.options().column;
+        uint32_t sourceStartColumn = tokenStream.options().sourceStartColumn;
+
+        MOZ_ASSERT(offset >= sourceStartColumn);
+        MOZ_ASSERT(toStringStart >= sourceStartColumn);
+        toStringStart -= sourceStartColumn;
+        bufStart = offset - sourceStartColumn;
         tokenStream.srcCoords.lineNumAndColumnIndex(offset, &startLine, &startColumn);
     }
 
@@ -580,8 +582,10 @@ class FunctionBox : public ObjectBox, public SharedContext
         //
         // Offsets are de-offset for the same reason as in setStart above.
         uint32_t offset = tokenStream.currentToken().pos.end;
-        MOZ_ASSERT(offset >= tokenStream.options().column);
-        bufEnd = offset - tokenStream.options().column;
+        uint32_t sourceStartColumn = tokenStream.options().sourceStartColumn;
+
+        MOZ_ASSERT(offset >= sourceStartColumn);
+        bufEnd = offset - sourceStartColumn;
         toStringEnd = bufEnd;
     }
 

js/src/jit-test/tests/parser/bug-1364648.js

@@ -0,0 +1 @@
+assertEq(evaluate("var f = x=>class { }; f()", { columnNumber: 1729 }).toString(), "class { }");

js/src/jsapi.cpp

@@ -3885,6 +3885,7 @@ JS::ReadOnlyCompileOptions::copyPODOptions(const ReadOnlyCompileOptions& rhs)
     copyPODTransitiveOptions(rhs);
     lineno = rhs.lineno;
     column = rhs.column;
+    sourceStartColumn = rhs.sourceStartColumn;
     isRunOnce = rhs.isRunOnce;
     noScriptRval = rhs.noScriptRval;
 }

js/src/jsapi.h

@@ -3971,6 +3971,7 @@ class JS_FRIEND_API(ReadOnlyCompileOptions) : public TransitiveCompileOptions
       : TransitiveCompileOptions(),
         lineno(1),
         column(0),
+        sourceStartColumn(0),
         isRunOnce(false),
         noScriptRval(false)
     { }
@@ -3993,6 +3994,7 @@ class JS_FRIEND_API(ReadOnlyCompileOptions) : public TransitiveCompileOptions
     // POD options.
     unsigned lineno;
     unsigned column;
+    unsigned sourceStartColumn;
     // isRunOnce only applies to non-function scripts.
     bool isRunOnce;
     bool noScriptRval;
@@ -4065,7 +4067,12 @@ class JS_FRIEND_API(OwningCompileOptions) : public ReadOnlyCompileOptions
         return *this;
     }
     OwningCompileOptions& setUTF8(bool u) { utf8 = u; return *this; }
-    OwningCompileOptions& setColumn(unsigned c) { column = c; return *this; }
+    OwningCompileOptions& setColumn(unsigned c, unsigned ssc) {
+        MOZ_ASSERT(ssc <= c);
+        column = c;
+        sourceStartColumn = ssc;
+        return *this;
+    }
     OwningCompileOptions& setIsRunOnce(bool once) { isRunOnce = once; return *this; }
     OwningCompileOptions& setNoScriptRval(bool nsr) { noScriptRval = nsr; return *this; }
     OwningCompileOptions& setSelfHostingMode(bool shm) { selfHostingMode = shm; return *this; }
@@ -4161,7 +4168,12 @@ class MOZ_STACK_CLASS JS_FRIEND_API(CompileOptions) final : public ReadOnlyCompi
         return *this;
     }
     CompileOptions& setUTF8(bool u) { utf8 = u; return *this; }
-    CompileOptions& setColumn(unsigned c) { column = c; return *this; }
+    CompileOptions& setColumn(unsigned c, unsigned ssc) {
+        MOZ_ASSERT(ssc <= c);
+        column = c;
+        sourceStartColumn = ssc;
+        return *this;
+    }
     CompileOptions& setIsRunOnce(bool once) { isRunOnce = once; return *this; }
     CompileOptions& setNoScriptRval(bool nsr) { noScriptRval = nsr; return *this; }
     CompileOptions& setSelfHostingMode(bool shm) { selfHostingMode = shm; return *this; }

js/src/jsscript.cpp

@@ -2273,6 +2273,7 @@ ScriptSource::initFromOptions(JSContext* cx, const ReadOnlyCompileOptions& optio
 
     introductionType_ = options.introductionType;
     setIntroductionOffset(options.introductionOffset);
+    startColumn_ = options.sourceStartColumn;
     parameterListEnd_ = parameterListEnd.isSome() ? parameterListEnd.value() : 0;
 
     if (options.hasIntroductionInfo) {

js/src/jsscript.h

@@ -430,6 +430,12 @@ class ScriptSource
     UniqueTwoByteChars sourceMapURL_;
     bool mutedErrors_;
 
+    // The start column of the source. Offsets kept for toString and the
+    // function source in LazyScripts are absolute positions within a
+    // ScriptSource buffer. To get their positions, they need to be offset
+    // with the starting column.
+    uint32_t startColumn_;
+
     // bytecode offset in caller script that generated this code.
     // This is present for eval-ed code, as well as "new Function(...)"-introduced
     // scripts.
@@ -506,6 +512,7 @@ class ScriptSource
         displayURL_(nullptr),
         sourceMapURL_(nullptr),
         mutedErrors_(false),
+        startColumn_(0),
         introductionOffset_(0),
         parameterListEnd_(0),
         introducerFilename_(nullptr),
@@ -618,6 +625,8 @@ class ScriptSource
 
     bool mutedErrors() const { return mutedErrors_; }
 
+    uint32_t startColumn() const { return startColumn_; }
+
     bool hasIntroductionOffset() const { return hasIntroductionOffset_; }
     uint32_t introductionOffset() const {
         MOZ_ASSERT(hasIntroductionOffset());
@@ -1596,6 +1605,7 @@ class JSScript : public js::gc::TenuredCell
     bool isRelazifiable() const {
         return (selfHosted() || lazyScript) && !hasInnerFunctions_ && !types_ &&
                !isStarGenerator() && !isLegacyGenerator() && !isAsync() &&
+               !isDefaultClassConstructor() &&
                !hasBaselineScript() && !hasAnyIonScript() &&
                !doNotRelazify_;
     }

js/src/jsstr.h

@@ -87,13 +87,14 @@ struct JSSubString {
 
 /*
  * Shorthands for ASCII (7-bit) decimal and hex conversion.
- * Manually inline isdigit for performance; MSVC doesn't do this for us.
+ * Manually inline isdigit and isxdigit for performance; MSVC doesn't do this for us.
  */
 #define JS7_ISDEC(c)    ((((unsigned)(c)) - '0') <= 9)
+#define JS7_ISA2F(c)    ((((((unsigned)(c)) - 'a') <= 5) || (((unsigned)(c)) - 'A') <= 5))
 #define JS7_UNDEC(c)    ((c) - '0')
 #define JS7_ISOCT(c)    ((((unsigned)(c)) - '0') <= 7)
 #define JS7_UNOCT(c)    (JS7_UNDEC(c))
-#define JS7_ISHEX(c)    ((c) < 128 && isxdigit(c))
+#define JS7_ISHEX(c)    ((c) < 128 && (JS7_ISDEC(c) || JS7_ISA2F(c)))
 #define JS7_UNHEX(c)    (unsigned)(JS7_ISDEC(c) ? (c) - '0' : 10 + tolower(c) - 'a')
 #define JS7_ISLET(c)    ((c) < 128 && isalpha(c))
 

js/src/shell/js.cpp

@@ -1389,7 +1389,7 @@ ParseCompileOptions(JSContext* cx, CompileOptions& options, HandleObject opts,
         int32_t c;
         if (!ToInt32(cx, v, &c))
             return false;
-        options.setColumn(c);
+        options.setColumn(c, c);
     }
 
     if (!JS_GetProperty(cx, opts, "sourceIsLazy", &v))

js/src/tests/jstests.list

@@ -85,98 +85,7 @@ skip-if(!xulRuntime.shell) script test262/language/global-code/script-decl-func-
 skip-if(!xulRuntime.shell) script test262/language/global-code/script-decl-lex.js
 skip-if(!xulRuntime.shell) script test262/language/global-code/script-decl-var-err.js
 
