Merge m-c to f-t

.hgtags

@@ -96,3 +96,4 @@ d7ce9089999719d5186595d160f25123a4e63e39 FIREFOX_AURORA_23_BASE
 8d3810543edccf4fbe458178b88dd4a6e420b010 FIREFOX_AURORA_24_BASE
 ad0ae007aa9e03cd74e9005cd6652e544139b3b5 FIREFOX_AURORA_25_BASE
 2520866d58740851d862c7c59246a4e3f8b4a176 FIREFOX_AURORA_26_BASE
+05025f4889a0bf4dc99ce0c244c750adc002f015 FIREFOX_AURORA_27_BASE

b2g/confvars.sh

@@ -5,7 +5,7 @@
 MOZ_APP_BASENAME=B2G
 MOZ_APP_VENDOR=Mozilla
 
-MOZ_APP_VERSION=27.0a1
+MOZ_APP_VERSION=28.0a1
 MOZ_APP_UA_NAME=Firefox
 
 MOZ_UA_OS_AGNOSTIC=1

browser/config/version.txt

@@ -1 +1 @@
-27.0a1
+28.0a1

build/docs/test_manifests.rst

@@ -53,7 +53,11 @@ In summary, manifests are ini files with section names describing test files::
 Keys under sections can hold metadata about each test::
 
     [test_foo.js]
-    skip-if = os == win
+    skip-if = os == "win"
+    [test_foo.js]
+    skip-if = os == "linux" && debug
+    [test_baz.js]
+    fail-if = os == "mac" || os == "android"
 
 There is a special **DEFAULT** section whose keys/metadata apply to all
 sections/tests::

config/Makefile.in

@@ -4,10 +4,6 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-# For sanity's sake, we compile nsinstall without the wrapped system
-# headers, so that we can use it to set up the wrapped system headers.
-VISIBILITY_FLAGS =
-
 # STDCXX_COMPAT is not needed here, and will actually fail because
 # libstdc++-compat is not built yet.
 MOZ_LIBSTDCXX_HOST_VERSION =

config/milestone.txt

@@ -10,4 +10,4 @@
 # hardcoded milestones in the tree from these two files.
 #--------------------------------------------------------
 
-27.0a1
+28.0a1

config/moz.build

@@ -5,6 +5,9 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 NO_DIST_INSTALL = True
+# For sanity's sake, we compile nsinstall without the wrapped system
+# headers, so that we can use it to set up the wrapped system headers.
+NO_VISIBILITY_FLAGS = True
 
 CONFIGURE_SUBST_FILES += [
     'autoconf.mk',

content/html/content/src/HTMLInputElement.cpp

@@ -4614,9 +4614,6 @@ HTMLInputElement::SetSelectionRange(int32_t aSelectionStart,
       aRv = textControlFrame->SetSelectionRange(aSelectionStart, aSelectionEnd, dir);
       if (!aRv.Failed()) {
         aRv = textControlFrame->ScrollSelectionIntoView();
-        nsRefPtr<nsAsyncDOMEvent> event =
-          new nsAsyncDOMEvent(this, NS_LITERAL_STRING("select"), true, false);
-        event->PostDOMEvent();
       }
     }
   }
@@ -4740,6 +4737,11 @@ HTMLInputElement::SetRangeText(const nsAString& aReplacement, uint32_t aStart,
 
   Optional<nsAString> direction;
   SetSelectionRange(aSelectionStart, aSelectionEnd, direction, aRv);
+  if (!aRv.Failed()) {
+    nsRefPtr<nsAsyncDOMEvent> event =
+      new nsAsyncDOMEvent(this, NS_LITERAL_STRING("select"), true, false);
+    event->PostDOMEvent();
+  }
 }
 
 int32_t

content/html/content/src/HTMLTextAreaElement.cpp

@@ -888,9 +888,6 @@ HTMLTextAreaElement::SetSelectionRange(uint32_t aSelectionStart,
       rv = textControlFrame->SetSelectionRange(aSelectionStart, aSelectionEnd, dir);
       if (NS_SUCCEEDED(rv)) {
         rv = textControlFrame->ScrollSelectionIntoView();
-        nsRefPtr<nsAsyncDOMEvent> event =
-          new nsAsyncDOMEvent(this, NS_LITERAL_STRING("select"), true, false);
-        event->PostDOMEvent();
       }
     }
   }
@@ -995,6 +992,11 @@ HTMLTextAreaElement::SetRangeText(const nsAString& aReplacement,
 
   Optional<nsAString> direction;
   SetSelectionRange(aSelectionStart, aSelectionEnd, direction, aRv);
+  if (!aRv.Failed()) {
+    nsRefPtr<nsAsyncDOMEvent> event =
+      new nsAsyncDOMEvent(this, NS_LITERAL_STRING("select"), true, false);
+    event->PostDOMEvent();
+  }
 }
 
 nsresult

content/html/content/test/forms/test_set_range_text.html

@@ -81,6 +81,8 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=850364
         ok(true, "select event should be fired for " + aEvent.target.id);
         if (++numOfSelectCalls == expectedNumOfSelectCalls) {
           SimpleTest.finish();
+        } else if (numOfSelectCalls > expectedNumOfSelectCalls) {
+          ok(false, "Too many select events were fired");
         }
       }, false);
 
@@ -97,7 +99,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=850364
       is(elem.selectionEnd, 4, msg + ".selectionEnd == 4");
       elem.setRangeText("mnk");
       is(elem.value, "0mnk6789ABCDEF", msg + ".value == \"0mnk6789ABCDEF\"");
-      expectedNumOfSelectCalls += 3;
+      expectedNumOfSelectCalls += 2;
 
       //test SetRange(replacement, start, end, mode) with start > end
       try {
@@ -159,7 +161,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=850364
       is(elem.value, "0Z23456789", msg + ".value == \"0Z23456789\"");
       is(elem.selectionStart, 6, msg + ".selectionStart == 6, with \"preserve\"");
       is(elem.selectionEnd, 9, msg + ".selectionEnd == 9, with \"preserve\"");
-      expectedNumOfSelectCalls += 2;
+      expectedNumOfSelectCalls += 1;
 
       //subcase: selection{Start|End} < end
       elem.value = "0123456789";
@@ -168,7 +170,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=850364
       is(elem.value, "01QRST9", msg + ".value == \"01QRST9\"");
       is(elem.selectionStart, 2, msg + ".selectionStart == 2, with \"preserve\"");
       is(elem.selectionEnd, 6, msg + ".selectionEnd == 6, with \"preserve\"");
-      expectedNumOfSelectCalls += 2;
+      expectedNumOfSelectCalls += 1;
 
       //subcase: selectionStart > end, selectionEnd < end
       elem.value = "0123456789";
@@ -177,7 +179,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=850364
       is(elem.value, "0QRST56789", msg + ".value == \"0QRST56789\"");
       is(elem.selectionStart, 1, msg + ".selectionStart == 1, with \"default\"");
       is(elem.selectionEnd, 5, msg + ".selectionEnd == 5, with \"default\"");
-      expectedNumOfSelectCalls += 2;
+      expectedNumOfSelectCalls += 1;
 
       //subcase: selectionStart < end, selectionEnd > end
       elem.value = "0123456789";
@@ -186,7 +188,7 @@ https://bugzilla.mozilla.org/show_bug.cgi?id=850364
       is(elem.value, "01QRST6789", msg + ".value == \"01QRST6789\"");
       is(elem.selectionStart, 2, msg + ".selectionStart == 2, with \"default\"");
       is(elem.selectionEnd, 9, msg + ".selectionEnd == 9, with \"default\"");
-      expectedNumOfSelectCalls += 2;
+      expectedNumOfSelectCalls += 1;
     }
   }
 

content/html/document/src/HTMLAllCollection.cpp

@@ -10,7 +10,7 @@
 #include "nsDOMClassInfo.h"
 #include "nsHTMLDocument.h"
 #include "jsapi.h"
-#include "js/GCAPI.h"
+#include "nsWrapperCacheInlines.h"
 
 namespace mozilla {
 namespace dom {

content/media/TextTrack.cpp

@@ -182,8 +182,8 @@ void
 TextTrack::SetReadyState(uint16_t aState)
 {
   mReadyState = aState;
-  if (mReadyState == HTMLTrackElement::LOADED ||
+  if (mMediaElement && (mReadyState == HTMLTrackElement::LOADED ||
-      mReadyState == HTMLTrackElement::ERROR) {
+      mReadyState == HTMLTrackElement::ERROR)) {
     mMediaElement->RemoveTextTrack(this, true);
   }
 }

content/media/WebVTTListener.cpp

@@ -107,7 +107,8 @@ WebVTTListener::OnStopRequest(nsIRequest* aRequest,
                               nsresult aStatus)
 {
   if (mElement->ReadyState() != HTMLTrackElement::ERROR) {
-    mElement->mTrack->SetReadyState(HTMLTrackElement::LOADED);
+    TextTrack* track = mElement->Track();
+    track->SetReadyState(HTMLTrackElement::LOADED);
   }
   // Attempt to parse any final data the parser might still have.
   mParserWrapper->Flush();

content/media/gstreamer/GStreamerLoader.cpp

@@ -7,6 +7,7 @@
 #include <stdio.h>
 
 #include "GStreamerLoader.h"
+#include "mozilla/NullPtr.h"
 
 #define LIBGSTREAMER 0
 #define LIBGSTAPP 1

content/xbl/src/nsBindingManager.cpp

@@ -33,6 +33,7 @@
 #include "nsRuleProcessorData.h"
 #include "nsIWeakReference.h"
 
+#include "nsWrapperCacheInlines.h"
 #include "nsIXPConnect.h"
 #include "nsDOMCID.h"
 #include "nsIDOMScriptObjectFactory.h"

db/sqlite3/src/Makefile.in

@@ -7,7 +7,6 @@ SHORT_LIBNAME    = mozsqlt3
 ifndef MOZ_FOLD_LIBS
 FORCE_SHARED_LIB = 1
 endif
-VISIBILITY_FLAGS =
 LIB_IS_C_ONLY    = 1
 
 ifeq ($(OS_ARCH),WINNT)

db/sqlite3/src/moz.build

@@ -5,6 +5,7 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 MODULE = 'sqlite3'
+NO_VISIBILITY_FLAGS = True
 
 EXPORTS += [
     'sqlite3.h',

dom/base/Navigator.cpp

@@ -656,7 +656,7 @@ VibrateWindowListener::HandleEvent(nsIDOMEvent* aEvent)
     nsCOMPtr<nsIDOMWindow> window = do_QueryReferent(mWindow);
     hal::CancelVibrate(window);
     RemoveListener();
-    gVibrateWindowListener = NULL;
+    gVibrateWindowListener = nullptr;
     // Careful: The line above might have deleted |this|!
   }
 

dom/base/nsDOMClassInfo.cpp

@@ -3606,7 +3606,7 @@ nsWindowSH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
   }
 
   // Handle resolving if id refers to a name resolved by DOM worker code.
-  JS::Rooted<JSObject*> tmp(cx, NULL);
+  JS::Rooted<JSObject*> tmp(cx, nullptr);
   if (!ResolveWorkerClasses(cx, obj, id, flags, &tmp)) {
     return NS_ERROR_FAILURE;
   }

dom/base/nsDOMJSUtils.h

@@ -37,9 +37,9 @@ JSObject* GetDefaultScopeFromJSContext(JSContext *cx);
 //    ((JS::Value*)aArgv)[0], ..., ((JS::Value*)aArgv)[aArgc - 1]
 // The resulting object will take a copy of the array, and ensure each
 // element is rooted.
-// Optionally, aArgv may be NULL, in which case the array is allocated and
+// Optionally, aArgv may be nullptr, in which case the array is allocated and
-// rooted, but all items remain NULL.  This presumably means the caller will
+// rooted, but all items remain nullptr.  This presumably means the caller
-// then QI us for nsIJSArgArray, and set our array elements.
+// will then QI us for nsIJSArgArray, and set our array elements.
 nsresult NS_CreateJSArgv(JSContext *aContext, uint32_t aArgc, void *aArgv,
                          nsIJSArgArray **aArray);
 

dom/base/nsFocusManager.cpp

@@ -145,7 +145,7 @@ static const char* kObservedPrefs[] = {
   "accessibility.tabfocus_applies_to_xul",
   "accessibility.mouse_focuses_formcontrol",
   "focusmanager.testmode",
-  NULL
+  nullptr
 };
 
 nsFocusManager::nsFocusManager()

dom/base/nsFocusManager.h

@@ -518,7 +518,7 @@ private:
   // When a mouse down event process is finished, ESM sets focus to the target
   // content.  Therefore, while DOM event handlers are handling mouse down
   // events, the handlers should be able to steal focus from any elements even
-  // if focus is in chrome content.  So, if this isn't NULL and the caller
+  // if focus is in chrome content.  So, if this isn't nullptr and the caller
   // can access the document node, the caller should succeed in moving focus.
   nsCOMPtr<nsIDocument> mMouseDownEventHandlingDocument;
 

dom/base/nsGlobalWindow.cpp

@@ -676,7 +676,7 @@ nsOuterWindowProxy::preventExtensions(JSContext *cx,
                                       JS::Handle<JSObject*> proxy)
 {
   // See above.
-  JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
+  JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
                        JSMSG_CANT_CHANGE_EXTENSIBILITY);
   return false;
 }
@@ -1222,7 +1222,7 @@ nsGlobalWindow::~nsGlobalWindow()
   if (IsOuterWindow()) {
     JSObject *proxy = GetWrapperPreserveColor();
     if (proxy) {
-      js::SetProxyExtra(proxy, 0, js::PrivateValue(NULL));
+      js::SetProxyExtra(proxy, 0, js::PrivateValue(nullptr));
     }
 
     // An outer window is destroyed with inner windows still possibly
@@ -2115,7 +2115,7 @@ CreateNativeGlobalForInner(JSContext* aCx,
   MOZ_ASSERT(aPrincipal);
   MOZ_ASSERT(aHolder);
 
-  nsGlobalWindow *top = NULL;
+  nsGlobalWindow *top = nullptr;
   if (aNewInner->GetOuterWindow()) {
     top = aNewInner->GetTop();
   }
@@ -2396,7 +2396,7 @@ nsGlobalWindow::SetNewDocument(nsIDocument* aDocument,
         return NS_ERROR_FAILURE;
       }
 
-      js::SetProxyExtra(mJSObject, 0, js::PrivateValue(NULL));
+      js::SetProxyExtra(mJSObject, 0, js::PrivateValue(nullptr));
 
       JS::Rooted<JSObject*> obj(cx, mJSObject);
       outerObject = xpc::TransplantObject(cx, obj, outerObject);
@@ -3133,7 +3133,7 @@ void
 nsGlobalWindow::OnFinalize(JSObject* aObject)
 {
   if (aObject == mJSObject) {
-    mJSObject = NULL;
+    mJSObject = nullptr;
   }
 }
 
@@ -5618,7 +5618,7 @@ nsGlobalWindow::SetFullScreenInternal(bool aFullScreen, bool aRequireTrust)
     pmService->NewWakeLock(NS_LITERAL_STRING("DOM_Fullscreen"), this, getter_AddRefs(mWakeLock));
   } else if (mWakeLock && !mFullScreen) {
     mWakeLock->Unlock();
-    mWakeLock = NULL;
+    mWakeLock = nullptr;
   }
 
   return NS_OK;
@@ -10441,7 +10441,7 @@ nsGlobalWindow::ShowSlowScriptDialog()
     }
   }
 
-  // GetStringFromName can return NS_OK and still give NULL string
+  // GetStringFromName can return NS_OK and still give nullptr string
   if (NS_FAILED(rv) || !title || !msg || !stopButton || !waitButton ||
       (!debugButton && debugPossible) || !neverShowDlg) {
     NS_ERROR("Failed to get localized strings.");
@@ -10956,7 +10956,7 @@ nsGlobalWindow::GetParentInternal()
     return parent;
   }
 
-  return NULL;
+  return nullptr;
 }
 
 void
@@ -12697,7 +12697,7 @@ nsGlobalWindow::SyncGamepadState()
 {
   FORWARD_TO_INNER_VOID(SyncGamepadState, ());
   if (mHasSeenGamepadInput) {
-    mGamepads.EnumerateRead(EnumGamepadsForSync, NULL);
+    mGamepads.EnumerateRead(EnumGamepadsForSync, nullptr);
   }
 }
 #endif

dom/base/nsJSEnvironment.cpp

@@ -1062,7 +1062,7 @@ nsJSContext::BindCompiledEventHandler(nsISupports* aTarget,
       rv = NS_ERROR_OUT_OF_MEMORY;
     }
   } else {
-    funobj = NULL;
+    funobj = nullptr;
   }
 
   aBoundHandler.set(funobj);
@@ -1187,9 +1187,8 @@ nsJSContext::SetProperty(JS::Handle<JSObject*> aTarget, const char* aPropName, n
   }
   JS::Value vargs = OBJECT_TO_JSVAL(args);
 
-  return JS_DefineProperty(mContext, aTarget, aPropName, vargs, NULL, NULL, 0)
+  return JS_DefineProperty(mContext, aTarget, aPropName, vargs,
-    ? NS_OK
+  						   nullptr, nullptr, 0) ? NS_OK : NS_ERROR_FAILURE;
-    : NS_ERROR_FAILURE;
 }
 
 nsresult
@@ -2519,7 +2518,7 @@ DOMGCSliceCallback(JSRuntime *aRt, JS::GCProgress aProgress, const JS::GCDescrip
     if (!sShuttingDown) {
       CallCreateInstance("@mozilla.org/timer;1", &sInterSliceGCTimer);
       sInterSliceGCTimer->InitWithFuncCallback(InterSliceGCTimerFired,
-                                               NULL,
+                                               nullptr,
                                                NS_INTERSLICE_GC_DELAY,
                                                nsITimer::TYPE_ONE_SHOT);
     }

dom/base/nsJSTimeoutHandler.cpp

@@ -93,7 +93,7 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INTERNAL(nsJSScriptTimeoutHandler)
         JS_GetObjectFunction(js::UncheckedUnwrap(tmp->mFunction->Callable()));
       if (fun && JS_GetFunctionId(fun)) {
         JSFlatString *funId = JS_ASSERT_STRING_IS_FLAT(JS_GetFunctionId(fun));
-        size_t size = 1 + JS_PutEscapedFlatString(NULL, 0, funId, 0);
+        size_t size = 1 + JS_PutEscapedFlatString(nullptr, 0, funId, 0);
         char *funIdName = new char[size];
         if (funIdName) {
           JS_PutEscapedFlatString(funIdName, size, funId, 0);

dom/base/nsWindowMemoryReporter.cpp

@@ -100,7 +100,7 @@ nsWindowMemoryReporter::Init()
   nsCOMPtr<nsIObserverService> os = services::GetObserverService();
   if (os) {
     // DOM_WINDOW_DESTROYED_TOPIC announces what we call window "detachment",
-    // when a window's docshell is set to NULL.
+    // when a window's docshell is set to nullptr.
     os->AddObserver(sWindowReporter, DOM_WINDOW_DESTROYED_TOPIC,
                     /* weakRef = */ true);
     os->AddObserver(sWindowReporter, "after-minimize-memory-usage",
@@ -185,7 +185,7 @@ CollectWindowReports(nsGlobalWindow *aWindow,
 
   // Avoid calling aWindow->GetTop() if there's no outer window.  It will work
   // just fine, but will spew a lot of warnings.
-  nsGlobalWindow *top = NULL;
+  nsGlobalWindow *top = nullptr;
   nsCOMPtr<nsIURI> location;
   if (aWindow->GetOuterWindow()) {
     // Our window should have a null top iff it has a null docshell.
@@ -483,9 +483,12 @@ nsWindowMemoryReporter::CollectReports(nsIMemoryReporterCallback* aCb,
   WindowPaths topWindowPaths;
 
   // Collect window memory usage.
-  nsWindowSizes windowTotalSizes(NULL);
+  nsWindowSizes windowTotalSizes(nullptr);
-  nsCOMPtr<amIAddonManager> addonManager =
+  nsCOMPtr<amIAddonManager> addonManager;
-    do_GetService("@mozilla.org/addons/integration;1");
+  if (XRE_GetProcessType() == GeckoProcessType_Default) {
+    // Only try to access the service from the main process.
+    addonManager = do_GetService("@mozilla.org/addons/integration;1");
+  }
   for (uint32_t i = 0; i < windows.Length(); i++) {
     rv = CollectWindowReports(windows[i], addonManager,
                               &windowTotalSizes, &ghostWindows,
@@ -772,7 +775,7 @@ GetNonDetachedWindowDomainsEnumerator(const uint64_t& aId, nsGlobalWindow* aWind
  */
 void
 nsWindowMemoryReporter::CheckForGhostWindows(
-  nsTHashtable<nsUint64HashKey> *aOutGhostIDs /* = NULL */)
+  nsTHashtable<nsUint64HashKey> *aOutGhostIDs /* = nullptr */)
 {
   nsCOMPtr<nsIEffectiveTLDService> tldService = do_GetService(
     NS_EFFECTIVETLDSERVICE_CONTRACTID);

dom/base/nsWindowMemoryReporter.h

@@ -202,7 +202,7 @@ private:
    * This is called asynchronously after we observe a DOM window being detached
    * from its docshell, and also right before we generate a memory report.
    */
-  void CheckForGhostWindows(nsTHashtable<nsUint64HashKey> *aOutGhostIDs = NULL);
+  void CheckForGhostWindows(nsTHashtable<nsUint64HashKey> *aOutGhostIDs = nullptr);
 
   /**
    * Maps a weak reference to a detached window (nsIWeakReference) to the time

dom/bindings/BindingDeclarations.h

@@ -459,7 +459,7 @@ GetWrapperCache(nsGlobalWindow*)
 inline nsWrapperCache*
 GetWrapperCache(void* p)
 {
-  return NULL;
+  return nullptr;
 }
 
 // Helper template for smart pointers to resolve ambiguity between

dom/bindings/BindingUtils.cpp

@@ -263,7 +263,7 @@ DefineConstants(JSContext* cx, JS::Handle<JSObject*> obj,
 {
   for (; cs->name; ++cs) {
     bool ok =
-      JS_DefineProperty(cx, obj, cs->name, cs->value, NULL, NULL,
+      JS_DefineProperty(cx, obj, cs->name, cs->value, nullptr, nullptr,
                         JSPROP_ENUMERATE | JSPROP_READONLY | JSPROP_PERMANENT);
     if (!ok) {
       return false;
@@ -329,8 +329,8 @@ InterfaceObjectToString(JSContext* cx, unsigned argc, JS::Value *vp)
   JS::Rooted<JSObject*> callee(cx, &args.callee());
 
   if (!args.thisv().isObject()) {
-    JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_CANT_CONVERT_TO,
+    JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
-                         "null", "object");
+                         JSMSG_CANT_CONVERT_TO, "null", "object");
     return false;
   }
 
@@ -344,7 +344,8 @@ InterfaceObjectToString(JSContext* cx, unsigned argc, JS::Value *vp)
   const jschar* name = JS_GetInternedStringCharsAndLength(jsname, &length);
 
   if (js::GetObjectJSClass(&args.thisv().toObject()) != clasp) {
-    JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_INCOMPATIBLE_PROTO,
+    JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
+                         JSMSG_INCOMPATIBLE_PROTO,
                          NS_ConvertUTF16toUTF8(name).get(), "toString",
                          "object");
     return false;
@@ -429,7 +430,7 @@ CreateInterfaceObject(JSContext* cx, JS::Handle<JSObject*> global,
                                     ctorNargs);
   }
   if (!constructor) {
-    return NULL;
+    return nullptr;
   }
 
   if (constructorClass) {
@@ -441,12 +442,12 @@ CreateInterfaceObject(JSContext* cx, JS::Handle<JSObject*> global,
                                      InterfaceObjectToString,
                                      0, 0));
     if (!toString) {
-      return NULL;
+      return nullptr;
     }
 
     JSString *str = ::JS_InternString(cx, name);
     if (!str) {
-      return NULL;
+      return nullptr;
     }
     JSObject* toStringObj = JS_GetFunctionObject(toString);
     js::SetFunctionNativeReserved(toStringObj, TOSTRING_CLASS_RESERVED_SLOT,
@@ -457,7 +458,7 @@ CreateInterfaceObject(JSContext* cx, JS::Handle<JSObject*> global,
 
     if (!JS_DefineProperty(cx, constructor, "length", JS::Int32Value(ctorNargs),
                            nullptr, nullptr, JSPROP_READONLY | JSPROP_PERMANENT)) {
-      return NULL;
+      return nullptr;
     }
   }
 
@@ -497,7 +498,7 @@ CreateInterfaceObject(JSContext* cx, JS::Handle<JSObject*> global,
   }
 
   if (proto && !JS_LinkConstructorAndPrototype(cx, constructor, proto)) {
-    return NULL;
+    return nullptr;
   }
 
   if (defineOnGlobal && !DefineConstructor(cx, global, name, constructor)) {
@@ -558,7 +559,7 @@ CreateInterfacePrototypeObject(JSContext* cx, JS::Handle<JSObject*> global,
   JS::Rooted<JSObject*> ourProto(cx,
     JS_NewObjectWithUniqueType(cx, protoClass, parentProto, global));
   if (!ourProto) {
-    return NULL;
+    return nullptr;
   }
 
   if (properties) {
@@ -703,8 +704,8 @@ NativeInterface2JSObjectAndThrowIfFailed(JSContext* aCx,
 
   MOZ_ASSERT(NS_IsMainThread());
 
-  if (!XPCConvert::NativeInterface2JSObject(aRetval, NULL, aHelper, aIID,
+  if (!XPCConvert::NativeInterface2JSObject(aRetval, nullptr, aHelper, aIID,
-                                            NULL, aAllowNativeWrapper, &rv)) {
+                                            nullptr, aAllowNativeWrapper, &rv)) {
     // I can't tell if NativeInterface2JSObject throws JS exceptions
     // or not.  This is a sloppy stab at the right semantics; the
     // method really ought to be fixed to behave consistently.

dom/bindings/BindingUtils.h

@@ -1032,7 +1032,7 @@ inline bool
 WrapObject(JSContext* cx, JS::Handle<JSObject*> scope, T* p,
            JS::MutableHandle<JS::Value> rval)
 {
-  return WrapObject(cx, scope, p, NULL, rval);
+  return WrapObject(cx, scope, p, nullptr, rval);
 }
 
 // Helper to make it possible to wrap directly out of an nsCOMPtr
@@ -1050,7 +1050,7 @@ inline bool
 WrapObject(JSContext* cx, JS::Handle<JSObject*> scope, const nsCOMPtr<T>& p,
            JS::MutableHandle<JS::Value> rval)
 {
-  return WrapObject(cx, scope, p, NULL, rval);
+  return WrapObject(cx, scope, p, nullptr, rval);
 }
 
 // Helper to make it possible to wrap directly out of an nsRefPtr
@@ -1068,7 +1068,7 @@ inline bool
 WrapObject(JSContext* cx, JS::Handle<JSObject*> scope, const nsRefPtr<T>& p,
            JS::MutableHandle<JS::Value> rval)
 {
-  return WrapObject(cx, scope, p, NULL, rval);
+  return WrapObject(cx, scope, p, nullptr, rval);
 }
 
 // Specialization to make it easy to use WrapObject in codegen.

dom/bindings/DOMJSProxyHandler.cpp

@@ -154,7 +154,8 @@ bool
 DOMProxyHandler::preventExtensions(JSContext *cx, JS::Handle<JSObject*> proxy)
 {
   // Throw a TypeError, per WebIDL.
-  JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_CANT_CHANGE_EXTENSIBILITY);
+  JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
+                       JSMSG_CANT_CHANGE_EXTENSIBILITY);
   return false;
 }
 
@@ -192,7 +193,7 @@ DOMProxyHandler::defineProperty(JSContext* cx, JS::Handle<JSObject*> proxy, JS::
     return JS_ReportErrorFlagsAndNumber(cx,
                                         JSREPORT_WARNING | JSREPORT_STRICT |
                                         JSREPORT_STRICT_MODE_ERROR,
-                                        js_GetErrorMessage, NULL,
+                                        js_GetErrorMessage, nullptr,
                                         JSMSG_GETTER_ONLY);
   }
 

dom/bluetooth/BluetoothService.h

@@ -117,7 +117,7 @@ public:
    * Returns the path of the default adapter, implemented via a platform
    * specific method.
    *
-   * @return Default adapter path/name on success, NULL otherwise
+   * @return NS_OK on success, NS_ERROR_FAILURE otherwise
    */
   virtual nsresult
   GetDefaultAdapterPathInternal(BluetoothReplyRunnable* aRunnable) = 0;

dom/bluetooth/BluetoothUtils.cpp

@@ -111,7 +111,7 @@ BroadcastSystemMessage(const nsAString& aType,
   NS_ASSERTION(!::JS_IsExceptionPending(cx),
       "Shouldn't get here when an exception is pending!");
 
-  JS::RootedObject obj(cx, JS_NewObject(cx, NULL, NULL, NULL));
+  JS::RootedObject obj(cx, JS_NewObject(cx, nullptr, nullptr, nullptr));
   if (!obj) {
     BT_WARNING("Failed to new JSObject for system message!");
     return false;

dom/bluetooth/ObexBase.cpp

@@ -95,7 +95,7 @@ ParseHeaders(const uint8_t* aHeaderStart,
     switch (headerId >> 6)
     {
       case 0x00:
-        // NULL terminated Unicode text, length prefixed with 2-byte
+        // Null-terminated Unicode text, length prefixed with 2-byte
         // unsigned integer.
       case 0x01:
         // byte sequence, length prefixed with 2 byte unsigned integer.

dom/bluetooth/linux/BluetoothDBusService.cpp

@@ -580,7 +580,7 @@ GetProperty(DBusMessageIter aIter, Properties* aPropertyTypes,
             InfallibleTArray<BluetoothNamedValue>& aProperties)
 {
   DBusMessageIter prop_val, array_val_iter;
-  char* property = NULL;
+  char* property = nullptr;
   uint32_t array_type;
   int i, expectedType, receivedType;
 
@@ -942,14 +942,14 @@ AgentEventFilter(DBusConnection *conn, DBusMessage *msg, void *data)
       goto handle_error;
     }
 
-    dbus_connection_send(conn, reply, NULL);
+    dbus_connection_send(conn, reply, nullptr);
     dbus_message_unref(reply);
     v = parameters;
   } else if (dbus_message_is_method_call(msg, DBUS_AGENT_IFACE, "Authorize")) {
     // This method gets called when the service daemon needs to authorize a
     // connection/service request.
     const char *uuid;
-    if (!dbus_message_get_args(msg, NULL,
+    if (!dbus_message_get_args(msg, nullptr,
                                DBUS_TYPE_OBJECT_PATH, &objectPath,
                                DBUS_TYPE_STRING, &uuid,
                                DBUS_TYPE_INVALID)) {
@@ -987,7 +987,7 @@ AgentEventFilter(DBusConnection *conn, DBusMessage *msg, void *data)
       goto handle_error;
     }
 
-    dbus_connection_send(conn, reply, NULL);
+    dbus_connection_send(conn, reply, nullptr);
     dbus_message_unref(reply);
     return DBUS_HANDLER_RESULT_HANDLED;
   } else if (dbus_message_is_method_call(msg, DBUS_AGENT_IFACE,
@@ -995,7 +995,7 @@ AgentEventFilter(DBusConnection *conn, DBusMessage *msg, void *data)
     // This method gets called when the service daemon needs to confirm a
     // passkey for an authentication.
     uint32_t passkey;
-    if (!dbus_message_get_args(msg, NULL,
+    if (!dbus_message_get_args(msg, nullptr,
                                DBUS_TYPE_OBJECT_PATH, &objectPath,
                                DBUS_TYPE_UINT32, &passkey,
                                DBUS_TYPE_INVALID)) {
@@ -1019,7 +1019,7 @@ AgentEventFilter(DBusConnection *conn, DBusMessage *msg, void *data)
     // This method gets called when the service daemon needs to get the passkey
     // for an authentication. The return value should be a string of 1-16
     // characters length. The string can be alphanumeric.
-    if (!dbus_message_get_args(msg, NULL,
+    if (!dbus_message_get_args(msg, nullptr,
                                DBUS_TYPE_OBJECT_PATH, &objectPath,
                                DBUS_TYPE_INVALID)) {
       errorStr.AssignLiteral("Invalid arguments for RequestPinCode() method");
@@ -1040,7 +1040,7 @@ AgentEventFilter(DBusConnection *conn, DBusMessage *msg, void *data)
     // This method gets called when the service daemon needs to get the passkey
     // for an authentication. The return value should be a numeric value
     // between 0-999999.
-    if (!dbus_message_get_args(msg, NULL,
+    if (!dbus_message_get_args(msg, nullptr,
                                DBUS_TYPE_OBJECT_PATH, &objectPath,
                                DBUS_TYPE_INVALID)) {
       errorStr.AssignLiteral("Invalid arguments for RequestPasskey() method");
@@ -1068,7 +1068,7 @@ AgentEventFilter(DBusConnection *conn, DBusMessage *msg, void *data)
       goto handle_error;
     }
 
-    dbus_connection_send(conn, reply, NULL);
+    dbus_connection_send(conn, reply, nullptr);
     dbus_message_unref(reply);
 