-# Fails because window has a "length" property resp. the indexed property access on WindowProxy.
-skip-if(!xulRuntime.shell) script test262/language/expressions/arrow-function/dstr-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/arrow-function/dstr-dflt-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/assignment/dstr-array-rest-nested-obj-null.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/assignment/dstr-array-rest-nested-obj-undefined-hole.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/assignment/dstr-array-rest-nested-obj-undefined-own.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/assignment/dstr-array-rest-nested-obj-undefined.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/async-generator/dstr-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/async-generator/dstr-dflt-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/async-generator/dstr-named-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/async-generator/dstr-named-dflt-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/class/dstr-async-gen-meth-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/class/dstr-async-gen-meth-dflt-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/class/dstr-async-gen-meth-static-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/class/dstr-async-gen-meth-static-dflt-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/class/dstr-gen-meth-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/class/dstr-gen-meth-dflt-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/class/dstr-gen-meth-static-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/class/dstr-gen-meth-static-dflt-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/class/dstr-meth-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/class/dstr-meth-dflt-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/class/dstr-meth-static-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/class/dstr-meth-static-dflt-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/function/dstr-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/function/dstr-dflt-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/generators/dstr-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/generators/dstr-dflt-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/object/dstr-async-gen-meth-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/object/dstr-async-gen-meth-dflt-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/object/dstr-gen-meth-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/object/dstr-gen-meth-dflt-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/object/dstr-meth-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/expressions/object/dstr-meth-dflt-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/async-generator/dstr-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/async-generator/dstr-dflt-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/class/dstr-async-gen-meth-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/class/dstr-async-gen-meth-dflt-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/class/dstr-async-gen-meth-static-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/class/dstr-async-gen-meth-static-dflt-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/class/dstr-gen-meth-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/class/dstr-gen-meth-dflt-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/class/dstr-gen-meth-static-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/class/dstr-gen-meth-static-dflt-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/class/dstr-meth-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/class/dstr-meth-dflt-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/class/dstr-meth-static-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/class/dstr-meth-static-dflt-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/const/dstr-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/for-await-of/async-func-dstr-const-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/for-await-of/async-func-dstr-let-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/for-await-of/async-func-dstr-var-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/for-await-of/async-gen-dstr-const-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/for-await-of/async-gen-dstr-let-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/for-await-of/async-gen-dstr-var-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/for-of/dstr-array-rest-nested-obj-null.js
-skip-if(!xulRuntime.shell) script test262/language/statements/for-of/dstr-array-rest-nested-obj-undefined-hole.js
-skip-if(!xulRuntime.shell) script test262/language/statements/for-of/dstr-array-rest-nested-obj-undefined-own.js
-skip-if(!xulRuntime.shell) script test262/language/statements/for-of/dstr-array-rest-nested-obj-undefined.js
-skip-if(!xulRuntime.shell) script test262/language/statements/for-of/dstr-const-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/for-of/dstr-let-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/for-of/dstr-var-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/for/dstr-const-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/for/dstr-let-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/for/dstr-var-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/function/dstr-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/function/dstr-dflt-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/generators/dstr-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/generators/dstr-dflt-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/let/dstr-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/try/dstr-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/language/statements/variable/dstr-ary-ptrn-rest-obj-prop-id.js
-skip-if(!xulRuntime.shell) script test262/built-ins/Array/prototype/every/15.4.4.16-2-15.js
-skip-if(!xulRuntime.shell) script test262/built-ins/Array/prototype/every/15.4.4.16-7-c-i-23.js
-skip-if(!xulRuntime.shell) script test262/built-ins/Array/prototype/filter/15.4.4.20-2-15.js
-skip-if(!xulRuntime.shell) script test262/built-ins/Array/prototype/filter/15.4.4.20-9-c-i-23.js
-skip-if(!xulRuntime.shell) script test262/built-ins/Array/prototype/forEach/15.4.4.18-2-15.js
-skip-if(!xulRuntime.shell) script test262/built-ins/Array/prototype/forEach/15.4.4.18-7-c-i-23.js
-skip-if(!xulRuntime.shell) script test262/built-ins/Array/prototype/indexOf/15.4.4.14-1-17.js
-skip-if(!xulRuntime.shell) script test262/built-ins/Array/prototype/indexOf/15.4.4.14-2-15.js
-skip-if(!xulRuntime.shell) script test262/built-ins/Array/prototype/indexOf/15.4.4.14-9-b-i-23.js
-skip-if(!xulRuntime.shell) script test262/built-ins/Array/prototype/lastIndexOf/15.4.4.15-1-17.js
-skip-if(!xulRuntime.shell) script test262/built-ins/Array/prototype/lastIndexOf/15.4.4.15-2-15.js
-skip-if(!xulRuntime.shell) script test262/built-ins/Array/prototype/lastIndexOf/15.4.4.15-8-b-i-23.js
-skip-if(!xulRuntime.shell) script test262/built-ins/Array/prototype/map/15.4.4.19-8-c-i-23.js
-skip-if(!xulRuntime.shell) script test262/built-ins/Array/prototype/reduce/15.4.4.21-2-15.js
-skip-if(!xulRuntime.shell) script test262/built-ins/Array/prototype/reduce/15.4.4.21-8-b-iii-1-23.js
-skip-if(!xulRuntime.shell) script test262/built-ins/Array/prototype/reduce/15.4.4.21-9-c-i-23.js
-skip-if(!xulRuntime.shell) script test262/built-ins/Array/prototype/reduceRight/15.4.4.22-2-15.js
-skip-if(!xulRuntime.shell) script test262/built-ins/Array/prototype/reduceRight/15.4.4.22-8-b-iii-1-23.js
-skip-if(!xulRuntime.shell) script test262/built-ins/Array/prototype/reduceRight/15.4.4.22-9-c-i-23.js
-skip-if(!xulRuntime.shell) script test262/built-ins/Array/prototype/some/15.4.4.17-2-15.js
-skip-if(!xulRuntime.shell) script test262/built-ins/Array/prototype/some/15.4.4.17-7-c-i-23.js
+# Defines a restricted property on the WindowProxy object.
 skip-if(!xulRuntime.shell) script test262/built-ins/Object/defineProperty/15.2.3.6-4-354-13.js
 skip-if(!xulRuntime.shell) script test262/built-ins/Object/defineProperty/15.2.3.6-4-360-7.js
 skip-if(!xulRuntime.shell) script test262/built-ins/Object/defineProperty/15.2.3.6-4-531-13.js
@@ -590,6 +499,42 @@ skip include test262/built-ins/RegExp/lookBehind/jstests.list
 # https://bugzilla.mozilla.org/show_bug.cgi?id=1362154
 skip include test262/built-ins/RegExp/named-groups/jstests.list
 
+# Stash rval in AsyncIteratorClose
+# https://bugzilla.mozilla.org/show_bug.cgi?id=1364608
+skip script test262/language/statements/for-await-of/async-func-dstr-const-ary-ptrn-elision-step-err.js
+skip script test262/language/statements/for-await-of/async-func-dstr-const-ary-ptrn-rest-id-iter-step-err.js
+skip script test262/language/statements/for-await-of/async-func-dstr-let-ary-ptrn-elision-step-err.js
+skip script test262/language/statements/for-await-of/async-func-dstr-let-ary-ptrn-rest-id-iter-step-err.js
+skip script test262/language/statements/for-await-of/async-func-dstr-var-ary-ptrn-elision-step-err.js
+skip script test262/language/statements/for-await-of/async-func-dstr-var-ary-ptrn-rest-id-iter-step-err.js
+skip script test262/language/statements/for-await-of/async-gen-dstr-const-ary-ptrn-elision-iter-close.js
+skip script test262/language/statements/for-await-of/async-gen-dstr-const-ary-ptrn-elision-step-err.js
+skip script test262/language/statements/for-await-of/async-gen-dstr-const-ary-ptrn-rest-id-iter-close.js
+skip script test262/language/statements/for-await-of/async-gen-dstr-const-ary-ptrn-rest-id-iter-step-err.js
+skip script test262/language/statements/for-await-of/async-gen-dstr-let-ary-ptrn-elision-iter-close.js
+skip script test262/language/statements/for-await-of/async-gen-dstr-let-ary-ptrn-elision-step-err.js
+skip script test262/language/statements/for-await-of/async-gen-dstr-let-ary-ptrn-rest-id-iter-step-err.js
+skip script test262/language/statements/for-await-of/async-gen-dstr-let-ary-ptrn-rest-id-iter-close.js
+skip script test262/language/statements/for-await-of/async-gen-dstr-var-ary-ptrn-elision-iter-close.js
+skip script test262/language/statements/for-await-of/async-gen-dstr-var-ary-ptrn-elision-step-err.js
+skip script test262/language/statements/for-await-of/async-gen-dstr-var-ary-ptrn-rest-id-iter-close.js
+skip script test262/language/statements/for-await-of/async-gen-dstr-var-ary-ptrn-rest-id-iter-step-err.js
+
+# Missing expression statement restriction for "async function"
+# https://bugzilla.mozilla.org/show_bug.cgi?id=1361143
+skip script test262/language/statements/for/decl-async-fun.js
+skip script test262/language/statements/for/decl-async-gen.js
+skip script test262/language/statements/for-in/decl-async-fun.js
+skip script test262/language/statements/for-in/decl-async-gen.js
+skip script test262/language/statements/for-of/decl-async-fun.js
+skip script test262/language/statements/for-of/decl-async-gen.js
+skip script test262/language/statements/labeled/decl-async-function.js
+skip script test262/language/statements/labeled/decl-async-generator.js
+skip script test262/language/statements/while/decl-async-fun.js
+skip script test262/language/statements/while/decl-async-gen.js
+skip script test262/language/statements/with/decl-async-fun.js
+skip script test262/language/statements/with/decl-async-gen.js
+
 ####################################################
 # Tests disabled due to invalid test expectations  #
 ####################################################

js/src/tests/test262-update.py

@@ -19,6 +19,7 @@ from itertools import chain, imap
 
 # Skip all tests which use features not supported in SpiderMonkey.
 UNSUPPORTED_FEATURES = set(["tail-call-optimization"])
+RELEASE_OR_BETA = set(["async-iteration"])
 
 @contextlib.contextmanager
 def TemporaryDirectory():
@@ -229,11 +230,20 @@ def convertTestFile(test262parser, testSource, testName, includeSet, strictTests
     # Skip tests with unsupported features.
     if "features" in testRec:
         unsupported = UNSUPPORTED_FEATURES.intersection(testRec["features"])
+        releaseOrBeta = RELEASE_OR_BETA.intersection(testRec["features"])
         if unsupported:
-            refTestSkip.append("%s is not supported" % ",".join(list(unsupported)))
+            refTestSkip.append(
+              "%s is not supported" % ",".join(list(unsupported)))
+        elif releaseOrBeta:
+            refTestSkipIf.append(
+              ("release_or_beta",
+               "%s is not released yet" % ",".join(list(releaseOrBeta)))
+            )
         elif "SharedArrayBuffer" in testRec["features"]:
-            refTestSkipIf.append(("!this.hasOwnProperty('SharedArrayBuffer')",
-                                  "SharedArrayBuffer not yet riding the trains"))
+            refTestSkipIf.append(
+              ("!this.hasOwnProperty('SharedArrayBuffer')",
+               "SharedArrayBuffer not yet riding the trains")
+            )
 
     # Includes for every test file in a directory is collected in a single
     # shell.js file per directory level. This is done to avoid adding all

js/src/tests/test262/GIT-INFO

@@ -1,5 +1,7 @@
-commit 19eb1d2e02c31ba813fe0ff5d10ea2c09a911fb5
-Author: Joseph Pecoraro <joepeck02@gmail.com>
-Date:   Thu May 4 08:22:28 2017 -0700
+commit 5c8f4db9d72385965ff8b4fa94536649279f1470
+Author: Rick Waldron <waldron.rick@gmail.com>
+Date:   Wed May 17 15:46:04 2017 -0400
 
-    Add tests for completion value of function / class declaration statements (#1012)
+    Merge pull request #1040 from leobalter/remove-unnecessary-tests
+    
+    Remove unnecessary tests

js/src/tests/test262/annexB/language/statements/labeled/function-declaration.js

@@ -9,5 +9,6 @@ flags: [noStrict]
 ---*/
 label: function g() {}
 
+label1: label2: function f() {}
 
 reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/every/15.4.4.16-2-15.js

@@ -1,25 +0,0 @@
-// Copyright (c) 2012 Ecma International.  All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-es5id: 15.4.4.16-2-15
-description: Array.prototype.every - 'length' is property of the global object
----*/
-
-        function callbackfn1(val, idx, obj) {
-            return val > 10;
-        }
-
-        function callbackfn2(val, idx, obj) {
-            return val > 11;
-        }
-
-            this[0] = 12;
-            this[1] = 11;
-            this[2] = 9;
-            this.length = 2;
-
-assert(Array.prototype.every.call(this, callbackfn1), 'Array.prototype.every.call(this, callbackfn1) !== true');
-assert.sameValue(Array.prototype.every.call(this, callbackfn2), false, 'Array.prototype.every.call(this, callbackfn2)');
-
-reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/every/15.4.4.16-7-c-i-23.js