     // Do not send an notification to upper layer, too annoying.
@@ -1138,7 +1138,7 @@ public:
     if (!dbus_connection_register_object_path(threadConnection->GetConnection(),
                                               KEY_REMOTE_AGENT,
                                               mAgentVTable,
-                                              NULL)) {
+                                              nullptr)) {
       BT_WARNING("%s: Can't register object path %s for remote device agent!",
                  __FUNCTION__, KEY_REMOTE_AGENT);
       return;
@@ -1157,7 +1157,7 @@ public:
   void Handle(DBusMessage* aReply)
   {
     static const DBusObjectPathVTable sAgentVTable = {
-      NULL, AgentEventFilter, NULL, NULL, NULL, NULL
+      nullptr, AgentEventFilter, nullptr, nullptr, nullptr, nullptr
     };
 
     MOZ_ASSERT(!NS_IsMainThread()); // DBus thread
@@ -1227,7 +1227,7 @@ private:
     if (!dbus_connection_register_object_path(threadConnection->GetConnection(),
                                               KEY_LOCAL_AGENT,
                                               aAgentVTable,
-                                              NULL)) {
+                                              nullptr)) {
       BT_WARNING("%s: Can't register object path %s for agent!",
                  __FUNCTION__, KEY_LOCAL_AGENT);
       return false;
@@ -1341,7 +1341,7 @@ EventFilter(DBusConnection* aConn, DBusMessage* aMsg, void* aData)
     return DBUS_HANDLER_RESULT_NOT_YET_HANDLED;
   }
 
-  if (dbus_message_get_path(aMsg) == NULL) {
+  if (dbus_message_get_path(aMsg) == nullptr) {
     BT_WARNING("DBusMessage %s has no bluetooth destination, ignoring\n",
                dbus_message_get_member(aMsg));
     return DBUS_HANDLER_RESULT_NOT_YET_HANDLED;
@@ -1664,7 +1664,7 @@ BluetoothDBusService::StartInternal()
 
   // Add a filter for all incoming messages_base
   if (!dbus_connection_add_filter(mConnection->GetConnection(),
-                                  EventFilter, NULL, NULL)) {
+                                  EventFilter, nullptr, nullptr)) {
     BT_WARNING("Cannot create DBus Event Filter for DBus Thread!");
     return NS_ERROR_FAILURE;
   }

dom/browser-element/BrowserElementParent.cpp

@@ -226,7 +226,7 @@ BrowserElementParent::OpenWindowInProcess(nsIDOMWindow* aOpenerWindow,
                                           const nsACString& aFeatures,
                                           nsIDOMWindow** aReturnWindow)
 {
-  *aReturnWindow = NULL;
+  *aReturnWindow = nullptr;
 
   // If we call window.open from an <iframe> inside an <iframe mozbrowser>,
   // it's as though the top-level document inside the <iframe mozbrowser>

dom/ipc/ContentChild.cpp

@@ -28,7 +28,7 @@
 #include "mozilla/layers/PCompositorChild.h"
 #include "mozilla/net/NeckoChild.h"
 #include "mozilla/Preferences.h"
-#ifdef MOZ_CONTENT_SANDBOX
+#if defined(MOZ_CONTENT_SANDBOX) && defined(XP_LINUX)
 #include "mozilla/Sandbox.h"
 #endif
 #include "mozilla/unused.h"
@@ -315,7 +315,7 @@ ContentChild::Init(MessageLoop* aIOLoop,
 {
 #ifdef MOZ_WIDGET_GTK
     // sigh
-    gtk_init(NULL, NULL);
+    gtk_init(nullptr, nullptr);
 #endif
 
 #ifdef MOZ_WIDGET_QT
@@ -553,7 +553,7 @@ ContentChild::RecvSetProcessPrivileges(const ChildPrivileges& aPrivs)
                           aPrivs;
   // If this fails, we die.
   SetCurrentProcessPrivileges(privs);
-#ifdef MOZ_CONTENT_SANDBOX
+#if defined(MOZ_CONTENT_SANDBOX) && defined(XP_LINUX)
   // SetCurrentProcessSandbox should be moved close to process initialization
   // time if/when possible. SetCurrentProcessPrivileges should probably be
   // moved as well. Right now this is set ONLY if we receive the
@@ -576,16 +576,16 @@ mozilla::jsipc::PJavaScriptChild *
 ContentChild::AllocPJavaScriptChild()
 {
     nsCOMPtr<nsIJSRuntimeService> svc = do_GetService("@mozilla.org/js/xpc/RuntimeService;1");
-    NS_ENSURE_TRUE(svc, NULL);
+    NS_ENSURE_TRUE(svc, nullptr);
 
     JSRuntime *rt;
     svc->GetRuntime(&rt);
-    NS_ENSURE_TRUE(svc, NULL);
+    NS_ENSURE_TRUE(svc, nullptr);
 
     mozilla::jsipc::JavaScriptChild *child = new mozilla::jsipc::JavaScriptChild(rt);
     if (!child->init()) {
         delete child;
-        return NULL;
+        return nullptr;
     }
     return child;
 }
@@ -819,7 +819,7 @@ PIndexedDBChild*
 ContentChild::AllocPIndexedDBChild()
 {
   NS_NOTREACHED("Should never get here!");
-  return NULL;
+  return nullptr;
 }
 
 bool

dom/ipc/ContentParent.cpp

@@ -1057,14 +1057,14 @@ ContentParent::MarkAsDead()
             sAppContentParents->Remove(mAppManifestURL);
             if (!sAppContentParents->Count()) {
                 delete sAppContentParents;
-                sAppContentParents = NULL;
+                sAppContentParents = nullptr;
             }
         }
     } else if (sNonAppContentParents) {
         sNonAppContentParents->RemoveElement(this);
         if (!sNonAppContentParents->Length()) {
             delete sNonAppContentParents;
-            sNonAppContentParents = NULL;
+            sNonAppContentParents = nullptr;
         }
     }
 
@@ -1072,7 +1072,7 @@ ContentParent::MarkAsDead()
         sPrivateContent->RemoveElement(this);
         if (!sPrivateContent->Length()) {
             delete sPrivateContent;
-            sPrivateContent = NULL;
+            sPrivateContent = nullptr;
         }
     }
 
@@ -1261,7 +1261,7 @@ ContentParent::ActorDestroy(ActorDestroyReason why)
                                                        NS_ConvertUTF16toUTF8(mAppManifestURL));
                 }
 
-                crashReporter->GenerateCrashReport(this, NULL);
+                crashReporter->GenerateCrashReport(this, nullptr);
 
                 nsAutoString dumpID(crashReporter->ChildDumpID());
                 props->SetPropertyAsAString(NS_LITERAL_STRING("dumpID"), dumpID);
@@ -1279,7 +1279,7 @@ ContentParent::ActorDestroy(ActorDestroyReason why)
     MessageLoop::current()->
         PostTask(FROM_HERE,
                  NewRunnableFunction(DelayedDeleteSubprocess, mSubprocess));
-    mSubprocess = NULL;
+    mSubprocess = nullptr;
 
     // IPDL rules require actors to live on past ActorDestroy, but it
     // may be that the kungFuDeathGrip above is the last reference to
@@ -1605,9 +1605,9 @@ ContentParent::~ContentParent()
                    !sNonAppContentParents->Contains(this));
     } else {
         // In general, we expect sAppContentParents->Get(mAppManifestURL) to be
-        // NULL.  But it could be that we created another ContentParent for this
+        // nullptr.  But it could be that we created another ContentParent for
-        // app after we did this->ActorDestroy(), so the right check is that
+        // this app after we did this->ActorDestroy(), so the right check is
-        // sAppContentParents->Get(mAppManifestURL) != this.
+        // that sAppContentParents->Get(mAppManifestURL) != this.
         MOZ_ASSERT(!sAppContentParents ||
                    sAppContentParents->Get(mAppManifestURL) != this);
     }
@@ -1733,7 +1733,7 @@ ContentParent::RecvSetClipboardText(const nsString& text,
                                 text.Length() * sizeof(PRUnichar));
     NS_ENSURE_SUCCESS(rv, true);
     
-    clipboard->SetData(trans, NULL, whichClipboard);
+    clipboard->SetData(trans, nullptr, whichClipboard);
     return true;
 }
 
@@ -2136,7 +2136,7 @@ ContentParent::AllocPJavaScriptParent()
     mozilla::jsipc::JavaScriptParent *parent = new mozilla::jsipc::JavaScriptParent();
     if (!parent->init()) {
         delete parent;
-        return NULL;
+        return nullptr;
     }
     return parent;
 }
@@ -3166,7 +3166,7 @@ ContentParent::RecvPrivateDocShellsExist(const bool& aExist)
       nsCOMPtr<nsIObserverService> obs = mozilla::services::GetObserverService();
       obs->NotifyObservers(nullptr, "last-pb-context-exited", nullptr);
       delete sPrivateContent;
-      sPrivateContent = NULL;
+      sPrivateContent = nullptr;
     }
   }
   return true;

dom/ipc/CrashReporterParent.cpp

@@ -66,7 +66,7 @@ CrashReporterParent::CrashReporterParent()
 #ifdef MOZ_CRASHREPORTER
       mNotes(4),
 #endif
-      mStartTime(time(NULL))
+      mStartTime(time(nullptr))
     , mInitialized(false)
 {
     MOZ_COUNT_CTOR(CrashReporterParent);

dom/ipc/CrashReporterParent.h

@@ -122,7 +122,7 @@ CrashReporterParent::GenerateCrashReport(Toplevel* t,
                                          const AnnotationTable* processNotes)
 {
   nsCOMPtr<nsIFile> crashDump;
-  if (t->TakeMinidump(getter_AddRefs(crashDump), NULL) &&
+  if (t->TakeMinidump(getter_AddRefs(crashDump), nullptr) &&
       CrashReporter::GetIDFromMinidump(crashDump, mChildDumpID)) {
     return GenerateChildData(processNotes);
   }

dom/ipc/TabChild.cpp

@@ -1261,7 +1261,7 @@ TabChild::RecvLoadURL(const nsCString& uri)
     nsresult rv = mWebNav->LoadURI(NS_ConvertUTF8toUTF16(uri).get(),
                                    nsIWebNavigation::LOAD_FLAGS_ALLOW_THIRD_PARTY_FIXUP |
                                    nsIWebNavigation::LOAD_FLAGS_DISALLOW_INHERIT_OWNER,
-                                   NULL, NULL, NULL);
+                                   nullptr, nullptr, nullptr);
     if (NS_FAILED(rv)) {
         NS_WARNING("mWebNav->LoadURI failed. Eating exception, what else can I do?");
     }
@@ -1703,7 +1703,7 @@ TabChild::DispatchSynthesizedMouseEvent(uint32_t aMsg, uint64_t aTime,
   MOZ_ASSERT(aMsg == NS_MOUSE_MOVE || aMsg == NS_MOUSE_BUTTON_DOWN ||
              aMsg == NS_MOUSE_BUTTON_UP);
 
-  WidgetMouseEvent event(true, aMsg, NULL,
+  WidgetMouseEvent event(true, aMsg, nullptr,
                          WidgetMouseEvent::eReal, WidgetMouseEvent::eNormal);
   event.refPoint = LayoutDeviceIntPoint(aRefPoint.x, aRefPoint.y);
   event.time = aTime;
@@ -2387,7 +2387,7 @@ TabChild::AllocPIndexedDBChild(
                             const nsCString& aASCIIOrigin, bool* /* aAllowed */)
 {
   NS_NOTREACHED("Should never get here!");
-  return NULL;
+  return nullptr;
 }
 
 bool

dom/ipc/TabParent.cpp

@@ -193,7 +193,7 @@ NS_IMPL_ISUPPORTS3(TabParent, nsITabParent, nsIAuthPromptProvider, nsISecureBrow
 
 TabParent::TabParent(ContentParent* aManager, const TabContext& aContext)
   : TabContext(aContext)
-  , mFrameElement(NULL)
+  , mFrameElement(nullptr)
   , mIMESelectionAnchor(0)
   , mIMESelectionFocus(0)
   , mIMEComposing(false)

dom/media/bridge/MediaModule.cpp

@@ -26,13 +26,13 @@ NS_GENERIC_FACTORY_CONSTRUCTOR(PeerConnectionImpl)
 NS_DEFINE_NAMED_CID(PEERCONNECTION_CID);
 
 static const mozilla::Module::CIDEntry kCIDs[] = {
-  { &kPEERCONNECTION_CID, false, NULL, sipcc::PeerConnectionImplConstructor },
+  { &kPEERCONNECTION_CID, false, nullptr, sipcc::PeerConnectionImplConstructor },
-  { NULL }
+  { nullptr }
 };
 
 static const mozilla::Module::ContractIDEntry kContracts[] = {
   { PEERCONNECTION_CONTRACTID, &kPEERCONNECTION_CID },
-  { NULL }
+  { nullptr }
 };
 
 static const mozilla::Module kModule = {

dom/mobilemessage/src/MmsMessage.cpp

@@ -495,7 +495,7 @@ MmsMessage::GetAttachments(JSContext* aCx, JS::Value* aAttachments)
 
     tmpJsVal.setString(tmpJsStr);
     if (!JS_DefineProperty(aCx, attachmentObj, "id", tmpJsVal,
-                           NULL, NULL, JSPROP_ENUMERATE)) {
+                           nullptr, nullptr, JSPROP_ENUMERATE)) {
       return NS_ERROR_FAILURE;
     }
 
@@ -507,7 +507,7 @@ MmsMessage::GetAttachments(JSContext* aCx, JS::Value* aAttachments)
 
     tmpJsVal.setString(tmpJsStr);
     if (!JS_DefineProperty(aCx, attachmentObj, "location", tmpJsVal,
-                           NULL, NULL, JSPROP_ENUMERATE)) {
+                           nullptr, nullptr, JSPROP_ENUMERATE)) {
       return NS_ERROR_FAILURE;
     }
 
@@ -521,7 +521,7 @@ MmsMessage::GetAttachments(JSContext* aCx, JS::Value* aAttachments)
     NS_ENSURE_SUCCESS(rv, rv);
 
     if (!JS_DefineProperty(aCx, attachmentObj, "content", tmpJsVal,
-                           NULL, NULL, JSPROP_ENUMERATE)) {
+                           nullptr, nullptr, JSPROP_ENUMERATE)) {
       return NS_ERROR_FAILURE;
     }
 

dom/mobilemessage/src/MobileMessageCallback.cpp

@@ -163,7 +163,8 @@ MobileMessageCallback::NotifyMessageDeleted(bool *aDeleted, uint32_t aSize)
   AutoPushJSContext cx(sc->GetNativeContext());
   NS_ENSURE_TRUE(cx, NS_ERROR_FAILURE);
 
-  JS::Rooted<JSObject*> deleteArrayObj(cx, JS_NewArrayObject(cx, aSize, NULL));
+  JS::Rooted<JSObject*> deleteArrayObj(cx,
+                                       JS_NewArrayObject(cx, aSize, nullptr));
   JS::Rooted<JS::Value> value(cx);
   for (uint32_t i = 0; i < aSize; i++) {
     value.setBoolean(aDeleted[i]);

dom/src/json/nsJSON.cpp

@@ -216,7 +216,7 @@ nsJSON::EncodeInternal(JSContext* cx, const JS::Value& aValue,
       toJSON.isObject() &&
       JS_ObjectIsCallable(cx, &toJSON.toObject())) {
     // If toJSON is implemented, it must not throw
-    if (!JS_CallFunctionValue(cx, obj, toJSON, 0, NULL, val.address())) {
+    if (!JS_CallFunctionValue(cx, obj, toJSON, 0, nullptr, val.address())) {
       if (JS_IsExceptionPending(cx))
         // passing NS_OK will throw the pending exception
         return NS_OK;

dom/system/OSFileConstants.cpp

@@ -136,7 +136,7 @@ struct Paths {
 /**
  * System directories.
  */
-Paths* gPaths = NULL;
+Paths* gPaths = nullptr;
 
 }
 
@@ -303,7 +303,7 @@ void CleanupOSFileConstants()
 /**
  * End marker for ConstantSpec
  */
-#define PROP_END { NULL, JS::UndefinedValue() }
+#define PROP_END { nullptr, JS::UndefinedValue() }
 
 
 // Define missing constants for Android
@@ -514,6 +514,11 @@ static const dom::ConstantSpec gLibcProperties[] =
   // (may not be exact, depending on padding).
   { "OSFILE_SIZEOF_DIRENT_D_NAME", INT_TO_JSVAL(sizeof (struct dirent) - offsetof (struct dirent, d_name)) },
 
+  // Defining |timeval|.
+  { "OSFILE_SIZEOF_TIMEVAL", INT_TO_JSVAL(sizeof (struct timeval)) },
+  { "OSFILE_OFFSETOF_TIMEVAL_TV_SEC", INT_TO_JSVAL(offsetof (struct timeval, tv_sec)) },
+  { "OSFILE_OFFSETOF_TIMEVAL_TV_USEC", INT_TO_JSVAL(offsetof (struct timeval, tv_usec)) },
+
 #if defined(DT_UNKNOWN)
   // Position of field |d_type| in |dirent|
   // Not strictly posix, but seems defined on all platforms
@@ -671,18 +676,19 @@ JSObject *GetOrCreateObjectProperty(JSContext *cx, JS::Handle<JSObject*> aObject
 {
   JS::Rooted<JS::Value> val(cx);
   if (!JS_GetProperty(cx, aObject, aProperty, &val)) {
-    return NULL;
+    return nullptr;
   }
   if (!val.isUndefined()) {
     if (val.isObject()) {
       return &val.toObject();
     }
 
-    JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
+    JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
       JSMSG_UNEXPECTED_TYPE, aProperty, "not an object");
-    return NULL;
+    return nullptr;
   }
-  return JS_DefineObject(cx, aObject, aProperty, NULL, NULL, JSPROP_ENUMERATE);
+  return JS_DefineObject(cx, aObject, aProperty, nullptr, nullptr,
+                         JSPROP_ENUMERATE);
 }
 
 /**
@@ -712,12 +718,12 @@ bool DefineOSFileConstants(JSContext *cx, JS::Handle<JSObject*> global)
 {
   MOZ_ASSERT(gInitialized);
 
-  if (gPaths == NULL) {
+  if (gPaths == nullptr) {
     // If an initialization error was ignored, we may end up with
-    // |gInitialized == true| but |gPaths == NULL|. We cannot
+    // |gInitialized == true| but |gPaths == nullptr|. We cannot
     // |MOZ_ASSERT| this, as this would kill precompile_cache.js,
     // so we simply return an error.
-    JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
+    JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
       JSMSG_CANT_OPEN, "OSFileConstants", "initialization has failed");
     return false;
   }

dom/system/gonk/AutoMounter.cpp

@@ -378,7 +378,7 @@ AutoMounter::UpdateState()
     if (umsAvail) {
       char functionsStr[60];
       if (ReadSysFile(ICS_SYS_USB_FUNCTIONS, functionsStr, sizeof(functionsStr))) {
-        umsEnabled = strstr(functionsStr, "mass_storage") != NULL;
+        umsEnabled = strstr(functionsStr, "mass_storage") != nullptr;
       } else {
         ERR("Error reading file '%s': %s", ICS_SYS_USB_FUNCTIONS, strerror(errno));
         umsEnabled = false;
@@ -556,7 +556,7 @@ ShutdownAutoMounterIOThread()
 {
   MOZ_ASSERT(MessageLoop::current() == XRE_GetIOMessageLoop());
 
-  sAutoMounter = NULL;
+  sAutoMounter = nullptr;
   ShutdownVolumeManager();
 }
 
@@ -662,11 +662,11 @@ InitVolumeConfig()
       continue;
     }
     if (!strcmp(command, "create")) {
-      if (!(vol_name_cstr = strtok_r(NULL, delim, &save_ptr))) {
+      if (!(vol_name_cstr = strtok_r(nullptr, delim, &save_ptr))) {
         ERR("No vol_name in %s line %d",  filename, n);
         continue;
       }
-      if (!(mount_point_cstr = strtok_r(NULL, delim, &save_ptr))) {
+      if (!(mount_point_cstr = strtok_r(nullptr, delim, &save_ptr))) {
         ERR("No mount point for volume '%s'. %s line %d", vol_name_cstr, filename, n);
         continue;
       }
@@ -739,8 +739,8 @@ SetAutoMounterSharingMode(const nsCString& aVolumeName, bool aAllowSharing)
 void
 ShutdownAutoMounter()
 {
-  sAutoMounterSetting = NULL;
+  sAutoMounterSetting = nullptr;
-  sUsbCableObserver = NULL;
+  sUsbCableObserver = nullptr;
 
   XRE_GetIOMessageLoop()->PostTask(
       FROM_HERE,

dom/system/gonk/VolumeManager.cpp

@@ -111,7 +111,7 @@ TemporaryRef<Volume>
 VolumeManager::FindVolumeByName(const nsCSubstring& aName)
 {
   if (!sVolumeManager) {
-    return NULL;
+    return nullptr;
   }
   VolumeArray::size_type  numVolumes = NumVolumes();
   VolumeArray::index_type volIndex;
@@ -121,7 +121,7 @@ VolumeManager::FindVolumeByName(const nsCSubstring& aName)
       return vol;
     }
   }
-  return NULL;
+  return nullptr;
 }
 
 //static
@@ -391,7 +391,7 @@ ShutdownVolumeManagerIOThread()
 {
   MOZ_ASSERT(MessageLoop::current() == XRE_GetIOMessageLoop());
 
-  sVolumeManager = NULL;
+  sVolumeManager = nullptr;
 }
 
 /**************************************************************************

dom/system/gonk/VolumeServiceIOThread.cpp

@@ -75,7 +75,7 @@ void
 ShutdownVolumeServiceIOThread()
 {
   MOZ_ASSERT(MessageLoop::current() == XRE_GetIOMessageLoop());
-  sVolumeServiceIOThread = NULL;
+  sVolumeServiceIOThread = nullptr;
 }
 
 } // system

dom/system/gonk/VolumeServiceTest.cpp

@@ -193,7 +193,7 @@ ShutdownVolumeServiceTest()
 {
 #if TEST_NSVOLUME_OBSERVER
   DBG("ShutdownVolumeServiceTestIOThread called");
-  sTestObserver = NULL;
+  sTestObserver = nullptr;
 #endif
 }
 

dom/system/unix/nsHapticFeedback.cpp

@@ -50,7 +50,7 @@ nsHapticFeedback::PerformSimpleAction(int32_t aType)
     const char* pattern = "PatternTouchscreen";
     dbus_message_iter_append_basic(&iter, DBUS_TYPE_STRING, &pattern);
 
-    if (dbus_connection_send(connection, msg, NULL)) {
+    if (dbus_connection_send(connection, msg, nullptr)) {
         dbus_connection_flush(connection);
         dbus_message_unref(msg);
     } else {

dom/wifi/NetUtils.cpp

@@ -128,7 +128,7 @@ int32_t NetUtils::do_dhcp_do_request(const char *ifname,
     // http://androidxref.com/4.3_r2.1/xref/system/core/libnetutils/dhcp_utils.c#181
     DEFINE_DLFUNC(dhcp_do_request, int32_t, const char*, char*, char*,  uint32_t*, char**, char*, uint32_t*, char*, char*)
     USE_DLFUNC(dhcp_do_request)
-    char *dns[3] = {dns1, dns2, NULL};
+    char *dns[3] = {dns1, dns2, nullptr};
     char domains[PROPERTY_VALUE_MAX];
     ret = dhcp_do_request(ifname, ipaddr, gateway, prefixLength, dns,
                           server, lease, vendorinfo, domains);

dom/workers/DOMBindingBase.h

@@ -84,7 +84,7 @@ class DOMBindingAnchor
 
 public:
   DOMBindingAnchor()
-  : mBinding(NULL)
+  : mBinding(nullptr)
   { }
 
   DOMBindingAnchor(T* aBinding)

dom/workers/DOMBindingInlines.h

@@ -65,20 +65,20 @@ Wrap(JSContext* aCx, JSObject* aGlobal, nsRefPtr<T>& aConcreteObject)
   if (!aGlobal) {
     aGlobal = JS::CurrentGlobalOrNull(aCx);
     if (!aGlobal) {
-      return NULL;
+      return nullptr;
     }
   }
 
   JS::Rooted<JSObject*> global(aCx, aGlobal);
   JSObject* proto = WrapPrototypeTraits<T>::GetProtoObject(aCx, global);
   if (!proto) {
-    return NULL;
+    return nullptr;
   }
 
   JSObject* wrapper =
     JS_NewObject(aCx, WrapPrototypeTraits<T>::GetJSClass(), proto, global);
   if (!wrapper) {
-    return NULL;
+    return nullptr;
   }
 
   js::SetReservedSlot(wrapper, DOM_OBJECT_SLOT,

dom/workers/EventListenerManager.cpp

@@ -35,7 +35,7 @@ struct EventListenerManager::ListenerCollection :
       static_cast<ListenerCollection*>(JS_malloc(aCx,
                                                  sizeof(ListenerCollection)));
     if (!collection) {
-      return NULL;
+      return nullptr;
     }
 
     new (collection) ListenerCollection(aTypeId);
@@ -72,7 +72,7 @@ struct ListenerData : LinkedListElement<ListenerData>
     ListenerData* listenerData =
       static_cast<ListenerData*>(JS_malloc(aCx, sizeof(ListenerData)));
     if (!listenerData) {
-      return NULL;
+      return nullptr;
     }
 
     new (listenerData) ListenerData(aListener, aPhase, aWantsUntrusted);
@@ -283,7 +283,7 @@ EventListenerManager::GetEventListener(const jsid& aType) const
     }
   }
 
-  return NULL;
+  return nullptr;
 }
 
 bool

dom/workers/Events.cpp

@@ -53,14 +53,14 @@ public:
     if (aMainRuntime) {
       JS::Rooted<JS::Value> windowPropVal(aCx);
       if (!JS_GetProperty(aCx, aObj, sClass.name, &windowPropVal)) {
-        return NULL;
+        return nullptr;
       }
 
       if (!JSVAL_IS_PRIMITIVE(windowPropVal)) {
         JS::Rooted<JS::Value> protoVal(aCx);
         if (!JS_GetProperty(aCx, JSVAL_TO_OBJECT(windowPropVal), "prototype",
                             &protoVal)) {
-          return NULL;
+          return nullptr;
         }
 
         if (!JSVAL_IS_PRIMITIVE(protoVal)) {
@@ -74,17 +74,17 @@ public:
     JS::Rooted<JSObject*> proto(aCx, JS_InitClass(aCx, aObj, parentProto, clasp, Construct, 0,
                                                   sProperties, sFunctions, nullptr, nullptr));
     if (!proto) {
-      return NULL;
+      return nullptr;
     }
 
     JS::Rooted<JSObject*> ctor(aCx, JS_GetConstructor(aCx, proto));
     if (!ctor) {
-      return NULL;
+      return nullptr;
     }
 
     if (!dom::DefineConstants(aCx, ctor, sStaticConstants) ||
         !dom::DefineConstants(aCx, proto, sStaticConstants)) {
-      return NULL;
+      return nullptr;
     }
 
     return proto;
@@ -96,7 +96,7 @@ public:
   {
     const JSClass* clasp = aMainRuntime ? &sMainRuntimeClass : &sClass;
 
-    JSObject* obj = JS_NewObject(aCx, clasp, NULL, aParent);
+    JSObject* obj = JS_NewObject(aCx, clasp, nullptr, aParent);
     if (obj) {
       Event* priv = new Event();
       SetJSPrivateSafeish(obj, priv);
@@ -180,10 +180,10 @@ protected:
     if (priv) {
       return priv;
     }
-    JS_ReportErrorNumber(aCx, js_GetErrorMessage, NULL,
+    JS_ReportErrorNumber(aCx, js_GetErrorMessage, nullptr,
                          JSMSG_INCOMPATIBLE_PROTO, sClass.name, aFunctionName,
                          JS_GetClass(aObj)->name);
-    return NULL;
+    return nullptr;
   }
 
   static void
@@ -211,7 +211,7 @@ private:
   static bool
   Construct(JSContext* aCx, unsigned aArgc, jsval* aVp)
   {
-    JS_ReportErrorNumber(aCx, js_GetErrorMessage, NULL, JSMSG_WRONG_CONSTRUCTOR,
+    JS_ReportErrorNumber(aCx, js_GetErrorMessage, nullptr, JSMSG_WRONG_CONSTRUCTOR,
                          sClass.name);
     return false;
   }
@@ -410,7 +410,7 @@ public:
     const JSClass* clasp = aMainRuntime ? &sMainRuntimeClass : &sClass;
 
     return JS_InitClass(aCx, aObj, aParentProto, clasp, Construct, 0,
-                        sProperties, sFunctions, NULL, NULL);
+                        sProperties, sFunctions, nullptr, nullptr);
   }
 
   static JSObject*
@@ -421,26 +421,26 @@ public:
   {
     JS::Rooted<JSString*> type(aCx, JS_InternString(aCx, "message"));
     if (!type) {
-      return NULL;
+      return nullptr;
     }
 
     const JSClass* clasp = aMainRuntime ? &sMainRuntimeClass : &sClass;
 
-    JS::Rooted<JSObject*> obj(aCx, JS_NewObject(aCx, clasp, NULL, aParent));
+    JS::Rooted<JSObject*> obj(aCx, JS_NewObject(aCx, clasp, nullptr, aParent));
     if (!obj) {
-      return NULL;
+      return nullptr;
     }
 
     JS::Rooted<JSObject*> ports(aCx, JS_NewArrayObject(aCx, 0, nullptr));
     if (!ports) {
-      return NULL;
+      return nullptr;
     }
 
     MessageEvent* priv = new MessageEvent(aMainRuntime);
     SetJSPrivateSafeish(obj, priv);
 
-    InitMessageEventCommon(aCx, obj, priv, type, false, false, NULL, NULL, NULL,
+    InitMessageEventCommon(aCx, obj, priv, type, false, false, nullptr,
-                           ports, true);
+                           nullptr, nullptr, ports, true);
 
     priv->mBuffer.swap(aData);
     priv->mClonedObjects.SwapElements(aClonedObjects);
@@ -470,7 +470,7 @@ public:
     }
 
     if (!ports) {
-      return NULL;
+      return nullptr;
     }
 
     MessageEvent* priv = new MessageEvent(false);
@@ -513,10 +513,10 @@ private:
       return GetJSPrivateSafeish<MessageEvent>(aObj);
     }
 
-    JS_ReportErrorNumber(aCx, js_GetErrorMessage, NULL,
+    JS_ReportErrorNumber(aCx, js_GetErrorMessage, nullptr,
                          JSMSG_INCOMPATIBLE_PROTO, sClass.name, aFunctionName,
                          classPtr->name);
-    return NULL;
+    return nullptr;
   }
 
   static void
@@ -540,8 +540,8 @@ private:
   static bool
   Construct(JSContext* aCx, unsigned aArgc, jsval* aVp)
   {
-    JS_ReportErrorNumber(aCx, js_GetErrorMessage, NULL, JSMSG_WRONG_CONSTRUCTOR,
+    JS_ReportErrorNumber(aCx, js_GetErrorMessage, nullptr,
-                         sClass.name);
+                         JSMSG_WRONG_CONSTRUCTOR, sClass.name);
     return false;
   }
 
@@ -693,7 +693,7 @@ public:
     const JSClass* clasp = aMainRuntime ? &sMainRuntimeClass : &sClass;
 
     return JS_InitClass(aCx, aObj, aParentProto, clasp, Construct, 0,
-                        sProperties, sFunctions, NULL, NULL);
+                        sProperties, sFunctions, nullptr, nullptr);
   }
 
   static JSObject*
@@ -702,14 +702,14 @@ public:
   {
     JS::Rooted<JSString*> type(aCx, JS_InternString(aCx, "error"));
     if (!type) {
-      return NULL;
+      return nullptr;
     }
 
     const JSClass* clasp = aMainRuntime ? &sMainRuntimeClass : &sClass;
 
-    JS::Rooted<JSObject*> obj(aCx, JS_NewObject(aCx, clasp, NULL, aParent));
+    JS::Rooted<JSObject*> obj(aCx, JS_NewObject(aCx, clasp, nullptr, aParent));
     if (!obj) {
-      return NULL;
+      return nullptr;
     }
 
     ErrorEvent* priv = new ErrorEvent();
@@ -748,10 +748,10 @@ private:
       return GetJSPrivateSafeish<ErrorEvent>(aObj);
     }
 
-    JS_ReportErrorNumber(aCx, js_GetErrorMessage, NULL,
+    JS_ReportErrorNumber(aCx, js_GetErrorMessage, nullptr,
                          JSMSG_INCOMPATIBLE_PROTO, sClass.name, aFunctionName,
                          classPtr->name);
-    return NULL;
+    return nullptr;
   }
 
   static void
@@ -770,8 +770,8 @@ private:
   static bool
   Construct(JSContext* aCx, unsigned aArgc, jsval* aVp)
   {
-    JS_ReportErrorNumber(aCx, js_GetErrorMessage, NULL, JSMSG_WRONG_CONSTRUCTOR,
+    JS_ReportErrorNumber(aCx, js_GetErrorMessage, nullptr,
-                         sClass.name);
+                         JSMSG_WRONG_CONSTRUCTOR, sClass.name);
     return false;
   }
 
@@ -887,7 +887,7 @@ public:
   InitClass(JSContext* aCx, JSObject* aObj, JSObject* aParentProto)
   {
     return JS_InitClass(aCx, aObj, aParentProto, &sClass, Construct, 0,
-                        sProperties, NULL, NULL, NULL);
+                        sProperties, nullptr, nullptr, nullptr);
   }
 
   static JSObject*
@@ -896,12 +896,13 @@ public:
   {
     JS::Rooted<JSString*> type(aCx, JS_InternJSString(aCx, aType));
     if (!type) {
-      return NULL;
+      return nullptr;
     }
 