@@ -1,24 +0,0 @@
-// Copyright (c) 2012 Ecma International.  All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-es5id: 15.4.4.16-7-c-i-23
-description: >
-    Array.prototype.every - This object is an global object which
-    contains index property
----*/
-
-        function callbackfn(val, idx, obj) {
-            if (idx === 0) {
-                return val !== 11;
-            } else {
-                return true;
-            }
-        }
-
-            this[0] = 11;
-            this.length = 1;
-
-assert.sameValue(Array.prototype.every.call(this, callbackfn), false, 'Array.prototype.every.call(this, callbackfn)');
-
-reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/filter/15.4.4.20-2-15.js

@@ -1,21 +0,0 @@
-// Copyright (c) 2012 Ecma International.  All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-es5id: 15.4.4.20-2-15
-description: Array.prototype.filter - 'length' is property of the global object
----*/
-
-        function callbackfn(val, idx, obj) {
-            return  obj.length === 2;
-        }
-
-            this[0] = 12;
-            this[1] = 11;
-            this[2] = 9;
-            this.length = 2;
-            var newArr = Array.prototype.filter.call(this, callbackfn);
-
-assert.sameValue(newArr.length, 2, 'newArr.length');
-
-reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/filter/15.4.4.20-9-c-i-23.js

@@ -1,22 +0,0 @@
-// Copyright (c) 2012 Ecma International.  All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-es5id: 15.4.4.20-9-c-i-23
-description: >
-    Array.prototype.filter - This object is the global object which
-    contains index property
----*/
-
-        function callbackfn(val, idx, obj) {
-            return idx === 0 && val === 11;
-        }
-
-            this[0] = 11;
-            this.length = 1;
-            var newArr = Array.prototype.filter.call(this, callbackfn);
-
-assert.sameValue(newArr.length, 1, 'newArr.length');
-assert.sameValue(newArr[0], 11, 'newArr[0]');
-
-reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/forEach/15.4.4.18-2-15.js

@@ -1,22 +0,0 @@
-// Copyright (c) 2012 Ecma International.  All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-es5id: 15.4.4.18-2-15
-description: Array.prototype.forEach - 'length' is property of the global object
----*/
-
-        var result = false;
-        function callbackfn(val, idx, obj) {
-            result = (obj.length === 2);
-        }
-
-            this[0] = 12;
-            this[1] = 11;
-            this[2] = 9;
-            this.length = 2;
-            Array.prototype.forEach.call(this, callbackfn);
-
-assert(result, 'result !== true');
-
-reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/forEach/15.4.4.18-7-c-i-23.js

@@ -1,26 +0,0 @@
-// Copyright (c) 2012 Ecma International.  All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-es5id: 15.4.4.18-7-c-i-23
-description: >
-    Array.prototype.forEach - This object is an global object which
-    contains index property
----*/
-
-        var testResult = false;
-
-        function callbackfn(val, idx, obj) {
-            if (idx === 0) {
-                testResult = (val === 11);
-            }
-        }
-
-            this[0] = 11;
-            this.length = 1;
-
-            Array.prototype.forEach.call(this, callbackfn);
-
-assert(testResult, 'testResult !== true');
-
-reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/indexOf/15.4.4.14-1-17.js

@@ -1,14 +0,0 @@
-// Copyright (c) 2012 Ecma International.  All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-es5id: 15.4.4.14-1-17
-description: Array.prototype.indexOf applied to the global object
----*/
-
-            this[1] = true;
-            this.length = 2;
-
-assert.sameValue(Array.prototype.indexOf.call(this, true), 1, 'Array.prototype.indexOf.call(this, true)');
-
-reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/indexOf/15.4.4.14-2-15.js

@@ -1,22 +0,0 @@
-// Copyright (c) 2012 Ecma International.  All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-es5id: 15.4.4.14-2-15
-description: Array.prototype.indexOf - 'length' is property of the global object
----*/
-
-        var targetObj = {};
-
-            this.length = 2;
-
-            this[1] = targetObj;
-
-assert.sameValue(Array.prototype.indexOf.call(this, targetObj), 1, 'Array.prototype.indexOf.call(this, targetObj)');
-
-            this[1] = {};
-            this[2] = targetObj;
-
-assert.sameValue(Array.prototype.indexOf.call(this, targetObj), -1, 'Array.prototype.indexOf.call(this, targetObj)');
-
-reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/indexOf/15.4.4.14-9-b-i-23.js

@@ -1,20 +0,0 @@
-// Copyright (c) 2012 Ecma International.  All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-es5id: 15.4.4.14-9-b-i-23
-description: Array.prototype.indexOf - This object is the global object
----*/
-
-        var targetObj = {};
-
-            this[0] = targetObj;
-            this[100] = "100";
-            this[200] = "200";
-            this.length = 200;
-
-assert.sameValue(Array.prototype.indexOf.call(this, targetObj), 0, 'Array.prototype.indexOf.call(this, targetObj)');
-assert.sameValue(Array.prototype.indexOf.call(this, "100"), 100, 'Array.prototype.indexOf.call(this, "100")');
-assert.sameValue(Array.prototype.indexOf.call(this, "200"), -1, 'Array.prototype.indexOf.call(this, "200")');
-
-reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/lastIndexOf/15.4.4.15-1-17.js

@@ -1,16 +0,0 @@
-// Copyright (c) 2012 Ecma International.  All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-es5id: 15.4.4.15-1-17
-description: Array.prototype.lastIndexOf applied to the global object
----*/
-
-        var targetObj = ["global"];
-
-            this[1] = targetObj;
-            this.length = 3;
-
-assert.sameValue(Array.prototype.lastIndexOf.call(this, targetObj), 1, 'Array.prototype.lastIndexOf.call(this, targetObj)');
-
-reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/lastIndexOf/15.4.4.15-2-15.js

@@ -1,24 +0,0 @@
-// Copyright (c) 2012 Ecma International.  All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-es5id: 15.4.4.15-2-15
-description: >
-    Array.prototype.lastIndexOf - 'length' is property of the global
-    object
----*/
-
-        var targetObj = {};
-
-            this.length = 2;
-
-            this[1] = targetObj;
-
-assert.sameValue(Array.prototype.lastIndexOf.call(this, targetObj), 1);
-
-            this[1] = {};
-            this[2] = targetObj;
-
-assert.sameValue(Array.prototype.lastIndexOf.call(this, targetObj), -1);
-
-reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/lastIndexOf/15.4.4.15-8-b-i-23.js

@@ -1,20 +0,0 @@
-// Copyright (c) 2012 Ecma International.  All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-es5id: 15.4.4.15-8-b-i-23
-description: Array.prototype.lastIndexOf - This object is the global object
----*/
-
-        var targetObj = {};
-
-            this[0] = targetObj;
-            this[100] = "100";
-            this[200] = "200";
-            this.length = 200;
-
-assert.sameValue(Array.prototype.lastIndexOf.call(this, targetObj), 0, 'Array.prototype.lastIndexOf.call(this, targetObj)');
-assert.sameValue(Array.prototype.lastIndexOf.call(this, "100"), 100, 'Array.prototype.lastIndexOf.call(this, "100")');
-assert.sameValue(Array.prototype.lastIndexOf.call(this, "200"), -1, 'Array.prototype.lastIndexOf.call(this, "200")');
-
-reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/map/15.4.4.19-2-15.js

@@ -1,23 +0,0 @@
-// Copyright (c) 2012 Ecma International.  All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-es5id: 15.4.4.19-2-15
-description: >
-    Array.prototype.map - when 'length' is property of the global
-    object
----*/
-
-        function callbackfn(val, idx, obj) {
-            return val > 10;
-        }
-
-            this[0] = 12;
-            this[1] = 11;
-            this[2] = 9;
-            this.length = 2;
-            var testResult = Array.prototype.map.call(this, callbackfn);
-
-assert.sameValue(testResult.length, 2, 'testResult.length');
-
-reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/map/15.4.4.19-8-c-i-23.js

@@ -1,27 +0,0 @@
-// Copyright (c) 2012 Ecma International.  All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-es5id: 15.4.4.19-8-c-i-23
-description: >
-    Array.prototype.map - This object is the global object which
-    contains index property
----*/
-
-        var kValue = "abc";
-
-        function callbackfn(val, idx, obj) {
-            if (idx === 0) {
-                return val === kValue;
-            }
-            return false;
-        }
-
-            this[0] = kValue;
-            this.length = 2;
-
-            var testResult = Array.prototype.map.call(this, callbackfn);
-
-assert.sameValue(testResult[0], true, 'testResult[0]');
-
-reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/pop/clamps-to-integer-limit.js

@@ -0,0 +1,37 @@
+// Copyright (C) 2017 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.pop
+description: >
+  Length values exceeding 2^53-1 are clamped to 2^53-1.
+info: |
+  1. ...
+  2. Let len be ? ToLength(? Get(O, "length")).
+  ...
+  4. Else len > 0,
+  a. Let newLen be len-1.
+  ...
+  e. Perform ? Set(O, "length", newLen, true).
+  ...
+---*/
+
+var arrayLike = {};
+
+arrayLike.length = 2**53 - 1;
+Array.prototype.pop.call(arrayLike);
+assert.sameValue(arrayLike.length, 2**53 - 2, "Length is 2**53 - 1");
+
+arrayLike.length = 2**53;
+Array.prototype.pop.call(arrayLike);
+assert.sameValue(arrayLike.length, 2**53 - 2, "Length is 2**53");
+
+arrayLike.length = 2**53 + 2;
+Array.prototype.pop.call(arrayLike);
+assert.sameValue(arrayLike.length, 2**53 - 2, "Length is 2**53 + 2");
+
+arrayLike.length = Infinity;
+Array.prototype.pop.call(arrayLike);
+assert.sameValue(arrayLike.length, 2**53 - 2, "Length is Infinity");
+
+reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/pop/length-near-integer-limit.js