-    JS::Rooted<JSObject*> obj(aCx, JS_NewObject(aCx, &sClass, NULL, aParent));
+    JS::Rooted<JSObject*> obj(aCx,
+                              JS_NewObject(aCx, &sClass, nullptr, aParent));
     if (!obj) {
-      return NULL;
+      return nullptr;
     }
 
     ProgressEvent* priv = new ProgressEvent();
@@ -940,10 +941,10 @@ private:
       return GetJSPrivateSafeish<ProgressEvent>(aObj);
     }
 
-    JS_ReportErrorNumber(aCx, js_GetErrorMessage, NULL,
+    JS_ReportErrorNumber(aCx, js_GetErrorMessage, nullptr,
                          JSMSG_INCOMPATIBLE_PROTO, sClass.name, aFunctionName,
                          classPtr->name);
-    return NULL;
+    return nullptr;
   }
 
   static void
@@ -963,8 +964,8 @@ private:
   static bool
   Construct(JSContext* aCx, unsigned aArgc, jsval* aVp)
   {
-    JS_ReportErrorNumber(aCx, js_GetErrorMessage, NULL, JSMSG_WRONG_CONSTRUCTOR,
+    JS_ReportErrorNumber(aCx, js_GetErrorMessage, nullptr,
-                         sClass.name);
+                         JSMSG_WRONG_CONSTRUCTOR, sClass.name);
     return false;
   }
 
@@ -1038,7 +1039,7 @@ Event::GetPrivate(JSObject* aObj)
       return GetJSPrivateSafeish<Event>(aObj);
     }
   }
-  return NULL;
+  return nullptr;
 }
 
 } /* anonymous namespace */

dom/workers/File.cpp

@@ -39,8 +39,8 @@ public:
   static JSObject*
   InitClass(JSContext* aCx, JSObject* aObj)
   {
-    return JS_InitClass(aCx, aObj, NULL, &sClass, Construct, 0, sProperties,
+    return JS_InitClass(aCx, aObj, nullptr, &sClass, Construct, 0,
-                        sFunctions, NULL, NULL);
+                        sProperties, sFunctions, nullptr, nullptr);
   }
 
   static JSObject*
@@ -48,7 +48,7 @@ public:
   {
     JS_ASSERT(SameCOMIdentity(static_cast<nsISupports*>(aBlob), aBlob));
 
-    JSObject* obj = JS_NewObject(aCx, &sClass, NULL, NULL);
+    JSObject* obj = JS_NewObject(aCx, &sClass, nullptr, nullptr);
     if (obj) {
       JS_SetPrivate(obj, aBlob);
       NS_ADDREF(aBlob);
@@ -68,10 +68,10 @@ private:
       return blob;
     }
 
-    JS_ReportErrorNumber(aCx, js_GetErrorMessage, NULL,
+    JS_ReportErrorNumber(aCx, js_GetErrorMessage, nullptr,
                          JSMSG_INCOMPATIBLE_PROTO, sClass.name, aFunctionName,
                          JS_GetClass(aObj)->name);
-    return NULL;
+    return nullptr;
   }
 
   static nsIDOMBlob*
@@ -240,7 +240,7 @@ public:
   InitClass(JSContext* aCx, JSObject* aObj, JSObject* aParentProto)
   {
     return JS_InitClass(aCx, aObj, aParentProto, &sClass, Construct, 0,
-                        sProperties, NULL, NULL, NULL);
+                        sProperties, nullptr, nullptr, nullptr);
   }
 
   static JSObject*
@@ -248,7 +248,7 @@ public:
   {
     JS_ASSERT(SameCOMIdentity(static_cast<nsISupports*>(aFile), aFile));
 
-    JSObject* obj = JS_NewObject(aCx, &sClass, NULL, NULL);
+    JSObject* obj = JS_NewObject(aCx, &sClass, nullptr, nullptr);
     if (obj) {
       JS_SetPrivate(obj, aFile);
       NS_ADDREF(aFile);
@@ -268,7 +268,7 @@ public:
         return file;
       }
     }
-    return NULL;
+    return nullptr;
   }
 
   static const JSClass*
@@ -286,16 +286,17 @@ private:
       return file;
     }
 
-    JS_ReportErrorNumber(aCx, js_GetErrorMessage, NULL,
+    JS_ReportErrorNumber(aCx, js_GetErrorMessage, nullptr,
                          JSMSG_INCOMPATIBLE_PROTO, sClass.name, aFunctionName,
                          JS_GetClass(aObj)->name);
-    return NULL;
+    return nullptr;
   }
 
   static bool
   Construct(JSContext* aCx, unsigned aArgc, jsval* aVp)
   {
-    JS_ReportErrorNumber(aCx, js_GetErrorMessage, NULL, JSMSG_WRONG_CONSTRUCTOR,
+    JS_ReportErrorNumber(aCx, js_GetErrorMessage, nullptr,
+                         JSMSG_WRONG_CONSTRUCTOR,
                          sClass.name);
     return false;
   }
@@ -454,7 +455,7 @@ Blob::GetPrivate(JSObject* aObj)
       return blob;
     }
   }
-  return NULL;
+  return nullptr;
 }
 
 } // anonymous namespace

dom/workers/RuntimeService.cpp

@@ -787,7 +787,7 @@ CreateJSContextForWorker(WorkerPrivate* aWorkerPrivate, JSRuntime* aRuntime)
 
   // Security policy:
   static JSSecurityCallbacks securityCallbacks = {
-    NULL,
+    nullptr,
     ContentSecurityPolicyAllows
   };
   JS_SetSecurityCallbacks(aRuntime, &securityCallbacks);

dom/workers/Worker.cpp

@@ -67,9 +67,9 @@ public:
     JS::Rooted<JSObject*> proto(aCx,
       js::InitClassWithReserved(aCx, aObj, aParentProto, ProtoClass(),
                                 Construct, 0, sProperties, sFunctions,
-                                NULL, NULL));
+                                nullptr, nullptr));
     if (!proto) {
-      return NULL;
+      return nullptr;
     }
 
     js::SetReservedSlot(proto, DOM_PROTO_INSTANCE_CLASS_SLOT,
@@ -81,7 +81,7 @@ public:
 
       JSObject* constructor = JS_GetConstructor(aCx, proto);
       if (!constructor)
-        return NULL;
+        return nullptr;
       js::SetFunctionNativeReserved(constructor, CONSTRUCTOR_SLOT_PARENT,
                                     PRIVATE_TO_JSVAL(parent));
     }
@@ -121,7 +121,7 @@ protected:
 
     WorkerPrivate* parent;
     if (priv.isUndefined()) {
-      parent = NULL;
+      parent = nullptr;
     } else {
       parent = static_cast<WorkerPrivate*>(priv.get().toPrivate());
       parent->AssertIsOnWorkerThread();
@@ -346,7 +346,7 @@ const DOMJSClass Worker::sClass = {
     JSCLASS_IMPLEMENTS_BARRIERS,
     JS_PropertyStub, JS_DeletePropertyStub, JS_PropertyStub, JS_StrictPropertyStub,
     JS_EnumerateStub, JS_ResolveStub, JS_ConvertStub, Finalize,
-    NULL, NULL, NULL, NULL, Trace
+    nullptr, nullptr, nullptr, nullptr, Trace
   },
   {
     INTERFACE_CHAIN_1(prototypes::id::EventTarget_workers),
@@ -427,9 +427,10 @@ public:
   {
     JS::Rooted<JSObject*> proto(aCx,
       js::InitClassWithReserved(aCx, aObj, aParentProto, ProtoClass(),
-                                Construct, 0, NULL, NULL, NULL, NULL));
+                                Construct, 0, nullptr, nullptr, nullptr,
+                                nullptr));
     if (!proto) {
-      return NULL;
+      return nullptr;
     }
 
     js::SetReservedSlot(proto, DOM_PROTO_INSTANCE_CLASS_SLOT,
@@ -441,7 +442,7 @@ public:
 
       JSObject* constructor = JS_GetConstructor(aCx, proto);
       if (!constructor)
-        return NULL;
+        return nullptr;
       js::SetFunctionNativeReserved(constructor, CONSTRUCTOR_SLOT_PARENT,
                                     PRIVATE_TO_JSVAL(parent));
     }
@@ -503,7 +504,7 @@ const DOMJSClass ChromeWorker::sClass = {
     JSCLASS_IMPLEMENTS_BARRIERS,
     JS_PropertyStub, JS_DeletePropertyStub, JS_PropertyStub, JS_StrictPropertyStub,
     JS_EnumerateStub, JS_ResolveStub, JS_ConvertStub, Finalize,
-    NULL, NULL, NULL, NULL, Trace,
+    nullptr, nullptr, nullptr, nullptr, Trace,
   },
   {
     INTERFACE_CHAIN_1(prototypes::id::EventTarget_workers),
@@ -551,9 +552,10 @@ Worker::GetInstancePrivate(JSContext* aCx, JSObject* aObj,
     return UnwrapDOMObject<WorkerPrivate>(aObj);
   }
 
-  JS_ReportErrorNumber(aCx, js_GetErrorMessage, NULL, JSMSG_INCOMPATIBLE_PROTO,
+  JS_ReportErrorNumber(aCx, js_GetErrorMessage, nullptr,
-                       Class()->name, aFunctionName, classPtr->name);
+                       JSMSG_INCOMPATIBLE_PROTO, Class()->name,
-  return NULL;
+                       aFunctionName, classPtr->name);
+  return nullptr;
 }
 
 JSObject*
@@ -632,14 +634,14 @@ WorkerCrossThreadDispatcher*
 GetWorkerCrossThreadDispatcher(JSContext* aCx, jsval aWorker)
 {
   if (JSVAL_IS_PRIMITIVE(aWorker)) {
-    return NULL;
+    return nullptr;
   }
 
   WorkerPrivate* w =
       Worker::GetInstancePrivate(aCx, JSVAL_TO_OBJECT(aWorker),
                                  "GetWorkerCrossThreadDispatcher");
   if (!w) {
-    return NULL;
+    return nullptr;
   }
   return w->GetCrossThreadDispatcher();
 }

dom/workers/WorkerPrivate.cpp

@@ -1990,6 +1990,11 @@ private:
 
     mAlreadyMappedToAddon = true;
 
+    if (XRE_GetProcessType() != GeckoProcessType_Default) {
+      // Only try to access the service from the main process.
+      return;
+    }
+
     nsAutoCString addonId;
     bool ok;
     nsCOMPtr<amIAddonManager> addonManager =
@@ -2387,7 +2392,7 @@ WorkerPrivateParent<Derived>::_finalize(JSFreeOp* aFop)
   // will call Release, and some of our members cannot be released during
   // finalization. Of course, if those members are already gone then we can skip
   // this mess...
-  WorkerPrivateParent<Derived>* extraSelfRef = NULL;
+  WorkerPrivateParent<Derived>* extraSelfRef = nullptr;
 
   if (!mParent && !mMainThreadObjectsForgotten) {
     AssertIsOnMainThread();

dom/workers/WorkerScope.cpp

@@ -107,7 +107,7 @@ public:
   InitClass(JSContext* aCx, JSObject* aObj, JSObject* aParentProto)
   {
     return JS_InitClass(aCx, aObj, aParentProto, Class(), Construct, 0,
-                        sProperties, sFunctions, NULL, NULL);
+                        sProperties, sFunctions, nullptr, nullptr);
   }
 
   using EventTarget::GetEventListener;
@@ -233,8 +233,8 @@ private:
   static bool
   Construct(JSContext* aCx, unsigned aArgc, jsval* aVp)
   {
-    JS_ReportErrorNumber(aCx, js_GetErrorMessage, NULL, JSMSG_WRONG_CONSTRUCTOR,
+    JS_ReportErrorNumber(aCx, js_GetErrorMessage, nullptr,
-                         sClass.name);
+                         JSMSG_WRONG_CONSTRUCTOR, sClass.name);
     return false;
   }
 
@@ -322,7 +322,7 @@ private:
     }
 
     if (JSVAL_IS_BOOLEAN(rval) && JSVAL_TO_BOOLEAN(rval) &&
-        !JS_CallFunctionName(aCx, event, "preventDefault", 0, NULL,
+        !JS_CallFunctionName(aCx, event, "preventDefault", 0, nullptr,
                              rval.address())) {
       return false;
     }
@@ -757,7 +757,7 @@ public:
   {
     JS::Rooted<JSObject*> proto(aCx,
       JS_InitClass(aCx, aObj, aParentProto, ProtoClass(), Construct, 0,
-                   sProperties, sFunctions, NULL, NULL));
+                   sProperties, sFunctions, nullptr, nullptr));
     if (proto) {
       void* domClass = const_cast<DOMClass *>(DOMClassStruct());
       js::SetReservedSlot(proto, DOM_PROTO_INSTANCE_CLASS_SLOT,
@@ -887,17 +887,17 @@ private:
       return UnwrapDOMObject<DedicatedWorkerGlobalScope>(aObj);
     }
 
-    JS_ReportErrorNumber(aCx, js_GetErrorMessage, NULL,
+    JS_ReportErrorNumber(aCx, js_GetErrorMessage, nullptr,
                          JSMSG_INCOMPATIBLE_PROTO, Class()->name, aFunctionName,
                          classPtr->name);
-    return NULL;
+    return nullptr;
   }
 
   static bool
   Construct(JSContext* aCx, unsigned aArgc, jsval* aVp)
   {
-    JS_ReportErrorNumber(aCx, js_GetErrorMessage, NULL, JSMSG_WRONG_CONSTRUCTOR,
+    JS_ReportErrorNumber(aCx, js_GetErrorMessage, nullptr,
-                         Class()->name);
+                         JSMSG_WRONG_CONSTRUCTOR, Class()->name);
     return false;
   }
 
@@ -910,7 +910,7 @@ private:
       return false;
     }
 
-    aObjp.set(resolved ? aObj.get() : NULL);
+    aObjp.set(resolved ? aObj.get() : nullptr);
     return true;
   }
 

dom/workers/XMLHttpRequest.cpp

@@ -1268,7 +1268,7 @@ public:
 
   void Clear()
   {
-    mXMLHttpRequestPrivate = NULL;
+    mXMLHttpRequestPrivate = nullptr;
   }
 
 private:
@@ -1424,7 +1424,7 @@ Proxy::HandleEvent(nsIDOMEvent* aEvent)
 }
 
 XMLHttpRequest::XMLHttpRequest(JSContext* aCx, WorkerPrivate* aWorkerPrivate)
-: XMLHttpRequestEventTarget(aCx), mJSObject(NULL), mUpload(NULL),
+: XMLHttpRequestEventTarget(aCx), mJSObject(nullptr), mUpload(nullptr),
   mWorkerPrivate(aWorkerPrivate),
   mResponseType(XMLHttpRequestResponseType::Text), mTimeout(0),
   mJSObjectRooted(false), mBackgroundRequest(false),
@@ -1470,7 +1470,7 @@ XMLHttpRequest::Constructor(const GlobalObject& aGlobal,
 
   if (!Wrap(cx, aGlobal.Get(), xhr)) {
     aRv.Throw(NS_ERROR_FAILURE);
-    return NULL;
+    return nullptr;
   }
 
   if (workerPrivate->XHRParamsAllowed()) {
@@ -1890,7 +1890,7 @@ XMLHttpRequest::GetUpload(ErrorResult& aRv)
 
   if (mCanceled) {
     aRv.Throw(UNCATCHABLE_EXCEPTION);
-    return NULL;
+    return nullptr;
   }
 
   if (!mUpload) {
@@ -1899,7 +1899,7 @@ XMLHttpRequest::GetUpload(ErrorResult& aRv)
 
     if (!upload) {
       aRv.Throw(NS_ERROR_FAILURE);
-      return NULL;
+      return nullptr;
     }
 
     mUpload = upload;

dom/workers/XMLHttpRequest.h

@@ -232,13 +232,13 @@ public:
   JSObject*
   GetResponseXML() const
   {
-    return NULL;
+    return nullptr;
   }
 
   JSObject*
   GetChannel() const
   {
-    return NULL;
+    return nullptr;
   }
 
   JS::Value

dom/workers/XMLHttpRequestUpload.cpp

@@ -16,7 +16,7 @@ XMLHttpRequestUpload*
 XMLHttpRequestUpload::Create(JSContext* aCx, XMLHttpRequest* aXHR)
 {
   nsRefPtr<XMLHttpRequestUpload> upload = new XMLHttpRequestUpload(aCx, aXHR);
-  return Wrap(aCx, NULL, upload) ? upload : NULL;
+  return Wrap(aCx, nullptr, upload) ? upload : nullptr;
 }
 
 void

gfx/angle/Makefile.in

@@ -2,10 +2,6 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-ifeq (WINNT,$(OS_TARGET))
-VISIBILITY_FLAGS =
-endif
-
 # The below is a rough translation of build_angle.gypi:
 DEFINES += -DANGLE_DISABLE_TRACE
 DEFINES += -DANGLE_COMPILE_OPTIMIZATION_LEVEL=D3DCOMPILE_OPTIMIZATION_LEVEL1

gfx/angle/moz.build

@@ -120,3 +120,6 @@ SOURCES += ['src/compiler/' + src for src in [
 LIBRARY_NAME = 'angle'
 LIBXUL_LIBRARY = True
 MSVC_ENABLE_PGO = True
+
+if CONFIG['OS_TARGET'] == 'WINNT':
+    NO_VISIBILITY_FLAGS = True

gfx/graphite2/src/Makefile.in

@@ -16,7 +16,6 @@ include $(srcdir)/files.mk
 
 # on Windows, we're going to link graphite with gkmedias instead of libxul
 ifeq (WINNT,$(OS_TARGET))
-VISIBILITY_FLAGS =
 endif
 
 ifeq (WINNT,$(OS_TARGET))

gfx/graphite2/src/moz.build

@@ -66,3 +66,5 @@ LIBRARY_NAME = 'mozgraphite2'
 
 MSVC_ENABLE_PGO = True
 
+if CONFIG['OS_TARGET'] == 'WINNT':
+    NO_VISIBILITY_FLAGS = True

gfx/layers/ipc/GestureEventListener.cpp

@@ -149,47 +149,46 @@ nsEventStatus GestureEventListener::HandleInputEvent(const InputData& aEvent)
 
     NS_WARN_IF_FALSE(foundAlreadyExistingTouch, "Touch ended, but not in list");
 
-    if (event.mTime - mTapStartTime <= MAX_TAP_TIME) {
+    if (mState == GESTURE_WAITING_DOUBLE_TAP) {
-      if (mState == GESTURE_WAITING_DOUBLE_TAP &&
+      CancelDoubleTapTimeoutTask();
-          event.mTime - mLastTapEndTime > MAX_TAP_TIME) {
+      if (mTapStartTime - mLastTapEndTime > MAX_TAP_TIME ||
-        // mDoubleTapTimeoutTask wasn't scheduled in time. We need to run the
+          event.mTime - mTapStartTime > MAX_TAP_TIME) {
-        // task synchronously to confirm the last tap.
+        // Either the time between taps or the last tap took too long
-        CancelDoubleTapTimeoutTask();
+        // confirm previous tap and handle current tap seperately
         TimeoutDoubleTap();
-
-        // Change the state so we can proceed to process the current tap.
         mState = GESTURE_WAITING_SINGLE_TAP;
-      }
+      } else {
-
-      if (mState == GESTURE_WAITING_DOUBLE_TAP) {
-        CancelDoubleTapTimeoutTask();
         // We were waiting for a double tap and it has arrived.
         HandleDoubleTap(event);
         mState = GESTURE_NONE;
-      } else if (mState == GESTURE_WAITING_SINGLE_TAP) {
-        CancelLongTapTimeoutTask();
-        HandleSingleTapUpEvent(event);
-
-        // We were not waiting for anything but a single tap has happened that
-        // may turn into a double tap. Wait a while and if it doesn't turn into
-        // a double tap, send a single tap instead.
-        mState = GESTURE_WAITING_DOUBLE_TAP;
-
-        mDoubleTapTimeoutTask =
-          NewRunnableMethod(this, &GestureEventListener::TimeoutDoubleTap);
-
-        mAsyncPanZoomController->PostDelayedTask(
-          mDoubleTapTimeoutTask,
-          MAX_TAP_TIME);
       }
-
-      mLastTapEndTime = event.mTime;
     }
 
-    if (mState == GESTURE_WAITING_SINGLE_TAP) {
+    if (mState == GESTURE_WAITING_SINGLE_TAP &&
+        event.mTime - mTapStartTime > MAX_TAP_TIME) {
+      // Extended taps are immediately dispatched as single taps
+      CancelLongTapTimeoutTask();
+      HandleSingleTapConfirmedEvent(event);
       mState = GESTURE_NONE;
+    } else if (mState == GESTURE_WAITING_SINGLE_TAP) {
+      CancelLongTapTimeoutTask();
+      HandleSingleTapUpEvent(event);
+
+      // We were not waiting for anything but a single tap has happened that
+      // may turn into a double tap. Wait a while and if it doesn't turn into
+      // a double tap, send a single tap instead.
+      mState = GESTURE_WAITING_DOUBLE_TAP;
+
+      mDoubleTapTimeoutTask =
+        NewRunnableMethod(this, &GestureEventListener::TimeoutDoubleTap);
+
+      mAsyncPanZoomController->PostDelayedTask(
+        mDoubleTapTimeoutTask,
+        MAX_TAP_TIME);
     }
 
+    mLastTapEndTime = event.mTime;
+
     if (!mTouches.Length()) {
       mSpanChange = 0.0f;
     }

gfx/ots/src/Makefile.in

@@ -26,7 +26,6 @@
 
 
 ifeq (WINNT,$(OS_TARGET))
-VISIBILITY_FLAGS =
 endif
 
 CSRCS =   \

gfx/ots/src/moz.build

@@ -54,3 +54,5 @@ LIBRARY_NAME = 'mozots'
 
 MSVC_ENABLE_PGO = True
 
+if CONFIG['OS_TARGET'] == 'WINNT':
+    NO_VISIBILITY_FLAGS = True

hal/windows/WindowsGamepad.cpp

@@ -232,7 +232,6 @@ public:
     mTimer = do_CreateInstance("@mozilla.org/timer;1", &rv);
     nsCOMPtr<nsIObserverService> observerService =
       mozilla::services::GetObserverService();
-    observerService->AddObserver(this, "devices-changed", false);
     observerService->AddObserver(this,
                                  NS_XPCOM_WILL_SHUTDOWN_OBSERVER_ID,
                                  false);
@@ -245,7 +244,6 @@ public:
     if (mObserving) {
       nsCOMPtr<nsIObserverService> observerService =
         mozilla::services::GetObserverService();
-      observerService->RemoveObserver(this, "devices-changed");
       observerService->RemoveObserver(this, NS_XPCOM_WILL_SHUTDOWN_OBSERVER_ID);
       mObserving = false;
     }
@@ -255,6 +253,15 @@ public:
     Stop();
   }
 
+  void SetDeviceChangeTimer() {
+    // set stable timer, since we will get multiple devices-changed
+    // notifications at once
+    if (mTimer) {
+      mTimer->Cancel();
+      mTimer->Init(this, kDevicesChangedStableDelay, nsITimer::TYPE_ONE_SHOT);
+    }
+  }
+
 private:
   // Gamepad service owns us, we just hold a reference back to it.
   WindowsGamepadService& mSvc;
@@ -277,7 +284,11 @@ public:
     }
   }
 
-  void DevicesChanged();
+  enum DeviceChangeType {
+    DeviceChangeNotification,
+    DeviceChangeStable
+  };
+  void DevicesChanged(DeviceChangeType type);
   void Startup();
   void Shutdown();
 
@@ -589,8 +600,12 @@ WindowsGamepadService::CleanupGamepad(Gamepad& gamepad) {
 }
 
 void
-WindowsGamepadService::DevicesChanged() {
+WindowsGamepadService::DevicesChanged(DeviceChangeType type) {
-  SetEvent(mThreadRescanEvent);
+  if (type == DeviceChangeNotification) {
+    mObserver->SetDeviceChangeTimer();
+  } else if (type == DeviceChangeStable) {
+    SetEvent(mThreadRescanEvent);
+  }
 }
 
 NS_IMETHODIMP
@@ -598,27 +613,39 @@ Observer::Observe(nsISupports* aSubject,
                   const char* aTopic,
                   const PRUnichar* aData) {
   if (strcmp(aTopic, "timer-callback") == 0) {
-    mSvc.DevicesChanged();
+    mSvc.DevicesChanged(WindowsGamepadService::DeviceChangeStable);
   } else if (strcmp(aTopic, NS_XPCOM_WILL_SHUTDOWN_OBSERVER_ID) == 0) {
     Stop();
-  } else if (strcmp(aTopic, "devices-changed")) {
-    // set stable timer, since we will get multiple devices-changed
-    // notifications at once
-    if (mTimer) {
-      mTimer->Cancel();
-      mTimer->Init(this, kDevicesChangedStableDelay, nsITimer::TYPE_ONE_SHOT);
-    }
   }
   return NS_OK;
 }
 
+WindowsGamepadService* gService = nullptr;
+HWND sHWnd = nullptr;
+
+static
+LRESULT CALLBACK
+GamepadWindowProc(HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam) {
+  const unsigned int DBT_DEVICEARRIVAL        = 0x8000;
+  const unsigned int DBT_DEVICEREMOVECOMPLETE = 0x8004;
+  const unsigned int DBT_DEVNODES_CHANGED     = 0x7;
+
+  if (msg == WM_DEVICECHANGE &&
+      (wParam == DBT_DEVICEARRIVAL ||
+       wParam == DBT_DEVICEREMOVECOMPLETE ||
+       wParam == DBT_DEVNODES_CHANGED)) {
+    if (gService) {
+      gService->DevicesChanged(WindowsGamepadService::DeviceChangeNotification);
+    }
+  }
+  return DefWindowProc(hwnd, msg, wParam, lParam);
+}
+
 } // namespace
 
 namespace mozilla {
 namespace hal_impl {
 
-WindowsGamepadService* gService = nullptr;
-
 void StartMonitoringGamepadStatus()
 {
   if (gService)
@@ -626,6 +653,23 @@ void StartMonitoringGamepadStatus()
 
   gService = new WindowsGamepadService();
   gService->Startup();
+
+  if (sHWnd == nullptr) {
+    WNDCLASSW wc;
+    HMODULE hSelf = GetModuleHandle(nullptr);
+
+    if (!GetClassInfoW(hSelf, L"MozillaGamepadClass", &wc)) {
+      ZeroMemory(&wc, sizeof(WNDCLASSW));
+      wc.hInstance = hSelf;
+      wc.lpfnWndProc = GamepadWindowProc;
+      wc.lpszClassName = L"MozillaGamepadClass";
+      RegisterClassW(&wc);
+    }
+
+    sHWnd = CreateWindowW(L"MozillaGamepadClass", L"Gamepad Watcher",
+                          0, 0, 0, 0, 0,
+                          nullptr, nullptr, hSelf, nullptr);
+  }
 }
 
 void StopMonitoringGamepadStatus()
@@ -633,6 +677,11 @@ void StopMonitoringGamepadStatus()
   if (!gService)
     return;
 
+  if (sHWnd) {
+    DestroyWindow(sHWnd);
+    sHWnd = nullptr;
+  }
+
   gService->Shutdown();
   delete gService;
   gService = nullptr;

js/src/assembler/assembler/X86Assembler.h

@@ -322,6 +322,7 @@ private:
     } TwoByteOpcodeID;
 
     typedef enum {
+        OP3_ROUNDSS_VsdWsd  = 0x0A,
         OP3_ROUNDSD_VsdWsd  = 0x0B,
         OP3_PTEST_VdVd      = 0x17,
         OP3_PINSRD_VsdWsd   = 0x22
@@ -521,7 +522,8 @@ public:
 
     void addl_rm(RegisterID src, int offset, RegisterID base)
     {
-        FIXME_INSN_PRINTING;
+        spew("addl       %s, %s0x%x(%s)",
+             nameIReg(4,src), PRETTY_PRINT_OFFSET(offset), nameIReg(base));
         m_formatter.oneByteOp(OP_ADD_EvGv, src, base, offset);
     }
 
@@ -637,7 +639,8 @@ public:
 
     void andl_rm(RegisterID src, int offset, RegisterID base)
     {
-        FIXME_INSN_PRINTING;
+        spew("andl       %s, %s0x%x(%s)",
+             nameIReg(4,src), PRETTY_PRINT_OFFSET(offset), nameIReg(base));
         m_formatter.oneByteOp(OP_AND_EvGv, src, base, offset);
     }
 
@@ -740,6 +743,11 @@ public:
         spew("fstp       %s0x%x(%s)", PRETTY_PRINT_OFFSET(offset), nameIReg(base));
         m_formatter.oneByteOp(OP_FPU6, FPU6_OP_FSTP, base, offset);
     }
+    void fstp32_m(int offset, RegisterID base)
+    {
+        spew("fstp32       %s0x%x(%s)", PRETTY_PRINT_OFFSET(offset), nameIReg(base));
+        m_formatter.oneByteOp(OP_FLD32, FPU6_OP_FSTP, base, offset);
+    }
 
     void negl_r(RegisterID dst)
     {
@@ -774,13 +782,15 @@ public:
 
     void orl_mr(int offset, RegisterID base, RegisterID dst)
     {
-        FIXME_INSN_PRINTING;
+        spew("orl        %s0x%x(%s), %s",
+             PRETTY_PRINT_OFFSET(offset), nameIReg(base), nameIReg(4,dst));
         m_formatter.oneByteOp(OP_OR_GvEv, dst, base, offset);
     }
 
     void orl_rm(RegisterID src, int offset, RegisterID base)
     {
-        FIXME_INSN_PRINTING;
+        spew("orl        %s, %s0x%x(%s)",
+             nameIReg(4,src), PRETTY_PRINT_OFFSET(offset), nameIReg(base));
         m_formatter.oneByteOp(OP_OR_EvGv, src, base, offset);
     }
 
@@ -870,7 +880,8 @@ public:
 
     void subl_rm(RegisterID src, int offset, RegisterID base)
     {
-        FIXME_INSN_PRINTING;
+        spew("subl       %s, %s0x%x(%s)",
+             nameIReg(4,src), PRETTY_PRINT_OFFSET(offset), nameIReg(base));
         m_formatter.oneByteOp(OP_SUB_EvGv, src, base, offset);
     }
 
@@ -955,13 +966,15 @@ public:
 
     void xorl_mr(int offset, RegisterID base, RegisterID dst)
     {
-        FIXME_INSN_PRINTING;
+        spew("xorl       %s0x%x(%s), %s",
+             PRETTY_PRINT_OFFSET(offset), nameIReg(base), nameIReg(4,dst));
         m_formatter.oneByteOp(OP_XOR_GvEv, dst, base, offset);
     }
 
     void xorl_rm(RegisterID src, int offset, RegisterID base)
     {
-        FIXME_INSN_PRINTING;
+        spew("xorl       %s, %s0x%x(%s)",
+             nameIReg(4,src), PRETTY_PRINT_OFFSET(offset), nameIReg(base));
         m_formatter.oneByteOp(OP_XOR_EvGv, src, base, offset);
     }
 
@@ -1588,7 +1601,8 @@ public:
 
     void movl_rm_disp32(RegisterID src, int offset, RegisterID base)
     {
-        FIXME_INSN_PRINTING;
+        spew("movl       %s, %s0x%x(%s)",
+             nameIReg(4,src), PRETTY_PRINT_OFFSET(offset), nameIReg(base));
         m_formatter.oneByteOp_disp32(OP_MOV_EvGv, src, base, offset);
     }
 
@@ -1619,7 +1633,8 @@ public:
 
     void movl_mr_disp32(int offset, RegisterID base, RegisterID dst)
     {
-        FIXME_INSN_PRINTING;
+        spew("movl       %s0x%x(%s), %s",
+             PRETTY_PRINT_OFFSET(offset), nameIReg(base), nameIReg(4,dst));
         m_formatter.oneByteOp_disp32(OP_MOV_GvEv, dst, base, offset);
     }
 
@@ -1750,12 +1765,14 @@ public:
 
     void movq_rm(RegisterID src, const void* addr)
     {
+        if (src == X86Registers::eax) {
+            movq_EAXm(addr);
+            return;
+        }
+
         spew("movq       %s, %p",
              nameIReg(8, src), addr);
-        if (src == X86Registers::eax)
+        m_formatter.oneByteOp64(OP_MOV_EvGv, src, addr);
-            movq_EAXm(addr);
-        else
-            m_formatter.oneByteOp64(OP_MOV_EvGv, src, addr);
     }
 
     void movq_mEAX(const void* addr)
@@ -1794,12 +1811,14 @@ public:
 
     void movq_mr(const void* addr, RegisterID dst)
     {
+        if (dst == X86Registers::eax) {
+            movq_mEAX(addr);
+            return;
+        }
+
         spew("movq       %p, %s",
              addr, nameIReg(8, dst));
-        if (dst == X86Registers::eax)
+        m_formatter.oneByteOp64(OP_MOV_GvEv, dst, addr);
-            movq_mEAX(addr);
-        else
-            m_formatter.oneByteOp64(OP_MOV_GvEv, dst, addr);
     }
 
     void leaq_mr(int offset, RegisterID base, RegisterID index, int scale, RegisterID dst)
@@ -2938,6 +2957,15 @@ public:
         m_formatter.immediate8(mode);
     }
 