@@ -0,0 +1,45 @@
+// Copyright (C) 2017 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.pop
+description: >
+  A value is removed from an array-like object whose length property is near the integer limit.
+info: |
+  ...
+  2. Let len be ? ToLength(? Get(O, "length")).
+  ...
+  4. Else len > 0,
+    a. Let newLen be len-1.
+    b. Let index be ! ToString(newLen).
+    c. Let element be ? Get(O, index).
+    d. Perform ? DeletePropertyOrThrow(O, index).
+    e. Perform ? Set(O, "length", newLen, true).
+    f. Return element. 
+---*/
+
+var arrayLike = {
+  "9007199254740989": "9007199254740989",
+  "9007199254740990": "9007199254740990",
+  "9007199254740991": "9007199254740991",
+  length: 2**53 - 1
+};
+
+var value = Array.prototype.pop.call(arrayLike);
+
+assert.sameValue(value, "9007199254740990",
+                 "arrayLike['9007199254740990'] is returned from pop()");
+
+assert.sameValue(arrayLike.length, 2**53 - 2,
+                 "New arrayLike.length is 2**53 - 2");
+
+assert.sameValue(arrayLike["9007199254740989"], "9007199254740989",
+                 "arrayLike['9007199254740989'] is unchanged");
+
+assert.sameValue("9007199254740990" in arrayLike, false,
+                 "arrayLike['9007199254740990'] is removed");
+
+assert.sameValue(arrayLike["9007199254740991"], "9007199254740991",
+                 "arrayLike['9007199254740991'] is unchanged");
+
+reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/push/clamps-to-integer-limit.js

@@ -0,0 +1,37 @@
+// Copyright (C) 2017 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.push
+description: >
+  Length values exceeding 2^53-1 are clamped to 2^53-1.
+info: |
+  1. ...
+  2. Let len be ? ToLength(? Get(O, "length")).
+  3. Let items be a List whose elements are, in left to right order, the arguments
+     that were passed to this function invocation.
+  4. Let argCount be the number of elements in items.
+  ...
+  7. Perform ? Set(O, "length", len, true).
+  ...
+---*/
+
+var arrayLike = {};
+
+arrayLike.length = 2**53 - 1;
+Array.prototype.push.call(arrayLike);
+assert.sameValue(arrayLike.length, 2**53 - 1, "Length is 2**53 - 1");
+
+arrayLike.length = 2**53;
+Array.prototype.push.call(arrayLike);
+assert.sameValue(arrayLike.length, 2**53 - 1, "Length is 2**53");
+
+arrayLike.length = 2**53 + 2;
+Array.prototype.push.call(arrayLike);
+assert.sameValue(arrayLike.length, 2**53 - 1, "Length is 2**53 + 2");
+
+arrayLike.length = Infinity;
+Array.prototype.push.call(arrayLike);
+assert.sameValue(arrayLike.length, 2**53 - 1, "Length is Infinity");
+
+reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/push/length-near-integer-limit.js

@@ -0,0 +1,41 @@
+// Copyright (C) 2017 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.push
+description: >
+  A value is inserted in an array-like object whose length property is near the integer limit.
+info: |
+  ...
+  2. Let len be ? ToLength(? Get(O, "length")).
+  3. Let items be a List whose elements are, in left to right order, the
+     arguments that were passed to this function invocation.
+  ...
+  5. Repeat, while items is not empty
+    ...
+  7. Perform ? Set(O, "length", len, true).
+  ...
+---*/
+
+var arrayLike = {
+  "9007199254740989": "9007199254740989",
+  /* "9007199254740990": empty */
+  "9007199254740991": "9007199254740991",
+  length: 2**53 - 2
+};
+
+Array.prototype.push.call(arrayLike, "new-value");
+
+assert.sameValue(arrayLike.length, 2**53 - 1,
+                 "New arrayLike.length is 2**53 - 1");
+
+assert.sameValue(arrayLike["9007199254740989"], "9007199254740989",
+                 "arrayLike['9007199254740989'] is unchanged");
+
+assert.sameValue(arrayLike["9007199254740990"], "new-value",
+                 "arrayLike['9007199254740990'] has new value");
+
+assert.sameValue(arrayLike["9007199254740991"], "9007199254740991",
+                 "arrayLike['9007199254740991'] is unchanged");
+
+reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/push/throws-if-integer-limit-exceeded.js

@@ -0,0 +1,40 @@
+// Copyright (C) 2017 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.push
+description: >
+  A TypeError is thrown if the new length exceeds 2^53-1.
+info: |
+  1. ...
+  2. Let len be ? ToLength(? Get(O, "length")).
+  3. Let items be a List whose elements are, in left to right order, the arguments
+     that were passed to this function invocation.
+  4. Let argCount be the number of elements in items.
+  5. If len + argCount > 2^53-1, throw a TypeError exception.
+  ...
+---*/
+
+var arrayLike = {};
+
+arrayLike.length = 2**53 - 1;
+assert.throws(TypeError, function() {
+  Array.prototype.push.call(arrayLike, null);
+}, "Length is 2**53 - 1");
+
+arrayLike.length = 2**53;
+assert.throws(TypeError, function() {
+  Array.prototype.push.call(arrayLike, null);
+}, "Length is 2**53");
+
+arrayLike.length = 2**53 + 2;
+assert.throws(TypeError, function() {
+  Array.prototype.push.call(arrayLike, null);
+}, "Length is 2**53 + 2");
+
+arrayLike.length = Infinity;
+assert.throws(TypeError, function() {
+  Array.prototype.push.call(arrayLike, null);
+}, "Length is Infinity");
+
+reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/reduce/15.4.4.21-2-15.js

@@ -1,20 +0,0 @@
-// Copyright (c) 2012 Ecma International.  All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-es5id: 15.4.4.21-2-15
-description: Array.prototype.reduce - 'length' is property of the global object
----*/
-
-        function callbackfn(prevVal, curVal, idx, obj) {
-            return (obj.length === 2);
-        }
-
-            this[0] = 12;
-            this[1] = 11;
-            this[2] = 9;
-            this.length = 2;
-
-assert.sameValue(Array.prototype.reduce.call(this, callbackfn, 1), true, 'Array.prototype.reduce.call(this, callbackfn, 1)');
-
-reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/reduce/15.4.4.21-8-b-iii-1-23.js

@@ -1,27 +0,0 @@
-// Copyright (c) 2012 Ecma International.  All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-es5id: 15.4.4.21-8-b-iii-1-23
-description: >
-    Array.prototype.reduce - This object is the global object which
-    contains index property
----*/
-
-        var testResult = false;
-        function callbackfn(prevVal, curVal, idx, obj) {
-            if (idx === 1) {
-                testResult = (prevVal === 0);
-            }
-        }
-
-            this[0] = 0;
-            this[1] = 1;
-            this[2] = 2;
-            this.length = 3;
-
-            Array.prototype.reduce.call(this, callbackfn);
-
-assert(testResult, 'testResult !== true');
-
-reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/reduce/15.4.4.21-9-c-i-23.js

@@ -1,27 +0,0 @@
-// Copyright (c) 2012 Ecma International.  All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-es5id: 15.4.4.21-9-c-i-23
-description: >
-    Array.prototype.reduce - This object is the global object which
-    contains index property
----*/
-
-        var testResult = false;
-        var initialValue = 0;
-        function callbackfn(prevVal, curVal, idx, obj) {
-            if (idx === 1) {
-                testResult = (curVal === 1);
-            }
-        }
-
-            this[0] = 0;
-            this[1] = 1;
-            this.length = 2;
-
-            Array.prototype.reduce.call(this, callbackfn, initialValue);
-
-assert(testResult, 'testResult !== true');
-
-reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/reduceRight/15.4.4.22-2-15.js

@@ -1,27 +0,0 @@
-// Copyright (c) 2012 Ecma International.  All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-es5id: 15.4.4.22-2-15
-description: >
-    Array.prototype.reduceRight - 'length' is property of the global
-    object
----*/
-
-var global = this;
-        var accessed = false;
-
-        function callbackfn(prevVal, curVal, idx, obj) {
-            accessed = true;
-            return obj.length === global.length;
-        }
-
-            this[0] = 12;
-            this[1] = 11;
-            this[2] = 9;
-            this.length = 2;
-
-assert(Array.prototype.reduceRight.call(this, callbackfn, 111), 'Array.prototype.reduceRight.call(this, callbackfn, 111) !== true');
-assert(accessed, 'accessed !== true');
-
-reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/reduceRight/15.4.4.22-8-b-iii-1-23.js

@@ -1,27 +0,0 @@
-// Copyright (c) 2012 Ecma International.  All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-es5id: 15.4.4.22-8-b-iii-1-23
-description: >
-    Array.prototype.reduceRight - This object is the global object
-    which contains index property
----*/
-
-        var testResult = false;
-        function callbackfn(prevVal, curVal, idx, obj) {
-            if (idx === 1) {
-                testResult = (prevVal === 2);
-            }
-        }
-
-            this[0] = 0;
-            this[1] = 1;
-            this[2] = 2;
-            this.length = 3;
-
-            Array.prototype.reduceRight.call(this, callbackfn);
-
-assert(testResult, 'testResult !== true');
-
-reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/reduceRight/15.4.4.22-9-c-i-23.js

@@ -1,27 +0,0 @@
-// Copyright (c) 2012 Ecma International.  All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-es5id: 15.4.4.22-9-c-i-23
-description: >
-    Array.prototype.reduceRight - This object is an global object
-    which contains index property
----*/
-
-        var testResult = false;
-        function callbackfn(prevVal, curVal, idx, obj) {
-            if (idx === 1) {
-                testResult = (curVal === 1);
-            }
-        }
-
-            this[0] = 0;
-            this[1] = 1;
-            this[2] = 2;
-            this.length = 3;
-
-            Array.prototype.reduceRight.call(this, callbackfn, "initialValue");
-
-assert(testResult, 'testResult !== true');
-
-reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/reverse/length-exceeding-integer-limit-with-object.js

@@ -0,0 +1,34 @@
+// Copyright (C) 2017 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.reverse
+description: >
+  Ensure reverse() implementation correctly handles length exceeding 2^53-1 with plain objects.
+info: |
+  ...
+  2. Let len be ? ToLength(? Get(O, "length")).
+  ...
+---*/
+
+function StopReverse() { }
+
+// Object with large "length" property and no indexed properties in the uint32 range.
+var arrayLike = {
+  get "9007199254740990"() {
+    throw new StopReverse();
+  },
+  get "9007199254740991"() {
+    $ERROR("Get 9007199254740991");
+  },
+  get "9007199254740992"() {
+    $ERROR("Get 9007199254740992");
+  },
+  length: 2**53 + 2,
+};
+
+assert.throws(StopReverse, function() {
+  Array.prototype.reverse.call(arrayLike);
+});
+
+reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/reverse/length-exceeding-integer-limit-with-proxy.js