+    void roundss_rr(XMMRegisterID src, XMMRegisterID dst, RoundingMode mode)
+    {
+        spew("roundss    %s, %s, %d",
+             nameFPReg(src), nameFPReg(dst), (int)mode);
+        m_formatter.prefix(PRE_SSE_66);
+        m_formatter.threeByteOp(OP3_ROUNDSS_VsdWsd, ESCAPE_ROUNDSD, (RegisterID)dst, (RegisterID)src);
+        m_formatter.immediate8(mode); // modes are the same for roundsd and roundss
+    }
+
     void pinsrd_rr(RegisterID src, XMMRegisterID dst)
     {
         spew("pinsrd     $1, %s, %s",

js/src/builtin/ParallelArray.js

@@ -791,10 +791,10 @@ function ParallelArrayScatter(targets, defaultValue, conflictFunc, length, mode)
   var targetsLength = std_Math_min(targets.length, self.shape[0]);
 
   if (targetsLength >>> 0 !== targetsLength)
-    ThrowError(JSMSG_BAD_ARRAY_LENGTH, ".prototype.scatter");
+    ThrowError(JSMSG_PAR_ARRAY_BAD_ARG, ".prototype.scatter length");
 
   if (length >>> 0 !== length)
-    ThrowError(JSMSG_BAD_ARRAY_LENGTH, ".prototype.scatter");
+    ThrowError(JSMSG_PAR_ARRAY_BAD_ARG, ".prototype.scatter length");
 
   parallel: for (;;) { // see ParallelArrayBuild() to explain why for(;;) etc
     if (ShouldForceSequential())

js/src/builtin/TestingFunctions.cpp

@@ -1306,7 +1306,7 @@ Deserialize(JSContext *cx, unsigned argc, jsval *vp)
 
     RootedValue deserialized(cx);
     if (!JS_ReadStructuredClone(cx, obj->data(), obj->nbytes(),
-                                JS_STRUCTURED_CLONE_VERSION, &deserialized, NULL, NULL)) {
+                                JS_STRUCTURED_CLONE_VERSION, &deserialized, nullptr, nullptr)) {
         return false;
     }
     args.rval().set(deserialized);

js/src/builtin/TypedObject.cpp

@@ -343,7 +343,7 @@ TypeEquivalent(JSContext *cx, unsigned int argc, Value *vp)
 },
 
 static const JSFunctionSpec NumericTypeObjectMethods[] = {
-    {"handle", {NULL, NULL}, 2, 0, "HandleCreate"},
+    {"handle", {nullptr, nullptr}, 2, 0, "HandleCreate"},
     JS_FS_END
 };
 
@@ -546,7 +546,7 @@ const JSPropertySpec ArrayType::typeObjectProperties[] = {
 };
 
 const JSFunctionSpec ArrayType::typeObjectMethods[] = {
-    {"handle", {NULL, NULL}, 2, 0, "HandleCreate"},
+    {"handle", {nullptr, nullptr}, 2, 0, "HandleCreate"},
     JS_FN("repeat", ArrayType::repeat, 1, 0),
     JS_FN("toSource", ArrayType::toSource, 0, 0),
     JS_FS_END
@@ -978,7 +978,7 @@ const JSPropertySpec StructType::typeObjectProperties[] = {
 };
 
 const JSFunctionSpec StructType::typeObjectMethods[] = {
-    {"handle", {NULL, NULL}, 2, 0, "HandleCreate"},
+    {"handle", {nullptr, nullptr}, 2, 0, "HandleCreate"},
     JS_FN("toSource", StructType::toSource, 0, 0),
     JS_FS_END
 };
@@ -1081,9 +1081,9 @@ StructType::layout(JSContext *cx, HandleObject structType, HandleObject fields)
     // fieldOffsets : { string: integer, ... }
     // fieldTypes : { string: Type, ... }
     RootedObject fieldOffsets(
-        cx, NewObjectWithClassProto(cx, &JSObject::class_, NULL, NULL));
+        cx, NewObjectWithClassProto(cx, &JSObject::class_, nullptr, nullptr));
     RootedObject fieldTypes(
-        cx, NewObjectWithClassProto(cx, &JSObject::class_, NULL, NULL));
+        cx, NewObjectWithClassProto(cx, &JSObject::class_, nullptr, nullptr));
     for (size_t i = 0; i < typeRepr->fieldCount(); i++) {
         const StructField &field = typeRepr->field(i);
         RootedId fieldId(cx, field.id);
@@ -1338,18 +1338,18 @@ js_InitTypedObjectClass(JSContext *cx, HandleObject obj)
 
     RootedObject handle(cx, NewBuiltinClassInstance(cx, &JSObject::class_));
     if (!module)
-        return NULL;
+        return nullptr;
 
     if (!JS_DefineFunctions(cx, handle, TypedHandle::handleStaticMethods))
-        return NULL;
+        return nullptr;
 
     RootedValue handleValue(cx, ObjectValue(*handle));
     if (!JSObject::defineProperty(cx, module, cx->names().Handle,
                                   handleValue,
-                                  NULL, NULL,
+                                  nullptr, nullptr,
                                   JSPROP_READONLY | JSPROP_PERMANENT))
     {
-        return NULL;
+        return nullptr;
     }
 
     return module;
@@ -1427,7 +1427,7 @@ TypedDatum::createUnattached(JSContext *cx,
 
     RootedObject obj(cx, createUnattachedWithClass(cx, &T::class_, type));
     if (!obj)
-        return NULL;
+        return nullptr;
 
     return &obj->as<T>();
 }
@@ -1457,9 +1457,9 @@ TypedDatum::createUnattachedWithClass(JSContext *cx,
     }
 
     RootedObject obj(
-        cx, NewObjectWithClassProto(cx, clasp, &*proto, NULL));
+        cx, NewObjectWithClassProto(cx, clasp, &*proto, nullptr));
     if (!obj)
-        return NULL;
+        return nullptr;
 
     obj->setPrivate(nullptr);
     obj->initReservedSlot(JS_DATUM_SLOT_TYPE_OBJ, ObjectValue(*type));
@@ -1542,7 +1542,7 @@ ReportDatumTypeError(JSContext *cx,
     if (!typeReprStr)
         return false;
 
-    JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL,
+    JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr,
                          errorNumber, typeReprStr);
 
     JS_free(cx, (void *) typeReprStr);
@@ -2174,10 +2174,10 @@ const Class TypedObject::class_ = {
     JS_ResolveStub,
     JS_ConvertStub,
     TypedDatum::obj_finalize,
-    NULL,           /* checkAccess */
+    nullptr,        /* checkAccess */
-    NULL,           /* call        */
+    nullptr,        /* call        */
-    NULL,           /* construct   */
+    nullptr,        /* construct   */
-    NULL,           /* hasInstance */
+    nullptr,        /* hasInstance */
     TypedDatum::obj_trace,
     JS_NULL_CLASS_EXT,
     {
@@ -2204,7 +2204,7 @@ const Class TypedObject::class_ = {
         TypedDatum::obj_deleteElement,
         TypedDatum::obj_deleteSpecial,
         TypedDatum::obj_enumerate,
-        NULL, /* thisObject */
+        nullptr, /* thisObject */
     }
 };
 
@@ -2213,13 +2213,13 @@ TypedObject::createZeroed(JSContext *cx, HandleObject type)
 {
     Rooted<TypedObject*> obj(cx, createUnattached<TypedObject>(cx, type));
     if (!obj)
-        return NULL;
+        return nullptr;
 
     TypeRepresentation *typeRepr = typeRepresentation(*type);
     size_t memsize = typeRepr->size();
     void *memory = JS_malloc(cx, memsize);
     if (!memory)
-        return NULL;
+        return nullptr;
     memset(memory, 0, memsize);
     obj->attach(memory);
     return obj;
@@ -2264,10 +2264,10 @@ const Class TypedHandle::class_ = {
     JS_ResolveStub,
     JS_ConvertStub,
     TypedDatum::obj_finalize,
-    NULL,           /* checkAccess */
+    nullptr,        /* checkAccess */
-    NULL,           /* call        */
+    nullptr,        /* call        */
-    NULL,           /* construct   */
+    nullptr,        /* construct   */
-    NULL,           /* hasInstance */
+    nullptr,        /* hasInstance */
     TypedDatum::obj_trace,
     JS_NULL_CLASS_EXT,
     {
@@ -2294,15 +2294,15 @@ const Class TypedHandle::class_ = {
         TypedDatum::obj_deleteElement,
         TypedDatum::obj_deleteSpecial,
         TypedDatum::obj_enumerate,
-        NULL, /* thisObject */
+        nullptr, /* thisObject */
     }
 };
 
 const JSFunctionSpec TypedHandle::handleStaticMethods[] = {
-    {"move", {NULL, NULL}, 3, 0, "HandleMove"},
+    {"move", {nullptr, nullptr}, 3, 0, "HandleMove"},
-    {"get", {NULL, NULL}, 1, 0, "HandleGet"},
+    {"get", {nullptr, nullptr}, 1, 0, "HandleGet"},
-    {"set", {NULL, NULL}, 2, 0, "HandleSet"},
+    {"set", {nullptr, nullptr}, 2, 0, "HandleSet"},
-    {"isHandle", {NULL, NULL}, 1, 0, "HandleTest"},
+    {"isHandle", {nullptr, nullptr}, 1, 0, "HandleTest"},
     JS_FS_END
 };
 
@@ -2426,7 +2426,7 @@ js::IsAttached(ThreadSafeContext *cx, unsigned argc, Value *vp)
 {
     CallArgs args = CallArgsFromVp(argc, vp);
     JS_ASSERT(args[0].isObject() && IsTypedDatum(args[0].toObject()));
-    args.rval().setBoolean(TypedMem(args[0].toObject()) != NULL);
+    args.rval().setBoolean(TypedMem(args[0].toObject()) != nullptr);
     return true;
 }
 

js/src/builtin/TypedObject.h

@@ -389,7 +389,7 @@ extern const JSJitInfo ObjectIsTypedObjectJitInfo;
  * Usage: IsAttached(obj)
  *
  * Given a TypedDatum `obj`, returns true if `obj` is
- * "attached" (i.e., its data pointer is NULL).
+ * "attached" (i.e., its data pointer is nullptr).
  */
 bool IsAttached(ThreadSafeContext *cx, unsigned argc, Value *vp);
 extern const JSJitInfo IsAttachedJitInfo;

js/src/config/Makefile.in

@@ -3,10 +3,6 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-# For sanity's sake, we compile nsinstall without the wrapped system
-# headers, so that we can use it to set up the wrapped system headers.
-VISIBILITY_FLAGS =
-
 ifneq (WINNT,$(HOST_OS_ARCH))
 HOST_PROGRAM	= nsinstall_real$(HOST_BIN_SUFFIX)
 endif

js/src/config/milestone.txt

@@ -10,4 +10,4 @@
 # hardcoded milestones in the tree from these two files.
 #--------------------------------------------------------
 
-27.0a1
+28.0a1

js/src/config/moz.build

@@ -5,6 +5,9 @@
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 NO_DIST_INSTALL = True
+# For sanity's sake, we compile nsinstall without the wrapped system
+# headers, so that we can use it to set up the wrapped system headers.
+NO_VISIBILITY_FLAGS = True
 
 if CONFIG['HOST_OS_ARCH'] != 'WINNT':
     HOST_SOURCES += [

js/src/jit-test/tests/ion/bug930993.js

@@ -0,0 +1,6 @@
+x = {};
+y = x;
+x.toString = function() {
+    Int8Array(ArrayBuffer)[0] = Float32Array(ArrayBuffer)[0];
+}
+print(x << y);

js/src/jit-test/tests/ion/bug931496.js

@@ -0,0 +1,11 @@
+
+function g() {
+    yield
+}
+g()
+function f() {
+    g()
+}
+try {
+    new f
+} catch (e) {}

js/src/jit-test/tests/ion/testFloat32-correctness.js

@@ -227,3 +227,41 @@ function otherMath() {
 };
 test(setupComp, otherMath);
 
+function setupFloor() {
+    f32[0] = -5.5;
+    f32[1] = -0.5;
+    f32[2] = 0;
+    f32[3] = 1.5;
+}
+function setupFloorDouble() {
+    f32[4] = NaN;
+    f32[5] = -0;
+    f32[6] = Infinity;
+    f32[7] = -Infinity;
+    f32[8] = Math.pow(2,31); // too big to fit into a int
+}
+function testFloor() {
+    for (var i = 0; i < 4; ++i) {
+        var f = Math.floor(f32[i]);
+        assertFloat32(g, false); // f is an int32
+
+        var g = Math.floor(-0 + f32[i]);
+        assertFloat32(g, false);
+
+        assertEq(f, g);
+    }
+}
+function testFloorDouble() {
+    for (var i = 4; i < 9; ++i) {
+        var f = Math.fround(Math.floor(f32[i]));
+        assertFloat32(f, true);
+
+        var g = Math.floor(-0 + f32[i]);
+        assertFloat32(g, false);
+
+        assertEq(f, g);
+    }
+}
+test(setupFloor, testFloor);
+test(setupFloorDouble, testFloorDouble);
+

js/src/jit/AsmJSLink.cpp

@@ -683,7 +683,7 @@ js::IsAsmJSModuleNative(js::Native native)
 }
 
 static bool
-IsMaybeWrappedNativeFunction(const Value &v, Native native, JSFunction **fun = NULL)
+IsMaybeWrappedNativeFunction(const Value &v, Native native, JSFunction **fun = nullptr)
 {
     if (!v.isObject())
         return false;
@@ -717,7 +717,7 @@ js::IsAsmJSModuleLoadedFromCache(JSContext *cx, unsigned argc, Value *vp)
 
     JSFunction *fun;
     if (!args.hasDefined(0) || !IsMaybeWrappedNativeFunction(args[0], LinkAsmJS, &fun)) {
-        JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_USE_ASM_TYPE_FAIL,
+        JS_ReportErrorNumber(cx, js_GetErrorMessage, nullptr, JSMSG_USE_ASM_TYPE_FAIL,
                              "argument passed to isAsmJSModuleLoadedFromCache is not a "
                              "validated asm.js module");
         return false;

js/src/jit/AsmJSModule.cpp

@@ -462,7 +462,7 @@ DeserializeName(ExclusiveContext *cx, const uint8_t *cursor, PropertyName **name
     cursor = ReadScalar<uint32_t>(cursor, &length);
 
     if (length == 0) {
-        *name = NULL;
+        *name = nullptr;
         return cursor;
     }
 
@@ -471,7 +471,7 @@ DeserializeName(ExclusiveContext *cx, const uint8_t *cursor, PropertyName **name
     if ((size_t(cursor) & (sizeof(jschar) - 1)) != 0) {
         // Align 'src' for AtomizeChars.
         if (!tmp.resize(length))
-            return NULL;
+            return nullptr;
         memcpy(tmp.begin(), cursor, length * sizeof(jschar));
         src = tmp.begin();
     } else {
@@ -480,7 +480,7 @@ DeserializeName(ExclusiveContext *cx, const uint8_t *cursor, PropertyName **name
 
     JSAtom *atom = AtomizeChars<CanGC>(cx, src, length);
     if (!atom)
-        return NULL;
+        return nullptr;
 
     *name = atom->asPropertyName();
     return cursor + length * sizeof(jschar);
@@ -513,10 +513,10 @@ DeserializeVector(ExclusiveContext *cx, const uint8_t *cursor, Vector<T, 0, Syst
     uint32_t length;
     cursor = ReadScalar<uint32_t>(cursor, &length);
     if (!vec->resize(length))
-        return NULL;
+        return nullptr;
     for (size_t i = 0; i < vec->length(); i++) {
         if (!(cursor = (*vec)[i].deserialize(cx, cursor)))
-            return NULL;
+            return nullptr;
     }
     return cursor;
 }
@@ -546,7 +546,7 @@ DeserializePodVector(ExclusiveContext *cx, const uint8_t *cursor,
     uint32_t length;
     cursor = ReadScalar<uint32_t>(cursor, &length);
     if (!vec->resize(length))
-        return NULL;
+        return nullptr;
     cursor = ReadBytes(cursor, vec->begin(), length * sizeof(T));
     return cursor;
 }
@@ -776,7 +776,7 @@ struct PropertyNameWrapper
     PropertyName *name;
 
     PropertyNameWrapper()
-      : name(NULL)
+      : name(nullptr)
     {}
     PropertyNameWrapper(PropertyName *name)
       : name(name)
@@ -897,7 +897,7 @@ struct ScopedCacheEntryOpenedForWrite
     intptr_t handle;
 
     ScopedCacheEntryOpenedForWrite(ExclusiveContext *cx, size_t serializedSize)
-      : cx(cx), serializedSize(serializedSize), memory(NULL), handle(-1)
+      : cx(cx), serializedSize(serializedSize), memory(nullptr), handle(-1)
     {}
 
     ~ScopedCacheEntryOpenedForWrite() {
@@ -950,7 +950,7 @@ struct ScopedCacheEntryOpenedForRead
     intptr_t handle;
 
     ScopedCacheEntryOpenedForRead(ExclusiveContext *cx)
-      : cx(cx), serializedSize(0), memory(NULL), handle(0)
+      : cx(cx), serializedSize(0), memory(nullptr), handle(0)
     {}
 