@@ -0,0 +1,121 @@
+// Copyright (C) 2017 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.reverse
+description: >
+  Ensure correct MOP operations are called when length exceeds 2^53-1.
+includes: [compareArray.js, proxyTrapsHelper.js]
+---*/
+
+function StopReverse() { }
+
+var arrayLike = {
+  0: "zero",
+  /* 1: hole, */
+  2: "two",
+  /* 3: hole, */
+
+  get 4() {
+    throw new StopReverse();
+  },
+
+  9007199254740987: "2**53-5",
+  /* 9007199254740988: hole, */
+  /* 9007199254740989: hole, */
+  9007199254740990: "2**53-2",
+
+  length: 2**53 + 2,
+};
+
+var traps = [];
+
+var proxy = new Proxy(arrayLike, allowProxyTraps({
+  getOwnPropertyDescriptor(t, pk) {
+    traps.push(`GetOwnPropertyDescriptor:${String(pk)}`);
+    return Reflect.getOwnPropertyDescriptor(t, pk);
+  },
+  defineProperty(t, pk, desc) {
+    traps.push(`DefineProperty:${String(pk)}`);
+    return Reflect.defineProperty(t, pk, desc);
+  },
+  has(t, pk) {
+    traps.push(`Has:${String(pk)}`);
+    return Reflect.has(t, pk);
+  },
+  get(t, pk, r) {
+    traps.push(`Get:${String(pk)}`);
+    return Reflect.get(t, pk, r);
+  },
+  set(t, pk, v, r) {
+    traps.push(`Set:${String(pk)}`);
+    return Reflect.set(t, pk, v, r);
+  },
+  deleteProperty(t, pk) {
+    traps.push(`Delete:${String(pk)}`);
+    return Reflect.deleteProperty(t, pk);
+  },
+}))
+
+// Uses a separate exception than Test262Error, so that errors from allowProxyTraps
+// are properly propagated.
+assert.throws(StopReverse, function() {
+  Array.prototype.reverse.call(proxy);
+});
+
+assert.compareArray(traps, [
+  // Initial get length operation.
+  "Get:length",
+
+  // Lower and upper index are both present.
+  "Has:0",
+  "Get:0",
+  "Has:9007199254740990",
+  "Get:9007199254740990",
+  "Set:0",
+  "GetOwnPropertyDescriptor:0",
+  "DefineProperty:0",
+  "Set:9007199254740990",
+  "GetOwnPropertyDescriptor:9007199254740990",
+  "DefineProperty:9007199254740990",
+
+  // Lower and upper index are both absent.
+  "Has:1",
+  "Has:9007199254740989",
+
+  // Lower index is present, upper index is absent.
+  "Has:2",
+  "Get:2",
+  "Has:9007199254740988",
+  "Delete:2",
+  "Set:9007199254740988",
+  "GetOwnPropertyDescriptor:9007199254740988",
+  "DefineProperty:9007199254740988",
+
+  // Lower index is absent, upper index is present.
+  "Has:3",
+  "Has:9007199254740987",
+  "Get:9007199254740987",
+  "Set:3",
+  "GetOwnPropertyDescriptor:3",
+  "DefineProperty:3",
+  "Delete:9007199254740987",
+
+  // Stop exception.
+  "Has:4",
+  "Get:4",
+]);
+
+assert.sameValue(arrayLike.length, 2**53 + 2, "Length property is not modified");
+
+assert.sameValue(arrayLike[0], "2**53-2", "Property at index 0");
+assert.sameValue(1 in arrayLike, false, "Property at index 1");
+assert.sameValue(2 in arrayLike, false, "Property at index 2");
+assert.sameValue(arrayLike[3], "2**53-5", "Property at index 3");
+
+assert.sameValue(9007199254740987 in arrayLike, false, "Property at index 2**53-5");
+assert.sameValue(arrayLike[9007199254740988], "two", "Property at index 2**53-4");
+assert.sameValue(9007199254740989 in arrayLike, false, "Property at index 2**53-3");
+assert.sameValue(arrayLike[9007199254740990], "zero", "Property at index 2**53-2");
+
+reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/reverse/shell.js

@@ -0,0 +1,23 @@
+// file: proxyTrapsHelper.js
+function allowProxyTraps(overrides) {
+  function throwTest262Error(msg) {
+    return function () { throw new Test262Error(msg); };
+  }
+  if (!overrides) { overrides = {}; }
+  return {
+    getPrototypeOf: overrides.getPrototypeOf || throwTest262Error('[[GetPrototypeOf]] trap called'),
+    setPrototypeOf: overrides.setPrototypeOf || throwTest262Error('[[SetPrototypeOf]] trap called'),
+    isExtensible: overrides.isExtensible || throwTest262Error('[[IsExtensible]] trap called'),
+    preventExtensions: overrides.preventExtensions || throwTest262Error('[[PreventExtensions]] trap called'),
+    getOwnPropertyDescriptor: overrides.getOwnPropertyDescriptor || throwTest262Error('[[GetOwnProperty]] trap called'),
+    has: overrides.has || throwTest262Error('[[HasProperty]] trap called'),
+    get: overrides.get || throwTest262Error('[[Get]] trap called'),
+    set: overrides.set || throwTest262Error('[[Set]] trap called'),
+    deleteProperty: overrides.deleteProperty || throwTest262Error('[[Delete]] trap called'),
+    defineProperty: overrides.defineProperty || throwTest262Error('[[DefineOwnProperty]] trap called'),
+    enumerate: throwTest262Error('[[Enumerate]] trap called: this trap has been removed'),
+    ownKeys: overrides.ownKeys || throwTest262Error('[[OwnPropertyKeys]] trap called'),
+    apply: overrides.apply || throwTest262Error('[[Call]] trap called'),
+    construct: overrides.construct || throwTest262Error('[[Construct]] trap called')
+  };
+}

js/src/tests/test262/built-ins/Array/prototype/slice/create-proxied-array-invalid-len.js

@@ -4,8 +4,7 @@
 es6id: 22.1.3.23
 esid: sec-array.prototype.slice
 description: >
-    An undefined value for the @@species constructor triggers the creation  of
-    an Array exotic object
+    Ensure a RangeError is thrown when a proxied array returns an invalid array length.
 info: |
     [...]
     8. Let A be ? ArraySpeciesCreate(O, count).
@@ -13,18 +12,17 @@ info: |
 
     9.4.2.3 ArraySpeciesCreate
 
+    [...]
+    3. Let isArray be ? IsArray(originalArray).
     [...]
     5. Let C be ? Get(originalArray, "constructor").
     [...]
-    7. If Type(C) is Object, then
-       a. Let C be ? Get(C, @@species).
-       b. If C is null, let C be undefined.
-    8. If C is undefined, return ? ArrayCreate(length).
+    10. Return ? Construct(C, « length »).
 
     9.4.2.2 ArrayCreate
 
     [...]
-    3. If length>232-1, throw a RangeError exception.
+    3. If length>2^32-1, throw a RangeError exception.
 features: [Proxy]
 ---*/
 

js/src/tests/test262/built-ins/Array/prototype/slice/length-exceeding-integer-limit-proxied-array.js

@@ -0,0 +1,58 @@
+// Copyright (C) 2017 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.slice
+description: >
+  Length property is clamped to 2^53-1, test with indices near 2^53-1 and negative indices
+  and a proxy to an array.
+info: |
+  ...
+  2. Let len be ? ToLength(? Get(O, "length")).
+  3. Let relativeStart be ? ToInteger(start).
+  4. If relativeStart < 0, let k be max((len + relativeStart), 0);
+     else let k be min(relativeStart, len).
+  5. If end is undefined, let relativeEnd be len; else let relativeEnd be ? ToInteger(end).
+  6. If relativeEnd < 0, let final be max((len + relativeEnd), 0);
+     else let final be min(relativeEnd, len).
+  ...
+includes: [compareArray.js]
+---*/
+
+var array = [];
+array["9007199254740988"] = "9007199254740988";
+array["9007199254740989"] = "9007199254740989";
+array["9007199254740990"] = "9007199254740990";
+array["9007199254740991"] = "9007199254740991";
+
+// Create a proxy to an array object, so IsArray returns true, but we can still
+// return a length value exceeding the integer limit.
+var proxy = new Proxy(array, {
+  get(t, pk, r) {
+    if (pk === "length")
+      return 2**53 + 2;
+    return Reflect.get(t, pk, r);
+  }
+});
+
+var result = Array.prototype.slice.call(proxy, 9007199254740989);
+assert.compareArray(result, [ "9007199254740989", "9007199254740990" ],
+                    "slice(9007199254740989)");
+
+var result = Array.prototype.slice.call(proxy, 9007199254740989, 9007199254740990);
+assert.compareArray(result, [ "9007199254740989" ],
+                    "slice(9007199254740989, 9007199254740990)");
+
+var result = Array.prototype.slice.call(proxy, 9007199254740989, 9007199254740996);
+assert.compareArray(result, [ "9007199254740989", "9007199254740990" ],
+                    "slice(9007199254740989, 9007199254740996)");
+
+var result = Array.prototype.slice.call(proxy, -2);
+assert.compareArray(result, [ "9007199254740989", "9007199254740990" ],
+                    "slice(-2)");
+
+var result = Array.prototype.slice.call(proxy, -2, -1);
+assert.compareArray(result, [ "9007199254740989" ],
+                    "slice(-2, -1)");
+
+reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/slice/length-exceeding-integer-limit.js

@@ -0,0 +1,49 @@
+// Copyright (C) 2017 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.slice
+description: >
+  Length property is clamped to 2^53-1, test with indices near 2^53-1 and negative indices.
+info: |
+  ...
+  2. Let len be ? ToLength(? Get(O, "length")).
+  3. Let relativeStart be ? ToInteger(start).
+  4. If relativeStart < 0, let k be max((len + relativeStart), 0);
+     else let k be min(relativeStart, len).
+  5. If end is undefined, let relativeEnd be len; else let relativeEnd be ? ToInteger(end).
+  6. If relativeEnd < 0, let final be max((len + relativeEnd), 0);
+     else let final be min(relativeEnd, len).
+  ...
+includes: [compareArray.js]
+---*/
+
+var arrayLike = {
+  "9007199254740988": "9007199254740988",
+  "9007199254740989": "9007199254740989",
+  "9007199254740990": "9007199254740990",
+  "9007199254740991": "9007199254740991",
+  length: 2**53 + 2,
+};
+
+var result = Array.prototype.slice.call(arrayLike, 9007199254740989);
+assert.compareArray(result, [ "9007199254740989", "9007199254740990" ],
+                    "slice(9007199254740989)");
+
+var result = Array.prototype.slice.call(arrayLike, 9007199254740989, 9007199254740990);
+assert.compareArray(result, [ "9007199254740989" ],
+                    "slice(9007199254740989, 9007199254740990)");
+
+var result = Array.prototype.slice.call(arrayLike, 9007199254740989, 9007199254740996);
+assert.compareArray(result, [ "9007199254740989", "9007199254740990" ],
+                    "slice(9007199254740989, 9007199254740996)");
+
+var result = Array.prototype.slice.call(arrayLike, -2);
+assert.compareArray(result, [ "9007199254740989", "9007199254740990" ],
+                    "slice(-2)");
+
+var result = Array.prototype.slice.call(arrayLike, -2, -1);
+assert.compareArray(result, [ "9007199254740989" ],
+                    "slice(-2, -1)");
+
+reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/some/15.4.4.17-2-15.js

@@ -1,25 +0,0 @@
-// Copyright (c) 2012 Ecma International.  All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-es5id: 15.4.4.17-2-15
-description: Array.prototype.some - 'length' is property of the global object
----*/
-
-        function callbackfn1(val, idx, obj) {
-            return val > 10;
-        }
-
-        function callbackfn2(val, idx, obj) {
-            return val > 11;
-        }
-
-            this[0] = 9;
-            this[1] = 11;
-            this[2] = 12;
-            this.length = 2;
-
-assert(Array.prototype.some.call(this, callbackfn1), 'Array.prototype.some.call(this, callbackfn1) !== true');
-assert.sameValue(Array.prototype.some.call(this, callbackfn2), false, 'Array.prototype.some.call(this, callbackfn2)');
-
-reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/some/15.4.4.17-7-c-i-23.js

@@ -1,23 +0,0 @@
-// Copyright (c) 2012 Ecma International.  All rights reserved.
-// This code is governed by the BSD license found in the LICENSE file.
-
-/*---
-es5id: 15.4.4.17-7-c-i-23
-description: >
-    Array.prototype.some - This object is an global object which
-    contains index property
----*/
-
-        function callbackfn(val, idx, obj) {
-            if (idx === 0) {
-                return val === 11;
-            }
-            return false;
-        }
-
-            this[0] = 11;
-            this.length = 1;
-
-assert(Array.prototype.some.call(this, callbackfn), 'Array.prototype.some.call(this, callbackfn) !== true');
-
-reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/splice/clamps-length-to-integer-limit.js

@@ -0,0 +1,38 @@
+// Copyright (C) 2017 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.splice
+description: >
+  Length values exceeding 2^53-1 are clamped to 2^53-1.
+info: |
+  1. ...
+  2. Let len be ? ToLength(? Get(O, "length")).
+  ...
+  5. If the number of actual arguments is 0, then
+    a. Let insertCount be 0.
+    b. Let actualDeleteCount be 0.
+  ...
+  19. Perform ? Set(O, "length", len - actualDeleteCount + itemCount, true).
+  ...
+---*/
+
+var arrayLike = {};
+
+arrayLike.length = 2**53 - 1;
+Array.prototype.splice.call(arrayLike);
+assert.sameValue(arrayLike.length, 2**53 - 1, "Length is 2**53 - 1");
+
+arrayLike.length = 2**53;
+Array.prototype.splice.call(arrayLike);
+assert.sameValue(arrayLike.length, 2**53 - 1, "Length is 2**53");
+
+arrayLike.length = 2**53 + 2;
+Array.prototype.splice.call(arrayLike);
+assert.sameValue(arrayLike.length, 2**53 - 1, "Length is 2**53 + 2");
+
+arrayLike.length = Infinity;
+Array.prototype.splice.call(arrayLike);
+assert.sameValue(arrayLike.length, 2**53 - 1, "Length is Infinity");
+
+reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/splice/create-species-length-exceeding-integer-limit.js

@@ -0,0 +1,90 @@
+// Copyright (C) 2017 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.splice
+description: >
+  Create species constructor with length exceeding integer limit and ensure MOP
+  operations are called in correct order.
+info: |
+  ...
+   9. Let A be ? ArraySpeciesCreate(O, actualDeleteCount).
+  10. Let k be 0.
+  11. Repeat, while k < actualDeleteCount
+    a. Let from be ! ToString(actualStart+k).
+    b. Let fromPresent be ? HasProperty(O, from).
+    c. If fromPresent is true, then
+       i. Let fromValue be ? Get(O, from).
+      ii. Perform ? CreateDataPropertyOrThrow(A, ! ToString(k), fromValue).
+    d. Increment k by 1.
+  12. Perform ? Set(A, "length", actualDeleteCount, true).
+  ...
+includes: [compareArray.js, proxyTrapsHelper.js]
+---*/
+
+function StopSplice() {}
+
+var traps = [];
+var targetLength;
+
+var array = ["no-hole", /* hole */, "stop"];
+array.constructor = {
+  [Symbol.species]: function(n) {
+    targetLength = n;
+    return target;
+  }
+};
+
+var source = new Proxy(array, allowProxyTraps({
+  get(t, pk, r) {
+    traps.push(`source.[[Get]]:${String(pk)}`);
+
+    // length property exceeding 2^53-1.
+    if (pk === "length")
+      return 2**53 + 2;
+
+    return Reflect.get(t, pk, r);
+  },
+  has(t, pk, r) {
+    traps.push(`source.[[Has]]:${String(pk)}`);
+
+    return Reflect.get(t, pk, r);
+  },
+}));
+
+var target = new Proxy([], allowProxyTraps({
+  defineProperty(t, pk, desc) {
+    traps.push(`target.[[DefineProperty]]:${String(pk)}`);
+
+    if (pk === "0" || pk === "1")
+      return Reflect.defineProperty(t, pk, desc);
+
+    throw new StopSplice();
+  }
+}));
+
+assert.throws(StopSplice, function() {
+  // deleteCount argument exceeding 2^53-1.
+  Array.prototype.splice.call(source, 0, 2**53 + 4);
+});
+
+assert.sameValue(targetLength, 2**53 - 1,
+                 "length and deleteCount were correctly clamped to 2^53-1");
+
+assert.compareArray(traps, [
+  "source.[[Get]]:length",
+
+  "source.[[Get]]:constructor",
+
+  "source.[[Has]]:0",
+  "source.[[Get]]:0",
+  "target.[[DefineProperty]]:0",
+
+  "source.[[Has]]:1",
+
+  "source.[[Has]]:2",
+  "source.[[Get]]:2",
+  "target.[[DefineProperty]]:2",
+]);
+
+reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/splice/length-and-deleteCount-exceeding-integer-limit.js

@@ -0,0 +1,56 @@
+// Copyright (C) 2017 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.splice
+description: >
+  Length and deleteCount are both clamped to 2^53-1 when they exceed the integer limit.
+info: |
+  ...
+  2. Let len be ? ToLength(? Get(O, "length")).
+  ...
+  7. Else,
+    a. Let insertCount be the number of actual arguments minus 2.
+    b. Let dc be ? ToInteger(deleteCount).
+    c. Let actualDeleteCount be min(max(dc, 0), len - actualStart).
+  ...
+  11. Repeat, while k < actualDeleteCount
+    a. Let from be ! ToString(actualStart+k).
+    b. Let fromPresent be ? HasProperty(O, from).
+    c. If fromPresent is true, then
+       i. Let fromValue be ? Get(O, from).
+      ii. Perform ? CreateDataPropertyOrThrow(A, ! ToString(k), fromValue).
+    d. Increment k by 1.
+  ...
+includes: [compareArray.js]
+---*/
+
+var arrayLike = {
+  "9007199254740988": "9007199254740988",
+  "9007199254740989": "9007199254740989",
+  "9007199254740990": "9007199254740990",
+  "9007199254740991": "9007199254740991",
+  length: 2**53 + 2,
+};
+
+var result = Array.prototype.splice.call(arrayLike, 9007199254740989, 2**53 + 4);
+
+assert.compareArray(result, [ "9007199254740989", "9007199254740990" ],
+                    "arrayLike['9007199254740989'] and arrayLike['9007199254740990'] are removed");
+
+assert.sameValue(arrayLike.length, 2**53 - 3,
+                 "New length is 2**53 - 3");
+
+assert.sameValue(arrayLike["9007199254740988"], "9007199254740988",
+                 "arrayLike['9007199254740988'] is unchanged");
+
+assert.sameValue("9007199254740989" in arrayLike, false,
+                 "arrayLike['9007199254740989'] is removed");
+
+assert.sameValue("9007199254740990" in arrayLike, false,
+                 "arrayLike['9007199254740990'] is removed");
+
+assert.sameValue(arrayLike["9007199254740991"], "9007199254740991",
+                 "arrayLike['9007199254740991'] is unchanged");
+
+reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/splice/length-exceeding-integer-limit-shrink-array.js

@@ -0,0 +1,66 @@
+// Copyright (C) 2017 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.splice
+description: >
+  An element is removed from an array-like object whose length exceeds the integer limit.
+info: |
+  ...
+  15. If itemCount < actualDeleteCount, then
+    a. Let k be actualStart.
+    b. Repeat, while k < (len - actualDeleteCount)
+        i. Let from be ! ToString(k+actualDeleteCount).
+       ii. Let to be ! ToString(k+itemCount).
+      iii. Let fromPresent be ? HasProperty(O, from).
+       iv. If fromPresent is true, then
+          1. Let fromValue be ? Get(O, from).
+          2. Perform ? Set(O, to, fromValue, true).
+        v. Else fromPresent is false,
+          1. Perform ? DeletePropertyOrThrow(O, to).
+       vi. Increase k by 1.
+    c. Let k be len.
+    d. Repeat, while k > (len - actualDeleteCount + itemCount)
+       i. Perform ? DeletePropertyOrThrow(O, ! ToString(k-1)).
+      ii. Decrease k by 1.
+  ...
+includes: [compareArray.js]
+---*/
+
+var arrayLike = {
+  "9007199254740986": "9007199254740986",
+  "9007199254740987": "9007199254740987",
+  "9007199254740988": "9007199254740988",
+  /* "9007199254740989": hole */
+  "9007199254740990": "9007199254740990",
+  "9007199254740991": "9007199254740991",
+  length: 2**53 + 2,
+};
+
+var result = Array.prototype.splice.call(arrayLike, 9007199254740987, 1);
+
+assert.compareArray(result, [ "9007199254740987" ],
+                    "arrayLike['9007199254740987'] is removed");
+
+assert.sameValue(arrayLike.length, 2**53 - 2,
+                 "New length is 2**53 - 2");
+
+assert.sameValue(arrayLike["9007199254740986"], "9007199254740986",
+                 "arrayLike['9007199254740986'] is unchanged");
+
+assert.sameValue(arrayLike["9007199254740987"], "9007199254740988",
+                 "arrayLike['9007199254740988'] is moved to arrayLike['9007199254740987']");
+
+assert.sameValue("9007199254740988" in arrayLike, false,
+                 "arrayLike['9007199254740990'] is removed");
+
+assert.sameValue(arrayLike["9007199254740989"], "9007199254740990",
+                 "arrayLike['9007199254740990'] is moved to arrayLike['9007199254740989']");
+
+assert.sameValue("9007199254740990" in arrayLike, false,
+                 "arrayLike['9007199254740990'] is removed");
+
+assert.sameValue(arrayLike["9007199254740991"], "9007199254740991",
+                 "arrayLike['9007199254740991'] is unchanged");
+
+reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/splice/length-near-integer-limit-grow-array.js