     ~ScopedCacheEntryOpenedForRead() {

js/src/jit/BaselineIC.cpp

@@ -5374,10 +5374,6 @@ TryAttachScopeNameStub(JSContext *cx, HandleScript script, ICGetName_Fallback *s
     if (!IsCacheableGetPropReadSlot(scopeChain, scopeChain, shape))
         return true;
 
-    // Instantiate properties on singleton scope chain objects, for use during Ion compilation.
-    if (scopeChain->hasSingletonType() && IsIonEnabled(cx))
-        types::EnsureTrackPropertyTypes(cx, scopeChain, NameToId(name));
-
     bool isFixedSlot;
     uint32_t offset;
     GetFixedOrDynamicSlotOffset(scopeChain, shape->slot(), &isFixedSlot, &offset);

js/src/jit/CodeGenerator.cpp

@@ -3899,19 +3899,20 @@ CodeGenerator::visitMathFunctionF(LMathFunctionF *ins)
 
     void *funptr = nullptr;
     switch (ins->mir()->function()) {
-      case MMathFunction::Log:  funptr = JS_FUNC_TO_DATA_PTR(void *, logf);  break;
+      case MMathFunction::Log:   funptr = JS_FUNC_TO_DATA_PTR(void *, logf);   break;
-      case MMathFunction::Sin:  funptr = JS_FUNC_TO_DATA_PTR(void *, sinf);  break;
+      case MMathFunction::Sin:   funptr = JS_FUNC_TO_DATA_PTR(void *, sinf);   break;
-      case MMathFunction::Cos:  funptr = JS_FUNC_TO_DATA_PTR(void *, cosf);  break;
+      case MMathFunction::Cos:   funptr = JS_FUNC_TO_DATA_PTR(void *, cosf);   break;
-      case MMathFunction::Exp:  funptr = JS_FUNC_TO_DATA_PTR(void *, expf);  break;
+      case MMathFunction::Exp:   funptr = JS_FUNC_TO_DATA_PTR(void *, expf);   break;
-      case MMathFunction::Tan:  funptr = JS_FUNC_TO_DATA_PTR(void *, tanf);  break;
+      case MMathFunction::Tan:   funptr = JS_FUNC_TO_DATA_PTR(void *, tanf);   break;
-      case MMathFunction::ATan: funptr = JS_FUNC_TO_DATA_PTR(void *, atanf); break;
+      case MMathFunction::ATan:  funptr = JS_FUNC_TO_DATA_PTR(void *, atanf);  break;
-      case MMathFunction::ASin: funptr = JS_FUNC_TO_DATA_PTR(void *, sinf);  break;
+      case MMathFunction::ASin:  funptr = JS_FUNC_TO_DATA_PTR(void *, sinf);   break;
-      case MMathFunction::ACos: funptr = JS_FUNC_TO_DATA_PTR(void *, acosf); break;
+      case MMathFunction::ACos:  funptr = JS_FUNC_TO_DATA_PTR(void *, acosf);  break;
+      case MMathFunction::Floor: funptr = JS_FUNC_TO_DATA_PTR(void *, floorf); break;
       default:
         MOZ_ASSUME_UNREACHABLE("Unknown or unsupported float32 math function");
     }
 
-    masm.callWithABI(funptr, MacroAssembler::DOUBLE);
+    masm.callWithABI(funptr, MacroAssembler::FLOAT);
     return true;
 }
 

js/src/jit/Ion.cpp

@@ -1553,6 +1553,37 @@ OffThreadCompilationAvailable(JSContext *cx)
         && !cx->runtime()->spsProfiler.enabled();
 }
 
+static void
+TrackAllProperties(JSContext *cx, JSObject *obj)
+{
+    JS_ASSERT(obj->hasSingletonType());
+
+    for (Shape::Range<NoGC> range(obj->lastProperty()); !range.empty(); range.popFront())
+        types::EnsureTrackPropertyTypes(cx, obj, range.front().propid());
+}
+
+static void
+TrackPropertiesForSingletonScopes(JSContext *cx, JSScript *script, BaselineFrame *baselineFrame)
+{
+    // Ensure that all properties of singleton call objects which the script
+    // could access are tracked. These are generally accessed through
+    // ALIASEDVAR operations in baseline and will not be tracked even if they
+    // have been accessed in baseline code.
+    JSObject *environment = script->function() ? script->function()->environment() : NULL;
+
+    while (environment && !environment->is<GlobalObject>()) {
+        if (environment->is<CallObject>() && environment->hasSingletonType())
+            TrackAllProperties(cx, environment);
+        environment = environment->enclosingScope();
+    }
+
+    if (baselineFrame) {
+        JSObject *scope = baselineFrame->scopeChain();
+        if (scope->is<CallObject>() && scope->hasSingletonType())
+            TrackAllProperties(cx, scope);
+    }
+}
+
 static AbortReason
 IonCompile(JSContext *cx, JSScript *script,
            BaselineFrame *baselineFrame, jsbytecode *osrPc, bool constructing,
@@ -1565,6 +1596,8 @@ IonCompile(JSContext *cx, JSScript *script,
                         script);
 #endif
 
+    TrackPropertiesForSingletonScopes(cx, script, baselineFrame);
+
     LifoAlloc *alloc = cx->new_<LifoAlloc>(BUILDER_LIFO_ALLOC_PRIMARY_CHUNK_SIZE);
     if (!alloc)
         return AbortReason_Alloc;

js/src/jit/IonBuilder.cpp

@@ -285,7 +285,7 @@ IonBuilder::canInlineTarget(JSFunction *target, CallInfo &callInfo)
             return false;
 
         RootedScript script(context(), target->nonLazyScript());
-        if (!script->hasBaselineScript()) {
+        if (!script->hasBaselineScript() && script->canBaselineCompile()) {
             MethodStatus status = BaselineCompile(context(), script);
             if (status != Method_Compiled)
                 return false;

js/src/jit/IonCaches.cpp

@@ -2989,7 +2989,7 @@ EqualStringsHelper(JSString *str1, JSString *str2)
     JS_ASSERT(!str2->isAtom());
     JS_ASSERT(str1->length() == str2->length());
 
-    const jschar *chars = str2->getChars(NULL);
+    const jschar *chars = str2->getChars(nullptr);
     if (!chars)
         return false;
     return mozilla::PodEqual(str1->asAtom().chars(), chars, str1->length());

js/src/jit/LIR-Common.h

@@ -4366,7 +4366,7 @@ class LStringLength : public LInstructionHelper<1, 1, 0>
     }
 };
 
-// Take the floor of a number. Implements Math.floor().
+// Take the floor of a double precision number. Implements Math.floor().
 class LFloor : public LInstructionHelper<1, 1, 0>
 {
   public:
@@ -4375,9 +4375,16 @@ class LFloor : public LInstructionHelper<1, 1, 0>
     LFloor(const LAllocation &num) {
         setOperand(0, num);
     }
+};
 
-    MRound *mir() const {
+// Take the floor of a single precision number. Implements Math.floor().
-        return mir_->toRound();
+class LFloorF : public LInstructionHelper<1, 1, 0>
+{
+  public:
+    LIR_HEADER(FloorF)
+
+    LFloorF(const LAllocation &num) {
+        setOperand(0, num);
     }
 };
 

js/src/jit/LOpcodes.h

@@ -246,6 +246,7 @@
     _(TypeOfV)                      \
     _(ToIdV)                        \
     _(Floor)                        \
+    _(FloorF)                       \
     _(Round)                        \
     _(In)                           \
     _(InArray)                      \

js/src/jit/Lowering.cpp

@@ -1129,8 +1129,17 @@ LIRGenerator::visitUrsh(MUrsh *ins)
 bool
 LIRGenerator::visitFloor(MFloor *ins)
 {
-    JS_ASSERT(ins->num()->type() == MIRType_Double);
+    MIRType type = ins->num()->type();
-    LFloor *lir = new LFloor(useRegister(ins->num()));
+    JS_ASSERT(IsFloatingPointType(type));
+
+    if (type == MIRType_Double) {
+        LFloor *lir = new LFloor(useRegister(ins->num()));
+        if (!assignSnapshot(lir))
+            return false;
+        return define(lir, ins);
+    }
+
+    LFloorF *lir = new LFloorF(useRegister(ins->num()));
     if (!assignSnapshot(lir))
         return false;
     return define(lir, ins);

js/src/jit/MCallOptimize.cpp

@@ -554,7 +554,6 @@ IonBuilder::inlineMathAbs(CallInfo &callInfo)
 IonBuilder::InliningStatus
 IonBuilder::inlineMathFloor(CallInfo &callInfo)
 {
-
     if (callInfo.constructing())
         return InliningStatus_NotInlined;
 
@@ -571,7 +570,7 @@ IonBuilder::inlineMathFloor(CallInfo &callInfo)
         return InliningStatus_Inlined;
     }
 
-    if (argType == MIRType_Double && returnType == MIRType_Int32) {
+    if (IsFloatingPointType(argType) && returnType == MIRType_Int32) {
         callInfo.unwrapArgs();
         MFloor *ins = new MFloor(callInfo.getArg(0));
         current->add(ins);
@@ -579,7 +578,7 @@ IonBuilder::inlineMathFloor(CallInfo &callInfo)
         return InliningStatus_Inlined;
     }
 
-    if (argType == MIRType_Double && returnType == MIRType_Double) {
+    if (IsFloatingPointType(argType) && returnType == MIRType_Double) {
         callInfo.unwrapArgs();
         MMathFunction *ins = MMathFunction::New(callInfo.getArg(0), MMathFunction::Floor, nullptr);
         current->add(ins);

js/src/jit/MIR.cpp

@@ -30,6 +30,23 @@ using mozilla::DoublesAreIdentical;
 using mozilla::IsFloat32Representable;
 using mozilla::Maybe;
 
+template<size_t Op> static void
+ConvertDefinitionToDouble(MDefinition *def, MInstruction *consumer)
+{
+    MInstruction *replace = MToDouble::New(def);
+    consumer->replaceOperand(Op, replace);
+    consumer->block()->insertBefore(consumer, replace);
+}
+
+static bool
+CheckUsesAreFloat32Consumers(MInstruction *ins)
+{
+    bool allConsumerUses = true;
+    for (MUseDefIterator use(ins); allConsumerUses && use; use++)
+        allConsumerUses &= use.def()->canConsumeFloat32();
+    return allConsumerUses;
+}
+
 void
 MDefinition::PrintOpcodeName(FILE *fp, MDefinition::Opcode op)
 {
@@ -650,6 +667,22 @@ MStringLength::foldsTo(bool useValueNumbers)
     return this;
 }
 
+void
+MFloor::trySpecializeFloat32()
+{
+    // No need to look at the output, as it's an integer (see IonBuilder::inlineMathFloor)
+    if (!input()->canProduceFloat32()) {
+        if (input()->type() == MIRType_Float32)
+            ConvertDefinitionToDouble<0>(input(), this);
+        return;
+    }
+
+    if (type() == MIRType_Double)
+        setResultType(MIRType_Float32);
+
+    setPolicyType(MIRType_Float32);
+}
+
 MTest *
 MTest::New(MDefinition *ins, MBasicBlock *ifTrue, MBasicBlock *ifFalse)
 {
@@ -1236,23 +1269,6 @@ MBinaryArithInstruction::foldsTo(bool useValueNumbers)
     return this;
 }
 
-template<size_t Op> static void
-ConvertDefinitionToDouble(MDefinition *def, MInstruction *consumer)
-{
-    MInstruction *replace = MToDouble::New(def);
-    consumer->replaceOperand(Op, replace);
-    consumer->block()->insertBefore(consumer, replace);
-}
-
-static bool
-CheckUsesAreFloat32Consumers(MInstruction *ins)
-{
-    bool allConsumerUses = true;
-    for (MUseDefIterator use(ins); allConsumerUses && use; use++)
-        allConsumerUses &= use.def()->canConsumeFloat32();
-    return allConsumerUses;
-}
-
 void
 MBinaryArithInstruction::trySpecializeFloat32()
 {

js/src/jit/MIR.h

@@ -3748,7 +3748,7 @@ class MMathFunction
     bool isFloat32Commutative() const {
         return function_ == Log || function_ == Sin || function_ == Cos
                || function_ == Exp || function_ == Tan || function_ == ATan
-               || function_ == ASin || function_ == ACos;
+               || function_ == ASin || function_ == ACos || function_ == Floor;
     }
     void trySpecializeFloat32();
 };
@@ -7595,13 +7595,14 @@ class MStringLength
 // Inlined version of Math.floor().
 class MFloor
   : public MUnaryInstruction,
-    public DoublePolicy<0>
+    public FloatingPointPolicy<0>
 {
   public:
     MFloor(MDefinition *num)
       : MUnaryInstruction(num)
     {
         setResultType(MIRType_Int32);
+        setPolicyType(MIRType_Double);
         setMovable();
     }
 
@@ -7616,6 +7617,15 @@ class MFloor
     TypePolicy *typePolicy() {
         return this;
     }
+    bool isFloat32Commutative() const {
+        return true;
+    }
+    void trySpecializeFloat32();
+#ifdef DEBUG
+    bool isConsistentFloat32Use() const {
+        return true;
+    }
+#endif
 };
 
 // Inlined version of Math.round().

js/src/jit/arm/CodeGenerator-arm.cpp

@@ -1202,6 +1202,18 @@ CodeGeneratorARM::visitFloor(LFloor *lir)
     return true;
 }
 
+bool
+CodeGeneratorARM::visitFloorF(LFloorF *lir)
+{
+    FloatRegister input = ToFloatRegister(lir->input());
+    Register output = ToRegister(lir->output());
+    Label bail;
+    masm.floorf(input, output, &bail);
+    if (!bailoutFrom(&bail, lir->snapshot()))
+        return false;
+    return true;
+}
+
 bool
 CodeGeneratorARM::visitRound(LRound *lir)
 {

js/src/jit/arm/CodeGenerator-arm.h

@@ -110,6 +110,7 @@ class CodeGeneratorARM : public CodeGeneratorShared
     virtual bool visitMathD(LMathD *math);
     virtual bool visitMathF(LMathF *math);
     virtual bool visitFloor(LFloor *lir);
+    virtual bool visitFloorF(LFloorF *lir);
     virtual bool visitRound(LRound *lir);
     virtual bool visitTruncateDToInt32(LTruncateDToInt32 *ins);
     virtual bool visitTruncateFToInt32(LTruncateFToInt32 *ins);

js/src/jit/arm/MacroAssembler-arm.cpp

@@ -3830,6 +3830,58 @@ MacroAssemblerARMCompat::floor(FloatRegister input, Register output, Label *bail
     bind(&fin);
 }
 
+void
+MacroAssemblerARMCompat::floorf(FloatRegister input, Register output, Label *bail)
+{
+    Label handleZero;
+    Label handleNeg;
+    Label fin;
+    compareFloat(input, InvalidFloatReg);
+    ma_b(&handleZero, Assembler::Equal);
+    ma_b(&handleNeg, Assembler::Signed);
+    // NaN is always a bail condition, just bail directly.
+    ma_b(bail, Assembler::Overflow);
+
+    // The argument is a positive number, truncation is the path to glory;
+    // Since it is known to be > 0.0, explicitly convert to a larger range,
+    // then a value that rounds to INT_MAX is explicitly different from an
+    // argument that clamps to INT_MAX
+    ma_vcvt_F32_U32(input, ScratchFloatReg);
+    ma_vxfer(VFPRegister(ScratchFloatReg).uintOverlay(), output);
+    ma_mov(output, output, SetCond);
+    ma_b(bail, Signed);
+    ma_b(&fin);
+
+    bind(&handleZero);
+    // Move the top word of the double into the output reg, if it is non-zero,
+    // then the original value was -0.0
+    as_vxfer(output, InvalidReg, VFPRegister(input).singleOverlay(), FloatToCore, Always, 0);
+    ma_cmp(output, Imm32(0));
+    ma_b(bail, NonZero);
+    ma_b(&fin);
+
+    bind(&handleNeg);
+    // Negative case, negate, then start dancing
+    ma_vneg_f32(input, input);
+    ma_vcvt_F32_U32(input, ScratchFloatReg);
+    ma_vxfer(VFPRegister(ScratchFloatReg).uintOverlay(), output);
+    ma_vcvt_U32_F32(ScratchFloatReg, ScratchFloatReg);
+    compareFloat(ScratchFloatReg, input);
+    ma_add(output, Imm32(1), output, NoSetCond, NotEqual);
+    // Negate the output.  Since INT_MIN < -INT_MAX, even after adding 1,
+    // the result will still be a negative number
+    ma_rsb(output, Imm32(0), output, SetCond);
+    // Flip the negated input back to its original value.
+    ma_vneg_f32(input, input);
+    // If the result looks non-negative, then this value didn't actually fit into
+    // the int range, and special handling is required.
+    // zero is also caught by this case, but floor of a negative number
+    // should never be zero.
+    ma_b(bail, Unsigned);
+
+    bind(&fin);
+}
+
 CodeOffsetLabel
 MacroAssemblerARMCompat::toggledJump(Label *label)
 {