@@ -0,0 +1,64 @@
+// Copyright (C) 2017 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.splice
+description: >
+  A value is inserted in an array-like object whose length property is near the integer limit.
+info: |
+  ...
+  16. Else if itemCount > actualDeleteCount, then
+    a. Let k be (len - actualDeleteCount).
+    b. Repeat, while k > actualStart
+        i. Let from be ! ToString(k + actualDeleteCount - 1).
+       ii. Let to be ! ToString(k + itemCount - 1).
+      iii. Let fromPresent be ? HasProperty(O, from).
+       iv. If fromPresent is true, then
+          1. Let fromValue be ? Get(O, from).
+          2. Perform ? Set(O, to, fromValue, true).
+        v. Else fromPresent is false,
+          1. Perform ? DeletePropertyOrThrow(O, to).
+       vi. Decrease k by 1.
+  ...
+includes: [compareArray.js]
+---*/
+
+var arrayLike = {
+  "9007199254740985": "9007199254740985",
+  "9007199254740986": "9007199254740986",
+  "9007199254740987": "9007199254740987",
+  /* "9007199254740988": hole */
+  "9007199254740989": "9007199254740989",
+  /* "9007199254740990": empty */
+  "9007199254740991": "9007199254740991",
+  length: 2**53 - 2,
+};
+
+var result = Array.prototype.splice.call(arrayLike, 9007199254740986, 0, "new-value");
+
+assert.compareArray(result, [], "No elements are removed");
+
+assert.sameValue(arrayLike.length, 2**53 - 1, "New length is 2**53 - 1");
+
+assert.sameValue(arrayLike["9007199254740985"], "9007199254740985",
+                 "arrayLike['9007199254740985'] is unchanged");
+
+assert.sameValue(arrayLike["9007199254740986"], "new-value",
+                 "arrayLike['9007199254740986'] contains the inserted value");
+
+assert.sameValue(arrayLike["9007199254740987"], "9007199254740986",
+                 "arrayLike['9007199254740986'] is moved to arrayLike['9007199254740987']");
+
+assert.sameValue(arrayLike["9007199254740988"], "9007199254740987",
+                 "arrayLike['9007199254740987'] is moved to arrayLike['9007199254740988']");
+
+assert.sameValue("9007199254740989" in arrayLike, false,
+                 "arrayLike['9007199254740989'] is removed");
+
+assert.sameValue(arrayLike["9007199254740990"], "9007199254740989",
+                 "arrayLike['9007199254740989'] is moved to arrayLike['9007199254740990']");
+
+assert.sameValue(arrayLike["9007199254740991"], "9007199254740991",
+                 "arrayLike['9007199254740991'] is unchanged");
+
+reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/splice/shell.js

@@ -0,0 +1,23 @@
+// file: proxyTrapsHelper.js
+function allowProxyTraps(overrides) {
+  function throwTest262Error(msg) {
+    return function () { throw new Test262Error(msg); };
+  }
+  if (!overrides) { overrides = {}; }
+  return {
+    getPrototypeOf: overrides.getPrototypeOf || throwTest262Error('[[GetPrototypeOf]] trap called'),
+    setPrototypeOf: overrides.setPrototypeOf || throwTest262Error('[[SetPrototypeOf]] trap called'),
+    isExtensible: overrides.isExtensible || throwTest262Error('[[IsExtensible]] trap called'),
+    preventExtensions: overrides.preventExtensions || throwTest262Error('[[PreventExtensions]] trap called'),
+    getOwnPropertyDescriptor: overrides.getOwnPropertyDescriptor || throwTest262Error('[[GetOwnProperty]] trap called'),
+    has: overrides.has || throwTest262Error('[[HasProperty]] trap called'),
+    get: overrides.get || throwTest262Error('[[Get]] trap called'),
+    set: overrides.set || throwTest262Error('[[Set]] trap called'),
+    deleteProperty: overrides.deleteProperty || throwTest262Error('[[Delete]] trap called'),
+    defineProperty: overrides.defineProperty || throwTest262Error('[[DefineOwnProperty]] trap called'),
+    enumerate: throwTest262Error('[[Enumerate]] trap called: this trap has been removed'),
+    ownKeys: overrides.ownKeys || throwTest262Error('[[OwnPropertyKeys]] trap called'),
+    apply: overrides.apply || throwTest262Error('[[Call]] trap called'),
+    construct: overrides.construct || throwTest262Error('[[Construct]] trap called')
+  };
+}

js/src/tests/test262/built-ins/Array/prototype/splice/throws-if-integer-limit-exceeded.js

@@ -0,0 +1,42 @@
+// Copyright (C) 2017 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.splice
+description: >
+  A TypeError is thrown if the new length exceeds 2^53-1.
+info: |
+  1. ...
+  2. Let len be ? ToLength(? Get(O, "length")).
+  ...
+  7. Else,
+    a. Let insertCount be the number of actual arguments minus 2.
+    b. Let dc be ? ToInteger(deleteCount).
+    c. Let actualDeleteCount be min(max(dc, 0), len - actualStart).
+  8. If len+insertCount-actualDeleteCount > 2^53-1, throw a TypeError exception.
+  ...
+---*/
+
+var arrayLike = {};
+
+arrayLike.length = 2**53 - 1;
+assert.throws(TypeError, function() {
+  Array.prototype.splice.call(arrayLike, 0, 0, null);
+}, "Length is 2**53 - 1");
+
+arrayLike.length = 2**53;
+assert.throws(TypeError, function() {
+  Array.prototype.splice.call(arrayLike, 0, 0, null);
+}, "Length is 2**53");
+
+arrayLike.length = 2**53 + 2;
+assert.throws(TypeError, function() {
+  Array.prototype.splice.call(arrayLike, 0, 0, null);
+}, "Length is 2**53 + 2");
+
+arrayLike.length = Infinity;
+assert.throws(TypeError, function() {
+  Array.prototype.splice.call(arrayLike, 0, 0, null);
+}, "Length is Infinity");
+
+reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/unshift/clamps-to-integer-limit.js

@@ -0,0 +1,34 @@
+// Copyright (C) 2017 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.unshift
+description: >
+  Length values exceeding 2^53-1 are clamped to 2^53-1.
+info: |
+  1. ...
+  2. Let len be ? ToLength(? Get(O, "length")).
+  3. Let argCount be the number of actual arguments.
+  4. If argCount > 0, then ...
+  5. Perform ? Set(O, "length", len+argCount, true).
+---*/
+
+var arrayLike = {};
+
+arrayLike.length = 2**53 - 1;
+Array.prototype.unshift.call(arrayLike);
+assert.sameValue(arrayLike.length, 2**53 - 1, "Length is 2**53 - 1");
+
+arrayLike.length = 2**53;
+Array.prototype.unshift.call(arrayLike);
+assert.sameValue(arrayLike.length, 2**53 - 1, "Length is 2**53");
+
+arrayLike.length = 2**53 + 2;
+Array.prototype.unshift.call(arrayLike);
+assert.sameValue(arrayLike.length, 2**53 - 1, "Length is 2**53 + 2");
+
+arrayLike.length = Infinity;
+Array.prototype.unshift.call(arrayLike);
+assert.sameValue(arrayLike.length, 2**53 - 1, "Length is Infinity");
+
+reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/unshift/length-near-integer-limit.js

@@ -0,0 +1,62 @@
+// Copyright (C) 2017 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.unshift
+description: >
+  Test properties are correctly accessed when length property is near 2^53-1.
+info: |
+  2. Let len be ? ToLength(? Get(O, "length")).
+  3. Let argCount be the number of actual arguments.
+  4. If argCount > 0, then
+    ...
+    b. Let k be len.
+    c. Repeat, while k > 0,
+        i. Let from be ! ToString(k-1).
+       ii. Let to be ! ToString(k+argCount-1).
+      iii. Let fromPresent be ? HasProperty(O, from).
+       iv. If fromPresent is true, then
+          1. Let fromValue be ? Get(O, from).
+          2. Perform ? Set(O, to, fromValue, true).
+        v. Else fromPresent is false,
+          1. Perform ? DeletePropertyOrThrow(O, to).
+       vi. Decrease k by 1.
+---*/
+
+function StopUnshift() {}
+
+var arrayLike = {
+  get "9007199254740986"() {
+    throw new StopUnshift();
+  },
+  "9007199254740987": "9007199254740987",
+  /* "9007199254740988": hole */
+  "9007199254740989": "9007199254740989",
+  /* "9007199254740990": empty */
+  "9007199254740991": "9007199254740991",
+  length: 2**53 - 2
+};
+
+assert.throws(StopUnshift, function() {
+  Array.prototype.unshift.call(arrayLike, null);
+});
+
+assert.sameValue(arrayLike.length, 2**53 - 2,
+                 "arrayLike.length is unchanged");
+
+assert.sameValue(arrayLike["9007199254740987"], "9007199254740987",
+                 "arrayLike['9007199254740987'] is unchanged");
+
+assert.sameValue(arrayLike["9007199254740988"], "9007199254740987",
+                 "arrayLike['9007199254740988'] is replaced with arrayLike['9007199254740987']");
+
+assert.sameValue("9007199254740989" in arrayLike, false,
+                 "arrayLike['9007199254740989'] is removed");
+
+assert.sameValue(arrayLike["9007199254740990"], "9007199254740989",
+                 "arrayLike['9007199254740990'] is replaced with arrayLike['9007199254740989']");
+
+assert.sameValue(arrayLike["9007199254740991"], "9007199254740991",
+                 "arrayLike['9007199254740991'] is unchanged");
+
+reportCompare(0, 0);

js/src/tests/test262/built-ins/Array/prototype/unshift/throws-if-integer-limit-exceeded.js

@@ -0,0 +1,39 @@
+// Copyright (C) 2017 André Bargull. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+esid: sec-array.prototype.unshift
+description: >
+  A TypeError is thrown if the new length exceeds 2^53-1.
+info: |
+  1. ...
+  2. Let len be ? ToLength(? Get(O, "length")).
+  3. Let argCount be the number of actual arguments.
+  4. If argCount > 0, then
+    a. If len+argCount > 2^53-1, throw a TypeError exception.
+    b. ...
+---*/
+
+var arrayLike = {};
+
+arrayLike.length = 2**53 - 1;
+assert.throws(TypeError, function() {
+  Array.prototype.unshift.call(arrayLike, null);
+}, "Length is 2**53 - 1");
+
+arrayLike.length = 2**53;
+assert.throws(TypeError, function() {
+  Array.prototype.unshift.call(arrayLike, null);
+}, "Length is 2**53");
+
+arrayLike.length = 2**53 + 2;
+assert.throws(TypeError, function() {
+  Array.prototype.unshift.call(arrayLike, null);
+}, "Length is 2**53 + 2");
+
+arrayLike.length = Infinity;
+assert.throws(TypeError, function() {
+  Array.prototype.unshift.call(arrayLike, null);
+}, "Length is Infinity");
+
+reportCompare(0, 0);

js/src/tests/test262/built-ins/Function/prototype/toString/AsyncGenerator.js

@@ -1,3 +1,4 @@
+// |reftest| skip-if(release_or_beta) -- async-iteration is not released yet
 // Copyright 2017 André Bargull. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 

js/src/tests/test262/built-ins/Function/prototype/toString/async-generator-declaration.js

@@ -1,3 +1,4 @@
+// |reftest| skip-if(release_or_beta) -- async-iteration is not released yet
 // Copyright 2017 André Bargull. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 

js/src/tests/test262/built-ins/Function/prototype/toString/async-generator-expression.js

@@ -1,3 +1,4 @@
+// |reftest| skip-if(release_or_beta) -- async-iteration is not released yet
 // Copyright 2017 André Bargull. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 

js/src/tests/test262/built-ins/Function/prototype/toString/async-generator-method-class-expression-static.js

@@ -1,3 +1,4 @@
+// |reftest| skip-if(release_or_beta) -- async-iteration is not released yet
 // Copyright 2017 André Bargull. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 

js/src/tests/test262/built-ins/Function/prototype/toString/async-generator-method-class-expression.js

@@ -1,3 +1,4 @@
+// |reftest| skip-if(release_or_beta) -- async-iteration is not released yet
 // Copyright 2017 André Bargull. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 

js/src/tests/test262/built-ins/Function/prototype/toString/async-generator-method-class-statement-static.js

@@ -1,3 +1,4 @@
+// |reftest| skip-if(release_or_beta) -- async-iteration is not released yet
 // Copyright 2017 André Bargull. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 

js/src/tests/test262/built-ins/Function/prototype/toString/async-generator-method-class-statement.js

@@ -1,3 +1,4 @@
+// |reftest| skip-if(release_or_beta) -- async-iteration is not released yet
 // Copyright 2017 André Bargull. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 

js/src/tests/test262/built-ins/Function/prototype/toString/async-generator-method-object.js

@@ -1,3 +1,4 @@
+// |reftest| skip-if(release_or_beta) -- async-iteration is not released yet
 // Copyright 2017 André Bargull. All rights reserved.
 // This code is governed by the BSD license found in the LICENSE file.
 

js/src/tests/test262/built-ins/Promise/reject-via-abrupt-queue.js

@@ -0,0 +1,54 @@
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Rejecting through an abrupt completion - captured in a queued job
+esid: sec-promise-executor
+info: |
+  25.4.3.1 Promise ( executor )
+
+  ...
+  9. Let completion be Call(executor, undefined, « resolvingFunctions.[[Resolve]],
+    resolvingFunctions.[[Reject]] »).
+  10. If completion is an abrupt completion, then
+    a. Perform ? Call(resolvingFunctions.[[Reject]], undefined, « completion.[[Value]] »).
+  11. Return promise.
+
+  25.4.1.3.1 Promise Reject Functions
+
+  ...
+  6. Return RejectPromise(promise, reason).
+
+  25.4.5.3.1 PerformPromiseThen ( promise, onFulfilled, onRejected, resultCapability )
+
+  ...
+  4. If IsCallable(onRejected) is false, then
+    a. Set onRejected to undefined.
+  ...
+  6. Let rejectReaction be the PromiseReaction { [[Capability]]: resultCapability,
+    [[Type]]: "Reject", [[Handler]]: onRejected }.
+  ...
+  9. Else,
+    a. Assert: The value of promise.[[PromiseState]] is "rejected".
+    ...
+    d. Perform EnqueueJob("PromiseJobs", PromiseReactionJob, « rejectReaction, reason »).
+flags: [async]
+---*/
+
+var thenable = Promise.resolve();
+var p = new Promise(function() {
+  throw thenable;
+});
+
+p.then(function() {
+    $DONE('The promise should not be fulfilled.');
+  }).then(function() {
+    $DONE('The promise should not be fulfilled.');
+  }, function(x) {
+    if (x !== thenable) {
+      $DONE('The promise should be rejected with the resolution value.');
+      return;
+    }
+    $DONE();
+  });

js/src/tests/test262/built-ins/Promise/reject-via-fn-deferred-queue.js

@@ -0,0 +1,62 @@
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Rejecting through deferred invocation of the provided resolving function,
+  captured in a queued job.
+esid: sec-promise-executor
+info: |
+  25.4.3.1 Promise ( executor )
+
+  ...
+  9. Let completion be Call(executor, undefined, « resolvingFunctions.[[Resolve]],
+    resolvingFunctions.[[Reject]] »).
+  10. If completion is an abrupt completion, then
+    a. Perform ? Call(resolvingFunctions.[[Reject]], undefined, « completion.[[Value]] »).
+  11. Return promise.
+
+  25.4.1.3.1 Promise Reject Functions
+
+  ...
+  6. Return RejectPromise(promise, reason).
+
+  25.4.5.3.1 PerformPromiseThen ( promise, onFulfilled, onRejected, resultCapability )
+
+  ...
+  4. If IsCallable(onRejected) is false, then
+    a. Set onRejected to undefined.
+  ...
+  6. Let rejectReaction be the PromiseReaction { [[Capability]]: resultCapability,
+    [[Type]]: "Reject", [[Handler]]: onRejected }.
+  7. If promise.[[PromiseState]] is "pending", then
+    ...
+    b. Append rejectReaction as the last element of the List that is
+      promise.[[PromiseRejectReactions]].
+  ...
+flags: [async]
+---*/
+
+var thenable = Promise.resolve();
+var returnValue = null;
+var reject;
+var p = new Promise(function(_, _reject) {
+  reject = _reject;
+});
+
+p.then(function() {
+    $DONE('The promise should not be fulfilled.');
+  }).then(function() {
+    $DONE('The promise should not be fulfilled.');
+  }, function(x) {
+    if (x !== thenable) {
+      $DONE('The promise should be rejected with the resolution value.');
+      return;
+    }
+
+    $DONE();
+  });
+
+returnValue = reject(thenable);
+
+assert.sameValue(returnValue, undefined, '"reject" function return value');

js/src/tests/test262/built-ins/Promise/reject-via-fn-immed-queue.js

@@ -0,0 +1,59 @@
+// Copyright (C) 2017 Mozilla Corporation. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+/*---
+description: >
+  Rejecting through immediate invocation of the provided resolving function,
+  captured in a queued job.
+esid: sec-promise-executor
+info: |
+  25.4.3.1 Promise ( executor )
+
+  ...
+  9. Let completion be Call(executor, undefined, « resolvingFunctions.[[Resolve]],
+    resolvingFunctions.[[Reject]] »).
+  10. If completion is an abrupt completion, then
+    a. Perform ? Call(resolvingFunctions.[[Reject]], undefined, « completion.[[Value]] »).
+  11. Return promise.
+
+  25.4.1.3.1 Promise Reject Functions
+
+  ...
+  6. Return RejectPromise(promise, reason).
+
+  25.4.5.3.1 PerformPromiseThen ( promise, onFulfilled, onRejected, resultCapability )
+
+  ...
+  4. If IsCallable(onRejected) is false, then
+    a. Set onRejected to undefined.
+  ...
+  6. Let rejectReaction be the PromiseReaction { [[Capability]]: resultCapability,
+    [[Type]]: "Reject", [[Handler]]: onRejected }.
+  ...
+  9. Else,
+    a. Assert: The value of promise.[[PromiseState]] is "rejected".
+    ...
+    d. Perform EnqueueJob("PromiseJobs", PromiseReactionJob, « rejectReaction, reason »).
+flags: [async]
+---*/
+
+var thenable = Promise.resolve();
+var returnValue = null;
+var p = new Promise(function(_, reject) {
+  returnValue = reject(thenable);
+});
+
+assert.sameValue(returnValue, undefined, '"reject" function return value');
+
+p.then(function() {
+    $DONE('The promise should not be fulfilled.');
+  }).then(function() {
+    $DONE('The promise should not be fulfilled.');
+  }, function(x) {
+    if (x !== thenable) {
+      $DONE('The promise should be rejected with the resolution value.');
+      return;
+    }
+
+    $DONE();
+  });

js/src/tests/test262/built-ins/RegExp/property-escapes/character-class.js

@@ -10,9 +10,11 @@ features: [regexp-unicode-property-escapes]
 ---*/
 
 /[\p{Hex}]/u;
-assert(
-  /[\p{Hex}-\uFFFF]/u.test('-'),
-  'property escape in character class should not be parsed as the start of a range'
+assert.throws(
+  SyntaxError,
+  () => /[\p{Hex}-\uFFFF]/u,
+  // See step 1 of https://tc39.github.io/ecma262/#sec-runtime-semantics-characterrange-abstract-operation.
+  'property escape at start of character class range should throw if it expands to multiple characters'
 );
 assert.throws.early(SyntaxError, "/[\\p{}]/u");
 assert.throws.early(SyntaxError, "/[\\p{invalid}]/u");

js/src/tests/test262/built-ins/Simd/AUTHORS

@@ -1,12 +0,0 @@
-Arun Purushan <arun.etm@gmail.com>
-Benjamin Bouvier <public@benj.me>
-Bill Budge <bbudge@chromium.org>
-Dan Ehrenberg <littledan@chromium.org>
-Dan Gohman <sunfish@mozilla.com>
-Deepti Gandluri <gdeepti@google.com>
-Florian Scholz <elchi3@elchi3.de>
-Heidi Pan <heidi.pan@intel.com>
-Jakob Stoklund Olesen <jolesen@mozilla.com>
-John McCutchan <john@johnmccutchan.com>
-Ningxin Hu <ningxin.hu@intel.com>
-Peter Jensen <peter.jensen@intel.com>